Professional Documents
Culture Documents
Enterasys Sflow
Enterasys Sflow
Stackable Switches
Configuration Guide
Firmware Version 6.03.xx.xxxx
P/N 9034313-07
Notice
EnterasysNetworksreservestherighttomakechangesinspecificationsandotherinformationcontainedinthisdocumentand
itswebsitewithoutpriornotice.ThereadershouldinallcasesconsultEnterasysNetworkstodeterminewhetheranysuch
changeshavebeenmade.
Thehardware,firmware,orsoftwaredescribedinthisdocumentissubjecttochangewithoutnotice.
INNOEVENTSHALLENTERASYSNETWORKSBELIABLEFORANYINCIDENTAL,INDIRECT,SPECIAL,OR
CONSEQUENTIALDAMAGESWHATSOEVER(INCLUDINGBUTNOTLIMITEDTOLOSTPROFITS)ARISINGOUTOF
ORRELATEDTOTHISDOCUMENT,WEBSITE,ORTHEINFORMATIONCONTAINEDINTHEM,EVENIFENTERASYS
NETWORKSHASBEENADVISEDOF,KNEWOF,ORSHOULDHAVEKNOWNOF,THEPOSSIBILITYOFSUCH
DAMAGES.
EnterasysNetworks,Inc.
50MinutemanRoad
Andover,MA01810
2009EnterasysNetworks,Inc.Allrightsreserved.
PartNumber: 903431307 June2009
ENTERASYS,ENTERASYSNETWORKS,ENTERASYSSECURENETWORKS,SECURESTACK,ENTERASYS
SECURESTACK,ENTERASYSNETSIGHT,WEBVIEW,andanylogosassociatedtherewith,aretrademarksorregistered
trademarksofEnterasysNetworks,Inc.intheUnitedStatesandothercountries.ForacompletelistofEnterasystrademarks,
seehttp://www.enterasys.com/company/trademarks.aspx.
Allotherproductnamesmentionedinthismanualmaybetrademarksorregisteredtrademarksoftheirrespectivecompanies.
DocumentationURL:http://www.enterasys.com/support/manuals
DocumentacionURL:http://www.enterasys.com/support/manuals
DokumentationimInternet:http://www.enterasys.com/support/manuals
Version:
ii
IftheProgramisexportedfromtheUnitedStatespursuanttotheLicenseExceptionTSRundertheU.S.Export
AdministrationRegulations,inadditiontotherestrictionontransfersetforthinSection1or2ofthisAgreement,You
agreenotto(i)reexportorreleasetheProgram,thesourcecodefortheProgramortechnologytoanationalofa
countryinCountryGroupsD:1orE:2(Albania,Armenia,Azerbaijan,Belarus,Cambodia,Cuba,Georgia,Iraq,
Kazakhstan,Laos,Libya,Macau,Moldova,Mongolia,NorthKorea,thePeoplesRepublicofChina,Russia,Tajikistan,
Turkmenistan,Ukraine,Uzbekistan,Vietnam,orsuchothercountriesasmaybedesignatedbytheUnitedStates
Government),(ii)exporttoCountryGroupsD:1orE:2(asdefinedherein)thedirectproductoftheProgramorthe
technology,ifsuchforeignproduceddirectproductissubjecttonationalsecuritycontrolsasidentifiedontheU.S.
CommerceControlList,or(iii)ifthedirectproductofthetechnologyisacompleteplantoranymajorcomponentofa
plant,exporttoCountryGroupsD:1orE:2thedirectproductoftheplantoramajorcomponentthereof,ifsuch
foreignproduceddirectproductissubjecttonationalsecuritycontrolsasidentifiedontheU.S.CommerceControl
ListorissubjecttoStateDepartmentcontrolsundertheU.S.MunitionsList.
5. UNITEDSTATESGOVERNMENTRESTRICTEDRIGHTS. TheenclosedProgram(i)wasdevelopedsolelyat
privateexpense;(ii)containsrestrictedcomputersoftwaresubmittedwithrestrictedrightsinaccordancewithsection
52.22719(a)through(d)oftheCommercialComputerSoftwareRestrictedRightsClauseanditssuccessors,and(iii)in
allrespectsisproprietarydatabelongingtoEnterasysand/oritssuppliers.ForDepartmentofDefenseunits,the
ProgramisconsideredcommercialcomputersoftwareinaccordancewithDFARSsection227.72023anditssuccessors,
anduse,duplication,ordisclosurebytheU.S.Governmentissubjecttorestrictionssetforthherein.
6. DISCLAIMEROFWARRANTY. EXCEPTFORTHOSEWARRANTIESEXPRESSLYPROVIDEDTOYOUIN
WRITINGBYENTERASYS,ENTERASYSDISCLAIMSALLWARRANTIES,EITHEREXPRESSORIMPLIED,
INCLUDINGBUTNOTLIMITEDTOIMPLIEDWARRANTIESOFMERCHANTABILITY,SATISFACTORY
QUALITY,FITNESSFORAPARTICULARPURPOSE,TITLEANDNONINFRINGEMENTWITHRESPECTTOTHE
PROGRAM.IFIMPLIEDWARRANTIESMAYNOTBEDISCLAIMEDBYAPPLICABLELAW,THENANYIMPLIED
WARRANTIESARELIMITEDINDURATIONTOTHIRTY(30)DAYSAFTERDELIVERYOFTHEPROGRAMTO
YOU.
7. LIMITATIONOFLIABILITY. INNOEVENTSHALLENTERASYSORITSSUPPLIERSBELIABLEFORANY
DAMAGESWHATSOEVER(INCLUDING,WITHOUTLIMITATION,DAMAGESFORLOSSOFBUSINESS,
PROFITS,BUSINESSINTERRUPTION,LOSSOFBUSINESSINFORMATION,SPECIAL,INCIDENTAL,
CONSEQUENTIAL,ORRELIANCEDAMAGES,OROTHERLOSS)ARISINGOUTOFTHEUSEORINABILITYTO
USETHEPROGRAM,EVENIFENTERASYSHASBEENADVISEDOFTHEPOSSIBILITYOFSUCHDAMAGES.
THISFOREGOINGLIMITATIONSHALLAPPLYREGARDLESSOFTHECAUSEOFACTIONUNDERWHICH
DAMAGESARESOUGHT.
THECUMULATIVELIABILITYOFENTERASYSTOYOUFORALLCLAIMSRELATINGTOTHEPROGRAM,
INCONTRACT,TORTOROTHERWISE,SHALLNOTEXCEEDTHETOTALAMOUNTOFFEESPAIDTO
ENTERASYSBYYOUFORTHERIGHTSGRANTEDHEREIN.
8. AUDITRIGHTS. YouherebyacknowledgethattheintellectualpropertyrightsassociatedwiththeProgramare
ofcriticalvaluetoEnterasys,and,accordingly,Youherebyagreetomaintaincompletebooks,recordsandaccounts
showing(i)licensefeesdueandpaid,and(ii)theuse,copyinganddeploymentoftheProgram.Youalsograntto
Enterasysanditsauthorizedrepresentatives,uponreasonablenotice,therighttoauditandexamineduringYour
normalbusinesshours,Yourbooks,records,accountsandhardwaredevicesuponwhichtheProgrammaybedeployed
toverifycompliancewiththisAgreement,includingtheverificationofthelicensefeesdueandpaidEnterasysandthe
use,copyinganddeploymentoftheProgram.Enterasysrightofexaminationshallbeexercisedreasonably,ingood
faithandinamannercalculatedtonotunreasonablyinterferewithYourbusiness.Intheeventsuchauditdiscovers
noncompliancewiththisAgreement,includingcopiesoftheProgrammade,usedordeployedinbreachofthis
Agreement,YoushallpromptlypaytoEnterasystheappropriatelicensefees.Enterasysreservestheright,tobe
exercisedinitssolediscretionandwithoutpriornotice,toterminatethislicense,effectiveimmediately,forfailureto
complywiththisAgreement.Uponanysuchtermination,YoushallimmediatelyceasealluseoftheProgramandshall
returntoEnterasystheProgramandallcopiesoftheProgram.
9. OWNERSHIP. Thisisalicenseagreementandnotanagreementforsale.Youacknowledgeandagreethatthe
Programconstitutestradesecretsand/orcopyrightedmaterialofEnterasysand/oritssuppliers.Youagreeto
implementreasonablesecuritymeasurestoprotectsuchtradesecretsandcopyrightedmaterial.Allright,titleand
interestinandtotheProgramshallremainwithEnterasysand/oritssuppliers.Allrightsnotspecificallygrantedto
YoushallbereservedtoEnterasys.
iii
iv
Contents
About This Guide
Using This Guide ..........................................................................................................................................xxxiii
Structure of This Guide .................................................................................................................................xxxiii
Related Documents ...................................................................................................................................... xxxv
Conventions Used in This Guide ................................................................................................................. xxxvi
Getting Help .................................................................................................................................................xxxvii
Chapter 1: Introduction
SecureStack C3 CLI Overview ....................................................................................................................... 1-1
Switch Management Methods ........................................................................................................................ 1-1
Factory Default Settings ................................................................................................................................. 1-2
Using the Command Line Interface ................................................................................................................ 1-6
Starting a CLI Session ............................................................................................................................. 1-6
Logging In ................................................................................................................................................ 1-7
Navigating the Command Line Interface .................................................................................................. 1-8
vii
viii
ix
xi
xii
xiv
xv
xvi
xviii
xix
xxi
create.............................................................................................................................................. 20-43
address........................................................................................................................................... 20-44
priority............................................................................................................................................. 20-45
advertise-interval ............................................................................................................................ 20-45
preempt .......................................................................................................................................... 20-46
enable............................................................................................................................................. 20-47
ip vrrp authentication-key ............................................................................................................... 20-48
show ip vrrp .................................................................................................................................... 20-48
Configuring PIM-SM ................................................................................................................................... 20-49
Design Considerations ......................................................................................................................... 20-49
Purpose ................................................................................................................................................ 20-49
Commands ........................................................................................................................................... 20-49
ip pimsm ......................................................................................................................................... 20-50
ip pimsm staticrp............................................................................................................................. 20-50
ip pimsm enable ............................................................................................................................. 20-51
ip pimsm query-interval .................................................................................................................. 20-52
show ip pimsm................................................................................................................................ 20-52
show ip pimsm componenttable ..................................................................................................... 20-53
show ip pimsm interface ................................................................................................................. 20-54
show ip pimsm neighbor ................................................................................................................. 20-55
show ip pimsm rp............................................................................................................................ 20-56
show ip pimsm rphash .................................................................................................................... 20-57
show ip pimsm staticrp ................................................................................................................... 20-58
show ip mroute ............................................................................................................................... 20-59
xxiii
xxiv
xxv
xxvi
xxviii
Index
Figures
1-1
1-2
1-3
1-4
1-5
1-6
10-1
Tables
1-1
1-2
1-3
3-1
3-2
3-3
3-4
3-5
5-1
6-1
6-2
xxix
6-3
6-4
6-5
7-1
7-2
7-3
7-4
7-5
7-6
7-7
8-1
8-2
8-3
8-4
8-5
8-6
8-7
8-8
8-9
8-10
8-11
9-1
10-1
10-2
10-3
11-1
11-2
11-3
14-1
14-2
14-3
14-4
14-5
14-6
14-7
14-8
15-1
15-2
15-3
18-1
18-2
19-1
19-2
20-1
20-2
20-3
20-4
20-5
20-6
20-7
20-8
20-9
20-10
20-11
20-12
20-13
xxx
22-1
22-2
22-3
22-4
22-5
24-1
24-2
25-1
25-2
25-3
25-4
25-5
25-6
25-7
25-8
25-9
25-10
25-11
25-12
25-13
26-1
26-2
26-3
26-4
26-5
26-6
26-7
26-8
27-1
28-1
28-2
A-1
A-2
xxxi
xxxii
Important Notice
Depending on the firmware version used in your C3 device, some features described in this
document may not be supported. Refer to the Release Notes shipped with your device to
determine which features are supported.
AccesstheSecureStackCLI.
UseCLIcommandstoperformnetworkmanagementanddeviceconfigurationoperations
EstablishandmanageVirtualLocalAreaNetworks(VLANs).
Establishandmanagestaticanddynamicallyassignedpolicyclassifications.
Establishandmanagepriorityclassification.
ConfigureIProutingandroutingprotocols,includingRIPversions1and2,OSPF,DVMRP,
IRDP,andVRRP.
ConfigureIPv6routing,includingOSPFv3.
Configuresecurityprotocols,including802.1XandRADIUS,SSHv2,PWA,MAClocking,and
MACauthentication.
Configureaccesscontrollists(ACLs).
xxxiii
Chapter 5,ConfiguringSystemPowerandPoE,describesthecommandsusedtoreviewandset
systempowerandPoEparametersondevicesthatofferPoweroverEthernet.
Chapter 6,DiscoveryProtocolConfigurationprovideshowtoconfigurediscoveryprotocols
supportedbythedevice.
Chapter 7,PortConfiguration,describeshowtoreviewandconfigureconsoleportsettings,and
howtoenableordisableswitchportsandconfigureswitchportsettings,includingportspeed,
duplexmode,autonegotiation,flowcontrol,portmirroring,linkaggegationandbroadcast
suppression.
Chapter 8,SNMPConfiguration,describeshowtoconfigureSNMPusersandusergroups,access
rights,targetaddresses,andnotificationparameters.
Chapter 9,SpanningTreeConfiguration,describeshowtoreviewandsetSpanningTreebridge
parametersforthedevice,includingbridgepriority,hellotime,maximumagingtimeandforward
delay;andhowtoreviewandsetSpanningTreeportparameters,includingportpriorityandpath
costs.ConfiguringtheSpanGuardandLoopProtectfunctionsisalsodescribed.
Chapter 10,802.1QVLANConfiguration,describeshowtocreatestaticVLANs,selectthemode
ofoperationforeachport,establishVLANforwarding(egress)lists,routeframesaccordingto
VLANID,displaythecurrentportsandporttypesassociatedwithaVLANandprotocol,createa
securemanagementVLAN,andconfigureportsonthedeviceasGVRPawareports.
Chapter 11,PolicyClassificationConfiguration,describeshowtocreate,changeorremoveuser
rolesorprofilesbasedonbusinessspecificuseofnetworkservices;howtopermitordenyaccess
tospecificservicesbycreatingandassigningclassificationruleswhichmapuserprofilestoframe
filteringpolicies;howtoclassifyframestoaVLANorClassofService(CoS);andhowtoassignor
unassignportstopolicyprofilessothatonlyportsactivatedforaprofilewillbeallowedto
transmitframesaccordingly.
Chapter 12,PortPriorityConfiguration,describeshowtosetthetransmitpriorityofeachport
andconfigurearatelimitforagivenportandlistofpriorities.
Chapter 13,IGMPConfiguration,describeshowtoconfigureInternetGroupManagement
Protocol(IGMP)settingsformulticastfiltering.
Chapter 14,LoggingandNetworkManagement,describeshowtoconfigureSyslog,howto
managegeneralswitchsettings,howtomonitornetworkeventsandstatus,andhowtoconfigure
SNTPandnodealiases.
Chapter 15,RMONConfiguration,describeshowtouseRMON(RemoteNetworkMonitoring),
whichprovidescomprehensivenetworkfaultdiagnosis,planning,andperformancetuning
informationandallowsforinteroperabilitybetweenSNMPmanagementstationsandmonitoring
agents.
Chapter 16,DHCPServerConfiguration,describeshowtoreviewandconfigureDHCPserver
parameters,howtoreviewandconfigureDHCPaddresspools,andhowtodisplayDHCPserver
information.
Chapter 17,DHCPSnoopingandDynamicARPInspection,describestwosecurityfeatures:
DHCPsnooping,whichmonitorsDHCPmessagesbetweenaDHCPclientandDHCPserverto
filterharmfulDHCPmessagesandtobuildadatabaseofauthorizedaddressbindings,and
DynamicARPinspection,whichusesthebindingsdatabasecreatedbytheDHCPsnooping
featuretorejectinvalidandmaliciousARPpackets.
Chapter 18,PreparingforRouterMode,providesinformationaboutroutermodes.
Chapter 19,IPConfiguration,describeshowtoenableIProutingforroutermodeoperation,how
toconfigureIPinterfacesettings,howtoreviewandconfiguretheroutingARPtable,howto
reviewandconfigureroutingbroadcasts,howtoconfigurePIM,andhowtoconfigureIProutes.
xxxiv
Related Documents
Chapter 20,IPv4RoutingProtocolConfiguration,describeshowtoconfigureIPv4routingand
routingprotocols,includingRIP,OSPF,DVMRP,IRDP,andVRRP.
Chapter 21,IPv6Management,describesthecommandsusedtoconfigureIPv6attheswitch
level.
Chapter 22,IPv6Configuration,describesthecommandsusedtoconfigureIPv6attherouting
level.
Chapter 23,IPv6ProxyRouting,describeshowtoenableIPv6proxyroutingandhowto
configureamixedC2/C3stackforIPv6proxyrouting.
Chapter 24,DHCPv6Configuration,describesthecommandsusedtoconfiguretheDynamic
HostConfigurationProtocolforIPv6.
Chapter 25,OSPFv3Configuration,describesthecommandsusedtoconfiguretheOpenShortest
PathFirstroutingprotocolforIPv6.
Chapter 26,AuthenticationandAuthorizationConfiguration,describeshowtoconfigure802.1X
authenticationusingEAPOL,howtoconfigureRADIUSserver,SecureShellserver,MAC
authentication,MAClocking,PortWebAuthentication,andIPaccesscontrollists(ACLs).
Chapter 27,TACACS+Configuration,providesinformationaboutthecommandsusedto
configureandmonitorTACACS+(TerminalAccessControllerAccessControlSystemPlus).
Related Documents
ThefollowingEnterasysNetworksdocumentsmayhelpyoutosetup,control,andmanagethe
SecureStackdevice:
EnterasysFirmwareFeatureGuides
SecureStackC3InstallationGuide(s)
SecureStackRedundantPowerSystemInstallationGuide
Documentslistedabove,canbeobtainedfromtheWorldWideWebinAdobeAcrobatPortable
DocumentFormat(PDF)atthefollowingwebsite:
http://www.enterasys.com/support/manuals/
xxxv
Description
Bold font
italic font
Courier font
[]
{}
[x | y | z]
{x | y | z}
[x {y | z} ]
Thefollowingiconsareusedinthisguide:
Note: Calls the readers attention to any item of information that may be of special importance.
xxxvi
Getting Help
Getting Help
Foradditionalsupportrelatedtothisswitchordocument,contactEnterasysNetworksusingone
ofthefollowingmethods:
World Wide Web
http://www.enterasys.com/support
1-800-872-8440 (toll-free in U.S. and Canada)
or 1-978-684-1000
Phone
Internet mail
To send comments or suggestions concerning this document to the Technical Publications Department:
techpubs@enterasys.com
Make sure to include the document Part Number in the email message.
BeforecallingEnterasysNetworks,havethefollowinginformationready:
YourEnterasysNetworksservicecontractnumber
Adescriptionofthefailure
Adescriptionofanyaction(s)alreadytakentoresolvetheproblem(forexample,changing
modeswitchesorrebootingtheunit)
TheserialandrevisionnumbersofallinvolvedEnterasysNetworksproductsinthenetwork
Adescriptionofyournetworkenvironment(forexample,layout,cabletype)
Networkloadandframesizeatthetimeoftrouble(ifknown)
Theswitchhistory(forexample,haveyoureturnedtheswitchbefore,isthisarecurring
problem?)
AnypreviousReturnMaterialAuthorization(RMA)numbers
xxxvii
Getting Help
xxxviii
1
Introduction
ThischapterprovidesanoverviewoftheSecureStackC3suniquefeaturesandfunctionality,an
overviewofthetasksthatmaybeaccomplishedusingtheCLIinterface,anoverviewofwaysto
managetheswitch,factorydefaultsettings,andinformationabouthowtousetheCommandLine
Interfacetoconfiguretheswitch.
For information about...
Refer to page...
1-1
1-1
1-2
1-6
UseCLIcommandstoperformnetworkmanagementandswitchconfigurationoperations.
Downloadanewfirmwareimage.
AssignIPaddressandsubnetmask.
Selectadefaultgateway.
EstablishandmanageVirtualLocalAreaNetworks(VLANs).
Establishandmanagepolicyprofilesandclassifications.
Establishandmanagepriorityclassification.
ConfigureIPv4routingandroutingprotocols.
ConfigureIPv6routingandroutingprotocols,includingOSPFv3.
Configuresecurityprotocols,including802.1XandRADIUS,SSHv2,PWA,MAClocking,and
MACauthentication.
Configureaccesscontrollists(ACLs).
LocallyusingaVTtypeterminalconnectedtotheconsoleport.
RemotelyusingaVTtypeterminalconnectedthroughamodem.
SecureStack C3 Configuration Guide
1-1
RemotelyusinganSNMPmanagementstation.
InbandthroughaTelnetconnection.
InbandusingtheEnterasysNetSightmanagementapplication.
RemotelyusingWebView,EnterasysNetworksembeddedwebserverapplication.
TheInstallationGuideforyourSecureStackC3deviceprovidessetupinstructionsforconnectinga
terminalormodemtotheswitch.
Feature
Default Setting
Set to 00-00-00-00-00-00-00-00
CDP interval
Set to 60 seconds.
Community name
Public.
1-2
Introduction
DHCP server
Disabled.
EAPOL
Disabled.
EAPOL authentication
mode
GARP timer
GVRP
Globally enabled.
20 lines.
Disabled.
IGMP snooping
Disabled. When enabled, query interval is set to 260 seconds and response
time is set to 10 seconds.
IP routes
Table 1-1
Feature
Default Setting
Enabled.
Disabled.
Set to DIP-SIP.
Lockout
Set to disable Read-Write and Read-Only users, and to lockout the default
admin (Super User) account for 15 minutes, after 3 failed login attempts.
Logging
Syslog port set to UDP port number 514. Logging severity level set to 6
(significant conditions) for all applications.
MAC locking
Passwords
Set to an empty string for all default user accounts. User must press ENTER
at the password prompt to access CLI.
Password aging
Disabled.
Password history
Policy classification
Port auto-negotiation
Port broadcast suppression Enabled and set to limit broadcast packets to 14,881 per second on all switch
ports.
Port duplex mode
Set to half duplex, except for 100BASE-FX and 1000BASE-X, which is set to
full duplex.
Port enable/disable
Enabled.
Port priority
Set to 0.
Port speed
Set to 10 Mbps, except for 1000BASE-X, which is set to 1000 Mbps, and
100BASE-FX, which is set to 100 Mbps.
Port trap
Priority classification
RADIUS client
Disabled.
RADIUS retries
RADIUS timeout
Rate limiting
1-3
Table 1-1
Feature
Default Setting
SNMP
Enabled.
SNTP
Disabled.
Spanning Tree
Edge port administrative status begins with the value set to false initially after
the device is powered up. If a Spanning Tree BDPU is not received on the
port within a few seconds, the status setting changes to true.
Enabled.
Set to 15 seconds.
Set to 2 seconds.
Set to 0.
Set to 20 seconds.
All ports with bridge priority are set to 128 (medium priority).
Enabled.
SSH
Disabled.
System contact
System location
System name
Terminal
Timeout
Set to 5 minutes.
User names
VLAN ID
Host VLAN
Notallofthefollowingroutingfeaturesareavailableonallplatforms.ChecktheReleaseNotesfor
yourspecificplatformsfordetails.
Table 1-2
1-4
Introduction
Output...
What it displays...
None configured.
None configured.
Table 1-2
Output...
What it displays...
Disabled.
Set to 1.
None configured.
None configured.
ARP table
ARP timeout
None configured.
None configured.
Set to 40 seconds.
No filters applied.
DVMRP
ICMP
IP-directed broadcasts
Disabled.
IP forward-protocol
IP interfaces
IRDP
MTU size
OSPF
Disabled.
OSPF cost
OSPF network
None configured.
OSPF priority
Set to 1.
None configured.
Proxy ARP
Set to 1 second.
Set to 5 seconds.
Set to version 1.
RIP offset
No value applied.
SNMP
Enabled.
1-5
Table 1-2
Output...
What it displays...
Split horizon
None configured.
Telnet
Enabled.
Timers (OSPF)
Set to 1 second.
VRRP
Disabled.
usingadefaultuseraccount,asdescribedinUsingaDefaultUserAccountonpage 17,or
usinganadministrativelyassigneduseraccountasdescribedinUsinganAdministratively
ConfiguredUserAccountonpage 17.
Figure 1-1
Username:admin
Password:
Enterasys SecureStack C3
Command Line Interface
Enterasys Networks, Inc.
50 Minuteman Rd.
Andover, MA 01810-1008 U.S.A.
Phone: +1 978 684 1000
E-mail: support@enterasys.com
WWW: http://www.enterasys.com
(c) Copyright Enterasys Networks, Inc. 2008
Chassis Serial Number:
Chassis Firmware Revision:
C3(su)->
1-6
Introduction
041800249041
6.03.xx.xxxx
TelnettotheswitchsIPaddress.
2.
Enterlogin(username)andpasswordinformationinoneofthefollowingways:
Iftheswitchsdefaultloginandpasswordsettingshavenotbeenchanged,followthe
stepslistedinUsingaDefaultUserAccountonpage 17,or
Enteranadministrativelyconfiguredusernameandpassword.
ThenoticeofauthorizationandthepromptdisplaysasshowninFigure 11.
ForinformationaboutconfiguringTelnetsettings,refertoStartingandConfiguringTelneton
page 337.
RefertotheinstructionsincludedwiththeTelnetapplicationforinformationaboutestablishinga
Telnetsession.
Logging In
Bydefault,theSecureStackC3switchisconfiguredwiththreeuserloginaccountsrofor
ReadOnlyaccess,rwforReadWriteaccess,andadminforsuperuseraccesstoallmodifiable
parameters.Thedefaultpasswordissettoablankstring.Forinformationonchangingthese
defaultsettings,refertoSettingUserAccountsandPasswordsonpage 32.
Attheloginprompt,enteroneofthefollowingdefaultusernames:
roforReadOnlyaccess.
rwforReadWriteaccess.
adminforSuperUseraccess.
2.
PressENTER.ThePasswordpromptdisplays.
3.
LeavethisstringblankandpressENTER.Theswitchinformationandpromptdisplaysas
showninFigure 11.
Attheloginprompt,enteryouradministrativelyassignedusernameandpressENTER.
2.
AtthePasswordprompt,enteryourpasswordandpressENTER.
ThenoticeofauthorizationandthepromptdisplaysasshowninFigure 11.
Note: Users with Read-Write (rw) and Read-Only access can use the set password command
(page 3-5) to change their own passwords. Administrators with Super User (su) access can use
the set system login command (page 3-4) to create and change user accounts, and the set
password command to change any local account password.
1-7
Syntax
show port status [port-string]
Defaults
Ifportstringisnotspecified,statusinformationforallportswillbedisplayed.
Admin:C3(su)>
ReadWrite:C3(rw)>
ReadOnly:C3(ro)>
C3(su)->show snmp ?
community
notify
targetaddr
targetparams
1-8
Introduction
SNMP
SNMP
SNMP
SNMP
v1/v2c
notify
target
target
Enteringaquestionmark(?)withoutaspaceafterapartialkeywordwilldisplayalistof
commandsthatbeginwiththepartialkeyword.Figure 14showshowtousethisfunctionforall
commandsbeginningwithco:
Figure 1-4
C3(rw)->co?
configure
C3(su)->co
copy
Note: At the end of the lookup display, the system will repeat the command you entered without the
?.
PressanykeyotherthanENTERtoadvancetheoutputonescreenatatime.
PressENTERtoadvancetheoutputonelineatatime.
TheexampleinFigure 15showshowtheshowmaccommandindicatesthatoutputcontinueson
morethanonescreen.
Figure 1-5
C3(su)->show mac
MAC Address
FID
Port
Type
---------------------------------------------------------00-00-1d-67-68-69
1
host
Management
00-00-02-00-00-00
1
ge.1.2
Learned
00-00-02-00-00-01
1
ge.1.3
Learned
00-00-02-00-00-02
1
ge.1.4
Learned
00-00-02-00-00-03
1
ge.1.5
Learned
00-00-02-00-00-04
1
ge.1.6
Learned
00-00-02-00-00-05
1
ge.1.7
Learned
00-00-02-00-00-06
1
ge.1.8
Learned
00-00-02-00-00-07
1
ge.1.9
Learned
00-00-02-00-00-08
1
ge.1.10
Learned
--More--
1-9
Figure 1-6
Abbreviating a Command
C3(su)->sh net
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address
Foreign Address
----- ------ ------ --------------------- --------------------TCP
0
0 10.21.73.13.23
134.141.190.94.51246
TCP
0
275 10.21.73.13.23
134.141.192.119.4724
TCP
0
0 *.80
*.*
TCP
0
0 *.23
*.*
UDP
0
0 10.21.73.13.1030
134.141.89.113.514
UDP
0
0 *.161
*.*
UDP
0
0 *.1025
*.*
UDP
0
0 *.123
*.*
State
------ESTABLISHED
ESTABLISHED
LISTEN
LISTEN
1-10
Introduction
Key Sequence
Command
Ctrl+A
Ctrl+B
Ctrl+D
Delete a character.
Ctrl+E
Ctrl+F
Ctrl+H
Ctrl+I or TAB
Complete word.
Ctrl+K
Ctrl+N
Scroll to next command in command history (use the CLI history command to
display the history).
Ctrl+P
Ctr1+Q
Ctr1+S
Ctrl+T
Transpose characters.
Ctrl+U or Ctrl+X
Ctrl+W
Ctrl+Y
2
Configuring Switches in a Stack
ThischapterprovidesinformationaboutconfiguringSecureStackC3switchesinastack.
For information about ...
2-1
2-2
2-3
2-3
2-3
2-5
2-5
2-6
Onceinstalledinastack,theswitchesbehaveandperformasasingleswitchproduct.Assuch,
youcanstartwithasingleunitandaddmoreunitsasyournetworkexpands.Youcanalsomix
differentproductsinthefamilyinasinglestacktoprovideadesiredcombinationofporttypes
andfunctionstomatchtherequirementsofindividualapplications.Inallcases,astackofunits
performsasonelargeproduct,andismanagedasasinglenetworkentity.
WhenswitchesareinstalledandconnectedasdescribedintheSecureStackC3InstallationGuides,
thefollowingoccursduringinitialization:
Theswitchthatwillmanagethestackisautomaticallyestablished.Thisisknownasthe
managerswitch.
Allotherswitchesareestablishedasmembersinthestack.
Thehierarchyoftheswitchesthatwillassumethefunctionofbackupmanagerisalso
determinedincasethecurrentmanagermalfunctions,ispowereddown,orisdisconnected
fromthestack.
2-1
Theconsoleportonthemanagerswitchremainsactiveforoutofband(local)switch
management,buttheconsoleportoneachmemberswitchisdeactivated.Thisenablesyouto
settheIPaddressandsystempasswordusingasingleconsoleport.Noweachswitchcanbe
configuredlocallyusingonlythemanagersconsoleport,orinbandusingaremotedeviceand
theCLIsetofcommandsdescribedinthissection.
Onceastackiscreated(morethanoneswitchisinterconnected),thefollowingprocedureoccurs:
1.
Bydefault,unitIDsarearbitrarilyassignedonafirstcome,firstservedbasis.
2.
UnitIDsaresavedagainsteachmodule.Then,everytimeaboardispowercycled,itwill
initializewiththesameunitID.Thisisimportantforportspecificinformation(forexample:
ge.4.12isthe12thGigabitEthernetportonUnit#4).
3.
Themanagementelectionprocessusesthefollowingprecedencetoassignamanagement
switch:
a.
Previouslyassigned/electedmanagementunit
b.
Managementassignedpriority(values115)
c.
Hardwarepreferencelevel
d. HighestMACAddress
Usethefollowingrecommendedprocedureswheninstallinganewstackablesystemoraddinga
newunittoanexistingstack.
Important
The following procedures assume that all units have a clean configuration from manufacturing. When adding
a new unit to an already running stack, it is also assumed that the new unit is using the same firmware image
version as other units in the stack.
Beforeapplyingpower,makeallphysicalconnectionswiththestackcablesasdescribedinthe
SecureStackC3InstallationGuides.
2.
Onceallofthestackcableshavebeenconnected,individuallypoweroneachunitfromtopto
bottom.
Notes: Ensure that each switch is fully operational before applying power to the next switch.
Since unit IDs are assigned on a first-come, first-served basis, this will ensure that unit IDs are
ordered sequentially.
Once unit IDs are assigned, they are persistent and will be retained during a power cycle to any or
all of the units.
2-2
3.
(Optional)Ifdesired,changethemanagementunitusingthesetswitchmovemanagement
commandasdescribedinsetswitchmovemanagementonpage211.
4.
Oncethedesiredmasterunithasbeenselected,resetthesystemusingtheresetcommand
(page350).
5.
Afterthestackhasbeenconfigured,youcanusetheshowswitchunitcommand(page26)to
physicallyidentifyeachunit.Whenyouenterthecommandwithaunitnumber,theMGR
LEDofthespecifiedswitchwillblinkfor10seconds.ThenormalstateofthisLEDisofffor
memberunitsandsteadygreenforthemanagerunit.
Stacktheunitsinthemethoddesired,andconnectthestackcables.
2.
Poweruponlytheunityouwishtobemanager.
3.
Oncethemanagementunitispoweredup,logintotheCLI,andusetheshowswitch
commandasdescribedinshowswitchonpage26todisplaystackinginformation.
4.
Clearanyswitcheswhicharelistedasunassignedusingtheclearswitchmember
commandasdescribedinclearswitchmemberonpage212.
5.
Powerupthememberofthestackyouwishtobecomeunit2.Oncethesecondunitisfully
powered,theCOMsessionoftheCLIwillstatethatanewCPUwasadded.
6.
Usetheshowswitchcommandtoredisplaystackinginformation.
a.
Ifthenewmemberdisplaysasunit2,youcanproceedtorepeatthisstepwiththenext
unit.
b.
Ifthenewmemberdisplaysadifferentunitnumber,youmust:
(1) Renumberthestackusingthesetswitchrenumbercommandasdescribedinset
switchonpage29,then
(2) Cleartheoriginalunitnumberusingtheclearswitchmembercommand.
7.
RepeatStep6untilallmembershavebeenrenumberedintheorderyoudesire.
8.
Afterthestackhasbeenreconfigured,youcanusetheshowswitchunitcommand(show
switchonpage26)tophysicallyconfirmtheidentityofeachunit.Whenyouenterthe
commandwithaunitnumber,theMGRLEDofthespecifiedswitchwillblinkfor10seconds.
ThenormalstateofthisLEDisoffformemberunitsandsteadygreenforthemanagerunit.
Ensurethatpowerisoffonthenewunitbeinginstalled.
2.
Useoneofthefollowingmethodstocompletestackcableconnections:
3.
Iftherunningstackusesadaisychaintopology,makethestackcableconnectionsfrom
thebottomofthestacktothenewunit(thatis,STACKDOWNportfromthebottomunit
oftherunningstacktotheSTACKUPportonthenewunit).
Iftherunningstackusesaringstacktopology,breaktheringandmakethestackcable
connectionstothenewunittoclosethering.
Applypowertothenewunit.
2-3
Tocreateavirtualswitchconfigurationinastackenvironment:
1.
Displaythetypesofswitchessupportedinthestack,usingtheshowswitchswitchtype
command(page27).
2.
Usingtheoutputoftheshowswitchswitchtypecommand,determinetheswitchindex(SID)
ofthemodelofswitchbeingconfigured.
3.
Addthevirtualswitchtothestackusingthesetswitchmembercommand(page211).Use
theSIDoftheswitchmodel,determinedinthepreviousstep,andtheunitIDthatyouwantto
assigntothisswitchmember.
4.
Proceedtoconfiguretheportsofthevirtualswitchasyouwoulddoforphysicallypresent
devices.
ThefollowingexampleaddsaC3G12424modetoastackasunit2ofthestack.Thefirstporton
thatvirtualswitchisthenassociatedwithVLAN555.
C3(su)->show switch switchtype
SID
--1
2
3
4
5
6
7
8
9
10
11
12
13
15
17
Switch Model ID
-------------------------------C2G124-24
C2K122-24
C2G124-48
C2G124-48P
C2H124-48
C2H124-48P
C2G134-24P
C2G170-24
C3G124-24P
C3G124-48P
C3G124-48
C3G124-24
C3K172-24
C3K122-24
C3K122-24P
Mgmt
Pref
---1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
Code
Version
--------0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
2-4
UseclearconfigtoclearconfigparameterswithoutclearingstackunitIDs.Thiscommand
WILLNOTclearstackparametersortheIPaddressandavoidstheprocessofrenumbering
thestack.
Useclearconfigallwhenitisnecessarytoclearallconfigparameters,includingstackunit
IDsandswitchpriorityvalues.ThiscommandwillnotcleartheIPaddressnorwillitremove
anappliedadvancedfeaturelicense.
UseclearipaddresstoremovetheIPaddressofthestack.
Useclearlicensetoremoveanappliedlicensefromaswitch.
Configurationparametersandstackinginformationcanalsobeclearedonthemasterunitonly
byselectingtherestoreconfigurationtofactorydefaultsoptionfromthebootmenuonswitch
startup.Thisselectionwillleavestackingprioritiesonallotherunits.
Configuration
Common Firmware Version
MixedstackingissupportedbySecureStackC2firmwareversion5.02.xx.xxxxonly.Youcaninstall
theC2firmwarefirst,withtheC3switchinstandalonemode,oryoucanaddtheC3switchtothe
stackandthencopytheC2firmwaretotheC3switchusingthesetswitchcopyfwcommand
(page210).AftercopyingtheC2firmwaretotheC3switch,youmustresetthestack.
Switch Manager
ItisrecommendedthataSecureStackC3switchbemadethemanagerofamixedstack.Usetheset
switchmovemanagementcommand(page211)tochangethemanagerunit.
2-5
Commands
For information about...
Refer to page...
show switch
2-6
2-7
2-8
set switch
2-9
2-10
2-10
2-11
2-11
2-12
show switch
Usethiscommandtodisplayinformationaboutoneormoreunitsinthestack.
Syntax
show switch [status] [unit]
Parameters
status
(Optional)Displayspowerandadministrativestatusinformationforone
ormoreunitsinthestack.
unit
(Optional)Specifiestheunit(s)forwhichinformationwilldisplay.
Defaults
Ifnotspecified,statusandotherconfigurationinformationaboutallunitswillbedisplayed.
Mode
Switchcommand,readonly.
Usage
Afterastackhasbeenconfigured,youcanusethiscommandtophysicallyconfirmtheidentityof
eachunit.Whenyouenterthecommandwithaunitnumber,theMGRLEDofthespecified
switchwillblinkfor10seconds.ThenormalstateofthisLEDisoffformemberunitsandsteady
greenforthemanagerunit.
2-6
Examples
Thisexampleshowshowtodisplayinformationaboutallswitchunitsinthestack:
C3(rw)->show switch
Management
Preconfig
Plugged-in
Switch
Code
Switch
Status
Model ID
Model ID
Status
Version
------ ------------ ------------- ------------- --------------------- -------1
Mgmt Switch C3G124-24
C3G124-24
OK
06.03.xx.xxxx
2
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
3
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
4
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
5
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
6
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
7
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
8
Stack Member C3G124-24
C3G124-24
OK
06.03.xx.xxxx
Thisexampleshowshowtodisplayinformationaboutswitchunit1inthestack:
C3(ro)->show switch 1
Switch
Management Status
Hardware Management Preference
Admin Management Preference
Switch Type
Preconfigured Model Identifier
Plugged-in Model Identifier
Switch Status
Switch Description
Detected Code Version
Detected Code in Flash
Detected Code in Back Image
Up Time
1
Management Switch
Unassigned
Unassigned
C3G124-24
C3G124-24
C3G124-24
OK
Enterasys Networks, Inc. C3 -- Model
C3G124-24
06.03.xx.xxxx
03.01.20
02.01.37
0 days 6 hrs 37 mins 54 secs
Thisexampleshowshowtodisplaystatusinformationforswitchunit1inthestack:
C3(ro)->show switch status 1
Switch
Switch Status
Admin State
Power State
Inserted Switch:
Model Identifier
Description
Configured Switch:
Model Identifier
Description
1
Full
C3G124-24
Enterasys Networks, Inc. C3 -- Model
C3G124-24
C3G124-24
Enterasys Networks, Inc. C3 -- Model
C3G124-24
Syntax
show switch switchtype [switchindex]
2-7
Parameters
switchindex
(Optional)Specifiestheswitchindex(SID)oftheswitchtypetodisplay.
Defaults
None.
Mode
Switchcommand,readonly.
Examples
Thisexampleshowshowtodisplayswitchtypeinformationaboutallswitchesinthestack:
C3(ro)->show switch switchtype
SID
--1
2
3
4
5
6
7
8
9
10
11
12
13
15
17
Switch Model ID
-------------------------------C2G124-24
C2K122-24
C2G124-48
C2G124-48P
C2H124-48
C2H124-48P
C2G134-24P
C2G170-24
C3G124-24P
C3G124-48P
C3G124-48
C3G124-24
C3K172-24
C3K122-24
C3K122-24P
Mgmt
Pref
---1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
Code
Version
--------0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
0xa08245
ThisexampleshowshowtodisplayswitchtypeinformationaboutSID1:
C3(ro)->show switch switchtype 1
Switch Type
Model Identifier
Switch Description
Management Preference
Expected Code Version
0x56950200
C2G124-24
Enterasys Networks, Inc. C2 -Model C2G124-24
1
0xa08245
Supported Cards:
Slot
Card Index (CID)
Model Identifier
0
1
C2G124-24
Syntax
show switch stack-ports [unit]
2-8
set switch
Parameters
unit
(Optional)SpecifiestheswitchunitID,anintegerrangingfrom1to8.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaydataanderrorinformationonstackports:
C3(ro)->show switch stack-ports
------------TX-------------- ------------RX----------Data
Error
Data
Error
Stacking
Rate
Rate
Total
Rate
Rate
Total
Switch
Port
(Mb/s) (Errors/s) Errors
(Mb/s) (Errors/s) Errors
------ ---------- ------ ---------- ---------- ------ ---------- -------1
Up
0
0
0
0
0
0
Down
0
0
0
0
0
0
set switch
UsethiscommandtoassignaswitchID,tosetaswitchspriorityforbecomingthemanagement
switchifthepreviousmanagementswitchfails,ortochangetheswitchunitIDforaswitchinthe
stack.
Syntax
set switch {unit [priority value | renumber newunit]}
Parameters
unit
Specifiesaunitnumberfortheswitch.Valuecanrangefrom1to8.
priorityvalue
Specifiesapriorityvaluefortheunit.Validvaluesare1to15withhigher
valuesassigninghigherpriority.
renumbernewunit
Specifiesanewnumberfortheunit.
Note: This number must be a previously unassigned unit ID number.
Defaults
None.
Mode
Switchcommand,readwrite.
2-9
Examples
Thisexampleshowshowtoassignpriority3toswitch5:
C3(su)->set switch 5 priority 3
Thisexampleshowshowtorenumberswitch5toswitch7:
C3(su)->set switch 5 renumber 7
Syntax
set switch copy-fw [destination-system unit]
Parameters
destinationsystem (Optional)Specifiestheunitnumberofunitonwhichtocopythe
unit
managementimagefile.
Defaults
Ifdestinationsystemisnotspecified,themanagementimagefilewillbereplicatedtoallswitches
inthestack.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoreplicatethemanagementimagefiletoallswitchesinthestack:
C3(su)->set switch copy-fw
Are you sure you want to copy firmware? (y/n) y
Code transfer completed successfully.
Syntax
set switch description unit description
Parameters
unit
Specifiesaunitnumberfortheswitch.
description
Specifiesatextdescriptionfortheunit.
Defaults
None.
2-10
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoassignthenameFirstUnittoswitchunit1inthestack:
C3(su)->set switch description 1 FirstUnit
Syntax
set switch movemanagement fromunit tounit
Parameters
fromunit
Specifiestheunitnumberofthecurrentmanagementswitch.
tounit
Specifiestheunitnumberofthenewlydesignatedmanagementswitch.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtomovemanagementfunctionalityfromswitch1toswitch2:
C3(su)->set switch movemenagement 1 2
Moving stack management will unconfigure entire stack including all interfaces.
Are you sure you want to move stack management? (y/n) y
Syntax
set switch member unit switch-id
Parameters
unit
Specifiesaunitnumberfortheswitch.
switchid
SpecifiesaswitchID(SID)fortheswitch.SIDscanbedisplayedwiththe
showswitchswitchtypecommand.
Defaults
None.
2-11
Mode
Switchcommand,readwrite.
Usage
RefertoCreatingaVirtualSwitchConfigurationonpage23formoreinformationabouthowto
addavirtualswitchtoastack.
Example
Thisexampleshowshowtospecifyaswitchasunit1withaswitchIDof1:
C3(su)->set switch member 1 1
Syntax
clear switch member unit
Parameters
unit
Specifiestheunitnumberoftheswitch.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoremovetheswitch5entryfromthestack:
C3(su)->clear switch member 5
2-12
3
Basic Configuration
Atstartup,theSecureStackC3switchisconfiguredwithmanydefaultsandstandardfeatures.
Thischapterdescribeshowtocustomizebasicsystemsettingstoadapttoyourworkenvironment.
For information about...
Refer to page...
3-1
3-2
3-9
3-32
3-35
3-37
3-39
3-49
3-50
3-52
3-55
Configuring Hostprotect
3-56
Step Task
CLI commands
3-5
3-11
copy tftp://tftp_server_ip_address/
filename system:image
3-45
3-36
show version
3-26
3-1
Table 3-2
Task
CLI commands
save config
3-41
26-77
3-37
3-53
7-25
7-34
Configure a VLAN.
10-5
10-9
10-9
26-7
26-7
Commands
For information about...
3-2
Refer to page...
3-3
3-4
3-4
set password
3-5
3-6
3-6
3-7
3-7
3-8
Basic Configuration
Syntax
show system login
Parameters
None.
Defaults
None.
Mode
Switchcommand,superuser.
Example
Thisexampleshowshowtodisplayloginaccountinformation.Inthiscase,switchdefaultshave
notbeenchanged:
C3(su)->show system login
Password history size: 0
Password aging
: disabled
Username
Access
State
admin
ro
rw
super-user
read-only
read-write
enabled
enabled
enabled
Table 31providesanexplanationofthecommandoutput.
Table 3-1
Output Field
What It Displays...
Number of previously used user login passwords that will be checked for
duplication when the set password command is executed. Configured with set
system password history (page 3-7).
Password aging
Number of days user passwords will remain valid before aging out. Configured
with set system password aging (page 3-6).
Username
Access
State
3-3
Syntax
set system login username {super-user | read-write | read-only} {enable | disable}
Parameters
username
Specifiesaloginnameforaneworexistinguser.Thisstringcanbea
maximumof80characters,althoughamaximumof16charactersis
recommendedforproperviewingintheshowsystemlogindisplay.
superuser|
readwrite|
readonly
Specifiestheaccessprivilegesforthisuser.
enable|disable
Enablesordisablestheuseraccount.
Defaults
None.
Mode
Switchcommand,superuser.
Usage
Loginaccounts,includingtheadminuseraccount,canbelockedoutaftermultiplefailedattempts
tologintothesystem.Refertoshowsystemlockoutonpage37andsetsystemlockouton
page38formoreinformationaboutlockoutparameters.
Iftheadminuseraccounthasbeenlockedout,youmustwaituntiltheconfiguredlockouttime
periodhasexpiredoryoucanpowercycletheswitchtorebootit,whichwillreenabletheadmin
useraccount.
Example
Thisexampleshowshowtoenableanewuseraccountwiththeloginnamenetopswithsuper
useraccessprivileges:
C3(su)->set system login netops super-user enable
Syntax
clear system login username
3-4
Basic Configuration
set password
Parameters
username
Specifiestheloginnameoftheaccounttobecleared.
Note: The default admin (su) account cannot be deleted.
Defaults
None.
Mode
Switchcommand,superuser.
Example
Thisexampleshowshowtoremovethenetopsuseraccount:
C3(su)->clear system login netops
set password
UsethiscommandtochangesystemdefaultpasswordsortosetanewloginpasswordontheCLI.
Syntax
set password [username]
Parameters
username
(Onlyavailabletouserswithsuperuseraccess.)Specifiesasystemdefault
orauserconfiguredloginaccountname.Bydefault,theSecureStackC3
switchprovidesthefollowingaccountnames:
roforReadOnlyaccess.
rwforReadWriteaccess.
adminforSuperUseraccess.(ThisaccesslevelallowsReadWriteaccess
toallmodifiableparameters,includinguseraccounts.)
Defaults
None.
Mode
Switchcommand,readwrite.
Switchcommand,superuser.
Usage
ReadWriteuserscanchangetheirownpasswords.
SuperUsers(Admin)canchangeanypasswordonthesystem.
Ifyouforgetthepasswordfortheadminuseraccount,youcanresetthepasswordtothedefault
passwordvaluebypressingthepasswordresetbuttonontheswitch.
3-5
Examples
ThisexampleshowshowasuperuserwouldchangetheReadWritepasswordfromthesystem
default(blankstring):
C3(su)->set password rw
Please enter new password: ********
Please re-enter new password: ********
Password changed.
C3(su)->
ThisexampleshowshowauserwithReadWriteaccesswouldchangehispassword:
C3(su)->set password
Please enter old password: ********
Please enter new password: ********
Please re-enter new password: ********
Password changed.
C3(su)->
Syntax
set system password length characters
Parameters
characters
Specifiestheminimumnumberofcharactersforauseraccountpassword.
Validvaluesare0to40.
Defaults
None.
Mode
Switchcommand,superuser.
Example
Thisexampleshowshowtosettheminimumsystempasswordlengthto8characters:
C3(su)->set system password length 8
Syntax
set system password aging {days | disable}
3-6
Basic Configuration
Parameters
days
Specifiesthenumberofdaysuserpasswordswillremainvalidbefore
agingout.Validvaluesare1to365.
disable
Disablespasswordaging.
Defaults
None.
Mode
Switchcommand,superuser.
Example
Thisexampleshowshowtosetthesystempasswordagetimeto45days:
C3(su)->set system password aging 45
Syntax
set system password history size
Parameters
size
Specifiesthenumberofpasswordscheckedforduplication.Validvalues
are0to10.
Defaults
None.
Mode
Switchcommand,superuser.
Example
Thisexampleshowshowtoconfigurethesystemtocheckthelast10passwordsforduplication
C3(su)->set system password history 10
Syntax
show system lockout
3-7
Parameters
None.
Defaults
None.
Mode
Switchcommand,superuser.
Example
Thisexampleshowshowtodisplayuserlockoutsettings.Inthiscase,switchdefaultshavenot
beenchanged:
C3(su)->show system lockout
Lockout attempts: 3
Lockout time:
15 minutes.
Table 33providesanexplanationofthecommandoutput.Thesesettingsareconfiguredwiththe
setsystemlockoutcommand(setsystemlockoutonpage38).
Table 3-3
Output Field
What It Displays...
Lockout attempts
Lockout time
Number of minutes the default admin user account will be locked out after the
maximum login attempts.
Syntax
set system lockout {[attempts attempts] [time time]}
Parameters
attemptsattempts
Specifiesthenumberoffailedloginattemptsallowedbeforeareadwrite
orreadonlyusersaccountwillbedisabled.Validvaluesare1to10.
timetime
Specifiesthenumberofminutesthedefaultadminuseraccountwillbe
lockedoutafterthemaximumloginattempts.Validvaluesare0to60.
Defaults
None.
Mode
Switchcommand,superuser.
3-8
Basic Configuration
Usage
Onceauseraccountislockedout,itcanonlybereenabledbyasuperuserwiththesetsystem
logincommand(page34).
Ifthedefaultadminsuperuseraccounthasbeenlockedout,youcanwaituntilthelockouttime
hasexpiredoryoucanresettheswitchinordertoreenabletheadminaccount.
Example
Thisexampleshowshowtosetloginattemptsto5andlockouttimeto30minutes:
C3(su)->set system lockout attempts 5 time 30
Commands
For information about...
Refer to page...
show ip address
3-10
set ip address
3-11
clear ip address
3-11
show ip protocol
3-12
set ip protocol
3-12
show system
3-13
3-14
3-15
3-16
3-17
3-17
3-18
3-18
3-19
show time
3-20
set time
3-20
show summertime
3-21
set summertime
3-22
3-22
3-23
3-9
show ip address
Refer to page...
clear summertime
3-24
set prompt
3-24
3-25
3-25
3-26
show version
3-26
3-27
3-28
3-28
set width
3-29
set length
3-29
show logout
3-30
set logout
3-30
show console
3-31
3-31
show ip address
UsethiscommandtodisplaythesystemIPaddressandsubnetmask.
Syntax
show ip address
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythesystemIPaddressandsubnetmask:
C3(su)->show ip address
Name
---------------host
3-10
Basic Configuration
Address
---------------10.42.13.20
Mask
---------------255.255.0.0
set ip address
set ip address
UsethiscommandtosetthesystemIPaddress,subnetmaskanddefaultgateway.
Note: The C3 does not support the ability for a user to configure the host's gateway to be a local
routed interface IP. The host's gateway must exist on a different device in the network if one is
configured.
Syntax
set ip address ip-address [mask ip-mask] [gateway ip-gateway]
Parameters
ipaddress
SetstheIPaddressforthesystem.ForSecureStackC3systems,thisisthe
IPaddressofthemanagementswitchasdescribedinAboutSecureStack
C3SwitchOperationinaStackonpage21.
maskipmask
(Optional)Setsthesystemssubnetmask.
gatewayipgateway
(Optional)Setsthesystemsdefaultgateway(nexthopdevice).
Defaults
Ifnotspecified,ipmaskwillbesettothenaturalmaskoftheipaddressandipgatewaywillbesetto
theipaddress.
Mode
Switchcommand,readwrite.
Usage
Parametersmustbeenteredintheordershown(hostIP,thenmask,thengateway)forthe
commandtobeaccepted.
Example
ThisexampleshowshowtosetthesystemIPaddressto10.1.10.1withamaskof255.255.128.0:
C3(su)->set ip address 10.1.10.1 mask 255.255.128.0
clear ip address
UsethiscommandtoclearthesystemIPaddress.
Syntax
clear ip address
Parameters
None.
Defaults
None.
3-11
show ip protocol
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearthesystemIPaddress:
C3(rw)->clear ip address
show ip protocol
UsethiscommandtodisplaythemethodusedtoacquireanetworkIPaddressforswitch
management.
Syntax
show ip protocol
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythemethodusedtoacquireanetworkIPaddress:
C3(su)->show ip protocol
System IP address acquisition method: dhcp
set ip protocol
UsethiscommandtospecifytheprotocolusedtoacquireanetworkIPaddressforswitch
management.
Syntax
set ip protocol {bootp | dhcp | none}
Parameters
bootp
SelectsBOOTPastheprotocoltousetoacquirethesystemIPaddress.
dhcp
SelectsDHCPastheprotocoltousetoacquirethesystemIPaddress.
none
NoprotocolwillbeusedtoacquirethesystemIPaddress.
Defaults
None.
3-12
Basic Configuration
show system
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthemethodusedtoacquireanetworkIPaddresstoDHCP.
C3(su)->set ip protocol dhcp
show system
Usethiscommandtodisplaysysteminformation,includingcontactinformation,powerandfan
traystatusanduptime.
Syntax
show system
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaysysteminformation:
C3(su)->show system
System contact:
System location:
System name:
Switch 1
-------PS1-Status
---------Ok
PS2-Status
---------Not Installed and/or Not Operating
Fan1-Status
----------Ok
Fan2-Status
----------Ok
Temp-Alarm
----------off
Thermal Threshold: 58%
Temp alarm max threshold: 100%
Temp alarm trap: disabled
Temp alarm syslog: disabled
Uptime d,h:m:s
-------------0,20:36:49
Logout
------0 min
SecureStack C3 Configuration Guide
3-13
Thefollowingtableprovidesanexplanationofthecommandoutput.
Table 3-4
Output
What It Displays...
System contact
Contact person for the system. Default of a blank string can be changed with the
set system contact command (set system contact on page 3-28).
System location
Where the system is located. Default of a blank string can be changed with the
set system location command (set system location on page 3-28).
System name
Name identifying the system. Default of a blank string can be changed with the
set system name command (set system name on page 3-27).
Switch x
Indicates the switch position in the stack. When multiple switches are in a stack,
information for each switch is displayed.
PS1-Status
PS2-Status
Fanx-Status
Temp-Alarm
Indicates status of temperature alarm on, off. The status will show NA (not
available) on switches that do not support this functionality.
Thermal Threshold
Percentage of thermal threshold reached. The status will show NA (not available)
on switches that do not support this functionality.
Uptime d,h:m:s
System uptime.
Logout
Time an idle console or Telnet CLI session will remain connected before timing
out. Default of 5 minutes can be changed with the set logout command (set
logout on page 3-30).
Syntax
show system hardware
Parameters
None.
Defaults
None.
3-14
Basic Configuration
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythesystemshardwareconfiguration.Pleasenotethatthe
informationyouseedisplayedmaydifferfromthisexample.
C3(su)->show system hardware
SLOT 1 HARDWARE INFORMATION
--------------------------Model:
Serial Number:
Vendor ID:
Base MAC Address:
Hardware Version:
FirmWare Version:
Boot Code Version:
777777777777
0xbc00
00:11:88:B1:76:C0
BCM56514 REV 1
01.00.00.0052
01.00.42
Syntax
show system utilization {cpu | storage | process}
Parameters
cpu
Displayinformationabouttheprocessorrunningontheswitch.
storage
Displayinformationabouttheoverallmemoryusageontheswitch.
process
Displayinformationabouttheprocessesrunningontheswitch.
Defaults
None.
Mode
Switchcommand,readonly.
Examples
ThisexampleshowshowtodisplaythesystemsCPUutilization:
C3(ro)->show system utilization cpu
CPU Utilization Threshold Traps enable: Threshold = 80.0%
Total CPU Utilization:
Switch
CPU
5 sec
1 min
5 min
----------------------------------------------1
1
50%
49%
49%
3-15
Thisexampleshowshowtodisplaythesystemsoverallmemoryusage:
C3(ro)->show system utilization storage
Storage Utilization:
Type
Description
Size(Kb)
Available (Kb)
--------------------------------------------------------------RAM
RAM device
262144
97173
Flash
Images, Config, Other
31095
8094
Thisexampleshowshowtodisplayinformationabouttheprocessesrunningonthesystem.Only
partialoutputisshown.
C3(ro)->show system utilization process
Switch:1
CPU:1
TID
Name
5Sec
1Min
5Min
---------------------------------------------------------c157930 ipMapForwardingTask
3.60%
3.02%
3.48%
cc70000 RMONTask
0.00%
0.00%
0.00%
ccb0b60 SNMPTask
34.80%
34.06%
31.78%
d4847a0 tEmWeb
0.00%
0.03%
0.01%
d4ca360 hapiRxTask
3.20%
4.80%
5.00%
dec8600 lvl7TaskUtilMonitorTas
0.40%
0.40%
0.40%
eb74120 bcmRX
2.00%
2.91%
4.48%
eb7fbc8 bcmLINK.0
0.40%
0.22%
0.32%
f00c9a0 bcmTX
0.00%
0.33%
0.53%
f027648 bcmCNTR.0
0.00%
0.00%
0.03%
f034858 bcmL2X.0
0.00%
0.02%
0.04%
Syntax
set system utilization threshold threshold
Parameters
thresholdthreshold
Specifiesathresholdvaluein1/10ofapercent.Validrangeis1to1000.
Avalueof0disablesutilizationnotificationmessages.
Defaults
Thedefaultthresholdvalueis80%.
Mode
Switchcommand,readwrite.
Usage
ThiscommandsetsthepercentageofsystemCPUutilitizationthatwillcauseatrapnotificationto
besent.Afterthethresholdhasbeenexceeded,additionalnotificationswillbesentonceaminute
untiltheutilizationhasdroppedbackbelowthethreshold.
Example
ThisexamplesetstheCPUutilizationthresholdto75%.
3-16
Basic Configuration
Syntax
clear system utilization
Parameters
None.
Defaults
Thedefaultthresholdvalueis80%.
Mode
Switchcommand,readwrite.
Example
ThisexampleresetstheCPUutilizationthresholdtothedefault.
C3(rw)->show system utilization cpu
CPU Utilization Threshold Traps enable: Threshold = 75.0%
Total CPU Utilization:
Switch
CPU
5 sec
1 min
5 min
------------------------------------------------1
1
10%
10%
10%
C3(rw)->clear system utilization
C3(rw)->show system utilization cpu
CPU Utilization Threshold Traps enable: Threshold = 80.0%
Total CPU Utilization:
Switch
CPU
5 sec
1 min
5 min
------------------------------------------------1
1
14%
11%
10%
Syntax
show system enhancedbuffermode
Parameters
None.
3-17
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodisplayenhancedbuffermodestatus:
C3(su)->show system enhancedbuffermode enable
Optimized system buffer distribution
Disable
Syntax
set system enhancedbuffermode {enable | disable}
Parameters
enable|disable
Enablesordisablesenhancedbuffermode.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoenableenhancedbuffermode:
C3(su)->set system enhancedbuffermode enable
Changes in the enhanced buffer mode will require resetting this unit.
Are you sure you want to continue? (y/n)
Syntax
set system temperature {[syslog enable | disable] [trap enable | disable]
[overtemp-threshold value]}
3-18
Basic Configuration
Parameters
syslogenable|
disable
Enablesordisableslogginghightemperaturealertstothesystemlog
whenthesystemtransitionsintoanalarmstate.
trapenable|disable
EnablesordisablessendinghightemperaturealertsbymeansofSNMP
trapswhenthesystemtransitionsintoanalarmstate.
overtempthreshold
value
Setsthethermalthresholdasapercentageofthemaximumratedforthe
specificplatform.Valuecanrangefrom0to100%.
Defaults
Syslogalertsaredisabledbydefault.
Trapalertsaredisabledbydefault.
Overtempthresholdis100%bydefault.
Mode
Switchcommand,readwrite.
Usage
Ontheplatformsthatsupportthisfeature,temperaturesensorsarelocatedinseveraldifferent
locationswithinthedevice.Thresholdcalibrationshavebeencalculatedseparatelyforeach
platform.Thethermalovertempthresholdisthehighwatermarkthat,whenreached,triggersan
alerttowarnthesystemadministratorthatthedeviceisoperatingathightemperatures.
Whenahightemperaturealertconditionoccurs,theCPULEDonthefrontpaneloftheswitch
willflashred.Inaddition,ifenabled,asyslogmessagewillbeloggedand/oranSNMPtrapwill
besent.
Thevaluessetwiththiscommandcanbeviewedwiththeshowsystemcommand.
Example
ThefollowingexampleenablessendingSNMPtrapsandsetstheovertempthresholdto60%.
C3(su)->set system temperature trap enable overtemp-threshold 60
Syntax
clear system temperature
Parameters
None.
Defaults
None.
3-19
show time
Mode
Switchcommand,readwrite.
Usage
Thiscommandresetsallthehightemperatureparameterstotheirdefaultvalues:
Syslogalertsaredisabledbydefault.
Trapalertsaredisabledbydefault.
Overtempthresholdis100%bydefault.
Example
Thisexampleresetsallhightemperatureparameterstotheirdefaults.
C3(su)->clear system temperature
show time
Usethiscommandtodisplaythecurrenttimeofdayinthesystemclock.
Syntax
show time
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythecurrenttime.Theoutputshowsthedayoftheweek,
month,day,andthetimeofdayinhours,minutes,andsecondsandtheyear:
C3(su)->show time
THU SEP 05 09:21:57 2002
set time
Usethiscommandtochangethetimeofdayonthesystemclock.
Syntax
set time [mm/dd/yyyy] [hh:mm:ss]
3-20
Basic Configuration
show summertime
Parameters
[mm/dd/yyyy]
[hh:mm:ss]
Setsthetimein:
month,day,yearand/or
24hourformat
Atleastonesetoftimeparametersmustbeentered.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthesystemclockto7:50a.m:
C3(su)->set time 7:50:00
show summertime
Usethiscommandtodisplaydaylightsavingstimesettings.
Syntax
show summertime
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaydaylightsavingstimesettings:
C3(su)->show summertime
Summertime is disabled and set to ''
Start : SUN APR 04 02:00:00 2004
End
: SUN OCT 31 02:00:00 2004
Offset: 60 minutes (1 hours 0 minutes)
Recurring: yes, starting at 2:00 of the first Sunday of April and ending at 2:00
of the last Sunday of October
3-21
set summertime
set summertime
Usethiscommandtoenableordisablethedaylightsavingstimefunction.
Syntax
set summertime {enable | disable} [zone]
Parameters
enable|disable
Enablesordisablesthedaylightsavingstimefunction.
zone
(Optional)Appliesanametothedaylightsavingstimesettings.
Defaults
Ifazonenameisnotspecified,nonewillbeapplied.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtoenabledaylightsavingstimefunction:
C3(su)->set summertime enable
Syntax
set summertime date start_month start_date start_year start_hr_min end_month
end_date end_year end_hr_min [offset_minutes]
Parameters
start_month
Specifiesthemonthoftheyeartostartdaylightsavingstime.
start_date
Specifiesthedayofthemonthtostartdaylightsavingstime.
start_year
Specifiestheyeartostartdaylightsavingstime.
start_hr_min
Specifiesthetimeofdaytostartdaylightsavingstime.Formatishh:mm.
end_month
Specifiesthemonthoftheyeartoenddaylightsavingstime.
end_date
Specifiesthedayofthemonthtoenddaylightsavingstime.
end_year
Specifiestheyeartoenddaylightsavingstime.
end_hr_min
Specifiesthetimeofdaytoenddaylightsavingstime.Formatishh:mm.
offset_minutes
(Optional)Specifiestheamountoftimeinminutestooffsetdaylight
savingstimefromthenondaylightsavingstimesystemsetting.Valid
valuesare11440.
Defaults
Ifanoffsetisnotspecified,nonewillbeapplied.
3-22
Basic Configuration
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetadaylightsavingstimestartdateofApril4,2004at2a.m.andan
endingdateofOctober31,2004at2a.m.withanoffsettimeofonehour:
C3(su)->set summertime date April 4 2004 02:00 October 31 2004 02:00 60
Syntax
set summertime recurring start_week start_day start_month start_hr_min end_week
end_day end_month end_hr_min [offset_minutes]
Parameters
start_week
Specifiestheweekofthemonthtorestartdaylightsavingstime.Valid
valuesare:first,second,third,fourth,andlast.
start_day
Specifiesthedayoftheweektorestartdaylightsavingstime.
start_hr_min
Specifiesthetimeofdaytorestartdaylightsavingstime.Formatis
hh:mm.
end_week
Specifiestheweekofthemonthtoenddaylightsavingstime.
end_day
Specifiesthedayoftheweektoenddaylightsavingstime.
end_hr_min
Specifiesthetimeofdaytoenddaylightsavingstime.Formatishh:mm.
offset_minutes
(Optional)Specifiestheamountoftimeinminutestooffsetdaylight
savingstimefromthenondaylightsavingstimesystemsetting.Valid
valuesare11440.
Defaults
Ifanoffsetisnotspecified,nonewillbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowsetdaylightsavingstimetorecurstartingonthefirstSundayofAprilat
2a.m.andendingthelastSundayofOctoberat2a.m.withanoffsettimeofonehour:
C3(su)->set summertime recurring first Sunday April 02:00 last Sunday October
02:00 60
3-23
clear summertime
clear summertime
Usethiscommandtoclearthedaylightsavingstimeconfiguration.
Syntax
clear summertime
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearthedaylightsavingstimeconfiguration:
C3(su)->clear summertime
set prompt
Usethiscommandtomodifythecommandprompt.
Syntax
set prompt prompt_string
Parameters
prompt_string
Specifiesatextstringforthecommandprompt.
Note: A prompt string containing a space in the text must be enclosed
in quotes as shown in the example below.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthecommandprompttoSwitch1:
C3(su)->set prompt Switch 1
Switch 1(su)->
3-24
Basic Configuration
Syntax
show banner motd
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythebannermessageoftheday:
C3(rw)->show banner motd
This system belongs to XYZ Corporation.
Use of this system is strictly limited to authorized personnel.
Syntax
set banner motd message
Parameters
message
Specifiesamessageoftheday.Thisisatextstringthatneedstobein
doublequotesifanyspacesareused.Usea\nforanewlineand\tfora
tab(eightspaces).
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthemessageofthedaybannertoread:Thissystembelongsto
XYZCorporation.Useofthissystemisstrictlylimitedtoauthorizedpersonnel.
3-25
Syntax
clear banner motd
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearthemessageofthedaybannertoablankstring:
C3(rw)->clear banner motd
show version
Usethiscommandtodisplayhardwareandfirmwareinformation.RefertoDownloadinga
FirmwareImageonpage332forinstructionsonhowtodownloadafirmwareimage.
Syntax
show version
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayversioninformation.Pleasenotethatyoumayseedifferent
informationdisplayed,dependingonthetypeofhardware.
C3(su)->show version
Copyright (c) 2007 by Enterasys Networks, Inc.
3-26
Basic Configuration
Model
-------------C3G124-48P
Serial #
----------------001188021035
Versions
------------------Hw:BCM5665 REV 17
Bp:01.00.29
Fw:6.03.xx.xxxx
BuFw:03.01.13
PoE:500_3
Table 35providesanexplanationofthecommandoutput.
Table 3-5
Output Field
What It Displays...
Model
Serial #
Versions
Syntax
set system name [string]
Parameters
string
(Optional)Specifiesatextstringthatidentifiesthesystem.
Note: A name string containing a space in the text must be enclosed in
quotes as shown in the example below.
Defaults
Ifstringisnotspecified,thesystemnamewillbecleared.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthesystemnametoInformationSystems:
C3(su)->set system name Information Systems
3-27
Syntax
set system location [string]
Parameters
string
(Optional)Specifiesatextstringthatindicateswherethesystemis
located.
Note: A location string containing a space in the text must be
enclosed in quotes as shown in the example below.
Defaults
Ifstringisnotspecified,thelocationnamewillbecleared.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthesystemlocationstring:
C3(su)->set system location Bldg N32-04 Closet 9
Syntax
set system contact [string]
Parameters
string
(Optional)Specifiesatextstringthatcontainsthenameofthepersonto
contactforsystemadministration.
Note: A contact string containing a space in the text must be enclosed
in quotes as shown in the example below.
Defaults
Ifstringisnotspecified,thecontactnamewillbecleared.
Mode
Switchcommand,readwrite.
3-28
Basic Configuration
set width
Example
Thisexampleshowshowtosetthesystemcontactstring:
C3(su)->set system contact Joe Smith
set width
Usethiscommandtosetthenumberofcolumnsfortheterminalconnectedtotheswitchsconsole
port.
Syntax
set width screenwidth [default]
Parameters
screenwidth
Setsthenumberofterminalcolumns.Validvaluesare50to150.
default
(Optional)Makesthissettingpersistentforallfuturesessions(writtento
NVRAM).
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThenumberofrowsofCLIoutputdisplayedissetusingthesetlengthcommandasdescribedin
setlengthonpage329.
Example
Thisexampleshowshowtosettheterminalcolumnsto50:
C3(su)->set width 50
set length
UsethiscommandtosetthenumberoflinestheCLIwilldisplay.Thiscommandispersistent
(writtentoNVRAM).
Syntax
set length screenlength
Parameters
screenlength
SetsthenumberoflinesintheCLIdisplay.Validvaluesare0,which
disablesthescrollingscreenfeaturedescribedinDisplayingScrolling
Screensonpage19,andfrom5to512.
3-29
show logout
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosettheterminallengthto50:
C3(su)->set length 50
show logout
Usethiscommandtodisplaythetime(inseconds)anidleconsoleorTelnetCLIsessionwill
remainconnectedbeforetimingout.
Syntax
show logout
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheCLIlogoutsetting:
C3(su)->show logout
Logout currently set to: 10 minutes.
set logout
Usethiscommandtosetthetime(inminutes)anidleconsoleorTelnetCLIsessionwillremain
connectedbeforetimingout.
Syntax
set logout timeout
Parameters
timeout
Defaults
None.
3-30
Basic Configuration
Setsthenumberofminutesthesystemwillremainidlebeforetimingout.
show console
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthesystemtimeoutto10minutes:
C3(su)->set logout 10
show console
Usethiscommandtodisplayconsolesettings.
Syntax
show console [baud] [bits] [flowcontrol] [parity] [stopbits]
Parameters
baud
(Optional)Displaystheinput/outputbaudrate.
bits
(Optional)Displaysthenumberofbitspercharacter.
flowcontrol
(Optional)Displaysthetypeofflowcontrol.
parity
(Optional)Displaysthetypeofparity.
stopbits
(Optional)Displaysthenumberofstopbits.
Defaults
Ifnoparametersarespecified,allsettingswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayallconsolesettings:
C3(su)->show console
Baud
Flow
Bits
------ ------- ---9600
Disable 8
StopBits
---------1
Parity
-----none
Syntax
set console baud rate
Parameters
rate
Setstheconsolebaudrate.Validvaluesare:300,600,1200,2400,4800,5760,
9600,14400,19200,38400,and115200.
3-31
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosettheconsoleportbaudrateto19200:
C3(su)->set console baud 19200
ViaTFTPdownload.ThisprocedureusesaTFTPserverconnectedtothenetworkand
downloadsthefirmwareusingtheTFTPprotocol.FordetailsonhowtoperformaTFTP
downloadusingthecopycommand,refertocopyonpage345.Forinformationonsetting
TFTPtimeoutandretryparameters,refertosettftptimeoutonpage347andsettftp
retryonpage348.
Viatheserial(console)port.Thisprocedureisanoutofbandoperationthatcopiesthe
firmwarethroughtheserialporttotheswitch.Itshouldbeusedincaseswhenyoucannot
connecttheswitchtoperformtheinbandcopydownloadprocedureviaTFTP.Serialconsole
downloadhasbeensuccessfullytestedwiththefollowingapplications:
HyperTerminalCopyright1999
TeraTermProVersion2.3
Anyotherterminalapplicationsmayworkbutarenotexplicitlysupported.
TheC3switchallowsyoutodownloadandstoredualimages.Thebackupimagecanbe
downloadedandselectedasthestartupimagebyusingthecommandsdescribedinthissection.
Ifyouhavenotalreadydoneso,settheswitchsIPaddressusingthesetipaddresscommand
asdetailedinsetipaddressonpage311.
2.
Downloadanewimagefileusingthecopycommandasdetailedincopyonpage345.
Withtheconsoleportconnected,poweruptheswitch.Thefollowingmessagedisplays:
Version 01.00.29 05-09-2005
Computing MD5 Checksum of operational code...
Select an option. If no selection in 2 seconds then
operational code will start.
3-32
Basic Configuration
2.
Beforethebootupcompletes,type2toselectStartBootMenu.Useadministratorfor
thePassword.
Note: The Boot Menu password administrator can be changed using boot menu option 11.
Options available
1 - Start operational code
2 - Change baud rate
3 - Retrieve event log using XMODEM (64KB).
4 - Load new operational code using XMODEM
5 - Display operational code vital product data
6 - Run Flash Diagnostics
7 - Update Boot Code
8 - Delete operational code
9 - Reset the system
10 - Restore Configuration to factory defaults (delete config files)
11 - Set new Boot Code password
[Boot Menu] 2
3.
Type2.Thefollowingbaudrateselectionscreendisplays:
1
2
3
4
5
6
7
8
0
4.
1200
2400
4800
9600
19200
38400
57600
115200
no change
Type8tosettheswitchbaudrateto115200.Thefollowingmessagedisplays:
Setting baud rate to 115200, you must change your terminal baud rate.
5.
Settheterminalbaudrateto115200andpressENTER.
6.
Fromthebootmenuoptionsscreen,type4toloadnewoperationalcodeusingXMODEM.
WhentheXMODEMtransferiscomplete,thefollowingmessageandheaderinformationwill
display:
[Boot Menu] 4
Ready to receive the file with XMODEM/CRC....
Ready to RECEIVE File xcode.bin in binary mode
Send several Control-X characters to cCKCKCKCKCKCKCK
XMODEM transfer complete, checking CRC....
Verified operational code CRC.
3-33
7.
Fromthebootmenuoptionsscreen,type2todisplaythebaudrateselectionscreenagain.
8.
Type4settheswitchbaudrateto9600.Thefollowingmessagedisplays:
Setting baud rate to 9600, you must change your terminal baud rate.
9.
Settheterminalbaudrateto9600andpressENTER.
10. Fromthebootmenuoptionsscreen,type1tostartthenewoperationalcode.Thefollowing
messagedisplays:
Operational Code Date: Tue Jun 29 08:34:05 2004
Uncompressing.....
Note: You will not be able to peform these steps remotely unless you have remote console support.
1.
Saveyourrunningconfigurationwiththesaveconfigcommand.
2.
Makeacopyofthecurrentconfigurationwiththeshowconfigoutfileconfigs/filename
command.Usethedircommandtoconfirmthatthefilewascreated.
3.
Ifdesired,copythefiletoaremoteTFTPserverwiththecopycommand:
copytftp://configs/filename server_ipaddr/pathandfilename
3-34
4.
Loadyourpreviousversionofcodeonthedevice,asdescribedinDownloadingaFirmware
Image(page 332).
5.
Setthisolderversionofcodetobethebootcodewiththesetbootsystemcommand(page3
36).Whenthesystemasksifyouwanttoresetthedevice,specifyno(n).
6.
Reloadthesavedconfigurationontothedevicewiththeconfigurecommand,describedon
page344.
Basic Configuration
7.
Rebootthesystemusingtheresetcommand(page350).
Caution: If you do not follow the steps above, you may lose remote connectivity to the switch.
Commands
For information about...
Refer to page...
3-35
3-36
Syntax
show boot system
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheswitchsbootfirmwareimage:
C3(su)->show boot system
Current system image to boot: bootfile
3-35
Syntax
set boot system filename
Parameters
filename
Specifiesthenameofthefirmwareimagefile.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thiscommandallowsyoutosetthefirmwareimagetobeloadedatstartup.Youcanchooseto
resetthesystemtousethenewfirmwareimageimmediately,oryoucanchoosetoonlyspecifythe
newimagetobeloadedthenexttimetheswitchisrebooted.
YoucanusethedircommandtodisplaytheActiveimageandtheBootimage,whichwillbe
theimageloadedatthenextsystemreboot.
Note: If you are changing the firmware image to a version earlier than the current version, refer to
Reverting to a Previous Image on page 3-34 for the correct steps to follow.
Example
Thisexampleshowshowtosetthebootfirmwareimagefiletobeusedatthenextrebootofthe
system,byansweringntotheprompt.ThedircommandisthenexecutedtodisplaytheActive
andBootimages.
C3(su)->set boot system c3_06.03.03.0007
This command can optionally reset the system to boot the new image.
Do you want to reset now (y/n) [n]?n
C3(su)->dir
Images:
==================================================================
Filename:
c3_06.03.00.0026 (Active)
Version:
06.03.00.0026
Size:
9405440 (bytes)
Date:
Fri Jul 18 12:48:35 2008
CheckSum:
f1626ccf10d8f48cd6c3e79ab602342a
Compatibility: <platform specific>
Filename:
c3_06.03.03.0007 (Boot)
Version:
06.03.03.0007
Size:
8290304 (bytes)
Date:
Fri May 9 11:35:27 2008
CheckSum:
9f820d79239f10890442f8ff1f2bc914
Compatibility: <platform specific>
3-36
Basic Configuration
Commands
For information about...
Refer to page...
show telnet
3-37
set telnet
3-37
telnet
3-38
show telnet
UsethiscommandtodisplaythestatusofTelnetontheswitch.
Syntax
show telnet
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayTelnetstatus:
C3(su)->show telnet
Telnet inbound is currently: ENABLED
Telnet outbound is currently: ENABLED
set telnet
UsethiscommandtoenableordisableTelnetontheswitch.
Syntax
set telnet {enable | disable} [inbound | outbound | all]
3-37
telnet
Parameters
enable|disable
EnablesordisablesTelnetservices.
inbound|
outbound|all
(Optional)Specifiesinboundservice(theabilitytoTelnettothisswitch),
outboundservice(theabilitytoTelnettootherdevices),orall(both
inboundandoutbound).
Defaults
Ifnotspecified,bothinboundandoutboundTelnetservicewillbeenabled.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodisableinboundandoutboundTelnetservices:
C3(su)->set telnet disable all
Disconnect all telnet sessions and disable now (y/n)? [n]: y
All telnet sessions have been terminated, telnet is now disabled.
telnet
UsethiscommandtostartaTelnetconnectiontoaremotehost.TheSecureStackC3switchallows
atotaloffourinboundand/oroutboundTelnetsessiontorunsimultaneously.
Syntax
telnet host [port]
Parameters
host
SpecifiesthenameorIPaddressoftheremotehost.
port
(Optional)Specifiestheserverportnumber.
Defaults
Ifnotspecified,thedefaultportnumber23willbeused.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtostartaTelnetsessiontoahostat10.21.42.13:
C3(su)->telnet 10.21.42.13
3-38
Basic Configuration
Onastandaloneunit,theconfigurationischeckedeverytwominutesandsavediftherehas
beenachange.
Onastack,theconfigurationissavedacrossthestackevery30minutesiftherehasbeena
change.
IfyouwanttosavearunningconfigurationtoNVRAMmoreoftenthantheautomaticintervals,
executethesaveconfigcommandandwaitforthesystemprompttoreturn.Aftertheprompt
returns,theconfigurationwillbepersistent.
Youcanchangethepersistencemodefromautotomanualwiththesetsnmppersistmode
command.Ifthepersistencemodeissettomanual,configurationcommandswillnotbe
automaticallywrittentoNVRAM.Althoughtheconfigurationcommandswillactivelymodifythe
runningconfiguration,theywillnotpersistacrossaresetunlessthesaveconfigcommandhas
beenexecuted.
Note: When your device is configured for manual SNMP persistence mode, and you attempt to
change the boot system image, the device will not prompt you to save changes or warn you that
changes will be lost.
Purpose
TosetandviewthepersistencemodeforCLIconfigurationcommands,manuallysavethe
runningconfiguration,view,manage,andexecuteconfigurationfilesandimagefiles,andsetand
viewTFTPparameters.
Commands
For information about...
Refer to page...
3-40
3-40
save config
3-41
dir
3-41
show file
3-42
show config
3-43
configure
3-44
copy
3-45
delete
3-46
3-46
3-47
3-39
Refer to page...
3-47
3-48
3-48
Syntax
show snmp persistmode
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
Bydefault,themodeissettoautosave,whichautomaticallysavesconfigurationchangesat
specificintervals.Ifthemodeissettomanual,configurationcommandsareneverautomatically
saved.Inordertomakeconfigurationchangespersistentwhenthemodeismanual,thesave
configcommandmustbeissuedasdescribedinConfigurationPersistenceModeonpage339.
Example
Thisexampleshowshowtodisplaytheconfigurationpersistencemodesetting.Inthiscase,
persistencemodeissettomanual,whichmeansconfigurationchangesarenotbeing
automaticallysaved.
C3(su)->show snmp persistmode
persistmode is manual
Syntax
set snmp persistmode {auto | manual}
3-40
Basic Configuration
save config
Parameters
auto
Setstheconfigurationpersistencemodetoautomatic.Thisisthedefault
state.
manual
Setstheconfigurationpersistencemodetomanual.Inordertomake
configurationchangespersistent,thesaveconfigcommandmustbe
issuedasdescribedinsaveconfigonpage341.Thismodeisusefulfor
revertingbacktooldconfigurations.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosettheconfigurationpersistencemodetomanual:
C3(su)->set snmp persistmode manual
save config
Usethiscommandtosavetherunningconfiguration.Ifapplicable,thiscommandwillsavethe
configurationtoallswitchmembersinastack.
Syntax
save config
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosavetherunningconfiguration:
C3(su)->save config
dir
Usethiscommandtolistconfigurationandimagefilesstoredinthefilesystem.
Syntax
dir [filename]
3-41
show file
Parameters
filename
(Optional)Specifiesthefilenameordirectorytolist.
Defaults
Iffilenameisnotspecified,allfilesinthesystemwillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtolistalltheconfigurationandimagefilesinthesystem.Thedisplay
indicateswhichimagefileistheActivefileandwhichimagefileistheBootfilethatwillbeused
thenexttimethesystemreboots.
C3(su)->dir
Images:
==================================================================
Filename:
c3-series_06.03.00.0029 (Active)
Version:
06.03.00.0029
Size:
9411584 (bytes)
Date:
Fri Aug 1 06:55:23 2008
CheckSum:
6126a7aadfdf05150afb6eca51982302
Compatibility: <platform specific>
Filename:
Version:
Size:
Date:
CheckSum:
Compatibility:
c3-series_06.03.00.0030 (Boot)
06.03.00.0030
9411584 (bytes)
Fri Aug 8 08:44:04 2008
627938b785fa7fdb8eed74672af1edcc
<platform specific>
Files:
================================
configs:
base_may
base_apr
base_july
base_june
logs:
current.log
Size
========
22629
22629
20581
20581
2065
show file
Usethiscommandtodisplaythecontentsofafile.
Syntax
show file filename
Parameters
filename
3-42
Basic Configuration
Specifiesthenameofthefiletodisplay.
show config
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayatextfilenamedmyconfigintheconfigs/directory.Note
thatonlyaportionofthefileisshowninthisexample.
C3(rw)->show file configs/myconfig
...
17 : #snmp
18 :
19 : set snmp access ro security-model v1 exact read All notify All nonvolatile
20 :
21 : set snmp access ro security-model v2c exact read All notify All nonvolatile
22 :
23 : set snmp access public security-model v1 exact read All write All notify All
nonvolatile
24 :
25 : set snmp access public security-model v2c exact read All write All notify All
nonvolatile
26 :
27 : set snmp access public security-model usm exact read All write All notify All
nonvolatile
28 :
29 : set snmp community :xxxxxxxxxxx:
30 :
31 : set snmp group ro user ro security-model v1
32 :
33 : set snmp group public user public security-model v1
34 :
35 : set snmp group ro user ro security-model v2c
36 :
37 : set snmp group public user public security-model v2c
38 :
39 : set snmp group public user public security-model usm
40 :
41 : set snmp user public authentication md5 :xxxxxxxxx: encryption des privacy
:xxxxxxxxxx:
42 :
43 : set snmp view viewname All subtree 1
44 :
45 : !
show config
Usethiscommandtodisplaythesystemconfigurationorwritetheconfigurationtoafile.
Syntax
show config [all | facility] [outfile {configs/filename}]
3-43
configure
Parameters
all
(Optional)Displaysdefaultandnondefaultconfigurationsettings.
facility
(Optional)Specifiestheexactnameofonefacilityforwhichtoshow
configuration.Forexample,enterroutertoshowonlyrouter
configuration.
outfile
(Optional)Specifiesthatthecurrentconfigurationwillbewrittentoatext
fileintheconfigs/directory.
configs/filename
Specifiesafilenameintheconfigs/directorytodisplay.
Defaults
Bydefault,showconfigwilldisplayallnondefaultconfigurationinformationforallfacilities.
Mode
Switchcommand,readonly.
Usage
Theseparatefacilitiesthatcanbedisplayedbythiscommandareidentifiedinthedisplayofthe
currentconfigurationbya#precedingthefacilityname.Forexample,#portindicatesthefacility
nameport.
Examples
Thisexampleshowshowtowritethecurrentconfigurationtoafilenamedsave_config2:
C3(rw)->show config all outfile configs/save_config2
Thisexampleshowshowtodisplayconfigurationforthefacilityport.
C3(rw)->show config port
This command shows non-default configurations only.
Use 'show config all' to show both default and non-default configurations.
begin
!
#***** NON-DEFAULT CONFIGURATION *****
!
!
#port
set port jumbo disable ge.1.1
!
end
configure
Usethiscommandtoexecuteapreviouslydownloadedconfigurationfilestoredontheswitch.
Syntax
configure filename [append]
3-44
Basic Configuration
copy
Parameters
filename
Specifiesthepathandfilenameoftheconfigurationfiletoexecute.
append
(Optional)Appendstheconfigurationfilecontentstothecurrent
configuration.Thisisequivalenttotypingthecontentsoftheconfigfile
directlyintotheCLIandcanbeused,forexample,tomakeincremental
adjustmentstothecurrentconfiguration.
Defaults
Ifappendisnotspecified,thecurrentrunningconfigurationwillbereplacedwiththecontentsof
theconfigurationfile,whichwillrequireanautomatedresetofthechassis.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoexecutetheJan1_2004.cfgconfigurationfile:
C3(su)->configure configs/Jan1_2004.cfg
copy
UsethiscommandtouploadordownloadanimageoraCLIconfigurationfile.
Syntax
copy source {destination | system:image}
Parameters
source
Specifieslocationandnameofthesourcefiletocopy.Optionsarealocalfile
pathintheconfigsorlogsdirectory,ortheURLofaTFTP,SecureFTP(SFTP),
orSecureCopy(SCP)server.
destination
Specifieslocationandnameofthedestinationwherethefilewillbecopied.
Optionsarealocalfilepathintheconfigsdirectory,ortheURLofaTFTP,
SFTP,orSCPserver.
system:image
Therequireddestinationofanimagefile.
Note: Only TFTP can be used to download an image file.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
SFTPandSCPcanonlybeusedtotransferconfigurationfilesorthelogs/current.logfile.You
cannotuseSFTPorSCPtodownloadimages(system:image).
3-45
delete
Examples
ThisexampleshowshowtodownloadanimageviaTFTP:
C3(su)->copy tftp://10.1.192.34/version01000 system:image
Thisexampleshowshowtodownloadaconfigurationfiletotheconfigsdirectory:
C3(su)->copy tftp://10.1.192.1/Jan1_2004.cfg configs/Jan1_2004.cfg
ThisexampleshowshowtouploadaconfigurationfilefromtheconfigsdirectoryusingSFTP.
C3(su)->copy configs/Jan1_2009.cfg sftp://user:passwd@10.1.192.1/Jan1_2009.cfg
delete
UsethiscommandtoremoveanimageoraCLIconfigurationfilefromtheswitch.
Syntax
delete filename
Parameters
filename
Specifiesthelocalpathnametothefile.Validdirectoriesare/imagesand
/configs.44.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Usethedircommand(page341)todisplaycurrentimageandconfigurationfilenames.
Example
ThisexampleshowshowtodeletetheJan1_2004.cfgconfigurationfile:
C3(su)->delete configs/Jan1_2004.cfg
Syntax
show tftp settings
Parameters
None.
Defaults
None.
3-46
Basic Configuration
Mode
Switchcommand,readonly.
Usage
TheTFTPtimeoutvaluecanbesetwiththesettftptimeoutcommand.TheTFTPretryvaluecan
besetwiththesettftpretrycommand.
Example
Thisexampleshowstheoutputofthiscommand.
C3(ro)->show tftp settings
TFTP packet timeout (seconds): 2
TFTP max retry: 5
Syntax
set tftp timeout seconds
Parameters
seconds
Specifiesthenumberofsecondstowaitforareply.Thevalidrangeis
from1to30seconds.Defaultvalueis2seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsthetimeoutperiodto4seconds.
C3(rw)->set tftp timeout 4
Syntax
clear tftp timeout
Parameters
None.
3-47
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearthetimeoutvaluetothedefaultof2seconds.
C3(rw)-> clear tftp timeout
Syntax
set tftp retry retry
Parameters
retry
Specifiesthenumberoftimesapacketwillberesent.Thevalidrangeis
from1to1000.Defaultvalueis5retries.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetstheretrycountto3.
C3(rw)->set tftp retry 3
Syntax
clear tftp retry
Parameters
None.
Defaults
None.
3-48
Basic Configuration
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtocleartheretryvaluetothedefaultof5retries.
C3(rw)-> clear tftp retry
Commands
For information about...
Refer to page...
cls
3-49
exit
3-50
Syntax
cls
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtocleartheCLIscreen:
C3(su)->cls
3-49
exit
exit
UseeitherofthesecommandstoleaveaCLIsession.
Syntax
exit
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
Bydefault,switchtimeoutoccursafter15minutesofuserinactivity,automaticallyclosingyour
CLIsession.Usethesetlogoutcommand(page330)tochangethisdefault.
Example
ThisexampleshowshowtoexitaCLIsession:
C3(su)->exit
Commands
For information about...
Refer to page...
reset
3-50
clear config
3-51
reset
Usethiscommandtoresettheswitchwithoutlosinganyuserdefinedconfigurationsettings.
Syntax
reset [unit]
Parameters
unit
3-50
Basic Configuration
(Optional)Specifiesaunittobereset.
clear config
Defaults
IfnounitIDisspecified,theentiresystemwillbereset.
Mode
Switchcommand,readwrite.
Usage
ASecureStackC3switchcanalsoberesetwiththeRESETbuttonlocatedonitsfrontpanel.For
informationonhowtodothis,refertotheSecureStackC3InstallationGuideshippedwithyour
switch.
Examples
Thisexampleshowshowtoresetthesystem:
C3(su)->reset
Are you sure you want to reload the stack? (y/n) y
Saving Configuration to stacking members
Reloading all switches.
Thisexampleshowshowtoresetunit1:
C3(su)->reset 1
Are you sure you want to reload the switch? (y/n) y
Reloading switch 1.
This switch is manager of the stack.
STACK: detach 3 units
clear config
Usethiscommandtocleartheuserdefinedconfigurationparameters.
Syntax
clear config [all]
Parameters
all
(Optional)Clearsuserdefinedconfigurationparameters(andstackunit
numbersandpriorities,ifapplicable).
Defaults
Ifallisnotspecified,stackingconfigurationparameterswillnotbecleared.
Mode
Switchcommand,readwrite.
Usage
Whenusingtheclearconfigcommandtoclearconfigurationparametersinastack,itisimportant
torememberthefollowing:
3-51
UseclearconfigtoclearconfigurationparameterswithoutclearingstackunitIDs.This
commandWILLNOTclearstackparametersandavoidstheprocessofrenumberingthe
stack.
Useclearconfigallwhenitisnecessarytoclearallconfigurationparameters,includingstack
unitIDs(ifapplicable)andswitchpriorityvalues.
UsetheclearipaddresscommandtocleartheIPaddress.
Configurationparametersandstackinginformationcanalsobeclearedonthemasterunitonlyby
selectingoption10(restoreconfigurationtofactorydefaults)fromthebootmenuonswitch
startup.Thisselectionwillleavestackingprioritiesonallotherunits,ifapplicable.
Example
Thisexampleshowshowtoclearconfigurationparameters(includingstackingparameters,if
applicable):
C3(su)->clear config all
Commands
For information about...
show webview
3-52
set webview
3-53
show ssl
3-53
set ssl
3-54
show webview
UsethiscommandtodisplayWebViewstatus.
Syntax
show webview
Parameters
None.
3-52
Refer to page...
Basic Configuration
set webview
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayWebViewstatus:
C3(rw)->show webview
WebView is Enabled.
set webview
UsethiscommandtoenableordisableWebViewontheswitch.
Syntax
set webview {enable | disable}
Parameters
enable|disable
EnableordisableWebViewontheswitch.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ItisgoodpracticeforsecurityreasonstodisableHTTPaccessontheswitchwhenfinished
configuringwithWebView,andthentoonlyenableWebViewontheswitchwhenchangesneedto
bemade.
Example
ThisexampleshowshowtodisableWebViewontheswitch:
C3(rw)->set webview disable
show ssl
UsethiscommandtodisplaySSLstatus.
Syntax
show ssl
Parameters
None.
3-53
set ssl
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySSLstatus:
C3(rw)->show ssl
SSL status: Enabled
set ssl
UsethiscommandtoenableordisabletheuseofWebViewoverSSLport443.Bydefault,SSLis
disabledontheswitch.Thiscommandcanalsobeusedtoreinitializethehostkeythatisusedfor
encryption.
Syntax
set ssl {enabled | disabled | reinitialize | hostkey reinitialize}
Parameters
enabled|disabled
EnablesordisablestheabilitytouseWebViewoverSSL.
reinitialize
StopsandthenrestartstheSSLprocess.
hostkeyreinitialize
StopsSSL,regeneratesnewkeys,andthenrestartsSSL.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenableSSL:
C3(rw)->set ssl enabled
3-54
Basic Configuration
Command
For information about...
Refer to page...
show support
3-55
show support
Usethiscommandtodisplayswitchinformationfortroubleshooting.
Syntax
show support
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
Thiscommandinitiatesanumberofshowcommandstoeasilygatherbasicinformationfroman
installeddevice.Tousethiscommand,setyourconsoletocapturetheoutputtoafilefirst,before
executingthecommand,sincetheoutputisextensive.
Outputfromthefollowingcommandsisgatheredbythiscommand:
showversion
showloggingbuffer
showportstatus
showsystemutilizationprocess
showsystemutilizationstorage
showconfig
Example
Thereisnodisplayexamplebecausetheoutputofthiscommandisquitelengthy.
3-55
Configuring Hostprotect
Configuring Hostprotect
Purpose
ThisfeatureenablesratelimitingofhostboundtrafficonSecureStackC3switches,toassistinthe
preventionofDenialofServiceissues.Whenenabled,thehostprotectfunctionalityappliesa64
kbpsmetertocontrolplanetraffic,suchasBPDUsorLACPpackets,destinedforthehost
processor.
Commands
For information about...
Refer to page...
3-56
3-56
3-57
Syntax
show system hostprotect
Parameters
None.
Defaults
Hostprotectisenabledbydefault.
Mode
Switchcommand,readonly.
Example
Thisexampleshowstheoutputofthiscommand.
C3(rw)->show system hostprotect
hostprotect Enable
Syntax
set system hostprotect {enable | disable}
3-56
Basic Configuration
Parameters
enable
Enableshostprotectmode.
disable
Disableshostprotectmode.
Defaults
Thisfeatureisdisabledbydefault.
Mode
Switchcommand,readwrite.
Usage
Hostprotectuseshardwareresourcesthatarealsousedforpriorityqueues(seeConfiguring
PrioritytoTransmitQueueMappingonpage124),soifhostprotectisenabled,priorityqueues
arelimited.
Atboottime,ifmorethantwopriorityqueuemappingsaredefined,inadditiontothedefault
mapping,hostprotectwillbedisabled.
Atruntime,ifhostprotectifenabled,andyouattempttodefinemorethantwopriorityqueue
mappings(withthesetportpriorityqueuecommand),thesetwillfailandawarningmessage
willbedisplayed.
Atruntime,ifmorethantwopriorityqueuemappingsexist,andyouattempttoenable
hostprotectwiththiscommand,thesetwillfailandawarningmessagewillbedisplayed.
Changingthehostprotectstatusrequiresaresetoftheswitchorstackofswitches.
Example
Thisexampledisableshostprotect.
C3(rw)->set system hostprotect disable
Changes in the host protect mode will require resetting this stack.
Are you sure you want to continue? (y/n)y
Syntax
clear system hostprotect
Parameters
None.
Defaults
Thedefaultstateisenabled.
Mode
Switchcommand,readwrite.
3-57
Usage
Changingthehostprotectstatusrequiresaresetoftheswitchorstackofswitches.Ifmorethan
twopriorityqueuemappingsexistandyouexecutethiscommandtoresetthehostprotectstatus
toenabled,thecommandwillnotcompleteandyouwillgetawarningmessage.
Example
Thisexampleattemptstoreturnthehostprotectstatustothedefault,butthecommandcannot
completebecausemorethantwopriorityqueuemappingsexist.
C3(rw)->clear system hostprotect
Changes in the host protect mode will require resetting this stack.
Are you sure you want to continue? (y/n)y
Error: Could not set system host protect to default
3-58
Basic Configuration
4
Activating Licensed Features
InordertoenabletheC3advancedfeatures,suchasAdvancedRouting,youmustpurchaseand
activatealicensekey.Ifyouhavepurchasedalicense,youcanproceedtoactivateyourlicenseas
describedinthissection.Ifyouwishtoobtainapermanentorevaluationlicense,usethe
EnterasysCustomerPortalorcontacttheEnterasysNetworksSalesDepartment.
Note: All members of a stack must be licensed in order to support licensed features in a stack
environment. If the master unit in a stack has an activated license, all member units also must have
an activated license in order to operate. If the master unit in a stack does not have an activated
license, then the licensed functionality will not be available to member units, even if they have
licenses installed.
Thecontentsofthesixfields,fromtheleft,indicate:
Typethetypeoflicense.FortheSecureStackC3,thevalueinthisfieldisalways
INCREMENT.
Featuredescriptionofthefeaturebeinglicensed.Forexample,advrouterasshowninthe
characterstringabove.
Datebasedversion(DBV)adaterelatedstring.FortheSecureStackC3,thevalueinthis
fieldisnotsignificant.
Expirationtypeindicateswhetherthelicenseisapermanentoranevaluationlicense.Ifthe
licenseisanevaluationlicense,thisfieldwillcontaintheexpirationdateofthelicense.Ifthe
licenseisapermanentlicense,thisfieldwillcontainthewordpermanent.
Keythelicensekey.
HostIDtheserialnumberoftheswitchtowhichthislicenseapplies.
WhenactivatinglicensesonSecureStackdevices,werecommendthatyoucopyandpastethe
licensecharacterstring,ratherthanenteringthetextmanually.
ObtainvalidlicensesforallmembersofthestackfromtheEnterasysCustomerPortal.
4-1
2.
Optionally,notetheserialnumbersoftheswitchesinthestack.Youcanusetheshowsystem
hardwarecommand(page314)todisplaytheswitchserialnumbers.
Note: Since license keys are applied to the correct stack member switch automatically, based on
the switch serial number that is part of the license string, you should know the serial numbers of the
switches in order to enable the licenses of the member switches first, before the master unit.
3.
Enablethelicensesonthestackmembersfirst,beforeenablingthemasterunit,usingtheset
licensecommand(page43).Forexample:
C3(rw)->set license INCREMENT advrouter 2006.0127 27-jan-2011 0123456789AB
0123456789AB
4.
Enablethelicenseontheswitchmasterunitlast,usingthesetlicensecommand.
ObtainalicenseforthenewswitchfromtheEnterasysCustomerPortal.
2.
Addthenewunittothestack,followingtheprocedureinAddingaNewUnittoanExisting
Stackonpage 23.
3.
Usethesetlicensecommandtoinstallandactivatethenewswitchslicense.Thenewswitch
willthenjointhestackanditsportswillbeattached.
Alternatively,youcaninstallandactivatethenewswitchslicensefirst,beforeaddingtheswitch
tothestack.
Commands
For information about...
4-2
Refer to page...
set license
4-3
show license
4-4
clear license
4-4
set license
set license
UsethiscommandtoactivatetheSecureStackC3licensedfeatures.
Syntax
set license type feature DBV expiration key hostid
Parameters
type
Specifiesthetypeoflicense.FortheSecureStackC3,thevalueinthisfield
isalwaysINCREMENT.
feature
Thenameofthefeaturebeinglicensed.
DBV
Adaterelatedstringgeneratedaspartofthelicense.
expiration
Indicateswhetherthelicenseisapermanentoranevaluationlicense.If
thelicenseisanevaluationlicense,thisfieldwillcontaintheexpiration
dateofthelicense.Ifthelicenseisapermanentlicense,thisfieldwill
containthewordpermanent.
key
Thelicensekey.
hostid
Theserialnumberoftheswitchtowhichthislicenseapplies.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Ifmultipleswitchesareusedinastack,anindividuallicenseisrequiredforeachstackmember.
RefertoLicensingProcedureinaStackEnvironmentonpage 41formoreinformation.
Whenactivatinglicenseswiththiscommand,EnterasysNetworksrecommendsthatyoucopyand
pastetheentirelicensecharacterstring,ratherthanenterthetextmanually.Ifyouenterthe
characterstringmanually,ensurethatyouexactlymatchthecapitalizationofthecharacterstring
senttoyou.
Everylicenseisassociatedwithaspecifichardwareplatform,basedontheserialnumberofthe
hardwareplatform.Ifyouneedtomovealicensefromonehardwareplatformtoanother,you
mustcontactEnterasysCustomerSupporttoarrangeforrehostingofthelicense.
Example
Thisexampleshowshowtoactivateapermanentlicensekeyontheswitchwithserialnumber
075103099041.Inthisexample,theswitchisastandaloneunitsoitsunitnumberis1.
C3(rw)->set license INCREMENT advrouter 2008.0212 permanent DF6A8558E5AB
075103099041
Validating license on unit 1
License successfully validated and set on unit 1
C3(rw)->
4-3
show license
show license
Usethiscommandtodisplaylicensekeyinformationforswitcheswithactivatedlicenses.
Syntax
show license [unit number]
Parameters
unitnumber
(Optional)Specifiestheswitchforwhichtodisplaylicenseinformation.
RefertoChapter 2,ConfiguringSwitchesinaStack,formore
informationaboutstackunitIDs,ornumbers.
Defaults
Ifnounitnumberisspecified,licensekeyinformationforallswitchesinthestackisdisplayed.
Mode
Switchcommand,readonly.
Usage
Licensescanbedisplayed,applied,andclearedonlywiththelicensecommandsdescribedinthis
chapter.Generalconfigurationcommandssuchasshowconfigorclearconfigdonotaffect
licenses.
Example
Thisexampleshowshowtodisplaylicensekeyinformationforswitchunit1inthestack.
C3(ro)->show license unit 1
unit 1
key: INCREMENT advrouter 2006.0728 permanent 31173CAC6495 045100039001
status: Active
clear license
Usethiscommandtoclearthelicensekeysettings..
Syntax
clear license featureId feature
Parameters
featureIDfeature
Thenameofthefeaturebeingcleared.
Defaults
None.
Mode
Switchcommand,readwrite.
4-4
clear license
Example
Thisexampleshowshowtocleartheadvrouter licensedfeature:
C3(rw)->clear license featureId advrouter
4-5
clear license
4-6
5
Configuring System Power and PoE
Important Notice
The commands in this section apply only to PoE-equipped devices. Consult the Installation Guide for your
product to determine if it is PoE-equipped.
ThecommandsinthischapterallowyoutoreviewandsetsystempowerandPoE(Powerover
Ethernet)parameters,includingthepoweravailabletothesystem,theusagethresholdforeach
module,whetherornotSNMPtrapmessageswillbesentwhenpowerstatuschanges,andper
portPoEsettings.
Commands
For information about...
Refer to page...
show inlinepower
5-1
5-2
5-3
5-3
5-4
5-5
show inlinepower
Usethiscommandtodisplaysystempowerproperties.
Syntax
show inlinepower
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
5-1
Example
Thisexampleshowshowtodisplaysystempowerproperties:
C3(su)->show inlinepower
Detection Mode
: auto
Unit
---1
Status
-----auto
Power(W)
-------375
Consumption(W)
-------------0.00
Usage(%)
-------0.00
Threshold(%)
-----------80
Trap
---enable
Table 51providesanexplanationofthecommandoutput.
Table 5-1
Output
What It Displays...
Detection Mode
Displays the PD detection mode used by the switch. The detection mode can be
configured with the command set inlinepower detectionmode (page 5-3).
Unit
Status
Whether the PoE administrative state is off (disabled) or auto (on). This state is not
configurable.
Power (W)
Consumption (W)
Usage (%)
Threshold (%)
Units alloted percentage of total PoE power available in the system. The threshold
can be configured with the command set inlinepower threshold (page 5-2).
Trap
Whether PoE trap messaging is enabled or disabled on this unit. Trap messaging
can be configured with the command set inlinepower trap (page 5-3).
Syntax
set inlinepower threshold usage-threshold module-number
Parameters
usagethreshold
Specifiesapowerthresholdasapercentageofavailablesystempower.
Validvaluesare11to100.
modulenumber
Specifiesthemoduleorunitonwhichtosetthepowerthreshold.
Defaults
None.
Mode
Switchcommand,readwrite.
5-2
Usage
ThethresholdisexpressedasapercentageoftheavailablePoEpower.Whenthisthresholdis
reached,atrapwillbesentiftrapsareenabledwiththesetinlinepowertrapcommand.
Example
Thisexampleshowshowtosetthepowerthresholdto90onmodule/unit1:
C3(su)->set inlinepower threshold 90 1
Syntax
set inlinepower trap {disable | enable} module-number
Parameters
disable|enable
Disablesorenablesinlinepowertrapmessaging.
modulenumber
Specifiesthemoduleorunitonwhichtodisableorenabletrapmessaging.
Defaults
Sendingoftrapsisdisabledbydefault.
Mode
Switchcommand,readwrite.
Usage
Themodulesorunitspowerusagethresholdmustbesetusingthesetinlinepowerthreshold
commandasdescribedonpage52.
Example
Thisexampleshowshowtoenableinlinepowertrapmessagingonmodule1:
C3(su)->set inlinepower trap enable 1
Syntax
set inlinepower detectionmode {auto | ieee)
5-3
Parameters
auto
Specifiesthattheswitchwillusethestandard802.3afdetectionmethod
first.Ifthatfails,thentheswitchwillusethelegacy(pre802.3af
standard)capacitancemethodofdetection.
ieee
Specifiesthattheswitchwillonlyusethestandard802.3afdetection
method.
Defaults
Defaultdetectionmodeisauto.
Mode
Switchcommand,readwrite.
Usage
ThiscommandisusedtospecifyhowtheswitchshoulddetectPDsconnectedtoitsports.ThePoE
hardwareintheswitchescanusetheIEEEstandard802.3af(resistorbased)methodora
proprietarymethodusingcapacitordetection.
Ifautoisconfigured,theswitchwillfirstusetheIEEEresistorbaseddetectionmethod,andifthat
fails,theswitchwillusethecapacitorbaseddetectionmethod.Ifieeeisconfigured,onlytheIEEE
resistorbaseddetectionmethodwillbeused.
Example
ThisexamplesetstheswitchsPDdetectionmodetoIEEEstandard802.3afonly.
C3(su)->set inlinepower detectionmode ieee
Syntax
show port inlinepower [port-string]
Parameters
portstring
(Optional)DisplaysinformationforspecificPoEport(s).
Defaults
Ifnotspecified,informationforallPoEportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayPoEinformationforportge.2.1.Inthiscase,theports
administrativestate,PoEpriorityandclasshavenotbeenchangedfromdefaultvalues:
5-4
Type
---wireless
Admin
----auto
Oper
---searching
Priority
-------low
Class
----0
Power(W)
-------15.4
Syntax
set port inlinepower port-string {[admin {off | auto}] [priority {critical | high
| low}] [type type]}
Parameters
portstring
Specifiestheport(s)onwhichtoconfigurePoE.
adminoff|auto
SetsthePoEadministrativestatetooff(disabled)orauto(on).
prioritycritical|
high|low
Setstheport(s)priorityforthePoEallocationalgorithmtocritical
(highest),highorlow.
typetype
Specifiesastringdescribingthetypeofdeviceconnectedtoaport.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenablePoEonportge.3.1withcriticalpriority:
C3(su)->set port inlinepower ge.3.1 admin auto priority critical
5-5
5-6
6
Discovery Protocol Configuration
Thischapterdescribeshowtoconfigurediscoveryprotocols.Formoreextensiveconfiguration
information,refertotheConfiguringNeighborDiscoveryfeatureguideontheEnterasys
Networkswebsite:http://www.enterasys.com/support/manuals
For information about...
Refer to page...
Configuring CDP
6-1
6-7
6-13
Configuring CDP
Purpose
ToreviewandconfiguretheEnterasysCDPdiscoveryprotocol.Thisprotocolisusedtodiscover
networktopology.Whenenabled,thisprotocolallowsEnterasysdevicestosendperiodicPDUs
aboutthemselvestoneighboringdevices.
Commands
ThecommandsusedtoreviewandconfiguretheCDPdiscoveryprotocolarelistedbelow.
For information about...
Refer to page...
show cdp
6-2
6-3
6-4
6-4
6-5
clear cdp
6-5
show neighbors
6-6
6-1
show cdp
show cdp
UsethiscommandtodisplaythestatusoftheCDPdiscoveryprotocolandmessageintervalon
oneormoreports.
Syntax
show cdp [port-string]
Parameters
portstring
(Optional)DisplaysCDPstatusforaspecificport.Foradetaileddescription
ofpossibleportstringvalues,refertoPort String Syntax Used in the CLIon
page71.
Defaults
Ifportstringisnotspecified,allCDPinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayCDPinformationforportsge.1.1throughge.1.9:
C3(su)->show cdp ge.1.1-9
CDP Global Status
CDP Version Supported
CDP Hold Time
CDP Authentication Code
CDP Transmit Frequency
:auto-enable
:30 hex
:180
:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 hex
:60
Port
Status
----------------ge.1.1
auto-enable
ge.1.2
auto-enable
ge.1.3
auto-enable
ge.1.4
auto-enable
ge.1.5
auto-enable
ge.1.6
auto-enable
ge.1.7
auto-enable
ge.1.8
auto-enable
ge.1.9
auto-enable
Table 61providesanexplanationofthecommandoutput.
Table 6-1
6-2
Output Field
What It Displays...
CDP Versions
Supported
Minimum time interval (in seconds) at which CDP configuration messages can be
set. The default of 180 seconds can be reset with the set cdp hold-time command.
For details, refer to set cdp hold-time on page 6-5.
Table 6-1
Output Field
What It Displays...
CDP Authentication
Code
Authentication code for CDP discovery protocol. The default of 00-00-00-00-00-0000-00 can be reset using the set cdp auth command. For details, refer to set cdp
auth on page 6-4.
CDP Transmit
Frequency
Frequency (in seconds) at which CDP messages can be transmitted. The default of
60 seconds can be reset with the set cdp interval command. For details, refer to set
cdp interval on page 6-4.
Port
Status
Syntax
set cdp state {auto | disable | enable} [port-string]
Parameters
auto|disable|
enable
Autoenables,disablesorenablestheCDPprotocolonthespecifiedport(s).
Inautoenablemode,whichisthedefaultmodeforallports,aport
automaticallybecomesCDPenableduponreceivingitsfirstCDPmessage.
portstring
(Optional)EnablesordisablesCDPonspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
Defaults
Ifportstringisnotspecified,theCDPstatewillbegloballyset.
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtogloballyenableCDP:
C3(su)->set cdp state enable
ThisexampleshowshowtoenabletheCDPforportge.1.2:
C3(su)->set cdp state enable ge.1.2
ThisexampleshowshowtodisabletheCDPforportge.1.2:
C3(su)->set cdp state disable ge.1.2
6-3
Syntax
set cdp auth auth-code
Parameters
authcode
SpecifiesanauthenticationcodefortheCDPprotocol.Thiscanbeupto16
hexadecimalvaluesseparatedbycommas.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheauthenticationcodevaluedeterminesaswitchsCDPdomain.Iftwoormoreswitcheshave
thesameCDPauthenticationcode,theywillbeenteredintoeachothersCDPneighbortables.If
theyhavedifferentauthenticationcodes,theyareindifferentdomainsandwillnotbeentered
intoeachothersCDPneighbortables.
Aswitchwiththedefaultauthenticationcode(16nullcharacters)willrecognizeallswitches,no
matterwhattheirauthenticationcode,andenterthemintoitsCDPneighbortable.
Example
ThisexampleshowshowtosettheCDPauthenticationcodeto1,2,3,4,5,6,7,8:
C3(su)->set cdp auth 1,2,3,4,5,6,7,8:
Syntax
set cdp interval frequency
Parameters
frequency
SpecifiesthetransmitfrequencyofCDPmessagesinseconds.Validvalues
arefrom5to900seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
6-4
Example
ThisexampleshowshowtosettheCDPintervalfrequencyto15seconds:
C3(su)->set cdp interval 15
Syntax
set cdp hold-time hold-time
Parameters
holdtime
SpecifiestheholdtimevalueforCDPmessagesinseconds.Validvaluesare
from15to600.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetCDPholdtimeto60seconds:
C3(su)->set cdp hold-time 60
clear cdp
UsethiscommandtoresetCDPdiscoveryprotocolsettingstodefaults.
Syntax
clear cdp {[state] [port-state port-string] [interval] [hold-time] [auth-code]}
Parameters
state
(Optional)ResetstheglobalCDPstatetoautoenabled.
portstateportstring
(Optional)Resetstheportstateonspecificport(s)toautoenabled.
interval
(Optional)Resetsthemessagefrequencyintervalto60seconds.
holdtime
(Optional)Resetstheholdtimevalueto180seconds.
authcode
(Optional)Resetstheauthenticationcodeto16bytesof00(000000
0000000000).
Defaults
Atleastoneoptionalparametermustbeentered.
6-5
show neighbors
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheCDPstatetoautoenabled:
C3(su)->clear cdp state
show neighbors
ThiscommanddisplaysNeighborDiscoveryinformationforeithertheCDPorCiscoDP
protocols.
Syntax
show neighbors [port-string]
Parameters
portstring
(Optional)SpecifiestheportorportsforwhichtodisplayNeighbor
Discoveryinformation.
Defaults
Ifnoportisspecified,allNeighborDiscoveryinformationisdisplayed.
Mode
Switchcommand,readonly.
Usage
ThiscommanddisplaysinformationdiscoveredbyboththeCDPandtheCiscoDPprotocols.
Example
ThisexampledisplaysNeighborDiscoveryinformationforallports.
C3(su)->show neighbors
Port
Device ID
Port ID
Type
Network Address
-----------------------------------------------------------------------------ge.1.1
00036b8b1587
12.227.1.176
ciscodp
12.227.1.176
ge.1.6
0001f496126f
140.2.3.1
ciscodp
140.2.3.1
ge.1.6
00-01-f4-00-72-fe
140.2.4.102
cdp
140.2.4.102
ge.1.6
00-01-f4-00-70-8a
140.2.4.104
cdp
140.2.4.104
ge.1.6
00-01-f4-c5-f7-20
140.2.4.101
cdp
140.2.4.101
ge.1.6
00-01-f4-89-4f-ae
140.2.4.105
cdp
140.2.4.105
ge.1.6
00-01-f4-5f-1f-c0
140.2.1.11
cdp
140.2.1.11
ge.1.19
0001f400732e
165.32.100.10
ciscodp
165.32.100.10
6-6
Commands
ThecommandsusedtoreviewandconfiguretheCiscodiscoveryprotocolarelistedbelow.Refer
alsotoshowneighborsonpage66.
For information about...
Refer to page...
show ciscodp
6-7
6-8
6-9
6-9
6-10
6-10
clear ciscodp
6-12
show ciscodp
UsethiscommandtodisplayglobalCiscodiscoveryprotocolinformation.
Syntax
show ciscodp
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayglobalCiscoDPinformation.
C3(su)->show ciscodp
CiscoDP :Enabled
Timer :5
Holdtime (TTl): 180
SecureStack C3 Configuration Guide
6-7
Device ID : 001188554A60
Last Change : WED NOV 08 13:19:56 2006
Table 62providesanexplanationofthecommandoutput.
Table 6-2
Output Field
What It Displays...
CiscoDP
Whether Cisco DP is globally enabled or disabled. Auto indicates that Cisco DP will
be globally enabled only if Cisco DP PDUs are received.
Default setting of auto-enabled can be reset with the set ciscodp status command.
Timer
The number of seconds between Cisco discovery protocol PDU transmissions. The
default of 60 seconds can be reset with the set ciscodp timer command.
Holdtime
Number of seconds neighboring devices will hold PDU transmissions from the
sending device. Default value of 180 can be changed with the set ciscodp holdtime
command.
Device ID
Last Change
Syntax
show ciscodp port info [port-string]
Parameters
portstring
(Optional)DisplaysCiscoDPinformationforaspecificport.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
Defaults
Ifportstringisnotspecified,CiscoDPinformationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayCiscoDPinformationforGigabitEthernetport1inslot1.
C3(su)->show ciscodp port info ge.1.1
port
state
vvid
trusted
cos
---------------------------------------------ge.1.1
enable
none
yes
0
Table 63providesanexplanationofthecommandoutput.
6-8
Table 6-3
Output Field
What It Displays...
Port
State
vvid
Whether a voice VLAN ID has been set on this port. Default of none can be changed
using the set ciscodp port command.
trusted
The trust mode of the port. Default of trusted can be changed using the set ciscodp
port command.
cos
The Class of Service priority value for untrusted traffic. The default of 0 can be
changed using the set ciscodp port command.
Syntax
set ciscodp state {auto | disable | enable}
Parameters
auto
GloballyenableonlyifCiscoDPPDUsarereceived.
disable
GloballydisableCiscodiscoveryprotocol.
enable
GloballyenableCiscodiscoveryprotocol.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtogloballyenableCiscoDP:
C3(su)->set ciscodp state enable
Syntax
set ciscodp timer seconds
6-9
Parameters
seconds
SpecifiesthenumberofsecondsbetweenCiscoDPPDUtransmissions.
Validvaluesarefrom5to254seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosettheCiscoDPtimerto120seconds.
C3(su)->set ciscodp timer 120
Syntax
set ciscodp holdtime hold-time
Parameters
holdtime
SpecifiesthetimetoliveforCiscoDPPDUs.Validvaluesarefrom10to255
seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetCiscoDPholdtimeto180seconds:
C3(su)->set ciscodp hold-time 180
Syntax
set ciscodp port {[status {disable | enable}] [vvid {vlan-id | none | dot1p |
untagged}] [trusted {yes | no}] [cos value]} port-string
6-10
Parameters
status
SetstheCiscoDPportoperationalstatus.
disable
DoesnottransmitorprocessCiscoDPPDUs.
enable
TransmitsandprocessesCiscoDPPDUs.
vvid
SetstheportvoiceVLANforCiscoDPPDUtransmission.
vlanid
SpecifiestheVLANID,range14093.
none
NovoiceVLANwillbeusedinCiscoDPPDUs.Thisisthedefault.
dot1p
Instructsattachedphonetosend802.1ptaggedframes.
untagged
Instructsattachedphonetosenduntaggedframes.
trusted
Setstheextendedtrustmodeontheport.
yes
Instructsattachedphonetoallowthedeviceconnectedtoittotransmit
trafficcontaininganyCoSorLayer2802.1pmarking.Thisisthedefault
value.
no
Instructsattachedphonetooverwritethe802.1ptagoftraffic
transmittedbythedeviceconnectedtoitto0,bydefault,ortothevalue
configuredwiththecosparameter.
cosvalue
Instructsattachedphonetooverwritethe802.1ptagoftraffic
transmittedbythedeviceconnectedtoitwiththespecifiedvalue,when
thetrustmodeoftheportissettountrusted.Valuecanrangefrom0to
7,with0indicatingthelowestpriority.
portstring
Specifiestheport(s)onwhichstatuswillbeset.
Defaults
Status:enabled
VoiceVLAN:none
Trustmode:trusted
CoSvalue:0
Mode
Switchmode,readwrite.
Usage
ThefollowingpointsdescribehowtheCiscoDPextendedtrustsettingsworkontheswitch.
ACiscoDPporttruststatusoftrustedoruntrustedisonlymeaningfulwhenaCiscoIPphone
isconnectedtoaswitchportandaPCorotherdeviceisconnectedtothebackoftheCiscoIP
phone.
ACiscoDPportstateoftrustedoruntrustedonlyaffectstaggedtraffictransmittedbythe
deviceconnectedtotheCiscoIPphone.Untaggedtraffictransmittedbythedeviceconnected
totheCiscoIPphoneisunaffectedbythissetting.
IftheswitchportisconfiguredtoaCiscoDPtruststateoftrusted(withthetrustedyes
parameterofthiscommand),thissettingiscommunicatedtotheCiscoIPphoneinstructingit
toallowthedeviceconnectedtoittotransmittrafficcontaininganyCoSorLayer2802.1p
marking.
6-11
clear ciscodp
IftheswitchportisconfiguredtoaCiscoDPtruststateofuntrusted(trustedno),thissetting
iscommunicatedtotheCiscoIPphoneinstructingittooverwritethe802.1ptagoftraffic
transmittedbythedeviceconnectedtoitto0,bydefault,ortothevaluespecifiedbythecos
parameterofthiscommand.
Thereisaonetoonecorrelationbetweenthevaluesetwiththecosparameterandthe802.1p
valueassignedtoingressedtrafficbytheCiscoIPphone.Avalueof0equatestoan802.1p
priorityof0.Therefore,avalueof7isgiventhehighestpriority.
Note: The Cisco Discovery Protocol must be globally enabled using the set ciscodp status
command before operational status can be set on individual ports.
Examples
ThisexampleshowshowtosettheCiscoDPportvoiceVLANIDto3onportge.1.6andenable
theportoperationalstate.
C3(rw)->set ciscodp port status enable vvid 3 ge.1.6
ThisexampleshowshowtosettheCiscoDPextendedtrustmodetountrustedonportge.1.5and
settheCoSpriorityto1.
C3(rw)->set ciscodp port trusted no cos 1 ge.1.5
clear ciscodp
UsethiscommandtocleartheCiscodiscoveryprotocolbacktothedefaultvalues.
Syntax
clear ciscodp [status | timer | holdtime | {port {status | vvid | trust | cos}
[port-string]}]
Parameters
status
ClearsglobalCiscoDPenablestatustodefaultofauto.
timer
ClearsthetimebetweenCiscoDPPDUtransmissionstodefaultof60
seconds.
holdtime
ClearsthetimetoliveforCiscoDPPDUdatatodefaultof180seconds.
port
ClearstheCiscoDPportconfiguration.
status
Clearstheindividualportoperationalstatustothedefaultofenabled.
vvid
ClearstheindividualportvoiceVLANforCiscoDPPDUtransmission
to0.
trust
Clearsthetrustmodeconfigurationoftheporttotrusted.
cos
ClearstheCoSpriorityforuntrustedtrafficoftheportto0.
portstring
(Optional)Specifiestheport(s)onwhichstatuswillbeset.
Defaults
Ifnoparametersareentered,allCiscoDPparametersareresettothedefaultsgloballyandforall
ports.
Mode
Switchmode,readwrite.
6-12
Examples
ThisexampleshowshowtoclearalltheCiscoDPparametersbacktothedefaultsettings.
C3(rw)->clear ciscodp
ThisexampleshowshowtocleartheCiscoDPstatusonportge.1.5.
C3(rw)->clear ciscodp port status ge.1.5
AutodiscoveryofLANpolicies,suchasVLANid,802.1ppriority,andDiffServcodepoint
settings,leadingtoplugandplaynetworking
Devicelocationandtopologydiscovery,allowingcreationoflocationdatabasesand,inthe
caseofVoIP,provisionofE911services
ExtendedandautomatedpowermanagementofPoweroverEthernetendpoints
Inventorymanagement,allowingnetworkadministratorstotracktheirnetworkdevicesand
todeterminetheircharacteristics,suchasmanufacturer,softwareandhardwareversions,and
serialorassetnumbers
TheinformationsentbyanLLDPenableddeviceisextractedandtabulatedbyitspeers.The
communicationcanbedonewheninformationchangesoronaperiodicbasis.Theinformation
tabulatedisagedtoensurethatitiskeptuptodate.Portscanbeconfiguredtosendthis
information,receivethisinformation,orbothsendandreceive.
EitherLLDPorLLDPMED,butnotboth,canbeusedonaninterfacebetweentwodevices.A
switchportusesLLDPMEDwhenitdetectsthatanLLDPMEDcapabledeviceisconnectedtoit.
LLDPinformationiscontainedwithinaLinkLayerDiscoveryProtocolDataUnit(LLDPDU)sent
inasingle802.3Ethernetframe.TheinformationfieldsinLLDPDUareasequenceofshort,
variablelength,informationelementsknownasTLVstype,length,andvaluefieldswhere:
Typeidentifieswhatkindofinformationisbeingsent
Lengthindicatesthelengthoftheinformationstringinoctets
Valueistheactualinformationthatneedstobesent
TheLLDPstandardspecifiesthatcertainTLVsaremandatoryintransmittedLLDPDUs,while
othersareoptional.YoucanconfigureonaportspecificbasiswhichoptionalLLDPandLLDP
MEDTLVsshouldbesentinLLDPDUs.
Purpose
ToreviewandconfigureLLPDandLLPDMED.
6-13
Commands
ThecommandsusedtoreviewandconfiguretheCDPdiscoveryprotocolarelistedbelow.
For information about...
Refer to page...
show lldp
6-15
6-16
6-16
6-17
6-17
6-18
6-21
6-22
6-23
6-24
6-24
6-25
6-26
6-26
6-27
6-27
6-28
6-30
clear lldp
6-31
6-32
6-32
6-33
6-33
6-34
6-35
Configuration Tasks
Thecommandsincludedinthisimplementationallowyoutoperformthefollowingconfiguration
tasks:
6-14
show lldp
Step
Task
Command(s)
1.
2.
3.
4.
5.
show lldp
UsethiscommandtodisplayLLDPconfigurationinformation.
Syntax
show lldp
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayLLDPconfigurationinformation.
C3(ro)->show lldp
Message Tx Interval
Message Tx Hold Multiplier
Notification Tx Interval
MED Fast Start Count
:
:
:
:
Tx-Enabled Ports
Rx-Enabled Ports
Trap-Enabled Ports
MED Trap-Enabled Ports
30
4
5
3
6-15
Syntax
show lldp port status [port-string]
Parameters
portstring
(Optional)DisplaysLLDPstatusforoneorarangeofports.
Defaults
Ifportstringisnotspecified,LLDPstatusinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayLLDPportstatusinformationforallports.
C3(ro)->show lldp port status
Tx-Enabled Ports
Rx-Enabled Ports
Syntax
show lldp port trap [port-string]
Parameters
portstring
(Optional)Displaystheportorrangeofportsthathavebeenenabled
tosendLLDPand/orLLDPMEDnotifications.
Defaults
Ifportstringisnotspecified,LLDPporttrapinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
6-16
Example
ThisexampleshowshowtodisplayLLDPporttrapinformationforallports.
C3(ro)->show lldp port trap
Trap-Enabled Ports
:
MED Trap-Enabled Ports:
Syntax
showlldpporttxtlv[portstring]
Parameters
portstring
(Optional)DisplaysinformationaboutTLVconfigurationforoneora
rangeofports.
Defaults
Ifportstringisnotspecified,TLVconfigurationinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytransmitTLVinformationforthreeports.
C3(ro)->show lldp port tx-tlv ge.1.1-3
* Means TLV is supported and enabled on this port
o Means TLV is supported on this port
Means TLV is not supported on this port
Column Pro Id uses letter notation for enable: s-stp, l-lacp, g-gvrp
Ports
------ge.1.1
ge.1.2
ge.1.3
Port
Desc
---*
*
*
Sys
Name
---*
*
*
Sys
Desc
---*
*
*
Sys
Cap
--*
*
*
Mgmt
Addr
---*
*
*
Vlan
Id
---*
*
*
Pro
Id
---slg
slg
slg
Syntax
show lldp port location-info [port-string]
6-17
Parameters
portstring
(Optional)Displaysportlocationinformationforoneorarangeof
ports.
Defaults
Ifportstringisnotspecified,portlocationconfigurationinformationwillbedisplayedforall
ports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayportlocationinformationforthreeports.
C3(ro)->show lldp port location-info ge.1.1-3
Ports
-------ge.1.1
ge.1.2
ge.1.3
Type
------------ELIN
ELIN
ELIN
Location
------------------------1234567890
1234567890
1234567890
Syntax
show lldp port local-info [port-string]
Parameters
portstring
(Optional)Displayslocalsysteminformationforoneorarangeof
ports.
Defaults
Ifportstringisnotspecified,localsysteminformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythelocalsysteminformationstoredforportge.4.1.Table 64
describestheoutputfieldsofthiscommand.
C3(rw)->show lldp port local-info ge.4.1
Local Port : ge.4.1
Local Port Id: ge.4.1
-------------------Port Desc
: ... 1000BASE-TX RJ45 Gigabit Ethernet Frontpanel Port
6-18
Mgmt Addr
: 10.21.64.100
Chassis ID : 00-E0-63-93-74-A5
Sys Name
: LLDP PoE test Chassis
Sys Desc
: Enterasys Networks, Inc.
Sys Cap Supported/Enabled
: bridge,router/bridge
Auto-Neg Supported/Enabled
Auto-Neg Advertised
: yes/yes
: 10BASE-T, 10BASE-TFD,
100BASE-TX, 100BASE-TXFD,
1000BASE-TFD,
Bpause
Operational Speed/Duplex/Type : 100 full tx
Max Frame Size (bytes)
: 1522
Vlan Id
: 1
LAG Supported/Enabled/Id
: no/no/0
Protocol Id : Spanning Tree v-3 (IEEE802.1s)
LACP v-1
GVRP
Network Policy
(app/tag/vlanId/cos/dscp)
: voice/tagged/10/3/5
voice signaling/tagged/10/3/5
guest voice/tagged/10/3/5
guest voice signaling/tagged/10/3/5
softphone voice/tagged/10/3/5
video conferencing/tagged/10/3/5
streaming video/tagged/10/3/5
video signaling/tagged/10/3/5
: 1234567890123456789012345
ECS ELIN
PoE
PoE
PoE
PoE
PoE
PoE
PoE
Device
Power Source
MDI Supported/Enabled
Pair Controllable/Used
Power Class
Power Limit (mW)
Power Priority
:
:
:
:
:
:
:
PSE device
primary
yes/yes
false/spare
2
15400
high
Table 64describestheinformationdisplayedbytheshowlldpportlocalinfocommand.
Table 6-4
Output Field
What it Displays...
Local Port
Local Port Id
Mandatory basic LLDP TLV that identifies the port transmitting the
LLDPDU. Value is ifName object defined in RFC 2863.
Port Desc
Optional basic LLDP TLV. Value is ifDescr object defined in RFC 2863.
Mgmt Addr
Chassis ID
Mandatory basic LLDP TLV that identifies the chassis transmitting the
LLDPDU. Value is MAC address of chassis.
Sys Name
Optional basic LLDP TLV. Value is the administratively assigned name for
the system.
Sys Desc
Optional basic LLDP TLV. Value is sysDescr object defined in RFC 3418.
Optional basic LLDP TLV. System capabilities, value can be bridge and/or
router.
6-19
Table 6-4
6-20
Output Field
What it Displays...
Auto-Neg Supported/Enabled
IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Autonegotiation supported and enabled settings should be the same on the
two systems attached to the same link.
Auto-Neg Advertised
Operational Speed/Duplex/
Type
Vlan Id
IEEE 802.1 Extensions Port VLAN ID TLV. Value is port VLAN ID (pvid).
LAG Supported/Enabled/Id
IEEE 802.3 Extensions Link Aggregation TLV. Values indicate whether the
link associated with this port can be aggregated, whether it is currently
aggregated, and if aggregated, the aggregated port identifier.
Protocol Id
Network Policy
(app/tag/vlanId/cos/dscp)
ECS ELIN
PoE Device
IEEE 802.3 Extensions Power via MDI TLV. Displayed only when a port
has PoE capabilities. Indicates whether sending the Power via MDI TLV is
supported/enabled. Value can be yes or no.
IEEE 802.3 Extensions Power via MDI TLV. Displayed only when a port
has PoE capabilities. Indicates whether pair selection can be controlled on
the given port (refer to RFC 3621). Value for Controllable can be true or
false. Value of Used can be signal (signal pairs only are in use) or spare
(spare pairs only are in use).
IEEE 802.3 Extensions Power via MDI TLV. Displayed only when a port
has PoE capabilities. Indicates the power class supplied by the port. Value
can range from 0 to 4.
Table 6-4
Output Field
What it Displays...
Syntax
show lldp port remote-info [port-string]
Parameters
portstring
(Optional)Displaysremotesysteminformationforoneorarangeof
ports.
Defaults
Ifportstringisnotspecified,remotesysteminformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheremotesysteminformationstoredforportge.3.1.The
remotesysteminformationwasreceivedfromanIPphone,whichisanLLDPMEDenabled
device.Table 65describestheoutputfieldsthatareuniquetotheremotesysteminformation
displayedforaMEDenableddevice.
C3(ro)->show lldp port remote-info ge.3.1
Local Port : ge.3.1
Remote Port Id : 00-09-6e-0e-14-3d
--------------------Mgmt Addr
: 0.0.0.0
Chassis ID : 0.0.0.0
Device Type : Communication Device Endpoint (class III)
Sys Name
: AVE0E143D
Sys Cap Supported/Enabled
: bridge,telephone/bridge
Auto-Neg Supported/Enabled
Auto-Neg Advertised
:
:
:
:
yes/yes
10BASE-T, 10BASE-TFD
100BASE-TX, 100BASE-TXFD
pause, Spause
: voice/untagged/0/6/46
6-21
Hardware Revision
Firmware Revision
Software Revision
Serial Number
Manufacturer
Model Number
:
:
:
:
:
:
4610D01A
b10d01b2_7.bin
a10d01b2_7.bin
05GM42004348
Avaya
4610
Notethattheinformationfieldsdisplayedbytheshowlldpportremoteinfocommandwillvary,
dependingonthetypeofremotedevicethatisconnectedtotheport.
Table 65describestheoutputfieldsthatareuniquetotheremotesysteminformationdatabase.
RefertoTable 64onpage 19fordescriptionsoftheinformationfieldsthatarecommontoboththe
localandtheremotesysteminformationdatabases.
Table 6-5
Output Field
What it Displays...
Remote Port Id
Displays whatever port Id information received in the LLDPDU from the remote
device. In this case, the port Id is MAC address of remote device.
Device Type
Hardware Revision
Firmware Revision
Software Revision
Serial Number
Manufacturer
Model Number
Asset ID
Syntax
show lldp port network-policy {all | voice | voice-signaling | guest-voice | guestvoice-signaling | softphone-voice | video-conferencing | streaming-video | videosignaling} [port-string]
Parameters
6-22
all
Displaysinformationaboutallnetworkpolicyapplications.
voice
Displaysinformationaboutonlythevoiceapplicationtype.
voicesignaling
Displaysinformationaboutonlythevoicesignalingapplication
type.
guestvoice
Displaysinformationaboutonlytheguestvoiceapplicationtype.
guestvoicesignaling
Displaysinformationaboutonlytheguestvoicesignaling
applicationtype.
softphonevoice
Displaysinformationaboutonlythesoftphonevoiceapplication
type.
videoconferencing
Displaysinformationaboutonlythevideoconferencing
applicationtype.
streamingvideo
Displaysinformationaboutonlythestreamingvideoapplication
type.
videosignaling
Displaysinformationaboutonlythevideosignalingapplication
type.
portstring
(Optional)DisplaysinformationaboutLLDPnetworkpolicyfor
oneorarangeofports.
Defaults
Ifportstringisnotspecified,onlynondefaultvalueswillbedisplayedforallportsthathavenon
defaultvaluesconfigured.
Ifaportstringisspecified,thenallvalues,defaultandnondefault,aredisplayedforthespecified
ports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayallLLDPnetworkpolicyinformationforge.1.1.
C3(ro)->show lldp port network-policy all ge.1.1
Ports
------ge.1.1
Application
--------------------voice
voice signaling
guest voice
guest voice signaling
softphone voice
video conferencing
streaming video
video signaling
State
-------enabled
enabled
enabled
enabled
enabled
enabled
enabled
enabled
Tag
-------untagged
untagged
untagged
untagged
untagged
untagged
untagged
untagged
Vlan-Id
------1
1
1
1
1
1
1
1
Cos
--0
0
0
0
0
0
0
0
Dscp
--0
0
0
0
0
0
0
0
Syntax
set lldp tx-interval frequency
Parameters
frequency
SpecifiesthenumberofsecondsbetweentransmissionsofLLDP
frames.Valuecanrangefrom5to32,768seconds.Thedefaultis30
seconds.
6-23
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsthetransmitintervalto20seconds.
C3(rw)->set lldp tx-interval 20
Syntax
set lldp hold-multiplier multiplier-val
Parameters
multiplierval
Specifiesthemultipliertoapplytothetransmitintervaltodetermine
thetimetolivevalue.Valuecanrangefrom2to10.Defaultvalueis4.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsthetransmitintervalto20secondsandtheholdmultiplierto5,whichwill
configureatimetoliveof100tobeusedintheTTLfieldintheLLDPDUheader.
C3(rw)->set lldp tx-interval 20
C3(rw)->set lldp hold-multiplier 5
Syntax
set lldp trap-interval frequency
6-24
Parameters
frequency
SpecifiestheminimumtimebetweenLLDPtraptransmissions,in
seconds.Thevaluecanrangefrom5to3600seconds.Thedefault
valueis5seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexamplesetstheminimumintervalbetweenLLDPtrapsto10seconds.
C3(rw)->set lldp trap-interval 10
Syntax
set lldp med-fast-repeat count
Parameters
count
SpecifiesthenumberoffaststartLLDPDUstobesentwhenan
LLDPMEDendpointdeviceisdetected.Valuecanrangefrom1to
10.Defaultis3.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexamplesetsthenumberoffaststartLLDPDUstobesentto4.
C3(rw)->set lldp med-fast-repeat 4
6-25
Syntax
set lldp port status {tx-enable | rx-enable | both | disable} port-string
Parameters
txenable
EnablestransmittingLLDPDUsonthespecifiedports.
rxenable
EnablesreceivingandprocessingLLDPDUsfromremotesystemson
thespecifiedports.
both
EnablesbothtransmittingandprocessingreceivedLLDPDUsonthe
specifiedports.
disable
DisablesbothtransmittingandprocessingreceivedLLDPDUsonthe
specifiedports.
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleenablesbothtransmittingLLDPDUsandreceivingandprocessingLLDPDUsfrom
remotesystemsonportsge.1.1throughge.1.6.
C3(rw)->set lldp port status both ge.1.1-6
Syntax
set lldp port trap {enable | disable} port-string
Parameters
enable
EnabletransmittingLLDPtrapsonthespecifiedports.
disable
DisabletransmittingLLDPtrapsonthespecifiedports.
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
6-26
Mode
Switchcommand,readwrite.
Example
ThisexampleenablestransmittingLLDPtrapsonportsge.1.1throughge.1.6.
C3(rw)->set lldp port trap enable ge.1.1-6
Syntax
set lldp port med-trap {enable | disable} port-string
Parameters
enable
EnablestransmittingLLDPMEDtrapsonthespecifiedports.
disable
DisablestransmittingLLDPMEDtrapsonthespecifiedports.
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleenablestransmittingLLDPMEDtrapsonportsge.1.1throughge.1.6.
C3(rw)->set lldp port med-trap enable ge.1.1-6
Syntax
set lldp port location-info elin elin-string port-string
Parameters
elin
SpecifiesthattheECSELINdataformatistobeused.
elinstring
Specifiesthelocationidentifier.Valuecanbefrom10to25numerical
characters.
portstring
Specifiestheportorrangeofportstobeaffected.
6-27
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Afteryouconfigurealocationinformationvalue,youmustalsoconfiguretheporttosendthe
LocationInformationTLVwiththesetlldpporttxtlvcommand.Thisexampleconfiguresthe
ELINidentifier5551234567onportsge.1.1throughge.1.6andthenconfigurestheportstosend
theLocationInformationTLV.
C3(rw)->set lldp port location-info 5551234567 ge.1.1-6
C3(rw)->set lldp port tx-tlv med-loc ge.1.1-6
Syntax
set lldp port tx-tlv {[all] | [port-desc] [sys-name] [sys-desc] [sys-cap] [mgmtaddr] [vlan-id] [stp] [lacp] [gvrp] [mac-phy] [poe] [link-aggr] [max-frame] [medcap] [med-pol] [med-loc] [med-poe]} port-string
Parameters
6-28
all
AddsalloptionalTLVstotransmittedLLDPDUs.
portdesc
PortDescriptionoptionalbasicLLDPTLV.ValuesentisifDescrobject
definedinRFC2863.
sysname
SystemNameoptionalbasicLLDPTLV.Valuesentisthe
administrativelyassignednameforthesystem.
sysdesc
SystemDescriptionoptionalbasicLLDPTLV.ValuesentissysDescr
objectdefinedinRFC3418.
syscap
SystemCapabilitiesoptionalbasicLLDPTLV.Foranetwork
connectivitydevice,valuesentcanbebridgeand/orrouter.
mgmtaddr
ManagementAddressoptionalbasicLLDPTLV.ValuesentisIPv4
addressofhostinterface.
vlanid
PortVLANIDIEEE802.1ExtensionsTLV.ValuesentisportVLAN
ID(PVID).
stp
SpanningTreeinformationdefinedbyProtocolIdentityIEEE802.1
ExtensionsTLV.IfSTPisenabledontheport,valuesentincludes
versionofprotocolbeingused.
lacp
LACPinformationdefinedbyProtocolIdentityIEEE802.1
ExtensionsTLV.IfLACPisenabledontheport,valuesentincludes
versionofprotocolbeingused.
gvrp
GVRPinformationdefinedbyProtocolIdentityIEEE802.1
ExtensionsTLV.IfLACPisenabledontheport,valuesentincludes
versionofprotocolbeingused.
macphy
MACPHYConfiguration/StatusIEEE802.3ExtensionsTLV.Value
sentincludestheoperationalMAUtype,duplex,andspeedofthe
port.
poe
PowerviaMDIIEEE802.3ExtensionsTLV.Valuessentinclude
whetherpairselectioncanbecontrolledonport,andthepowerclass
suppliedbytheport.OnlyvalidforPoEenabledports.
linkaggr
LinkAggregationIEEE802.3ExtensionsTLV.Valuessentindicate
whetherthelinkassociatedwiththisportcanbeaggregated,
whetheritiscurrentlyaggregated,andifaggregated,theaggregated
portidentifier.
maxframe
MaximumFrameSizeIEEE802.3ExtensionsTLV.Valuesent
indicatesmaximumframesizeoftheportsMACandPHY.
medcap
LLDPMEDCapabilitiesTLV.Valuesentindicatesthecapabilities
(whetherthedevicesupportslocationinformation,networkpolicy,
extendedpowerviaMDI)andDeviceType(networkconnectivity
device)ofthesendingdevice.
medpol
LLDPMEDNetworkPolicyTLV.Valuessentincludeapplication
name,VLANtype(taggedoruntagged),VLANID,andbothLayer2
andLayer3prioritiesassociatedwithapplication,forallapplications
enabledontheport.Seethesetlldpportnetworkpolicycommand
formoreinformation.
medloc
LLDPMEDLocationIdentificationTLV.ValuesentistheECSELIN
valueconfiguredontheport.Seethesetlldpportlocationinfo
commandformoreinformation.
medpoe
LLDPMEDExtendedPowerviaMDITLV.Valuessentincludethe
PowerLimit(totalpowertheportiscapableofsourcingovera
maximumlengthcable)andthepowerpriorityconfiguredonthe
port.OnlyvalidforPoEenabledports.
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleconfiguresthemanagementaddress,MEDcapability,MEDnetworkpolicy,and
MEDlocationidentificationTLVstobesentinLLDPDUsbyportge.1.1.
C3(rw)->set lldp port tx-tlv mgmt-addr med-cap med-pol med-loc ge.1.1
6-29
Syntax
set lldp port network-policy {all | voice | voice-signaling | guest-voice |
guest-voice-signaling | softphone-voice | video-conferencing | streaming-video |
video-signaling} [state {enable | disable}] [tag {tagged | untagged}]
[vid {vlan-id | dot1p}] [cos cos-value] [dscp dscp-value] port-string
Parameters
all
Configuresallapplications.
voice
Configuresthevoiceapplication.
voicesignaling
Configuresthevoicesignalingapplication.
Thisapplicationwillnotbeadvertisedifthevoiceapplicationis
configuredwiththesameparameters.
guestvoice
Configurestheguestvoiceapplication.
guestvoicesignaling
Configurestheguestvoicesignalingapplication.
Thisapplicationwillnotbeadvertisediftheguestvoice
applicationisconfiguredwiththesameparameters.
softphonevoice
Configuresthesoftphonevoiceapplication.
videoconferencing
Configuresthevideoconferencingapplication.
streamingvideo
Configuresthestreamingvideoapplication.
videosignaling
Configuresthevideosignalingapplication.
Thisapplicationwillnotbeadvertisedifthevideoconferencing
applicationisconfiguredwiththesameparameters.
stateenable|disable
(Optional)Enablesordisablesadvertisingtheapplication
informationbeingconfigured.
tagtagged|untagged
(Optional)Indicateswhethertheapplicationbeingconfiguredis
usingataggedoruntaggedVLAN.Ifuntagged,boththeVLANID
andtheCoSpriorityfieldsareignoredandonlytheDSCPvalue
hasrelevance.
vidvlanid|dot1p
(Optional)VLANidentifierfortheport.Thevalueofvlanidcan
rangefrom1to4093.
Usedot1pifthedeviceisusingprioritytaggedframes,meaning
thatonlytheIEEE802.1Dprioritylevelissignificantandthe
defaultPVIDoftheingressportisused.
6-30
coscosvalue
(Optional)SpecifiestheLayer2prioritytobeusedforthe
applicationbeingconfigured.Thevaluecanrangefrom0to7.A
valueof0representsuseofthedefaultpriorityasdefinedinIEEE
802.1D.
dscpdscpvalue
(Optional)SpecifiestheDSCPvaluetobeusedtoprovideDiffserv
nodebehaviorfortheapplicationbeingconfigured.Thevaluecan
rangefrom0to63.Avalueof0representsuseofthedefaultDSCP
valueasdefinedinRFC2475.
clear lldp
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThisfeatureallowsadministratorstoquicklyprovisionLLDPendpointsviatheswitch.LLDP
clientswillusetheseLLDPnetworkpolicyparametersfortrafficoriginatingfromtheendpoint.
AsdescribedintheANSI/TIAStandardsdocument1057,theNetworkPolicyTLVisintendedfor
usewithapplicationsthathavespecificrealtimenetworkpolicyrequirements,suchasinteractive
voiceand/orvideoservicesandshouldbeimplementedonlyondirectlinksbetweennetwork
connectivitydevicesandendpointdevices.RefertotheANSI/TIAStandardsdocument1057for
descriptionsoftheapplicationtypes.
AfteryouconfigureNetworkPolicyTLVs,youmustalsoconfiguretheporttosendtheNetwork
PolicyTLVwiththesetlldpporttxtlvcommand.
Example
ThisexampleconfiguresthevoiceapplicationTLVonportge.2.1andthenconfigurestheportto
sendtheNetworkPolicyTLV.
C3(rw)->set lldp port network-policy voice state enable tag tagged vlan dot1p
ge.2.1
C3(rw)->set lldp port tx-tlv med-pol ge.2.1
clear lldp
UsethiscommandtoreturnLLDPparameterstotheirdefaultvalues.
Syntax
clear lldp {all | tx-interval | hold-multiplier | trap-interval | med-fast-repeat}
Parameters
all
ReturnsallLLDPconfigurationparameterstotheirdefaultvalues,
includingportLLDPconfigurationparameters.
txinterval
ReturnsthenumberofsecondsbetweentransmissionsofLLDP
frames.tothedefaultof30seconds.
holdmultiplier
Returnsthemultipliertoapplytothetransmitintervaltodetermine
thetimetolivevaluetothedefaultvalueof4.
trapinterval
ReturnstheminimumtimebetweenLLSPtraptransmissionstothe
defaultvalueof5seconds.
medfastrepeat
ReturnsthenumberoffaststartLLDPDUstobesentwhenanLLDP
MEDendpointdeviceisdetectedtothedefaultof3.
6-31
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplereturnsthetransmitintervaltothedefaultvalueof30seconds.
C3(rw)->clear lldp tx-interval
Syntax
clear lldp port status port-string
Parameters
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplereturnsportge.1.1tothedefaultstateofenabledforbothtransmittingand
processingreceivedLLDPDUs.
C3(rw)->clear lldp port status ge.1.1
Syntax
clear lldp port trap port-string
Parameters
portstring
Defaults
None.
6-32
Specifiestheportorrangeofportstobeaffected.
Mode
Switchcommand,readwrite.
Example
Thisexamplereturnsportge.1.1tothedefaultLLDPtrapstateofdisabled.
C3(rw)->clear lldp port trap ge.1.1
Syntax
clear lldp port med-trap port-string
Parameters
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplereturnsportge.1.1tothedefaultLLDPMEDtrapstateofdisabled.
C3(rw)->clear lldp port med-trap ge.1.1
Syntax
clear lldp port location-info elin port-string
Parameters
elin
SpecifiesthattheECSELINlocationinformationvalueshouldbe
cleared.
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
6-33
Example
ThisexamplereturnsthelocationinformationELINvalueonportge.1.1tothedefaultvalueof
null.
C3(rw)->clear lldp port location-info elin ge.1.1
Syntax
clear lldp port network-policy {all | voice | voice-signaling | guest-voice |
guest-voice-signaling | softphone-voice | video-conferencing | streaming-video |
video-signaling} {[state] [tag] [vid] [cos] [dscp]} port-string
Parameters
all
Appliescommandtoallapplications.
voice
Appliescommandtothevoiceapplication.
voicesignaling
Appliescommandtothevoicesignalingapplication.
guestvoice
Appliescommandtotheguestvoiceapplication.
guestvoicesignaling
Appliescommandtotheguestvoicesignalingapplication.
softphonevoice
Appliescommandtothesoftphonevoiceapplication.
videoconferencing
Appliescommandtothevideoconferencingapplication.
streamingvideo
Appliescommandtothestreamingvideoapplication.
videosignaling
Appliescommandtothevideosignalingapplication.
state
(Optional)Clearsthestateofadvertisingtheapplication
informationbeingconfiguredtodisabled.
tag
(Optional)Clearsthetagvalueoftheapplicationbeingconfigured
tountagged.
vid
(Optional)ClearstheVLANidentifierfortheporttothedefault
valueof1.
cos
(Optional)ClearstheLayer2prioritytobeusedfortheapplication
beingconfiguredtothedefaultvalueof0.(Avalueof0represents
useofthedefaultpriorityasdefinedinIEEE802.1D.)
dscp
(Optional)ClearstheDSCPvaluetobeusedtoprovideDiffserv
nodebehaviorfortheapplicationbeingconfiguredtothedefault
valueof0.(Avalueof0representsuseofthedefaultDSCPvalue
asdefinedinRFC2475.)
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
Atleastoneapplication(orall)andonepolicyparametermustbespecified.
Mode
Switchcommand,readwrite.
6-34
Example
Thisexamplereturnsallnetworkpolicyvaluesforallapplicationsonportge.1.1totheirdefault
values.
C3(rw)->clear lldp port network-policy all state tag vid cos dscp ge.1.1
Syntax
clear lldp port tx-tlv {[all] | [port-desc] [sys-name] [sys-desc] [sys-cap] [mgmtaddr] [vlan-id] [stp] [lacp] [gvrp] [mac-phy] [poe] [link-aggr] [max-frame] [medcap] [med-pol] [med-loc] [med-poe]} port-string
Parameters
all
DisablesalloptionalTLVsfrombeingtransmittedinLLDPDUs.
portdesc
DisablesthePortDescriptionoptionalbasicLLDPTLVfrombeing
transmittedinLLDPDUs.
sysname
DisablestheSystemNameoptionalbasicLLDPTLVfrombeing
transmittedinLLDPDUs.
sysdesc
DisablestheSystemDescriptionoptionalbasicLLDPTLVfrombeing
transmittedinLLDPDUs.
syscap
DisablestheSystemCapabilitiesoptionalbasicLLDPTLVfrom
beingtransmittedinLLDPDUs.
mgmtaddr
DisablestheManagementAddressoptionalbasicLLDPTLVfrom
beingtransmittedinLLDPDUs.
vlanid
DisablesthePortVLANIDIEEE802.1ExtensionsTLVfrombeing
transmittedinLLDPDUs.
stp
DisablestheSpanningTreeinformationdefinedbyProtocolIdentity
IEEE802.1ExtensionsTLVfrombeingtransmittedinLLDPDUs.
lacp
DisablestheLACPinformationdefinedbyProtocolIdentityIEEE
802.1ExtensionsTLVfrombeingtransmittedinLLDPDUs.
gvrp
DisablestheGVRPinformationdefinedbyProtocolIdentityIEEE
802.1ExtensionsTLVfrombeingtransmittedinLLDPDUs.
macphy
DisablestheMACPHYConfiguration/StatusIEEE802.3Extensions
TLVfrombeingtransmittedinLLDPDUs.
poe
DisablesthePowerviaMDIIEEE802.3ExtensionsTLVfrombeing
transmittedinLLDPDUs.OnlyvalidforPoEenabledports.
linkaggr
DisablestheLinkAggregationIEEE802.3ExtensionsTLVfrombeing
transmittedinLLDPDUs.
maxframe
DisablestheMaximumFrameSizeIEEE802.3ExtensionsTLVfrom
beingtransmittedinLLDPDUs.
medcap
DisablestheLLDPMEDCapabilitiesTLVfrombeingtransmittedin
LLDPDUs.
6-35
medpol
DisablestheLLDPMEDNetworkPolicyTLVfrombeingtransmitted
inLLDPDUs.
medloc
DisablestheLLDPMEDLocationIdentificationTLVfrombeing
transmittedinLLDPDUs.
medpoe
DisablestheLLDPMEDExtendedPowerviaMDITLVfrombeing
transmittedinLLDPDUs.OnlyvalidforPoEenabledports.
portstring
Specifiestheportorrangeofportstobeaffected.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledisablesthemanagementaddress,MEDcapability,MEDnetworkpolicy,andMED
locationidentificationTLVsfrombeingsentinLLDPDUsbyportge.1.1.
C3(rw)->clear lldp port tx-tlv mgmt-addr med-cap med-pol med-loc ge.1.1
6-36
7
Port Configuration
ThischapterdescribesthePortConfigurationsetofcommandsandhowtousethem.
For information about...
Refer to page...
7-1
7-2
7-7
7-11
7-14
7-16
7-22
7-24
7-33
Port Mirroring
7-36
7-42
7-56
7-1
Whereportnumberdependsonthedevice.Thehighestvalidportnumberisdependentonthe
numberofportsinthedeviceandtheporttype.
Examples
Note: You can use a wildcard (*) to indicate all of an item. For example, fe.3.* would represent all
100Mbps Ethernet (fe) ports in slot 3, and ge.3 * would represent all 1-Gigabit Ethernet (ge) ports
in slot 3.
Thisexampleshowstheportstringsyntaxforspecifyingthe1GigabitEthernetport14inslotunit
3.
ge.3.14
Thisexampleshowstheportstringsyntaxforspecifyingall1GigabitEthernetportsinslotunit3
inthesystem.
ge.3.*
Thisexampleshowstheportstringsyntaxforspecifyingallports(ofanyinterfacetype)inthe
system.
*.*.*
Commands
For information about...
7-2
Refer to page...
show port
7-3
7-3
7-4
7-6
7-6
Port Configuration
show port
show port
Usethiscommandtodisplaywhetherornotoneormoreportsareenabledforswitching.
Syntax
show port [port-string]
Parameters
portstring
(Optional)Displaysoperationalstatusforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
Defaults
Ifportstringisnotspecified,operationalstatusinformationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayoperationalstatusinformationforge.3.14:
C3(su)->show port ge.3.14
Port ge.3.14 enabled
Syntax
show port status [port-string]
Parameters
portstring
(Optional)Displaysstatusforspecificport(s).Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLIon
page71.
Defaults
Ifportstringisnotspecified,statusinformationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaystatusinformationforge.3.14:
C3(su)->show port status ge.3.14
Port
Alias
Oper
Admin
Speed
Duplex
Type
7-3
-----------ge.3.14
(truncated)
--------------
Status
------up
Status
------up
Table 71providesanexplanationofthecommandoutput.
Table 7-1
Output Field
What It Displays...
Port
Alias (truncated)
Alias configured for the port. For details on using the set port alias command, refer
to set port alias on page 7-9.
Oper Status
Admin Status
Whether the specified port is enabled (up) or disabled (down). For details on using
the set port disable command to change the default port status of enabled, refer to
set port disable on page 7-8. For details on using the set port enable command to
re-enable ports, refer to set port enable on page 7-8.
Speed
Operational speed in Mbps or Kbps of the specified port. For details on using the set
port speed command to change defaults, refer to set port speed on page 7-12.
Duplex
Duplex mode (half or full) of the specified port. For details on using the set port
duplex command to change defaults, refer to Setting Auto-Negotiation and
Advertised Ability on page 7-16.
Type
Syntax
show port counters [port-string] [switch | mib2]
Parameters
portstring
(Optional)Displayscounterstatisticsforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
switch|mib2
(Optional)DisplaysswitchorMIB2statistics.Switchstatisticsdetail
performanceoftheSecureStackC3device.MIB2interfacestatisticsdetail
performanceofallnetworkdevices.
Defaults
Ifportstringisnotspecified,counterstatisticswillbedisplayedforallports.
Ifmib2orswitcharenotspecified,allcounterstatisticswillbedisplayedforthespecifiedport(s).
Mode
Switchcommand,readonly.
7-4
Port Configuration
Examples
Thisexampleshowshowtodisplayallcounterstatistics,includingMIB2networktrafficand
trafficthroughthedeviceforge.3.1:
C3(su)->show port counters ge.3.1
MIB2 Interface: 1
Port: ge.3.1
No counter discontinuity time
----------------------------------------------------------------MIB2 Interface Counters
----------------------In Octets
In Unicast Pkts
In Multicast Pkts
In Broadcast Pkts
In Discards
In Errors
Out Octets
Out Unicasts Pkts
Out Multicast Pkts
Out Broadcast Pkts
Out Errors
0
0
0
0
0
0
0
0
0
0
0
0
0
Thisexampleshowshowtodisplayallge.3.1portcounterstatisticsrelatedtotrafficthroughthe
device.
C3(su)->show port counters ge.3.1 switch
Port: ge.3.1
Bridge Port: 2
Frames Transmitted
Table 72providesanexplanationofthecommandoutput.
Table 7-2
Output Field
What It Displays...
Port
MIB2 Interface
Bridge Port
MIB2 Interface
Counters
802.1Q Switch
Counters
7-5
Syntax
clear port counters [port-string]
Parameters
portstring
(Optional)Specifiestheportorrangeofportstoclearportcounter
statistics.
Defaults
Ifnoportstringisspecified,portcountersareclearedforallports.
Mode
Switchcommand,readwrite
Example
Thisexampleclearstheportcountersforge.3.1.
C3(rw)->clear port counters ge3.1
Syntax
show port cablestatus [port-string]
Parameters
portstring
(Optional)Specifiestheportorportstoshowstatusfor.
Defaults
Ifnoportisspecified,informationaboutallportswillbedisplayed.
Mode
Switchcommand,readonly.
Usage
For1GigabitEthernetRJ45portsonly,thiscommandwilldisplaythestatusoftheportscable
connection(describedinTable 73below),andtheapproximatelengthofthecableattachedtothe
port.Ifyourswitchplatformdoesnotsupport1GERJ45ports,thiscommandwillnotbe
available.
Ifnocableisattachedtotheport,thestatuswillbeOpenandnolengthwillbeshown.Ifthe
portisnota1GERJ45port,thecommandwillreturnastatusofNotSupported.
7-6
Port Configuration
Sincerunningthecablediagnosticsmaymomentarilyinterruptpacketflow,awarningmessageis
displayedandyouarepromptedtocontinue.
Example
Thisexampleshowsthecablestatusfor1GEportge.1.31.
C3(su)->show port cablestatus ge.1.31
Warning: port(s) will be offline momentarily.
Do you want to continue (y/n) [n]?y
Port
Status
--------- --------ge.1.31
Normal
Length
------3(m)-5(m)
Table 73providesanexplanationofthecommandoutput.
Table 7-3
Output Field
What it displays...
Port
Status
Indicates the status of the port. The value is one of the following:
Normal = normal
Open = no cable attached to port
Short = detection of an inter-pair short
Fail = unknown error or crosstalk
Detach = indicates ports on stack units that are no longer present,
but were previously connected
Not Supported = ports other than 1GE RJ45 ports
Length
Commands
For information about...
Refer to page...
7-8
7-8
7-9
7-9
7-7
Syntax
set port disable port-string
Parameters
portstring
Specifiestheport(s)todisable.Foradetaileddescriptionofpossibleport
stringvalues,refertoPortStringSyntaxUsedintheCLIonpage71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodisablege.1.1:
C3(su)->set port disable ge.1.1
Syntax
set port enable port-string
Parameters
portstring
Specifiestheport(s)toenable.Foradetaileddescriptionofpossibleport
stringvalues,refertoPortStringSyntaxUsedintheCLIonpage71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoenablege.1.3:
C3(su)->set port enable ge.1.3
7-8
Port Configuration
Syntax
show port alias [port-string]
Parameters
portstring
(Optional)Displaysaliasname(s)forspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntax
UsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,aliasesforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayaliasinformationforports13onslot3:
C3(rw)->show
Port ge.3.1
Port ge.3.2
Port ge.3.3
Syntax
set port alias port-string [name]
Parameters
portstring
Specifiestheporttowhichanaliaswillbeassigned.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntax
UsedintheCLIonpage71.
name
(Optional)Assignsanaliasnametotheport.Ifthealiasnamecontains
spaces,thetextstringmustbesurroundedbydoublequotes.Maximum
lengthis60characters.
Defaults
Ifnameisnotspecified,thealiasassignedtotheportwillbecleared.
Mode
Switchcommand,readwrite.
7-9
Examples
ThisexampleshowshowtoassignthealiasAdmintoge.3.3:
C3(rw)->set port alias ge.3.3 Admin
Thisexampleshowshowtoclearthealiasforge.3.3:
C3(rw)->set port alias ge.3.3
7-10
Port Configuration
Note: These settings only take effect on ports that have auto-negotiation disabled.
Commands
For information about...
Refer to page...
7-11
7-12
7-12
7-16
Syntax
show port speed [port-string]
Parameters
portstring
(Optional)Displaysdefaultspeedsetting(s)forspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,defaultspeedsettingsforallportswilldisplay.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythedefaultspeedsettingfor1GigabitEthernetport14in
slot 3:
C3(su)->show port speed ge.3.14
default speed is 10 on port ge.3.14.
7-11
Syntax
set port speed port-string {10 | 100 | 1000}
Parameters
portstring
Specifiestheport(s)forwhichtoaspeedvaluewillbeset.Fora
detaileddescriptionofpossibleportstringvalues,refertoPort
StringSyntaxUsedintheCLIonpage71.
10|100|1000
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetge.3.3toaportspeedof10 Mbps:
C3(su)->set port speed ge.3.3 10
Syntax
show port duplex [port-string]
Parameters
portstring
(Optional)Displaysdefaultduplexsetting(s)forspecificport(s).
Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,defaultduplexsettingsforallportswillbedisplayed.
Mode
Switchcommand,readonly.
7-12
Port Configuration
Example
ThisexampleshowshowtodisplaythedefaultduplexsettingforEthernetport14inslot 3:
C3(su)->show port duplex ge.3.14
default duplex mode is full on port ge.3.14.
Syntax
set port duplex port-string {full | half}
Parameters
portstring
Specifiestheport(s)forwhichduplextypewillbeset.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntax
UsedintheCLIonpage71.
full|half
Setstheport(s)tofullduplexorhalfduplexoperation.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetge.1.17tofullduplex:
C3(su)->set port duplex ge.1.17 full
7-13
Commands
For information about...
Refer to page...
7-14
7-15
7-15
Syntax
show port jumbo [port-string]
Parameters
portstring
(Optional)Displaysthestatusofjumboframesupportforspecific
port(s).Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,jumboframesupportstatusforallportswilldisplay.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythestatusofjumboframesupportforge.1.1:
C3(su)->show port jumbo ge.1.1
Port Number
Jumbo Status
Max Frame Size
------------- --------------- -----------------ge.1.1
Enable
9216
7-14
Port Configuration
Syntax
set port jumbo {enable | disable}[port-string]
Parameters
enable|disable
Enablesordisablesjumboframesupport.
portstring
(Optional)Specifiestheport(s)onwhichtodisableorenablejumbo
framesupport.Foradetaileddescriptionofpossibleportstringvalues,
refertoPortStringSyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,jumboframesupportwillbeenabledordisabledonallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenablejumboframesupportforGigabitEthernetport14inunit/slot
3:
C3(su)->set port jumbo enable ge.3.14
Syntax
clear port jumbo [port-string]
Parameters
portstring
(Optional)Specifiestheport(s)onwhichtoresetjumboframe
supportstatustoenabled.Foradetaileddescriptionofpossible
portstringvalues,refertoPortStringSyntaxUsedintheCLIon
page71.
Defaults
Ifportstringisnotspecified,jumboframesupportstatuswillberesetonallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetjumboframesupportstatusforGigabitEthernetport14inslot 3:
C3(su)->clear port jumbo ge.3.14
7-15
Note: Advertised ability can be activated only on ports that have auto-negotiation enabled.
Commands
For information about...
Refer to page...
7-16
7-17
7-17
7-18
7-19
7-20
7-20
Syntax
show port negotiation [port-string]
Parameters
portstring
(Optional)Displaysautonegotiationstatusforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,autonegotiationstatusforallportswillbedisplayed.
7-16
Port Configuration
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayautonegotiationstatusfor1GigabitEthernetport14inslot 3:
C3(su)->show port negotiation ge.3.14
auto-negotiation is enabled on port ge.3.14.
Syntax
set port negotiation port-string {enable | disable}
Parameters
portstring
Specifiestheport(s)forwhichtoenableordisableautonegotiation.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
enable|disable
Enablesordisablesautonegotiation.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodisableautonegotiationon1GigabitEthernetport3inslot14:
C3(su)->set port negotiation ge.3.14 disable
Syntax
show port advertise [port-string]
Parameters
portstring
(Optional)Displaysadvertisedabilityforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,advertisementforallportswillbedisplayed.
SecureStack C3 Configuration Guide
7-17
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayadvertisementstatusforGigabitports13and14:
C3(su)->show port advertise ge.1.13-14
ge.1.13
capability
advertised
remote
------------------------------------------------10BASE-T
yes
yes
yes
10BASE-TFD
yes
yes
yes
100BASE-TX
yes
yes
yes
100BASE-TXFD
yes
yes
yes
1000BASE-T
no
no
no
1000BASE-TFD
yes
yes
yes
pause
yes
yes
no
ge.1.14
capability
advertised
remote
------------------------------------------------10BASE-T
yes
yes
yes
10BASE-TFD
yes
yes
yes
100BASE-TX
yes
yes
yes
100BASE-TXFD
yes
yes
yes
1000BASE-T
no
no
no
1000BASE-TFD
yes
yes
yes
pause
yes
yes
no
Syntax
set port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd
| pause}
Parameters
portstring
Selecttheportsforwhichtoconfigureadvertisements.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
10t
Advertise10BASEThalfduplexmode.
10tfd
Advertise10BASETfullduplexmode.
100tx
Advertise100BASETXhalfduplexmode.
100txfd
Advertise100BASETXfullduplexmode.
1000t
Advertise1000BASEThalfduplexmode.
1000tfd
Advertise1000BASETfullduplexmode.
pause
AdvertisePAUSEforfullduplexlinks.
Defaults
None.
7-18
Port Configuration
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoconfigureport1toadvertise1000BASETfullduplex:
C3(su)->set port advertise ge.1.1 1000tfd
Syntax
clear port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd
| pause}
Parameters
portstring
Clearadvertisementsforspecificport(s).Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedinthe
CLIonpage71.
10t
Donotadvertise10BASEThalfduplexmode.
10tfd
Donotadvertise10BASETfullduplexmode.
100tx
Donotadvertise100BASETXhalfduplexmode.
100txfd
Donotadvertise100BASETXfullduplexmode.
1000t
Donotadvertise1000BASEThalfduplexmode.
1000tfd
Donotadvertise1000BASETfullduplexmode.
pause
DonotadvertisePAUSEforfullduplexlinks.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoconfigureport1tonotadvertise10MBcapabilityforauto
negotiation:
C3(su)->clear port advertise ge.1.1 10t 10tfd
7-19
Syntax
show port mdix {all|auto|forced-auto|mdi|mdix} [port-string]
Parameters
all
Displayinformationaboutallports.
auto
Displayinformationabouttheportsconfiguredtoautomatically
determinetherequiredMDI/MDIXmode.
forcedauto
Displayinformationabouttheportsforcedautomaticallytodetermine
therequiredMDI/MDIXmode.
mdi
DisplayinformationabouttheportsconfiguredwithMDIonlymode.
mdix
DisplayinformationabouttheportsconfiguredwithMDIXonlymode.
portstring
(Optional)DisplaytheselectedMDI/MDIXmodeonlyfortheportor
portsspecified.
Defaults
Ifportstringisnotspecified,informationisdisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampledisplaysinformationaboutportsconfiguredforMDIXonlymode.
C3(su)->show port mdix mdix
Port Number
MDIX Mode
------------- -----------------ge.1.27
MDIX
ge.1.28
MDIX
Syntax
set port mdix {auto|forced-auto|mdi|mdix} [port-string]
Parameters
7-20
auto
ConfigureportstoautomaticallydeterminetherequiredMDI/MDIX
mode.Thisisthedefaultcondition.
forcedauto
ForceportstoautomaticallydeterminetherequiredMDI/MDIXmode.
Port Configuration
mdi
ConfigureportstouseMDImodeonly.
mdix
ConfigureportstouseMDIXmodeonly.
portstring
(Optional)Specifytheportorportstoconfigure.
Defaults
Ifportstringisnotentered,allportsontheswitchareconfigured.
Mode
Switchcommand,readwrite.
Usage
Bydefault,Enterasys Networksswitchdevicesareconfiguredtoautomaticallydetectthecable
typeconnection,straightthrough(MDI)orcrossover(MDIX),requiredbythecableconnectedto
theport.YoucanconfigureportstoonlyuseMDIorMDIXconnectionswiththiscommand.
ThiscommandonlyconfiguresEthernetports,andcannotbeusedtoconfigurecomboportson
theswitch.
Example
Thisexampleconfiguresportsge.1.1andge.1.2touseMDIXmode.
C3(su)->set port mdix mdix ge.1.1-2
7-21
Commands
For information about...
show flowcontrol
7-22
set flowcontrol
7-22
show flowcontrol
Usethiscommandtodisplaytheflowcontrolstate.
Syntax
show flowcontrol
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheportflowcontrolstate:
C3(su)->show flowcontrol
Flow control status: enabled
set flowcontrol
Usethiscommandtoenableordisableflowcontrol.
Syntax
set flowcontrol {enable | disable}
Parameters
enable|disable
7-22
Refer to page...
Port Configuration
Enablesordisablesflowcontrolsettings.
set flowcontrol
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoenableflowcontrol:
C3(su)->set flowcontrol enable
7-23
Commands
For information about...
Refer to page...
7-24
7-25
show linkflap
7-25
7-28
7-28
7-29
7-29
7-30
7-30
7-31
7-31
clear linkflap
7-32
Syntax
show port trap [port-string]
Parameters
portstring
7-24
Port Configuration
(Optional)Displayslinktrapstatusforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
Defaults
Ifportstringisnotspecified,thetrapstatusforallportswillbedisplayed.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodisplaylinktrapstatusforge.3.1through4:
C3(su)->show port trap ge.3.1-4
Link traps enabled on port ge.3.1.
Link traps enabled on port ge.3.2.
Link traps enabled on port ge.3.3.
Link traps enabled on port ge.3.4.
Syntax
set port trap port-string {enable | disable}
Parameters
portstring
Specifiestheport(s)forwhichtoenableordisableporttraps.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
enable|disable
Enablesordisablessendingtrapmessageswhenlinkstatuschanges.
Defaults
Sendingtrapswhenlinkstatuschangesisenabledbydefault.
Mode
Switchcommand,readwrite.
Example
Thefollowingexampledisablessendingtraponge.3.1.
C3(su)->set port trap ge.3.1 disable
show linkflap
Usethiscommandtodisplaylinkflapdetectionstateandconfigurationinformation.
Syntax
show linkflap {globalstate | portstate | parameters | metrics | portsupported |
actsupported | maximum | downports | action | operstatus | threshold | interval]
| downtime | currentcount | totalcount | timelapsed | violations [port-string]}
7-25
show linkflap
Parameters
globalstate
Displaystheglobalenablestateoflinkflapdetection.
portstate
Displaystheportenablestateoflinkflapdetection.
parameters
Displaysthecurrentvalueofsettablelinkflapdetectionparameters.
metrics
Displayslinkflapdetectionmetrics.
portsupported
Displaysportswhichcansupportthelinkflapdetectionfunction.
actsupported
Displayslinkflapdetectionactionssupportedbysystemhardware.
maximum
Displaysthemaximumallowedlinkdownsper10secondssupported
bysystemhardware.
downports
Displaysportsdisabledbylinkflapdetectionduetoaviolation.
action
Displayslinkflapactionstakenonviolatingport(s).
operstatus
Displayswhetherlinkflaphasdeactivatedport(s).
threshold
Displaysthenumberofallowedlinkdowntransitionsbeforeactionis
taken.
interval
Displaysthetimeperiodforcountinglinkdowntransitions.
downtime
Displayshowlongviolatingport(s)aredeactivated.
currentcount
Displayshowmanylinkdowntransitionsareinthecurrentinterval.
totalcount
Displayshowmanylinkdowntransitionshaveoccurredsincethelast
reset.
timelapsed
Displaysthetimeperiodsincethelastlinkdowneventorreset.
violations
Displaysthenumberoflinkflapviolationssincethelastreset.
portstring
(Optional)Displaysinformationforspecificport(s).
Defaults
Ifnotspecified,informationaboutalllinkflapdetectionsettingswillbedisplayed.
Ifportstringisnotspecified,informationforallportswillbedisplayed.
Mode
Switchmode,readonly.
Usage
Thelinkflapdefaultconditionsareshowninthefollowingtable.
7-26
Linkflap Parameter
Default Condition
Disabled
Disabled
Linkflap action
None
Linkflap interval
20
Linkflap threshold
(number of allowed link down transitions before action is taken)
10
Port Configuration
show linkflap
Examples
Thisexampleshowshowtodisplaytheglobalstatusofthelinktrapdetectionfunction:
C3(rw)->show linkflap globalstate
Linkflap feature globally disabled
Thisexampleshowshowtodisplayportsdisabledbylinkflapdetectionduetoaviolation:
C3(rw)->show linkflap downports
Ports currently held DOWN for Linkflap violations:
None.
Thisexampleshowshowtodisplaythelinkflapparameterstable:
C3(rw)->show linkflap parameters
Linkflap Port Settable Parameter Table (X
Port
LF Status Actions Threshold
-------- --------- ------- ---------ge.1.1
disabled
....... 10
ge.1.2
enabled
D..S..T 3
ge.1.3
disabled
...S..T 10
means error
Interval
---------5
5
5
occurred)
Downtime
---------300
300
300
Table 74providesanexplanationoftheshowlinkflapparameterscommandoutput.
Table 7-4
Output Field
What it displays...
Port
Port designation.
LF Status
Actions
Threshold
Interval
Downtime
Interval (in seconds) port(s) will be held down after a link flap
violation.
Thisexampleshowshowtodisplaythelinkflapmetricstable:
C3(rw)->show linkflap metrics
Port
LinkStatus
CurrentCount
-------- ----------- -----------ge.1.1
operational 0
ge.1.2
disabled
4
ge.1.3
operational 3
TotalCount
---------0
15
3
TimeElapsed Violations
----------- ------------241437
0
147
5
241402
0
Table 75providesanexplanationoftheshowlinkflapmetricscommandoutput.
Table 7-5
Output Field
What it displays...
Port
Port designation.
LinkStatus
CurrentCount
TotalCount
7-27
Table 7-5
Output Field
What it displays...
TimeElapsed
Violations
Syntax
set linkflap globalstate {disable | enable}
Parameters
disable|enable
Globallydisablesorenablesthelinkflapdetectionfunction.
Defaults
Bydefault,thefunctionisdisabledgloballyandonallports.
Mode
Switchmode,readwrite.
Usage
Bydefault,thefunctionisdisabledgloballyandonallports.Ifdisabledgloballyafterperport
settingshavebeenconfiguredusingthelinkflapcommands,perportsettingswillberetained.
Example
Thisexampleshowshowtogloballyenablethelinktrapdetectionfunction.
C3(rw)->set linkflap globalstate enable
Syntax
set linkflap portstate {disable | enable} [port-string]
Parameters
disable|enable
Disablesorenablesthelinkflapdetectionfunction.
portstring
(Optional)Specifiestheportorportsonwhichtodisableorenable
monitoring.
Defaults
Ifportstringisnotspecified,allportsareenabledordisabled.
7-28
Port Configuration
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoenablethelinktrapmonitoringonallports.
C3(rw)->set linkflap portstate enable
Syntax
set linkflap interval port-string interval-value
Parameters
portstring
Specifiestheport(s)onwhichtosetthelinkflapinterval.
intervalvalue
Specifiesanintervalinseconds.Avalueof0willsettheintervalto
forever.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthelinkflapintervalonportge.1.4to1000seconds.
C3(rw)->set linkflap interval ge.1.4 1000
Syntax
set linkflap action port-string {disableInterface | gensyslogentry | gentrap |
all}
Parameters
portstring
Specifiestheport(s)onwhichtosetthelinkflapaction.
disableInterface
Setsthereactionasdisablingtheinterface.
gensyslogentry
Setsthereactionasgeneratingasyslogentry.
gentrap
SetsthereactionasgeneratinganSNMPtrap.
all
Setsthereactionasalloftheabove.
7-29
Defaults
None.
Mode
Switchmode,readwrite.
Example
Thisexampleshowshowtosetthelinkflapviolationactiononportge.1.4togeneratingaSyslog
entry.
C3(rw)->set linkflap action ge.1.4 gensyslogentry
Syntax
clear linkflap action [port-string] {disableInterface | gensyslogentry | gentrap
| all}
Parameters
portstring
(Optional)Specifiestheport(s)onwhichtoclearthelinkflapaction.
disableInterface
Clearsthereactionasdisablingtheinterface.
gensyslogentry
Clearsthereactionasgeneratingasyslogentry.
gentrap
ClearsthereactionasgeneratinganSNMPtrap.
all
Clearsthereactionasalloftheabove.
Defaults
Ifportstringisnotspecified,actionswillbeclearedonallports.
Mode
Switchmode,readwrite.
Example
Thisexampleshowshowtoclearthelinkflapviolationactiononportge.1.4togeneratinga
Syslogentry.
C3(rw)->clear linkflap action ge.1.4 gensyslogentry
Syntax
set linkflap threshold port-string threshold-value
7-30
Port Configuration
Parameters
portstring
Specifiestheport(s)onwhichtosetthelinkflapactiontriggercount.
thresholdvalue
Specifiesthenumberoflinkdowntransitionsnecessarytotriggerthe
linkflapaction.Aminimumof1mustbeconfigured.
Defaults
None.
Mode
Switchmode,readwrite.
Example
Thisexampleshowshowtosetthelinkflapthresholdonportge.1.4to5.
C3(rw)->set linkflap threshold ge.1.4 5
Syntax
set linkflap downtime port-string downtime-value
Parameters
portstring
Specifiestheport(s)onwhichtosetthelinkflapdowntime.
downtimevalue
Specifiesadowntimeinseconds.Avalueof0willsetthedowntimeto
forever.
Defaults
None.
Mode
Switchmode,readwrite.
Example
Thisexampleshowshowtosetthelinkflapdowntimeonportge.1.4to5000seconds.
C3(rw)->set linkflap downtime ge.1.4 5000
Syntax
clear linkflap down [port-string]
7-31
clear linkflap
Parameters
portstring
(Optional)Specifiestheportstomakeoperational.
Defaults
Ifportstringisnotspecified,allportsdisabledbyalinkflapviolationwillbemadeoperational.
Mode
Switchmode,readwrite.
Example
Thisexampleshowshowtomakedisabledportge.1.4operational.
C3(rw)->clear linkflap down ge.1.4
clear linkflap
Usethiscommandtoclearalllinkflapoptionsand/orstatisticsononeormoreports.
Syntax
clear linkflap {all | stats [port-string] | parameter port-string {threshold |
interval | downtime | all}
Parameters
all|stats
Clearsalloptionsandstatistics,orclearsonlystatistics.
parameter
Clearslinkflapparameters.
threshold|interval| Clearslinkflapthreshold,interval,downtimeorallparameters.
downtime|all
portstring
(Optionalunlessparameterisspecified)Specifiestheport(s)onwhich
toclearsettings.
Defaults
Ifportstringisnotspecified,settingsand/orstatisticswillbeclearedonallports.
Mode
Switchmode,readwrite.
Example
Thisexampleshowshowtoclearalllinkflapoptionsonportge.1.4.
C3(rw)->clear linkflap all ge.1.4
7-32
Port Configuration
Commands
For information about...
Refer to page...
7-33
7-34
7-34
Syntax
show port broadcast [port-string]
Parameters
portstring
(Optional)Selecttheportsforwhichtoshowbroadcastsuppression
thresholds.Foradetaileddescriptionofpossibleportstringvalues,refer
toPortStringSyntaxUsedintheCLIonpage71.
Defaults
Ifportstringisnotspecified,broadcaststatusofallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythebroadcastsuppressionthresholdsforports1through4:
C3(su)->show port broadcast ge.1.1-4
Port
Total BC
Threshold
Packets
(pkts/s)
---------------------------------------ge.1.1
0
50
7-33
ge.1.2
ge.1.3
ge.1.4
0
0
0
50
40
14881
Syntax
set port broadcast port-string threshold-val
Parameters
portstring
Selecttheportsforwhichtoconfigurebroadcastsuppressionthresholds.
Foradetaileddescriptionofpossibleportstringvalues,refertoPort
StringSyntaxUsedintheCLIonpage71.
thresholdval
Setsthepacketspersecondthresholdonbroadcasttraffic.Maximum
valueis
148810forFastEthernetports
1488100for1Gigabitports.
14881000for10Gigabitports
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
PerportbroadcastsuppressionishardsettobegloballyenabledontheC3.Ifyouwouldliketo
disablebroadcastsuppression,youcangetthesameresultbysettingthethresholdlimitforeach
porttothemaximumnumberofpacketswhichcanbereceivedpersecondaslistedinthe
parameterssection,above.Thedefaultbroadcastsuppressionthresholdforallportsissetto
14881.
Example
Thisexampleconfiguresports1through5withabroadcastlimitof50pps:
C3(su)->set port broadcast ge.1.1-5 50
Syntax
clear port broadcast port-string threshold
7-34
Port Configuration
Parameters
portstring
Selecttheportsforwhichtoclearbroadcastsuppressionthresholds.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleclearsthebroadcastthresholdlimitto14881ppsforports1through5:
C3(su)->clear port broadcast ge.1.1-5 threshold
7-35
Port Mirroring
Port Mirroring
Caution: Port mirroring configuration should be performed only by personnel who are
knowledgeable about the effects of port mirroring and its impact on network operation.
TheSecureStackC3deviceallowsyoutomirror(orredirect)thetrafficbeingswitchedonaport
forthepurposesofnetworktrafficanalysisandconnectionassurance.Whenportmirroringis
enabled,oneportbecomesamonitorportforanotherportwithinthedevice.
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of port
mirroring configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
Mirroring Features
TheSecureStackC3devicesupportsthefollowingmirroringfeatures:
Mirroringcanbeconfiguredinamanytooneconfigurationsothatonetarget(destination)
portcanmonitortrafficonupto8sourceports.Onlyonemirrordestinationportcanbe
configuredperstack,ifapplicable.
Bothtransmitandreceivetrafficwillbemirrored.
Adestinationportwillonlyactasamirroringportwhenthesessionisoperationallyactive.
Whenaportmirroriscreated,themirrordestinationportisremovedfromtheegresslistof
VLAN1afterareboot.
MACaddresseswillbelearnedforpacketstaggedwiththemirrorVLANID.Thiswill
preventtheabilitytosnooptrafficacrossmultiplehops.
Caution: Traffic mirrored to a VLAN may contain control traffic. This may be interpreted by the
downstream neighbor as legal control frames. It is recommended that you disable any protocols
(such as Spanning Tree) on inter-switch connections that might be affected .
Configurationofnormalportmirroringsourceportsandonedestinationportonallswitches,
asdescribedabove.
2.
ConfigurationofamirrorVLAN,whichisauniqueVLANonwhichmirroredpackets
traverseacrossthenetwork.ThemirrorVLANhastobeconfiguredonALLswitchesacross
thenetworkalongwhichmirroredtraffictraverses,fromtheswitchwherethesourceports
residetotheswitchwherethemirroredpacketsaresniffedand/orcaptured.
Youmustensurethatswitchesinvolvedareproperlyconfiguredtofacilitatecorrectremoteport
mirroringoperation.Thefollowingpointsinparticularneedtobeobserved:
7-36
Onthesourceswitch,thecorrectdestinationportmustbechosentoensurethatthereisan
egresspathfromthatporttothedesiredremotedestination(s).
Allportsonthepathfromthesourceporttotheremotedestinationmustbemembersofthe
mirrorVLAN.
Port Configuration
Port Mirroring
Onswitchesonthepathfromthesourceporttotheremotedestination,egresstagginghasto
beenabledonpotentialegressportsforthemirrorVLAN.
Withtheintroductionofremoteportmirroring:
ConfiguredmirrordestinationportswillNOTlosetheirswitchingorroutingpropertiesas
theydoonSecureStackA2,B2,orC2products.
OnswitcheswherethemirrorVLANhasbeenconfigured,anytrafficonthatVLANwillbe
floodedontheVLAN.Itwillneverbeunicast,evenifthesourceaddressofthetrafficasbeen
learnedontheswitch.
Procedures
PerformthefollowingstepstoconfigureandmonitorportmirroringusingSMONMIBobjects.
Tocreateandenableaportmirroringinstance:
1.
OpenaMIBbrowser,suchasNetsightMIBTools
2.
IntheMIBdirectorytree,navigatetotheportCopyEntryfolderandexpandit.
3.
SelecttheportCopyStatusMIB.
4.
EnteradesiredsourceandtargetportintheInstancefieldusingtheformatsource.target.
Forexample,3.2wouldcreatearelationshipwheresourceportge.1.3wouldbemirroredto
targetportge.1.2.
Note: In order to configure a port mirroring relationship, both source and destination interfaces must
be enabled and operational (up).
5.
EnterMIBoption4(createAndGo)andperformanSNMPSetoperation.
6.
(Optional)UsetheCLItoverifytheportmirroringinstancehasbeencreatedandenabledas
showninthefollowingexample:
C3(su)->show port mirroring
Port Mirroring
==============
Source Port
= ge.1.3
Target Port
= ge.1.2
Frames Mirrored = Rx and Tx
Port Mirroring status enabled
Tocreateaportmirroringinstancewithoutautomaticallyenablingit:
1.
Completesteps14above.
2.
EnterMIBoption5(createAndWait)andperformanSNMPSetoperation.
3.
(Optional)UsetheCLItoverifytheportmirroringinstancehasbeencreatedsettodisabled
modeasshowninthefollowingexample:
C3(su)->show port mirroring
7-37
Port Mirroring
==============
Source Port
= ge.1.3
Target Port
= ge.1.2
Frames Mirrored = Rx and Tx
Port Mirroring status disabled
4.
Whenyouarereadytoenablethisinstance,enterMIBoption1(active)andperformanSNMP
Setoperation.
5.
(Optional)UsetheCLItoverifytheportmirroringinstancehasbeenenabled.
Todeleteaportmirroringinstance:
1.
SelectapreviouslycreatedportmirroringinstanceinyourMIBbrowser.
2.
EnterMIBoption6(destroy)andperformanSNMPSetoperation.
3.
(Optional)UsetheCLItoverifytheportmirroringinstancehasbeendeletedasshowninthe
followingexample:
C3(su)->show port mirroring
No Port Mirrors configured.
Purpose
Toreviewandconfigureportmirroringonthedevice.
Commands
For information about...
Refer to page...
7-38
7-39
7-40
7-40
7-41
Syntax
show port mirroring
Parameters
None.
Defaults
None.
7-38
Port Configuration
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplayportmirroringinformation.Inthiscase,ge.1.4isconfigured
asasourceportandge.1.11isatargetandmirroringhasbeenenabledbetweentheseports:
C3(su)->show port mirroring
Port Mirroring
==============
Source Port = ge.1.4
Target Port = ge.1.11
Frames Mirrored = Rx and Tx
Port Mirroring status enabled.
Syntax
set port mirroring {create | disable | enable} source destination}
Parameters
create|disable|
enable
Creates,disablesorenablesmirroringsettingsonthespecifiedports.By
default,portmirrorsareenabledautomaticallywhencreated.
source
Specifiesthesourceportdesignation.Thisistheportonwhichthetraffic
willbemonitored.Foradetaileddescriptionofpossibleportstringvalues,
refertoPortStringSyntaxUsedintheCLIonpage71.
destination
Specifiesthetargetportdesignation.Thisistheportthatwillduplicateor
mirrorallthetrafficonthemonitoredport.Onlyonedestinationport
canbeconfiguredperstack,ifapplicable.
Foradetaileddescriptionofpossibleportstringvalues,refertoPort
StringSyntaxUsedintheCLIonpage71.
Defaults
Portmirrorsareautomaticallyenabledwhencreatedonthisplatform.
Mode
Switchcommand,readwrite.
Usage
NotethatLAGportsandtheirunderlyingphysicalports,asdescribedinLinkAggregation
ControlProtocol(LACP)onpage742,cannotbemirrored.
7-39
Example
Thisexampleshowshowtocreateandenableportmirroringwithge.1.4asthesourceport,and
ge.1.11asthetargetport:
C3(su)->set port mirroring create ge.1.4 ge.1.11
Syntax
clear port mirroring source destination
Parameters
source
Specifiesthesourceportofthemirroringconfigurationtobecleared.For
adetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
destination
Specifiesthetargetportofthemirroringconfigurationtobecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearaportmirroringrelationshipbetweensourceportge.1.4and
targetportge.1.11:
C3(su)->clear port mirroring ge.1.4 ge.1.11
Syntax
set mirror vlan vlan-id
Parameters
vlanid
Defaults
None.
7-40
Port Configuration
SpecifiestheVLANtobeusedforremoteportmirroring.TheIDcan
rangefrom2to4093.
Mode
Switchcommand,readwrite.
Usage
RefertoRemotePortMirroringonpage736forinformationaboutconfiguringmirrorVLANs.
UsetheshowportmirroringcommandtodisplaytheVLANsconfiguredforremoteport
mirroring.
Example
ThefollowingexampleassignsaVLANformirroringtrafficandthenshowstheconfiguredport
mirroringwiththeshowportmirrorcommand.
C3(su)->set mirror vlan 2
C3(su)->show port mirroring
Port Mirroring
==============
Source Port
= ge.1.1
Target Port
= ge.1.10
Frames Mirrored = Rx and Tx
Port Mirroring status enabled
Mirror Vlan
= 2
Syntax
clear mirror vlan vlan-id
Parameters
vlanid
SpecifiestheVLANtobecleared.TheIDcanrangefrom2to4093.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThefollowingexampleclearsVLAN2frombeingusedforremoteportmirroring.
C3(su)->clear mirror vlan 2
7-41
Usingmultiplelinkssimultaneouslytoincreasebandwidthisadesirableswitchfeature,which
canbeaccomplishedifbothsidesagreeonasetofportsthatarebeingusedasaLinkAggregation
Group(LAG).OnceaLAGisformedfromselectedports,problemswithloopingcanbeavoided
sincetheSpanningTreecantreatthisLAGasasingleport.
Enabledbydefault,theLinkAggregationControlProtocol(LACP)logicallygroupsinterfaces
togethertocreateagreaterbandwidthuplink,orlinkaggregation,accordingtotheIEEE802.3ad
standard.ThisstandardallowstheswitchtodeterminewhichportsareinLAGsandconfigure
themdynamically.SincetheprotocolisbasedontheIEEE802.3adspecification,anyswitchfrom
anyvendorthatsupportsthisstandardcanaggregatelinksautomatically.
802.3adLACPaggregationscanalsoberuntoendusers(thatis,aserver)ortoarouter.
Note: Earlier (proprietary) implementations of port aggregation referred to groups of aggregated
ports as trunks.
LACP Operation
Foreachaggregatableportinthedevice,LACP:
Maintainsconfigurationinformation(reflectingtheinherentpropertiesoftheindividuallinks
aswellasthoseestablishedbymanagement)tocontrolaggregation.
ExchangesconfigurationinformationwithotherdevicestoallocatethelinktoaLink
AggregationGroup(LAG).
Note: A given link is allocated to, at most, one Link Aggregation Group (LAG) at a time. The
allocation mechanism attempts to maximize aggregation, subject to management controls.
AttachestheporttotheaggregatorusedbytheLAG,anddetachestheportfromthe
aggregatorwhenitisnolongerusedbytheLAG.
Usesinformationfromthepartnerdeviceslinkaggregationcontrolentitytodecidewhether
toaggregateports.
TheoperationofLACPinvolvesthefollowingactivities:
Checkingthatcandidatelinkscanactuallybeaggregated.
ControllingtheadditionofalinktoaLAG,andthecreationofthegroupifnecessary.
Monitoringthestatusofaggregatedlinkstoensurethattheaggregationisstillvalid.
RemovingalinkfromaLAGifitsmembershipisnolongervalid,andremovingthegroupifit
nolongerhasanymemberlinks.
InordertoallowLACPtodeterminewhetherasetoflinksconnecttothesamedevice,andto
determinewhetherthoselinksarecompatiblefromthepointofviewofaggregation,itis
necessarytobeabletoestablish
7-42
Port Configuration
Agloballyuniqueidentifierforeachdevicethatparticipatesinlinkaggregation.
Ameansofidentifyingthesetofcapabilitiesassociatedwitheachportandwitheach
aggregator,asunderstoodbyagivendevice.
AmeansofidentifyingaLAGanditsassociatedaggregator.
Note: The path cost of a LAG port will be displayed as zero when it is not an active link.
LACP Terminology
Table 76defineskeyterminologyusedinLACPconfiguration.
Table 7-6
Term
Definition
Aggregator
Virtual port that controls link aggregation for underlying physical ports. Each
SecureStack C3 module provides 6 aggregator ports, which are designated in
the CLI as lag.0.1 through lag.0.6.
LAG
Link Aggregation Group. Once underlying physical ports (for example, fe.x.x)
are associated with an aggregator port, the resulting aggregation will be
represented as one LAG with a lag.x.x port designation.
SecureStack C3 LAGs can have up to 8 associated physical ports.
LACPDU
An actor is the local device sending LACPDUs. Its protocol partner is the
device on the other end of the link aggregation. Each maintains current status
of the other via LACPDUs containing information about their ports LACP
status and operational state.
Admin Key
Value assigned to aggregator ports and physical ports that are candidates for
joining a LAG. The LACP implementation on SecureStack C3 devices will use
this value to form an oper key and will determine which underlying physical
ports are capable of aggregating by comparing oper keys. Aggregator ports
allow only underlying ports with oper keys matching theirs to join their LAG.
On SecureStack C3 devices, the default admin key value is 32768.
System Priority
7-43
is,willblockredundantpaths).Forinformationaboutbuildingstaticaggregations,refertoset
lacpstatic(page 748).
EachSecureStackC3moduleprovidessixvirtuallinkaggregatorports,whicharedesignatedin
theCLIaslag.0.1throughlag.0.6.EachLAGcanhaveuptoeightassociatedphysicalports.Once
underlyingphysicalports(forexample,fe.x.x,orge.x.x)areassociatedwithanaggregatorport,
theresultingaggregationwillberepresentedasoneLAGwithalag.0.xportdesignation.LACP
determineswhichunderlyingphysicalportsarecapableofaggregatingbycomparingoperational
keys.AggregatorportsallowonlyunderlyingportswithkeysmatchingtheirstojointheirLAG.
LACPusesasystempriorityvaluetobuildaLAGID,whichdeterminesaggregationprecedence.
Iftherearetwopartnerdevicescompetingforthesameaggregator,LACPcomparestheLAGIDs
foreachgroupingofports.TheLAGwiththelowerLAGIDisgivenprecedenceandwillbe
allowedtousetheaggregator.
Thereareafewcasesinwhichportswillnotaggregate:
Anunderlyingphysicalportisattachedtoanotherportonthissameswitch(loopback).
ThereisnoavailableaggregatorfortwoormoreportswiththesameLAGID.Thiscan
happeniftherearesimplynoavailableaggregators,orifnoneoftheaggregatorshavea
matchingadminkeyandsystempriority.
802.1xauthenticationisenabledusingtheseteapolcommand(page 1618)andportsthat
wouldotherwiseaggregatearenot802.1Xauthorized.
TheLACPimplementationontheSecureStackC3devicewillallowuptoeightphysicalportsinto
aLAG.ThedevicewiththelowestLAGIDdetermineswhichunderlyingphysicalportsare
allowedintoaLAGbasedontheportsLAGportpriority.PortswiththelowestLAGportpriority
valuesareallowedintotheLAGandallotherspeedgroupingsgointoastandbystate.
MultiportLAGswillcontinuetooperateaslongasthereisatleastoneactiveportintheLAG.
Therefore,thereisnoneedtocreatebackupsingleportLAGsortospecificallyassigntheLAGand
allitsphysicalportstotheegresslistoftheLAGsVLAN.
Typically,twoormoreportsarerequiredtoformaLAG.However,youcanenablethecreationof
singleportLAGsasdescribedinsetlacpsingleportlagonpage750.IfasingleportLAGgoes
downandtheswitchstaysup,theswitchwillreconfiguretheLAGtothesameLAGnumberifthe
portcomesbackup.
Note: To aggregate, underlying physical ports must be running in full duplex mode and must be of
the same operating speed.
Commands
For information about...
7-44
Refer to page...
show lacp
7-45
set lacp
7-46
7-47
7-47
clear lacp
7-48
7-48
7-49
Port Configuration
show lacp
Refer to page...
7-50
7-49
7-51
7-52
7-54
show lacp
Usethiscommandtodisplayinformationaboutoneormoreaggregatorports.
Syntax
show lacp [port-string]
Parameters
portstring
(Optional)DisplaysLACPinformationforspecificLAGport(s).Valid
portdesignationsarelag.0.16.
Defaults
Ifportstringisnotspecified,linkaggregationinformationforallLAGswillbedisplayed.
Mode
Switchcommand,readonly.
Usage
EachSecureStackC3moduleprovides6virtuallinkaggregatorports,whicharedesignatedinthe
CLIaslag.0.1throughlag.0.6.Onceunderlyingphysicalports(thatis,ge.x.x)areassociatedwith
anaggregatorport,theresultingaggregationwillberepresentedasoneLinkAggregationGroup
(LAG)withalag.x.xportdesignation.
Example
Thisexampleshowshowtodisplaylacpinformationforlag.0.1.Thefollowingtabledescribesthe
outputfields.
C3(su)->show lacp lag.0.1
Global Link Aggregation state: enabled
Single Port LAGs:
disabled
Aggregator: lag.0.1
System Identifier:
System Priority:
Admin Key:
Oper Key:
Attached Ports:
Actor
00:01:F4:5F:1E:20
32768
32768
32768
ge.1.1
ge.1.3
Partner
00:11:88:11:74:F9
32768
0
Table 77providesanexplanationofthecommandoutput.
7-45
set lacp
Table 7-7
Output Field
What It Displays...
Global Link
Aggregation state
Displays if the single port LAG feature has been enabled on the switch. See set lacp
singleportlag on page 7-50 for more about single port LAG.
Aggregator
Actor
Partner
System Identifier
System Priority
System priority value which determines aggregation precedence. Only one LACP
system priority can be set on a SecureStack C3 device, using either the set lacp
asyspri command (page 7-47), or the set port lacp command (page 7-52).
Admin Key
Ports assigned key. SecureStack C3 devices provide a default admin key value of
32768 for all LAG ports (lag.0.1 though lag.0.6).
Oper Key
Ports operational key, derived from the admin key. Only underlying physical ports
with oper keys matching the aggregators will be allowed to aggregate.
Attached Ports
set lacp
UsethiscommandtodisableorenabletheLinkAggregationControlProtocol(LACP)onthe
device.
Syntax
set lacp {disable | enable}
Parameters
disable|enable
DisablesorenablesLACP.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodisableLACP:
C3(su)->set lacp disable
7-46
Port Configuration
Syntax
set lacp asyspri value
Parameters
asyspri
SetsthesystemprioritytobeusedincreatingaLAG(LinkAggregation
Group)ID.Validvaluesare0to65535.
value
Specifiesasystempriorityvalue.Validvaluesare0to65535,with
precedencegiventolowervalues.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
LACPusesthisvaluetodetermineaggregationprecedence.Iftherearetwopartnerdevices
competingforthesameaggregator,LACPcomparestheLAGIDsforeachgroupingofports.The
LAGwiththelowerLAGIDisgivenprecedenceandwillbeallowedtousetheaggregator.
Example
ThisexampleshowshowtosettheLACPsystempriorityto1000:
C3(su)->set lacp asyspri 1000
Syntax
set lacp aadminkey port-string value
Parameters
portstring
SpecifiestheLAGport(s)onwhichtoassignanadminkey.
value
Specifiesanadminkeyvaluetoset.Validvaluesare0to65535.The
defaultadminkeyvalueis32768.
Defaults
None.
Mode
Switchcommand,readwrite.
7-47
clear lacp
Usage
LACPwillusethisvaluetoformanoperkey.Onlyunderlyingphysicalportswithoperkeys
matchingthoseoftheiraggregatorswillbeallowedtoaggregate.Thedefaultadminkeyvaluefor
allLAGportsis32768.
Example
ThisexampleshowshowtosettheLACPadminkeyto2000forLAGport6:
C3(su)->set lacp aadminkey lag.0.6 2000
clear lacp
UsethiscommandtoclearLACPsystempriorityoradminkeysettings.
Syntax
clear lacp {[asyspri] [aadminkey port-string]}
Parameters
asyspri
Clearssystempriority.
aadminkeyportstring
Resetsadminkeysforoneormoreportstothedefaultvalueof32768.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheactoradminkeyforLAGport6:
C3(su)->clear lacp aadminkey lag.0.6
Syntax
set lacp static {disable | enable} | lagportstring [key] port-string
Parameters
7-48
disable|enable
Disablesorenablesstaticlinkaggregation.
lagportstring
SpecifiestheLAGaggregatorporttowhichnewportswillbeassigned.
Port Configuration
key
(Optional)SpecifiesthenewmemberportandLAGportaggregator
adminkeyvalue.Onlyportswithmatchingkeysareallowedto
aggregate.Validvaluesare065535.
Note: This key value must be unique. If ports other than the desired
underlying physical ports share the same admin key value, aggregation
will fail or undesired aggregations will form.
portstring
Specifiesthememberport(s)toaddtotheLAG.Foradetaileddescription
ofpossibleportstringvalues,refertoPortStringSyntaxUsedintheCLI
onpage71.
Defaults
Ifnotspecified,akeywillbeassignedaccordingtothespecifiedaggregator.Forexampleakeyof4
wouldbeassignedtolag.0.4.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoaddportge.1.6totheLAGofaggregatorport6:
C3(su)->set lacp static lag.0.6 ge.1.6
Syntax
clear lacp static lagportstring port-string
Parameters
lagportstring
SpecifiestheLAGaggregatorportfromwhichportswillberemoved.
portstring
Specifiestheport(s)toremovefromtheLAG.Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLI
onpage71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoremovege.1.6fromtheLAGofaggregatorport6:
C3(su)->clear lacp static lag.0.6 ge.1.6
7-49
Syntax
set lacp singleportlag {enable | disable}
Parameters
disable|enable
EnablesordisablestheformationofsingleportLAGs.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
WhensingleportLAGsareenabled,LinkAggregrationGroupscanbeformedwhenonlyone
portisreceivingprotocoltransmissionsfromapartner.Whenthissettingisdisabled,twoormore
portsarerequiredtoformaLAG.
ThissettinghasnoeffectonexistingLAGscreatedwithmultiplememberports.Italsodoesnot
preventpreviouslyformedLAGsfromcomingupaftertheyhavegonedown,aslongasany
previousLAGmemberportscomeupconnectedtothesameswitchasbeforetheLAGwent
down.
Example
ThisexampleenablestheformationofsingleportLAGs:
C3(su)->set lacp singleportlag enable
Syntax
clear lacp singleportlag
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
7-50
Port Configuration
Example
ThisexampleshowshowtoresetthesingleportLAGfunctionbacktodisabled:
C3(su)->clear lacp singleportlag
Syntax
show port lacp port port-string {[status {detail | summary}] | [counters]}
Parameters
portportstring
DisplaysLACPinformationforspecificport(s).Foradetaileddescription
ofpossibleportstringvalues,refertoPortStringSyntaxUsedintheCLI
onpage71.
statusdetail|
summary
DisplaysLACPstatusindetailedorsummaryinformation.
counters
DisplaysLACPcounterinformation.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
Statedefinitions,suchasActorAdminStateandPartnerAdminState,areindicatedwithletter
abbreviations.Iftheshowportlacpcommanddisplaysoneormoreofthefollowingletters,it
meansthestateistruefortheassociatedactororpartnerports:
E=Expired
F=Defaulted
D=Distributing(txenabled)
C=Collecting(rxenabled)
S=Synchronized(actorandpartneragree)
G=Aggregationallowed
S/l=Short/LongLACPtimeout
A/p=Active/PassiveLACP
Formoreinformationaboutthesestates,refertosetportlacp(page 752)andtheIEEE802.32002
specification.
Examples
ThisexampleshowshowtodisplaydetailedLACPstatusinformationforportge.1.12:
C3(su)-> show port lacp port ge.1.12 status detail
SecureStack C3 Configuration Guide
7-51
Port Instance:
ge.1.12
ActorPort:
1411
ActorSystemPriority:
32768
ActorPortPriority:
32768
ActorAdminKey:
32768
ActorOperKey:
32768
ActorAdminState:
-----GlA
ActorOperState:
-F----lA
ActorSystemID:
00-e0-63-9d-b5-87
SelectedAggID:
none
AttachedAggID:
none
MuxState:
Detached
DebugRxState:
port Disabled
PartnerAdminPort:
1411
PartnerOperPort:
1411
PartnerAdminSystemPriority:
32768
PartnerOperSystemPriority:
32768
PartnerAdminPortPriority:
32768
PartnerOperPortPriority:
32768
PartnerAdminKey:
1411
PartnerOperKey:
1411
PartnerAdminState:
--DCSGlp
PartnerOperState:
--DC-Glp
PartnerAdminSystemID: 00-00-00-00-00-00
PartnerOperSystemID:
00-00-00-00-00-00
ThisexampleshowshowtodisplaysummarizedLACPstatusinformationforportge.1.12:
C3(su)->show port lacp port ge.1.12 status summary
Port
Aggr
Actor System
Partner System
Pri:
System ID: Key:
Pri: System ID:
Key:
ge.1.12
none [(32768,00e0639db587,32768),(32768,000000000000, 1411)]
ThisexampleshowshowtodisplayLACPcountersforportge.1.12:
C3(su)->show port lacp port ge.1.12 counters
Port Instance:
ge.1.12
LACPDUsRx:
11067
LACPDUsTx:
0
IllegalRx:
0
UnknownRx:
0
MarkerPDUsRx:
0
MarkerPDUsTx:
0
MarkerResponsePDUsRx:
0
MarkerResponsePDUsTx:
374
Syntax
set port lacp port port-string {[aadminkey aadminkey] [aadminstate {lacpactive |
lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire}]
[aportpri aportpri] [asyspri asyspri] [enable | [disable] [padminkey padminkey]
[padminport padminport] [padminportpri padminportpri] [padminstate {lacpactive |
lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire}]
[padminsysid padminsysid] [padminsyspri padminsyspri]
Parameters
7-52
portportstring
Specifiesthephysicalport(s)onwhichtoconfigureLACP.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage71.
aadminkey
aadminkey
Setstheportsactoradminkey.LACPwillusethisvaluetoformanoper
keyandwilldeterminewhichunderlyingphysicalportsarecapableof
aggregatingbycomparingoperkeys.Aggregatorportsallowonly
underlyingportswithoperkeysmatchingtheirstojointheirLAG.Valid
valuesare165535.Thedefaultkeyvalueis32768.
Port Configuration
aadminstate
lacpactive|
lacptimeout|
lacpagg|lacpsync
|lacpcollect|
lacpdist|lacpdef|
lacpexpire
SetstheportsactorLACPadministrativestatetoallowfor:
lacpactiveTransmittingLACPPDUs.
lacptimeoutTransmittingLACPPDUsevery1sec.vs30sec.(default).
lacpaggAggregationonthisport.
lacpsyncTransitiontosynchronizationstate.
lacpcollectTransitiontocollectionstate.
lacpdistTransitiontodistributionstate.
lacpdefTransitiontodefaultedstate.
lacpexpireTransitiontoexpiredstate.
aportpriaportpri
Setstheportsactorportpriority.Validvaluesare065535,withlower
valuesdesignatinghigherpriority.
asyspriasyspri
Setstheportsactorsystempriority.TheLACPimplementationonthe
SecureStackC3deviceusesthisvaluetodetermineaggregation
precedencewhentherearetwodevicescompetingforthesame
aggregator.Validvaluesare065535,withhigherprecedencegivento
lowervalues.
Note: Only one LACP system priority can be set on a SecureStack
C3 device, using either this command, or the set lacp asyspri
command (set lacp asyspri on page 7-47).
enable
(Optional)EnablesLACPDUprocessingonthisport.
disable
(Optional)DisablesLACPDUprocessingonthisport.
padminkey
padminkey
Setsadefaultvaluetouseastheportspartneradminkey.Onlyportswith
matchingadminkeysareallowedtoaggregate.Validvaluesare165535.
padminport
padminport
Setsadefaultvaluetouseastheportspartneradminvalue.Validvalues
are165535.
padminportpri
padminportpri
Setsadefaultvaluetouseastheportspartnerportpriority.Validvalues
are065535,withlowervaluesgivenhigherpriority.
padminstate
SetsaportspartnerLACPadministrativestate.Seeaadminstateforvalid
lacpactive|
options.
lacptimeout|
lacpagg|lacpsync
|lacpcollect|
lacpdist|lacpdef|
lacpexpire
padminsysid
padminsysid
SetsadefaultvaluetouseastheportspartnersystemID.ThisisaMAC
address.
padminsyspri
padminsyspri
Setsadefaultvaluetouseastheportspartnerpriority.Validvaluesare0
65535,withlowervaluesgivenhigherpriority.
Defaults
Atleastoneparametermustbeenteredperportstring.
Ifenableordisablearenotspecified,port(s)willbeenabledwiththeLACPparametersentered.
7-53
Mode
Switchcommand,readwrite.
Usage
LACPcommandsandparametersbeginningwithana(suchasaadminkey)setactorvalues.
Correspondingcommandsandparametersbeginningwithap(suchaspadminkey)set
correspondingpartnervalues.ActorreferstothelocaldeviceparticipatinginLACPnegotiation,
whilepartnerreferstoitsremotedevicepartnerattheotherendofthenegotiation.Actorsand
partnersmaintaincurrentstatusoftheotherviaLACPDUscontaininginformationabouttheir
portsLACPstatusandoperationalstate.
Example
Thisexampleshowshowtosettheactoradminkeyto3555forportge.3.16:
C3(su)->set port lacp port ge.3.16 aadminkey 3555
Syntax
clear port lacp port port-string {[aadminkey] [aportpri] [asyspri] [aadminstate
{lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef
| lacpexpire | all}] [padminsyspri] [padminsysid] [padminkey] [padminportpri]
[padminport] [padminstate {lacpactive | lacptimeout | lacpagg | lacpsync |
lacpcollect | lacpdist | lacpdef | lacpexpire | all}]}
Parameters
portportstring
Specifiesthephysicalport(s)onwhichLACPsettingswillbecleared.For
adetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage71.
aadminkey
Clearsaportsactoradminkey.
aportpri
Clearsaportsactorportpriority.
asyspri
Clearstheportsactorsystempriority.
Clearsaportsspecificactoradminstate,orallactoradminstate(s).For
aadminstate
descriptionsofspecificstates,refertothesetportlacpcommand(set
lacpactive|
portlacponpage752).
lacptimeout|
lacpagg|lacpsync
|lacpcollect|
lacpdist|lacpdef|
lacpexpire|all
7-54
padminsyspri
Clearstheportsdefaultpartnerpriorityvalue.
padminsysid
ClearstheportsdefaultpartnersystemID.
padminkey
Clearstheportsdefaultpartneradminkey.
padminportpri
Clearstheportsdefaultpartnerportpriority.
Port Configuration
padminport
DeletesapartnerportfromtheLACPconfiguration.
Clearstheportsspecificpartneradminstate,orallpartneradminstate(s).
padminstate
lacpactive|
lacptimeout|
lacpagg|lacpsync
|lacpcollect|
lacpdist|lacpdef|
lacpexpire|all
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
IfyousetaporttoLACPpassiveusingthecommandclearportlacpport<portstring>
aadminstatelacpactive,thecommandclearportlacpport<portstring>aadminstatelacptimeout
willalsobeaddedtotheconfiguration.Ifyouunsetthefirstcommand,itwillremovethesecond
commandautomaticallyfromtheconfigurationfile.
Example
Thisexampleshowshowtoclearalllinkaggregationparametersforportge.3.16:
C3(su)->clear port lacp port ge.3.16
7-55
Commands
For information about...
Refer to page...
7-56
7-57
7-57
7-58
7-58
7-59
Syntax
set port protected port-string group-id
Parameters
portstring
Specifiestheportorportstobeprotected.
groupid
Specifiestheidofthegrouptowhichtheportsshouldbeassigned.Idcan
rangefrom0to2.
Defaults
None.
Mode
Switchcommand,readwrite.
7-56
Port Configuration
Example
Thisexampleshowshowtoassignportsge.1.1throughge.1.3toprotectedportgroup1:
C3(rw)->set port protected ge.1.1-3 1
Syntax
show port protected [port-string] | [group-id]
Parameters
portstring
(Optional)Specifiestheportorportsforwhichtodisplayinformation.
groupid
(Optional)Specifiestheidofthegroupforwhichtodisplayinformation.
Idcanrangefrom0to2.
Defaults
Ifnoparametersareentered,informationaboutallprotectedportsisdisplayed.
Mode
Readonly.
Example
Thisexampleshowshowtodisplayinformationaboutallprotectedports:
C3(ro)->show port protected
Group id
Port
---------------------1
ge.1.1
1
ge.1.2
1
ge.1.3
Syntax
clear port protected [port-string] | [group-id]
Parameters
portstring
(Optional)Specifiestheportorportstoremovefromprotectedmode.
groupid
(Optional)Specifiestheidofthegrouptoremovefromprotectedmode.
Idcanrangefrom0to2.
Defaults
Ifnoparametersareentered,allprotectedportsandgroupsarecleared.
7-57
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearprotectedportsge.1.1throughge.1.3:
C3(rw)->clear port protected ge.1.1-3
Syntax
set port protected name group-id name
Parameters
groupid
Specifiestheidofthisgroup.Idcanrangefrom0to2.
name
Specifiesanameforthegroup.Thenamecanbeupto32charactersin
length.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoassignthenamegroup1toprotectedportgroup1:
C3(rw)->set port protected name 1 group1
Syntax
show port protected name group-id
Parameters
groupid
Defaults
None.
Mode
Readonly.
7-58
Port Configuration
Specifiestheidofthegrouptodisplay.Idcanrangefrom0to2.
Example
Thisexampleshowshowtoshowthenameofprotectedportgroup1:
C3(ro)->show port protected name 1
Group ID
Group Name
----------------------------1
group1
Syntax
clear port protected name group-id
Parameters
groupid
Specifiestheidofthegroupforwhichtoclearthename.Idcanrange
from0to2.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearthenameofprotectedportgroup1:
C3(rw)->clear port protected name 1
7-59
7-60
Port Configuration
8
SNMP Configuration
ThischapterdescribestheSimpleNetworkManagementProtocol(SNMP)setofcommandsand
howtousethem.
For information about...
Refer to page...
8-1
8-3
8-8
8-15
8-19
8-23
8-26
8-29
8-37
8-39
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of SNMP
configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
Version1(SNMPv1)ThisistheinitialimplementationofSNMP.RefertoRFC1157forafull
descriptionoffunctionality.
Version2(SNMPv2c)ThesecondreleaseofSNMP,describedinRFC1907,hasadditions
andenhancementstodatatypes,countersize,andprotocoloperations.
Version3(SNMPv3)ThisisthemostrecentversionofSNMP,andincludessignificant
enhancementstoadministrationandsecurity.SNMPv3isfullydescribedinRFC2571,
RFC 2572,RFC2573,RFC2574,andRFC2575.
8-1
Manageddevices(suchasaswitch).
SNMPagentsandMIBs,includingSNMPtraps,communitystrings,andRemoteMonitoring
(RMON)MIBs,whichrunonmanageddevices.
SNMPnetworkmanagementapplications,suchastheEnterasysNetSightapplication,which
communicatewithagentstogetstatisticsandalertsfromthemanageddevices.
SNMPv3
SNMPv3isaninteroperablestandardsbasedprotocolthatprovidessecureaccesstodevicesby
authenticatingandencryptingframesoverthenetwork.Theadvancedsecurityfeaturesprovided
inSNMPv3areasfollows:
MessageintegrityCollectsdatasecurelywithoutbeingtamperedwithorcorrupted.
AuthenticationDeterminesthemessageisfromavalidsource.
EncryptionScramblesthecontentsofaframetopreventitfrombeingseenbyan
unauthorizedsource.
UnlikeSNMPv1andSNMPv2c,inSNMPv3,theconceptofSNMPagentsandSNMPmanagersno
longerapply.TheseconceptshavebeencombinedintoanSNMPentity.AnSNMPentityconsists
ofanSNMPengineandSNMPapplications.AnSNMPengineconsistsofthefollowingfour
components:
DispatcherThiscomponentsendsandreceivesmessages.
MessageprocessingsubsystemThiscomponentacceptsoutgoingPDUsfromthe
dispatcherandpreparesthemfortransmissionbywrappingtheminamessageheaderand
returningthemtothedispatcher.Themessageprocessingsubsystemalsoacceptsincoming
messagesfromthedispatcher,processeseachmessageheader,andreturnstheenclosedPDU
tothedispatcher.
SecuritysubsystemThiscomponentauthenticatesandencryptsmessages.
AccesscontrolsubsystemThiscomponentdetermineswhichusersandwhichoperations
areallowedaccesstomanagedobjects.
8-2
SNMP Configuration
Table 8-1
Model
Security Level
Authentication
Encryption
How It Works
v1
NoAuthNoPriv
Community string
None
v2c
NoAuthNoPriv
Community string
None
v3
NoAuthNoPriv
User name
None
AuthNoPriv
MD5 or SHA
None
authPriv
MD5 or SHA
DES
Example
ThisexamplepermitsthepowergrouptomanageallMIBsviaSNMPv3:
C3(su)->set snmp access powergroup security-model usm
Configuration Considerations
CommandsforconfiguringSNMPontheSecureStackC3deviceareindependentduringthe
SNMPsetupprocess.Forinstance,targetparameterscanbespecifiedwhensettingupoptional
notificationfilterseventhoughtheseparametershavenotyetbeencreatedwiththesetsnmp
targetparamscommand.
8-3
Commands
For information about...
Refer to page...
8-4
8-5
Syntax
show snmp engineid
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPengineproperties:
C3(su)->show snmp engineid
EngineId: 80:00:15:f8:03:00:e0:63:9d:b5:87
Engine Boots
= 12
Engine Time
= 162181
Max Msg Size
= 2048
Table 82providesanexplanationofthecommandoutput.
Table 8-2
8-4
Output Field
What It Displays...
EngineId
Engine Boots
Engine Time
SNMP Configuration
Syntax
show snmp counters
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPcountervalues
C3(su)->show snmp counters
--- mib2 SNMP group counters:
snmpInPkts
= 396601
snmpOutPkts
= 396601
snmpInBadVersions
= 0
snmpInBadCommunityNames = 0
snmpInBadCommunityUses = 0
snmpInASNParseErrs
= 0
snmpInTooBigs
= 0
snmpInNoSuchNames
= 0
snmpInBadValues
= 0
snmpInReadOnlys
= 0
snmpInGenErrs
= 0
snmpInTotalReqVars
= 403661
snmpInTotalSetVars
= 534
snmpInGetRequests
= 290
snmpInGetNexts
= 396279
snmpInSetRequests
= 32
snmpInGetResponses
= 0
snmpInTraps
= 0
snmpOutTooBigs
= 0
snmpOutNoSuchNames
= 11
snmpOutBadValues
= 0
snmpOutGenErrs
= 0
snmpOutGetRequests
= 0
snmpOutGetNexts
= 0
snmpOutSetRequests
= 0
snmpOutGetResponses
= 396601
snmpOutTraps
= 0
snmpSilentDrops
= 0
snmpProxyDrops
= 0
--- USM Stats counters:
usmStatsUnsupportedSecLevels = 0
usmStatsNotInTimeWindows
= 0
usmStatsUnknownUserNames
= 0
8-5
usmStatsUnknownEngineIDs
usmStatsWrongDigests
usmStatsDecryptionErrors
= 0
= 0
= 0
Table 83providesanexplanationofthecommandoutput.
Table 8-3
8-6
Output Field
What It Displays...
snmpInPkts
snmpOutPkts
snmpInBadVersions
snmpInBadCommunityNames
snmpInBadCommunityUses
snmpInASNParseErrs
snmpInTooBigs
Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as tooBig.
snmpInNoSuchNames
Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as noSuchName.
snmpInBadValues
Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as badValue.
snmpInReadOnlys
Number of valid SNMP PDUs delivered to the SNMP protocol entity with
the value of the error-status field as "readOnly."
snmpInGenErrs
Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as "genErr."
snmpInTotalReqVars
snmpInTotalSetVars
snmpInGetRequests
snmpInGetNexts
snmpInSetRequests
snmpInGetResponses
snmpInTraps
snmpOutTooBigs
Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status field as "tooBig."
snmpOutNoSuchNames
Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status as "noSuchName."
SNMP Configuration
Table 8-3
Output Field
What It Displays...
snmpOutBadValues
Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status field as "badValue."
snmpOutGenErrs
Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status field as "genErr."
snmpOutGetRequests
snmpOutGetNexts
snmpOutSetRequests
snmpOutGetResponses
snmpOutTraps
snmpSilentDrops
Number of SNMP Get, Set, or Inform request error messages that were
dropped because the reply was larger than the requestors maximum
message size.
snmpProxyDrops
Number of SNMP Get, Set, or Inform request error messages that were
dropped because the reply was larger than the proxy targets maximum
message size.
usmStatsUnsupportedSec
Levels
usmStatsNotInTimeWindows
usmStatsUnknownUserNames
usmStatsUnknownEngineIDs
usmStatsWrongDigests
usmStatsDecriptionErrors
8-7
UserApersonregisteredinSNMPv3toaccessSNMPmanagement.
GroupAcollectionofuserswhosharethesameSNMPaccessprivileges.
CommunityAnameusedtoauthenticateSNMPv1andv2users.
Commands
For information about...
Refer to page...
8-8
8-9
8-11
8-11
8-12
8-13
8-13
8-14
8-15
Syntax
show snmp user [list] | [user] | [remote remote] [volatile | nonvolatile | readonly]
Parameters
list
(Optional)DisplaysalistofregisteredSNMPusernames.
user
(Optional)Displaysinformationaboutaspecificuser.
remoteremote
(Optional)DisplaysinformationaboutusersonaspecificremoteSNMP
engine.
volatile|nonvolatile (Optional)Displaysuserinformationforaspecifiedstoragetype.
|readonly
Defaults
Iflistisnotspecified,detailedSNMPinformationwillbedisplayed.
8-8
SNMP Configuration
Ifuserisnotspecified,informationaboutallSNMPuserswillbedisplayed.
Ifremoteisnotspecified,userinformationaboutthelocalSNMPenginewillbedisplayed.
Ifnotspecified,userinformationforallstoragetypeswillbedisplayed.
Mode
Switchcommand,readonly.
Examples
ThisexampleshowshowtodisplayanSNMPuserlist:
C3(su)->show snmp user list
--- SNMP user information ----- List of registered users:
Guest
admin1
admin2
netops
ThisexampleshowshowtodisplayinformationfortheSNMPguestuser:
(su)->show snmp user guest
--- SNMP user information --EngineId: 00:00:00:63:00:00:00:a1:00:00:00:00
Username
= Guest
Auth protocol
= usmNoAuthProtocol
Privacy protocol
= usmNoPrivProtocol
Storage type
= nonVolatile
Row status
= active
Table 84providesanexplanationofthecommandoutput.
Table 8-4
What It Displays...
EngineId
Username
Auth protocol
Privacy protocol
Storage type
Row status
Syntax
set snmp user user [remote remoteid] [encryption {des | aes}] [privacy
privpassword] [authentication {md5 | sha}] [authpassword] [volatile | nonvolatile]
8-9
Parameters
user
SpecifiesanamefortheSNMPv3user.
remoteremoteid
(Optional)RegisterstheuseronaspecificremoteSNMPengine.
encryptiondes|
aes
(Optional)Specifiestheencryptiontypeforthisuser.
AESreferstotheAdvancedEncryptionStandardusinga128bitkeysize.
privacyprivpassword (Optional)Specifiesanencryptionpassword.Minimumof8characters.
Requiredifencryptionisspecified.
authenticationmd5 (Optional)SpecifiestheauthenticationtyperequiredforthisuserasMD5
|sha
orSHA.
authpassword
(Optional)Specifiesapasswordforthisuserwhenauthenticationis
required.Minimumof8characters.
volatile|
nonvolatile
(Optional)Specifiesastoragetypeforthisuserentry.
Defaults
Ifremoteisnotspecified,theuserwillberegisteredforthelocalSNMPengine.
Ifencryptionisnotspecified,noencryptionwillbeapplied.
Ifauthenticationisnotspecified,noauthenticationwillbeapplied.
Ifstoragetypeisnotspecified,nonvolatilewillbeapplied.
Mode
Switchcommand,readwrite.
Usage
Althoughalltheparametersexceptfortheusernameareoptional,ifyouareenteringanyofthe
optionalparameters,itisrecommendedthatyouenterthemintheordershowninthesyntax
statement.
Examples
ThisexampleshowshowtocreateanewSNMPusernamednetops.Bydefault,thisuserwillbe
registeredonthelocalSNMPenginewithoutauthenticationandencryption.Entriesrelatedtothis
userwillbestoredinpermanent(nonvolatile)memory:
C3(su)->set snmp user netops
ThisexamplecreatesanewSNMPusernamedadminwithDESencryptionandMD5
authenticationrequired.Theencryptionpasswordisadmintest1andtheauthentication
passwordisadmintest2.Bydefault,thisuserwillberegisteredonthelocalSNMPengineand
entriesrelatedtothisuserwillbestoredinpermanent(nonvolatile)memory.
C3(su)->set snmp user admin encryption des privacy admintest1 authentication md5
admintest2
8-10
SNMP Configuration
Syntax
clear snmp user user [remote remote]
Parameters
user
SpecifiesanSNMPv3usertoremove.
remoteremote
(Optional)RemovestheuserfromaspecificremoteSNMPengine.
Defaults
Ifremoteisnotspecified,theuserwillberemovedfromthelocalSNMPengine.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoremovetheSNMPusernamedbill:
C3(su)->clear snmp user bill
Syntax
show snmp group [groupname groupname] [user user] [security-model {v1 | v2c | usm}]
[volatile | nonvolatile | read-only]
Parameters
groupname
groupname
(Optional)DisplaysinformationforaspecificSNMPgroup.
useruser
(Optional)Displaysinformationaboutuserswithinthespecifiedgroup.
securitymodelv1| (Optional)Displaysinformationaboutgroupsassignedtoaspecific
v2c|usm
securitySNMPmodel.
volatile|
nonvolatile|read
only
(Optional)DisplaysSNMPgroupinformationforaspecifiedstoragetype.
Defaults
Ifgroupnameisnotspecified,informationaboutallSNMPgroupswillbedisplayed.
Ifuserisnotspecified,informationaboutallSNMPuserswillbedisplayed.
Ifsecuritymodelisnotspecified,userinformationaboutallSNMPversionswillbedisplayed.
Ifnotspecified,informationforallstoragetypeswillbedisplayed.
8-11
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPgroupinformation:
C3(su)->show snmp group
--- SNMP group information --Security model
= SNMPv1
Security/user name
= public
Group name
= Anyone
Storage type
= nonVolatile
Row status
= active
Security model
Security/user name
Group name
Storage type
Row status
=
=
=
=
=
SNMPv1
public.router1
Anyone
nonVolatile
active
Table 85providesanexplanationofthecommandoutput.
Table 8-5
What It Displays...
Security model
Security/user name
Group name
Storage type
Row status
Syntax
set snmp group groupname user user security-model {v1 | v2c | usm} [volatile |
nonvolatile]
Parameters
groupname
SpecifiesanSNMPgroupnametocreate.
useruser
SpecifiesanSNMPv3usernametoassigntothegroup.
securitymodelv1| SpecifiesanSNMPsecuritymodeltoassigntothegroup.
v2c|usm
volatile|
nonvolatile
(Optional)SpecifiesastoragetypeforSNMPentriesassociatedwiththe
group.
Defaults
Ifstoragetypeisnotspecified,nonvolatilestoragewillbeapplied.
8-12
SNMP Configuration
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocreateanSNMPgroupcalledanyone,assignausernamedpublic
andassignSNMPv3securitytothegroup:
C3(su)->set snmp group anyone user public security-model usm
Syntax
clear snmp group groupname user [security-model {v1 | v2c | usm}]
Parameters
groupname
SpecifiestheSNMPgrouptobecleared.
user
SpecifiestheSNMPusertobecleared.
securitymodelv1| (Optional)Clearsthesettingsassociatedwithaspecificsecuritymodel.
v2c|usm
Defaults
If not specified, settings related to all security models will be cleared.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearallsettingsassignedtothepublicuserwithintheSNMPgroup
anyone:
C3(su)->clear snmp group anyone public
Syntax
show snmp community [name]
Parameters
name
(Optional)DisplaysSNMPinformationforaspecificcommunityname.
Defaults
Ifnameisnotspecified,informationwillbedisplayedforallSNMPcommunities.
8-13
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayinformationabouttheSNMPpubliccommunityname.For
adescriptionofthisoutput,refertosetsnmpcommunity(page814).
C3(su)->show snmp community public
--- Configured community strings --Name
Security name
Context
Transport tag
Storage type
Status
=
=
=
=
=
=
*********
public
nonVolatile
active
Syntax
set snmp community community [securityname securityname] [context context]
[transport transport] [volatile | nonvolatile]
Parameters
community
Specifiesacommunitygroupname.
securityname
securityname
(Optional)SpecifiesanSNMPsecuritynametoassociatewiththis
community.
contextcontext
(Optional)Specifiesasubsetofmanagementinformationthiscommunity
willbeallowedtoaccess.Validvaluesarefullorpartialcontextnames.To
reviewallcontextsconfiguredforthedevice,usetheshowsnmpcontext
commandasdescribedinshowsnmpcontextonpage 821.
transporttransport
(Optional)SpecifiesthesetoftransportendpointsfromwhichSNMP
requestwiththiscommunitynamewillbeaccepted.Makesalinktoa
targetaddresstable.
volatile|
nonvolatile
(Optional)Specifiesthestoragetypefortheseentries.
Defaults
Ifsecuritynameisnotspecified,thecommunitynamewillbeused.
Ifcontextisnotspecified,thedefault(NULL)contextisapplied.
Iftransporttagisnotspecified,nonewillbeapplied.
Ifstoragetypeisnotspecified,nonvolatilewillbeapplied.
Mode
Switchcommand,readwrite.
8-14
SNMP Configuration
Usage
Whenyouconfigureacommunityname,ifyoudontspecifyacontextwiththecontextparameter,
thedefault(NULL)contextisapplied.Ifyouwanttochangeaconfiguredcontextbacktothe
default(NULL)context,enterahyphenasthevalueofthecontextparameter,asshowninthe
Examplesbelow.
Examples
ThisexampleshowshowtosetanSNMPcommunitynamecalledvip.
C3(su)->set snmp community vip
TheexampleshowshowtosetthecontextforSNMPcommunityviptothedefaultNULL
context.
C3(su)->set snmp community vip context -
Syntax
clear snmp community name
Parameters
name
SpecifiestheSNMPcommunitynametoclear.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodeletethecommunitynamevip.
C3(su)->clear snmp community vip
8-15
Commands
For information about...
Refer to page...
8-16
8-18
8-19
Syntax
show snmp access [groupname] [security-model {v1 | v2c | usm}] [noauthentication
| authentication | privacy] [context context] [volatile | nonvolatile | read-only]
Parameters
groupname
(Optional)DisplaysaccessinformationforaspecificSNMPv3group.
securitymodelv1| (Optional)DisplaysaccessinformationforSNMPsecuritymodelversion
v2c|usm
1,2cor3(usm).
noauthentication|
authentication|
privacy
(Optional)Displaysaccessinformationforaspecificsecuritylevel.
contextcontext
(Optional)Displaysaccessinformationforaspecificcontext.Fora
descriptionofhowtospecifySNMPcontexts,refertoUsingSNMP
ContextstoAccessSpecificMIBsonpage 83.
volatile|
nonvolatile|read
only
(Optional)Displaysaccessentriesforaspecificstoragetype.
Defaults
Ifgroupnameisnotspecified,accessinformationforallSNMPgroupswillbedisplayed.
Ifsecuritymodelisnotspecified,accessinformationforallSNMPversionswillbedisplayed.
Ifnoauthentication,authenticationorprivacyarenotspecified,accessinformationforall
securitylevelswillbedisplayed.
Ifcontextisnotspecified,allcontextswillbedisplayed.
Ifvolatile,nonvolatileorreadonlyarenotspecified,allentriesofallstoragetypeswillbe
displayed.
Mode
Switchcommand,readonly.
8-16
SNMP Configuration
Example
ThisexampleshowshowtodisplaySNMPaccessinformation:
C3(su)->show snmp
Group
=
Security model =
Security level =
Read View
=
Write View
=
Notify View
=
Context match
=
Storage type
=
Row status
=
access
SystemAdmin
USM
noAuthNoPriv
All
Group
Security model
Security level
Read View
Write View
Notify View
Context match
Storage type
Row status
NightOperator
USM
noAuthNoPriv
All
=
=
=
=
=
=
=
=
=
All
exact match
nonVolatile
active
All
exact match
nonVolatile
active
Table 86providesanexplanationofthecommandoutput.
Table 8-6
Output Field
What It Displays...
Group
Security model
Security level
Read View
Name of the view that allows this group to view SNMP MIB objects.
Write View
Name of the view that allows this group to configure the contents of the
SNMP agent.
Notify View
Name of the view that allows this group to send an SNMP trap message.
Context match
Whether or not SNMP context match must be exact (full context name
match) or a partial match with a given prefix.
Storage type
Whether access entries for this group are stored in volatile, nonvolatile
or read-only memory.
Row status
8-17
Syntax
set snmp access groupname security-model {v1 | v2c | usm} [noauthentication |
authentication | privacy] [context context] [exact | prefix] [read read] [write
write] [notify notify] [volatile | nonvolatile]
Parameters
groupname
SpecifiesanameforanSNMPv3group.
securitymodelv1| SpecifiesSNMPversion1,2cor3(usm).
v2c|usm
noauthentication|
authentication|
privacy
(Optional)AppliesSNMPsecuritylevelasnoauthentication,
authentication(withoutprivacy)orprivacy.Privacyspecifiesthat
messagessentonbehalfoftheuserareprotectedfromdisclosure.
contextcontextexact (Optional)Setsthecontextforthisaccessconfigurationandspecifiesthat
|prefix
thematchmustbeexact(matchingthewholecontextstring)oraprefix
matchonly.ContextisasubsetofmanagementinformationthisSNMP
groupwillbeallowedtoaccess.Validvaluesarefullorpartialcontext
names.Toreviewallcontextsconfiguredforthedevice,usetheshow
snmpcontextcommandasdescribedinshowsnmpcontexton
page 821.
readread
(Optional)Specifiesareadaccessview.
writewrite
(Optional)Specifiesawriteaccessview.
notifynotify
(Optional)Specifiesanotifyaccessview.
volatile|
nonvolatile|read
only
(Optional)StoresassociatedSNMPentriesastemporaryorpermanent,or
readonly.
Defaults
Ifsecuritylevelisnotspecified,noauthenticationwillbeapplied.
Ifcontextisnotspecified,accesswillbeenabledforthedefaultcontext.Ifcontextisspecified
withoutacontextmatch,exactmatchwillbeapplied.
Ifreadviewisnotspecifiednonewillbeapplied.
Ifwriteviewisnotspecified,nonewillbeapplied.
Ifnotifyviewisnotspecified,nonewillbeapplied.
Ifstoragetypeisnotspecified,entrieswillbestoredaspermanentandwillbeheldthroughdevice
reboot.
Mode
Switchcommand,readwrite.
Example
ThisexamplepermitsthepowergrouptomanageallMIBsviaSNMPv3:
C3(su)->set snmp access powergroup security-model usm
8-18
SNMP Configuration
Syntax
clear snmp access groupname security-model {v1 | v2c | usm} [noauthentication |
authentication | privacy] [context context]
Parameters
groupname
SpecifiesthenameoftheSNMPgroupforwhichtoclearaccess.
securitymodelv1| SpecifiesthesecuritymodeltobeclearedfortheSNMPaccessgroup.
v2c|usm
noauthentication|
authentication|
privacy
(Optional)ClearsaspecificsecuritylevelfortheSNMPaccessgroup.
contextcontext
(Optional)ClearsaspecificcontextfortheSNMPaccessgroup.Enter//
toclearthedefaultcontext.
Defaults
Ifsecuritylevelisnotspecified,alllevelswillbecleared.
Ifcontextisnotspecified,nonewillbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearSNMPversion3accessforthemisgroupviathe
authenticationprotocol:
C3(su)->clear snmp access mis-group security-model usm authentication
Commands
For information about...
Refer to page...
8-20
8-21
8-21
8-22
8-19
Syntax
show snmp view [viewname] [subtree oid-or-mibobject] [volatile | nonvolatile |
read-only]
Parameters
viewname
(Optional)DisplaysinformationforaspecificMIBview.
subtreeoidormibobject
(Optional)DisplaysinformationforaspecificMIBsubtreewhen
viewnameisspecified.
volatile|nonvolatile|
readonly
(Optional)Displaysentriesforaspecificstoragetype.
Defaults
Ifnoparametersarespecified,allSNMPMIBviewconfigurationinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPMIBviewconfigurationinformation:
C3(su)->show snmp view
--- SNMP MIB View information --View Name
= All
Subtree OID
= 1
Subtree mask
=
View Type
= included
Storage type
= nonVolatile
Row status
= active
View Name
Subtree OID
Subtree mask
View Type
Storage type
Row status
=
=
=
=
=
=
All
0.0
View Name
Subtree OID
Subtree mask
View Type
Storage type
Row status
=
=
=
=
=
=
Network
1.3.6.1.2.1
included
nonVolatile
active
included
nonVolatile
active
Table 87providesanexplanationofthecommandoutput.Fordetailsonusingthesetsnmpview
commandtoassignvariables,refertosetsnmpviewonpage 821.
8-20
SNMP Configuration
Table 8-7
Output Field
What It Displays...
View Name
Subtree OID
Subtree mask
View Type
Whether or not subtree use must be included or excluded for this view.
Storage type
Row status
Syntax
show snmp context
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
AnSNMPcontextisacollectionofmanagementinformationthatcanbeaccessedbyanSNMP
agentorentity.ThedefaultcontextallowsallSNMPagentstoaccessallmanagementinformation
(MIBs).Whencreatedusingthesetsnmpaccesscommand(setsnmpaccessonpage 818),other
contextscanbeappliedtolimitaccesstoasubsetofmanagementinformation.
Example
ThisexampleshowshowtodisplayalistofallSNMPcontextsknowntothedevice:
C3(su)->show snmp context
--- Configured contexts:
default context (all mibs)
Syntax
set snmp view viewname viewname subtree subtree [mask mask] [included | excluded]
[volatile | nonvolatile]
8-21
Parameters
viewnameviewname SpecifiesanameforaMIBview.
subtreesubtree
SpecifiesaMIBsubtreename.
maskmask
(Optional)Specifiesabitmaskforasubtree.
included|
excluded
(Optional)Specifiessubtreeuse(default)ornosubtreeuse.
volatile|
nonvolatile
(Optional)Specifiestheuseoftemporaryorpermanent(default)storage.
Defaults
Ifnotspecified,maskwillbesetto255.255.255.255
Ifnotspecified,subtreeusewillbeincluded.
Ifstoragetypeisnotspecified,nonvolatile(permanent)willbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetanSNMPMIBviewtopublicwithasubtreenameof1.3.6.1
included:
C3(su)->set snmp view viewname public subtree 1.3.6.1 included
Syntax
clear snmp view viewname subtree
Parameters
viewname
SpecifiestheMIBviewnametobedeleted.
subtree
SpecifiesthesubtreenameoftheMIBviewtobedeleted.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodeleteSNMPMIBviewpublic:
C3(su)->clear snmp view public 1.3.6.1
8-22
SNMP Configuration
Commands
For information about...
Refer to page...
8-23
8-24
8-25
Syntax
show snmp targetparams [targetParams] [volatile | nonvolatile | read-only]
Parameters
targetParams
(Optional)Displaysentriesforaspecifictargetparameter.
volatile|nonvolatile|
readonly
(Optional)Displaystargetparameterentriesforaspecificstorage
type.
Defaults
IftargetParamsisnotspecified,entriesassociatedwithalltargetparameterswillbedisplayed.
Ifnotspecified,entriesofallstoragetypeswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPtargetparametersinformation:
C3(su)->show snmp targetparams
--- SNMP TargetParams information --Target Parameter Name
= v1ExampleParams
Security Name
= public
Message Proc. Model
= SNMPv1
Security Level
= noAuthNoPriv
Storage type
= nonVolatile
Row status
= active
8-23
=
=
=
=
=
=
v2cExampleParams
public
SNMPv2c
noAuthNoPriv
nonVolatile
active
=
=
=
=
=
=
v3ExampleParams
CharlieDChief
USM
authNoPriv
nonVolatile
active
Table 88providesanexplanationofthecommandoutput.
Table 8-8
What It Displays...
Unique identifier for the parameter in the SNMP target parameters table.
Maximum length is 32 bytes.
Security Name
SNMP version.
Security Level
Storage type
Row status
Syntax
set snmp targetparams paramsname user user security-model {v1 | v2c | usm} messageprocessing {v1 | v2c | v3} [noauthentication | authentication | privacy] [volatile
| nonvolatile]
Parameters
paramsname
SpecifiesanameidentifyingparametersusedtogenerateSNMPmessages
toaparticulartarget.
useruser
SpecifiesanSNMPv1orv2communitynameoranSNMPv3username.
Maximumlengthis32bytes.
securitymodelv1| SpecifiestheSNMPsecuritymodelappliedtothistargetparameteras
v2c|usm
version1,2cor3(usm).
message
SpecifiestheSNMPmessageprocessingmodelappliedtothistarget
processingv1|v2c parameterasversion1,2cor3.
|v3
8-24
SNMP Configuration
noauthentication|
authentication|
privacy
(Optional)SpecifiestheSNMPsecuritylevelappliedtothistarget
parameterasnoauthentication,authentication(withoutprivacy)or
privacy.Privacyspecifiesthatmessagessentonbehalfoftheuserare
protectedfromdisclosure.
volatile|
nonvolatile
(Optional)Specifiesthestoragetypeappliedtothistargetparameter.
Defaults
None.
Ifnotspecified,securitylevelwillbesettonoauthentication.
Ifnotspecified,storagetypewillbesettononvolatile.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetSNMPtargetparametersnamedv1ExampleParamsforauser
namedfredusingversion3securitymodelandmessageprocessing,andauthentication:
C3(su)->set snmp targetparams v1ExampleParams user fred security-model usm
message-processing v3 authentication
Syntax
clear snmp targetparams targetParams
Parameters
targetParams
SpecifiesthenameoftheparameterintheSNMPtargetparameterstable
tobecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearSNMPtargetparametersnamedv1ExampleParams:
C3(su)->clear snmp targetparams v1ExampleParams
8-25
Commands
For information about...
Refer to page...
8-26
8-27
8-28
Syntax
show snmp targetaddr [targetAddr] [volatile | nonvolatile | read-only]
Parameters
targetAddr
(Optional)Displaysinformationforaspecifictargetaddressname.
volatile|nonvolatile (Optional)Whentargetaddressisspecified,displaystargetaddress
|readonly
informationforaspecificstoragetype.
Defaults
IftargetAddrisnotspecified,entriesforalltargetaddressnameswillbedisplayed.
Ifnotspecified,entriesofallstoragetypeswillbedisplayedforatargetaddress.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPtargetaddressinformation:
C3(su)->show snmp targetaddr
Target Address Name
= labmachine
Tag List
= v2cTrap
IP Address
= 10.2.3.116
UDP Port#
= 162
Target Mask
= 255.255.255.255
Timeout
= 1500
Retry count
= 4
Parameters
= v2cParams
Storage type
= nonVolatile
8-26
SNMP Configuration
Row status
= active
Table 89providesanexplanationofthecommandoutput.
Table 8-9
Output Field
What It Displays...
Tag List
IP Address
Target IP address.
UDP Port#
Target Mask
Timeout
Retry count
Parameters
Storage type
Row status
Syntax
set snmp targetaddr targetaddr ipaddr param param [udpport udpport] [mask mask]
[timeout timeout] [retries retries] [taglist taglist] [volatile | nonvolatile]
Parameters
targetaddr
SpecifiesauniqueidentifiertoindexthesnmpTargetAddrTable.
Maximumlengthis32bytes.
ipaddr
SpecifiestheIPaddressofthetarget.
paramparam
SpecifiesanentryintheSNMPtargetparameterstable,whichisused
whengeneratingamessagetothetarget.Maximumlengthis32bytes.
udpportudpport
(Optional)SpecifieswhichUDPportofthetargethosttouse.
maskmask
(Optional)SpecifiestheIPmaskofthetarget.
timeouttimeout
(Optional)Specifiesthemaximumroundtriptimeallowedto
communicatetothistargetaddress.Thisvalueisin.01secondsandthe
defaultis1500(15seconds.)
retriesretries
(Optional)Specifiesthenumberofmessageretriesallowedifaresponseis
notreceived.Defaultis3.
8-27
taglisttaglist
(Optional)SpecifiesalistofSNMPnotifytagvalues.Thistagsalocation
tothetargetaddressasaplacetosendnotifications.Listmustbeenclosed
inquotesandtagvaluesmustbeseparatedbyaspace(forexample,
tag1tag2).
volatile|
nonvolatile
(Optional)Specifiestemporary(default),orpermanentstorageforSNMP
entries.
Defaults
Ifnotspecified,udpportwillbesetto162.
Ifnotspecified,maskwillbesetto255.255.255.255
Ifnotspecified,timeoutwillbesetto1500.
Ifnotspecified,numberofretrieswillbesetto3.
Iftaglistisnotspecified,nonewillbeset.
Ifnotspecified,storagetypewillbenonvolatile.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoconfigureatrapnotificationcalledTrapSink.Thistrapnotification
willbesenttotheworkstation192.168.190.80(whichistargetaddresstr).Itwillusesecurity
andauthorizationcriteriacontainedinatargetparametersentrycalledv2cExampleParams.For
moreinformationonconfiguringabasicSNMPtrap,refertoCreatingaBasicSNMPTrap
Configurationonpage 837:
C3(su)->set snmp targetaddr tr 192.168.190.80 param v2cExampleParams taglist
TrapSink
Syntax
clear snmp targetaddr targetAddr
Parameters
targetAddr
Specifiesthetargetaddressentrytodelete.
Defaults
None.
Mode
Switchcommand,readwrite.
8-28
SNMP Configuration
Example
ThisexampleshowshowtoclearSNMPtargetaddressentrytr:
C3(su)->clear snmp targetaddr tr
Purpose
ToconfigureSNMPnotificationparametersandoptionalfilters.Notificationsareentitieswhich
handlethegenerationofSNMPv1andv2trapsorSNMPv3informsmessagestoselect
managementtargets.Optionalnotificationfiltersidentifywhichtargetsshouldnotreceive
notifications.ForasampleSNMPtrapconfigurationshowinghowSNMPnotificationparameters
areassociatedwithsecurityandauthorizationcriteria(targetparameters)andmappedtoa
managementtargetaddress,refertoCreatingaBasicSNMPTrapConfigurationonpage 837.
Commands
For information about...
Refer to page...
show newaddrtrap
8-30
set newaddrtrap
8-30
8-31
8-32
8-33
8-33
8-34
8-35
8-36
8-36
8-37
8-29
show newaddrtrap
show newaddrtrap
UsethiscommandtodisplaytheglobalandportspecificstatusoftheSNMPnewMACaddresses
trapfunction.
Syntax
show newaddrtrap [port-string]
Parameters
portstring
(Optional)DisplaysthestatusofthenewMACaddressestrapfunction
onspecificports.
Defaults
Ifportstringisnotspecified,thestatusofthenewMACaddressestrapfunctionwillbedisplayed
forallports.
Mode
Switchcommand,readonly.
Usage
Bydefault,thisfunctionisdisabledgloballyandperport.
Example
ThisexampledisplaystheNewAddressTrapstateforGigabitEthernetports1through5in
unit/slot1.
C3(ro)->show newaddrtrap ge.1.1-5
New Address Traps Globally disabled
Port
--------ge.1.1
ge.1.2
ge.1.3
ge.1.4
ge.1.5
Enable State
-----------disabled
disabled
disabled
disabled
disabled
set newaddrtrap
UsethiscommandtoenableordisableSNMPtrapmessaging,globallyorononeormoreports,
whennewsourceMACaddressesaredetected.
Syntax
set newaddrtrap [port-string] {enable | disable}
8-30
SNMP Configuration
Parameters
portstring
(Optional)EnableordisablethenewMACaddressestrapfunctionon
specificports.
enable|disable
EnableordisablethenewMACaddressestrapfunction.Ifentered
withouttheportstringparameter,enablesordisablesthefunction
globally.Whenenteredwiththeportstringparameter,enablesor
disablesthefunctiononspecificports.
Defaults
Ifportstringisnotspecified,thetrapfunctionissetglobally.
Mode
Switchmode,readwrite.
Usage
ThiscommandenablesanddisablessendingSNMPtrapmessageswhenanewsourceMAC
addressisdetectedbyaport.IftheportisaCDPport,however,trapsfornewsourceMAC
addresseswillnotbesent.
Thedefaultmodeisdisabledgloballyandperport.
Example
ThisexampleenablesthetrapfunctiongloballyandthenonGigabitEthernetports1through5in
unit/slot1.
C3(rw)->set newaddrtrap enable
C3(rw)->set newaddrtrap ge.1.1-5 enable
Syntax
show snmp notify [notify] [volatile | nonvolatile | read-only]
Parameters
notify
(Optional)Displaysnotifyentriesforaspecificnotifyname.
volatile|
nonvolatile|read
only
(Optional)Displaysnotifyentriesforaspecificstoragetype.
Defaults
Ifanotifynameisnotspecified,allentrieswillbedisplayed.
Ifvolatile,nonvolatile,orreadonlyarenotspecified,allstoragetypeentrieswillbedisplayed.
Mode
Switchcommand,readonly.
SecureStack C3 Configuration Guide
8-31
Example
ThisexampleshowshowtodisplaytheSNMPnotifyinformation:
C3(su)->show snmp notify
--- SNMP notifyTable information --Notify name
= 1
Notify Tag
= Console
Notify Type
= trap
Storage type
= nonVolatile
Row status
= active
Notify name
Notify Tag
Notify Type
Storage type
Row status
=
=
=
=
=
2
TrapSink
trap
nonVolatile
active
Table 810providesanexplanationofthecommandoutput.
Table 8-10
Output Field
What It Displays...
Notify name
Notify Tag
Notify Type
Storage type
Row status
Syntax
set snmp notify notify tag tag [trap | inform] [volatile | nonvolatile]
Parameters
notify
SpecifiesanSNMPnotifyname.
tagtag
SpecifiesanSNMPnotifytag.ThisbindsthenotifynametotheSNMP
targetaddresstable.
trap|inform
(Optional)SpecifiesSNMPv1orv2Trapmessages(default)orSNMPv3
InformRequestmessages.
volatile|
nonvolatile
(Optional)Specifiestemporary(default),orpermanentstorageforSNMP
entries.
Defaults
Ifnotspecified,messagetypewillbesettotrap.
8-32
SNMP Configuration
Ifnotspecified,storagetypewillbesettononvolatile.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetanSNMPnotifyconfigurationwithanotifynameofhelloanda
notifytagofworld.Notificationswillbesentastrapmessagesandstoragetypewill
automaticallydefaulttopermanent:
C3(su)->set snmp notify hello tag world trap
Syntax
clear snmp notify notify
Parameters
notify
SpecifiesanSNMPnotifynametoclear.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheSNMPnotifyconfigurationforhello:
C3(su)->clear snmp notify hello
Syntax
show snmp notifyfilter [profile] [subtree oid-or-mibobject] [volatile |
nonvolatile | read-only]
8-33
Parameters
profile
(Optional)Displaysaspecificnotifyfilter.
subtreeoidor
mibobject
(Optional)Displaysanotifyfilterwithinaspecificsubtree.
volatile|
nonvolatile|read
only
(Optional)Displaysnotifyfilterentriesofaspecificstoragetype.
Defaults
Ifnoparametersarespecified,allnotifyfilterinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Usage
SeeAboutSNMPNotifyFiltersonpage 829formoreinformationaboutnotifyfilters.
Example
ThisexampleshowshowtodisplaySNMPnotifyfilterinformation.Inthiscase,thenotifyprofile
pilot1insubtree1.3.6willnotreceiveSNMPnotificationmessages:
C3(su)->show snmp notifyfilter
--- SNMP notifyFilter information --Profile
= pilot1
Subtree
= 1.3.6
Filter type
= included
Storage type
= nonVolatile
Row status
= active
Syntax
set snmp notifyfilter profile subtree oid-or-mibobject [mask mask] [included |
excluded] [volatile | nonvolatile]
Parameters
8-34
profile
SpecifiesanSNMPfilternotifyname.
subtreeoidor
mibobject
SpecifiesaMIBsubtreeIDtargetforthefilter.
maskmask
(Optional)Appliesasubtreemask.
SNMP Configuration
included|
excluded
(Optional)Specifiesthatsubtreeisincludedorexcluded.
volatile|
nonvolatile
(Optional)Specifiesastoragetype.
Defaults
Ifnotspecified,maskisnotset.
Ifnotspecified,subtreewillbeincluded.
Ifstoragetypeisnotspecified,nonvolatile(permanent)willbeapplied.
Mode
Switchcommand,readwrite.
Usage
SeeAboutSNMPNotifyFiltersonpage 829formoreinformationaboutnotifyfilters.
Example
ThisexampleshowshowtocreateanSNMPnotifyfiltercalledpilot1withaMIBsubtreeIDof
1.3.6:
C3(su)->set snmp notifyfilter pilot1 subtree 1.3.6
Syntax
clear snmp notifyfilter profile subtree oid-or-mibobject
Parameters
profile
SpecifiesanSNMPfilternotifynametodelete.
subtreeoidor
mibobject
SpecifiesaMIBsubtreeIDcontainingthefiltertobedeleted.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodeletetheSNMPnotifyfilterpilot1:
C3(su)->clear snmp notifyfilter pilot1 subtree 1.3.6
8-35
Syntax
show snmp notifyprofile [profile] [targetparam targetparam] [volatile |
nonvolatile | read-only]
Parameters
profile
(Optional)Displaysaspecificnotifyprofile.
targetparam
targetparam
(Optional)Displaysentriesforaspecifictargetparameter.
volatile|
nonvolatile|read
only
(Optional)Displaysnotifyfilterentriesofaspecificstoragetype.
Defaults
Ifnoparametersarespecified,allnotifyprofileinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNMPnotifyinformationfortheprofilenamedarea51:
C3(su)->show snmp notifyprofile area51
--- SNMP notifyProfile information --Notify Profile = area51
TargetParam
= v3ExampleParams
Storage type
= nonVolatile
Row status
= active
Syntax
set snmp notifyprofile profile targetparam targetparam [volatile | nonvolatile]
8-36
SNMP Configuration
Parameters
profile
SpecifiesanSNMPfilternotifyname.
targetparam
targetparam
SpecifiesanassociatedentryintheSNMPTargetParamsTable.
volatile|
nonvolatile
(Optional)Specifiesastoragetype.
Defaults
Ifstoragetypeisnotspecified,nonvolatile(permanent)willbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocreateanSNMPnotifyprofilenamedarea51andassociateatarget
parametersentry.
C3(su)->set snmp notifyprofile area51 targetparam v3ExampleParams
Syntax
clear snmp notifyprofile profile targetparam targetparam
Parameters
profile
SpecifiesanSNMPfilternotifynametodelete.
targetparam
targetparam
SpecifiesanassociatedentryinthesnmpTargetParamsTable.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodeleteSNMPnotifyprofilearea51:
C3(su)->clear snmp notifyprofile area51 targetparam v3ExampleParams
8-37
occur.ThefollowingconfigurationexampleshowshowtouseCLIcommandstoassociateSNMP
notificationparameterswithsecurityandauthorizationcriteria(targetparameters),andmapthe
parameterstoamanagementtargetaddress.
Note: This example illustrates how to configure an SNMPv2 trap notification. Creating an
SNMPv1 or v3 Trap, or an SNMPv3 Inform notification would require using the same commands
with different parameters, where appropriate. Always ensure that v1/v2 communities or v3 users
used for generating traps or informs are pre-configured with enough privileges to access
corresponding MIBs.
CompleteanSNMPv2trapconfigurationonaSecureStackC3deviceasfollows:
1.
CreateacommunitynamethatwillactasanSNMPuserpassword.
2.
CreateanSNMPtargetparametersentrytoassociatesecurityandauthorizationcriteriatothe
usersinthecommunitycreatedinStep1.
3.
VerifyifanyapplicableSNMPnotificationentriesexist,orcreateanewone.Youwillusethis
entrytosendSNMPnotificationmessagestotheappropriatemanagementtargetscreatedin
Step 2.
4.
CreateatargetaddressentrytobindamanagementIPaddressto:
ThenotificationentryandtagnamecreatedinStep3and
ThetargetparametersentrycreatedinStep2.
Table 811showsthecommandsusedtocompleteanSNMPv2trapconfigurationona
SecureStackC3device.
Table 8-11
To do this...
Example
Thisexampleshowshowto:
CreateanSNMPcommunitycalledmgmt.
ConfigureatrapnotificationcalledTrapSink.
Thistrapnotificationwillbesentwiththecommunitynamemgmttotheworkstation
192.168.190.80(whichistargetaddresstr).Itwillusesecurityandauthorizationcriteriacontained
inatargetparametersentrycalledv2cExampleParams.
C3(su)->set snmp community mgmt
C3(su)->set snmp targetparams v2cExampleParams user mgmt
security-model v2c message-processing v2c
C3(su)->set snmp notify entry1 tag TrapSink
C3(su)->set snmp targetaddr tr 192.168.190.80 param v2cExampleParams taglist
TrapSink
8-38
SNMP Configuration
Determinesifthekeysfortrapdoorsdoexist.Intheexampleconfigurationabove,the
keythatSNMPislookingforisthenotificationentrycreatedwiththesetsnmpnotify
commandwhich,inthiscase,isakeylabeledentry1.
2.
Searchesforthedoorsmatchingsuchakey.Forexample,theparameterssetfortheentry1key
showsthatitopensonlythedoorTrapSink.
3.
VerifiesthatthespecifieddoorTrapSinkis,infact,available.Inthiscaseitwasbuiltusingthe
setsnmptargetaddrcommand.Thiscommandalsospecifiesthatthisdoorleadstothe
managementstation192.168.190.80,andtheprocedure(targetparams)tocrossthedoorstep
iscalledv2ExampleParams.
4.
Verifiesthatthev2ExampleParamsdescriptionofhowtostepthroughthedooris,infact,
there.Theagentcheckstargetparamsentriesanddeterminesthisdescriptionwasmadewith
thesetsnmptargetparamscommand,whichtellsexactlywhichSNMPprotocoltouseand
whatcommunitynametoprovide.Inthiscase,thecommunitynameismgmt.
5.
Verifiesthatthemgmtcommunitynameisavailable.Inthiscase,ithasbeenconfiguredusing
thesetsnmpcommunitycommand.
6.
Sendsthetrapnotificationmessage.
Commands
For information about...
Refer to page...
8-39
8-40
8-41
Syntax
show snmp interface
Parameters
None.
8-39
Defaults
None.
Mode
Switchmode,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.Inthiscase,theIPaddressassignedto
loopbackinterface1willbeusedasthesourceIPaddressoftheSNMPagent.
C3(rw)->show snmp interface
loopback 1
192.168.10.1
Syntax
set snmp interface {loopback loop-ID | vlan vlan-ID}
Parameters
loopbackloopID
Specifiestheloopbackinterfacetobeused.ThevalueofloopIDcan
rangefrom0to7.
vlanvlanID
SpecifiestheVLANinterfacetobeused.ThevalueofvlanIDcanrange
from1to4093.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThiscommandallowsyoutoconfigurethesourceIPaddressusedbytheSNMPagentwhen
generatingSNMPtraps.Anyofthemanagementinterfaces,includingVLANroutinginterfaces,
canbeconfiguredasthesourceIPaddressusedinpacketsgeneratedbytheSNMPagent.
AninterfacemusthaveanIPaddressassignedtoitbeforeitcanbesetbythiscommand.
Ifnointerfaceisspecified,thentheIPaddressoftheHostinterfacewillbeused.
Ifanonloopbackinterfaceisconfiguredwiththiscommand,applicationpacketegressis
restrictedtothatinterfaceiftheservercanbereachedfromthatinterface.Otherwise,thepackets
aretransmittedoverthefirstavailableroute.Packetsfromtheapplicationserverarereceivedon
theconfiguredinterface.
Ifaloopbackinterfaceisconfigured,andtherearemultiplepathstotheapplicationserver,the
outgoinginterface(gateway)isdeterminedbasedonthebestroutelookup.Packetsfromthe
applicationserverarethenreceivedonthesendinginterface.Ifrouteredundancyisrequired,
therefore,aloopbackinterfaceshouldbeconfigured.
8-40
SNMP Configuration
Example
ThisexampleconfiguresanIPaddressonVLANinterface100andthensetsthatinterfaceasthe
SNMPagentsourceIPaddress.
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
C3(rw)->router(Config-if(Vlan 100))#exit
C3(rw)->router(Config)#exit
C3(rw)->router#exit
C3(rw)->router>exit
C3(rw)->set snmp interface vlan 100
192.168.10.1
Syntax
clear snmp interface
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThiscommandreturnstheinterfaceusedforthesourceIPaddressoftheSNMPagentbacktothe
defaultoftheHostinterface.
C3(rw)->show snmp interface
vlan 100
192.168.10.1
8-41
8-42
SNMP Configuration
9
Spanning Tree Configuration
ThischapterdescribestheSpanningTreeConfigurationsetofcommandsandhowtousethem.
For information about...
Refer to page...
9-1
9-3
9-34
9-42
Caution: Spanning Tree configuration should be performed only by personnel who are very
knowledgeable about Spanning Trees and the configuration of the Spanning Tree Algorithm.
Otherwise, the proper operation of the network could be at risk.
RSTP
TheIEEE802.1wRapidSpanningProtocol(RSTP),anevolutionof802.1D,canachievemuch
fasterconvergencethanlegacySTPinaproperlyconfigurednetwork.RSTPsignificantlyreduces
thetimetoreconfigurethenetworksactivetopologywhenphysicaltopologyorconfiguration
parameterchangesoccur.ItselectsoneswitchastherootofaSpanningTreeconnectedactive
topologyandassignsportrolestoindividualportsontheswitch,dependingonwhetherthatport
ispartoftheactivetopology.
RSTPprovidesrapidconnectivityfollowingthefailureofaswitch,switchport,oraLAN.Anew
rootportandthedesignatedportontheothersideofthebridgetransitiontoforwardingthrough
anexplicithandshakebetweenthem.Bydefault,userportsareconfiguredtorapidlytransitionto
forwardinginRSTP.
9-1
MSTP
TheIEEE802.1sMultipleSpanningTreeProtocol(MSTP)buildsupon802.1DandRSTPby
optimizingutilizationofredundantlinksbetweenswitchesinanetwork.Whenredundantlinks
existbetweenapairofswitchesrunningsingleSTP,onelinkisforwardingwhiletheothersare
blockingforalltrafficflowingbetweenthetwoswitches.Theblockinglinksareeffectivelyused
onlyiftheforwardinglinkgoesdown.MSTPassignseachVLANpresentonthenetworktoa
particularSpanningTreeinstance,allowingeachswitchporttobeinadistinctstateforeachsuch
instance:blockingforoneSpanningTreewhileforwardingforanother.Thus,trafficassociated
withonesetofVLANscantraverseaparticularinterswitchlink,whiletrafficassociatedwith
anothersetofVLANscanbeblockedonthatlink.IfVLANsareassignedtoSpanningTrees
wisely,nointerswitchlinkwillbecompletelyidle,maximizingnetworkutilization.
FordetailsoncreatingSpanningTreeinstances,refertosetspantreemstionpage 912.
FordetailsonmappingSpanningTreeinstancestoVLANs,refertosetspantreemstmapon
page 914.
Note: MSTP and RSTP are fully compatible and interoperable with each other and with legacy
STP 802.1D.
CreatingasingleSpanningTreefromanyarrangementofswitchingorbridgingelements.
Compensatingautomaticallyforthefailure,removal,oradditionofanydeviceinanactive
datapath.
Achievingportchangesinshorttimeintervals,whichestablishesastableactivetopology
quicklywithminimalnetworkdisturbance.
Usingaminimumamountofcommunicationsbandwidthtoaccomplishtheoperationofthe
SpanningTreeProtocol.
Reconfiguringtheactivetopologyinamannerthatistransparenttostationstransmittingand
receivingdatapackets.
ManagingthetopologyinaconsistentandreproduciblemannerthroughtheuseofSpanning
TreeProtocolparameters.
Note: The term bridge is used as an equivalent to the term switch or device in this document.
Loop Protect
TheLoopProtectfeaturepreventsorshortcircuitsloopformationinanetworkwithredundant
pathsbyrequiringportstoreceivetype2BPDUs(RSTP/MSTP)onpointtopointinterswitch
links(ISLs)beforetheirstatesareallowedtobecomeforwarding.Further,ifaBPDUtimeout
occursonaport,itsstatebecomeslisteninguntilaBPDUisreceived.
Bothupstreamanddownstreamfacingportsareprotected.Whenarootoralternateportlosesits
pathtotherootbridgeduetoamessageageexpirationittakesontheroleofdesignatedport.It
willnotforwardtrafficuntilaBPDUisreceived.Whenaportisintendedtobethedesignatedport
inanISLitconstantlyproposesandwillnotforwarduntilaBPDUisreceived,andwillrevertto
9-2
listeningifitfailstogetaresponse.Thisprotectsagainstmisconfigurationandprotocolfailureby
theconnectedbridge.
TheDisputedBPDUmechanismprotectsagainstloopinginsituationswherethereisoneway
communication.AdisputedBPDUisoneinwhichtheflagsfieldindicatesadesignatedroleand
learningandthepriorityvectorisworsethanthatalreadyheldbytheport.IfadisputedBPDUis
received,theportisforcedtothelisteningstate.WhenaninferiordesignatedBPDUwiththe
learningbitsetisreceivedonadesignatedport,itsstateissettodiscardingtopreventloop
formation.NotethattheDisputemechanismisalwaysactiveregardlessoftheconfiguration
settingofLoopProtection.
LoopProtectoperatesasaperport,perMSTinstancefeature.Itshouldbesetoninterswitch
links.Itiscomprisedofseveralrelatedfunctions:
ControlofportforwardingstatebasedonreceptionofagreementBPDUs
ControlofportforwardingstatebasedonreceptionofdisputedBPDUs
Communicatingportnonforwardingstatusthroughtrapsandsyslogmessages
Disablingaportbasedonfrequencyoffailureevents
PortforwardingstateinthedesignatedportisgatedbyatimerthatissetuponBPDUreception.It
isanalogoustothercvdInfoWhiletimertheportuseswhenreceivingrootinformationintheroot/
alternate/backuprole.
TherearetwooperationalmodesforLoopProtectonaport.Iftheportisconnectedtoadevice
knowntoimplementLoopProtect,itusesfullfunctionalmode.Otherwisetheportoperatesin
limitedfunctionalmode.
ConnectiontoaLoopProtectswitchguaranteesthatthealternateagreementmechanismis
implemented.Thismeansthedesignatedportcanrelyonreceivingaresponsetoitsproposal
regardlessoftheroleoftheconnectedport,whichhastwoimportantimplications.First,the
designatedportconnectedtoanonrootportmaytransitiontoforwarding.Second,thereisno
ambiguitywhenatimeouthappens;aLoopProtecteventhasoccurred.
Infullfunctionalmode,whenatype2BPDUisreceivedandtheportisdesignatedandpointto
point,thetimerissetto3timeshelloTime.Inlimitedfunctionalmodethereistheadditional
requirementthattheflagsfieldindicatearootrole.IftheportisaboundaryporttheMSTIsfor
thatportfollowtheCIST,thatis,theMSTIporttimersaresetaccordingtotheCISTporttimer.If
theportisinternaltotheregionthentheMSTIporttimersaresetindependentlyusingthe
particularMSTImessage.
MessageageexpirationandtheexpirationoftheLoopProtecttimerarebothLoopProtectevents.
Anoticelevelsyslogmessageisproducedforeachsuchevent.Trapsmaybeconfiguredtoreport
theseeventsaswell.AsyslogmessageandtrapmaybeconfiguredfordisputedBPDUs.
ItisalsoconfigurabletoforcethelockingofaSID/portfortheoccurrenceofoneormoreevents.
Whentheconfigurednumberofeventshappenwithinagivenwindowoftime,theportisforced
intoblockingandheldthereuntilitismanuallyunlockedviamanagement.
9-3
Commands
For information about...
9-4
Refer to page...
9-5
set spantree
9-7
9-7
9-8
9-9
9-9
9-10
9-10
9-11
9-11
9-12
9-12
9-13
9-13
9-14
9-14
9-15
9-15
9-16
9-16
9-17
9-17
9-18
9-18
9-19
9-20
9-20
9-21
9-21
9-22
9-22
9-23
9-23
9-24
Refer to page...
9-24
9-25
9-25
9-26
9-27
9-27
9-28
9-28
9-29
9-29
9-30
9-30
9-31
9-31
9-32
9-32
9-32
9-33
Syntax
show spantree stats [port port-string] [sid sid] [active]
Parameters
portportstring
(Optional)Displaysinformationforthespecifiedport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
sidsid
(Optional)DisplaysinformationforaspecificSpanningTreeidentifier.If
notspecified,SID0isassumed.
active
(Optional)DisplaysinformationforportsthathavereceivedSTPBPDUs
sinceboot.
Defaults
Ifportstringisnotspecified,SpanningTreeinformationforallportswillbedisplayed.
Ifsidisnotspecified,informationforSpanningTree0willbedisplayed.
Ifactiveisnotspecifiedinformationforallportswillbedisplayedregardlessofwhetherornot
theyhavereceivedBPDUs.
SecureStack C3 Configuration Guide
9-5
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythedevicesSpanningTreeconfiguration:
C3(su)->show spantree stats
Spanning tree status
Spanning tree instance
Designated Root MacAddr
Designated Root Priority
Designated Root Cost
Designated Root Port
Root Max Age
Root Hello Time
Root Forward Delay
Bridge ID MAC Address
Bridge ID Priority
Bridge Max Age
Bridge Hello Time
Bridge Forward Delay
Topology Change Count
Time Since Top Change
Max Hops
enabled
0
00-e0-63-9d-c1-c8
0
10000
lag.0.1
20 sec
2 sec
15 sec
00-01-f4-da-5e-3d
32768
20 sec
2 sec
15 sec
7
00 days 03:19:15
20
Table 91showsadetailedexplanationofcommandoutput.
Table 9-1
9-6
Output
What It Displays...
Interval (in seconds) at which the root device sends BPDU (Bridge Protocol
Data Unit) packets.
Amount of time (in seconds) the root device spends in listening or learning
mode.
Bridge ID Priority
Maximum time (in seconds) the bridge can wait without receiving a
configuration message (bridge hello) before attempting to reconfigure.
This is a default value, or is assigned using the set spantree maxage
command. For details, refer to set spantree maxage on page 9-19.
set spantree
Table 9-1
Output
What It Displays...
Amount of time (in seconds) the bridge sends BPDUs. This is a default
value, or is assigned using the set spantree hello command. For details,
refer to set spantree hello on page 9-18.
Amount of time (in days, hours, minutes and seconds) since the last
topology change.
Max Hops
set spantree
UsethiscommandtogloballyenableordisabletheSpanningTreeprotocolontheswitch.
Syntax
set spantree {disable | enable}
Parameters
disable|enable
GloballydisablesorenablesSpanningTree.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodisableSpanningTreeonthedevice:
C3(su)->set spantree disable
Syntax
show spantree version
Parameters
None.
9-7
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySpanningTreeversioninformationforthedevice:
C3(su)->show spantree version
Force Version is mstp
Syntax
set spantree version {mstp | stpcompatible | rstp}
Parameters
mstp
SetstheversiontoSTP802.1scompatible.
stpcompatible
SetstheversiontoSTP802.1Dcompatible.
rstp
Setstheversionto802.1wcompatible.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Inmostnetworks,SpanningTreeversionshouldnotbechangedfromitsdefaultsettingofmstp
(MultipleSpanningTreeProtocol)mode.MSTPmodeisfullycompatibleandinteroperablewith
legacySTP802.1DandRapidSpanningTree(RSTP)bridges.Settingtheversiontostpcompatible
modewillcausethebridgetotransmitonly802.1DBPDUs,andwillpreventnonedgeportsfrom
rapidlytransitioningtoforwardingstate.
Example
ThisexampleshowshowtogloballychangetheSpanningTreeversionfromthedefaultofMSTP
toRSTP:
C3(su)->set spantree version rstp
9-8
Syntax
clear spantree version
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheSpanningTreeversion:
C3(su)->clear spantree version
Syntax
show spantree bpdu-forwarding
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheSpanningTreeBPDUforwardingmode:
C3(su)->show spantree bpdu-forwarding
BPDU forwarding is disabled.
9-9
Syntax
set spantree bpdu-forwarding {disable | enable}
Parameters
disable|enable
DisablesorenablesBPDUforwarding;.
Defaults
BydefaultBPDUforwardingisdisabled.
Mode
Switchcommand,readwrite.
Usage
TheSpanningTreeprotocolmustbedisabled(setspantreedisable)forthisfeaturetotakeeffect.
Example
ThisexampleshowshowtoenableBPDUforwarding:
C3(rw)-> set spantree bpdu-forwarding enable
Syntax
show spantree bridgeprioritymode
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheSpanningTreebridgeprioritymodesetting:
C3(rw)->show spantree bridgeprioritymode
Bridge Priority Mode is set to IEEE802.1t mode.
9-10
Syntax
set spantree bridgeprioritymode {8021d | 8021t}
Parameters
8021d
Setsthebridgeprioritymodetouse802.1D(legacy)values,whichare0
65535.
8021t
Setsthebridgeprioritymodetouse802.1tvalues,whichare0to61440,in
incrementsof4096.Valueswillautomaticallyberoundedupordown,
dependingonthe802.1tvaluetowhichtheenteredvalueisclosest.
Thisisthedefaultbridgeprioritymode.
Defaults
None
Mode
Switchcommand,readwrite.
Usage
Themodeaffectstherangeofpriorityvaluesusedtodeterminewhichdeviceisselectedasthe
SpanningTreerootasdescribedinsetspantreepriority(setspantreepriorityonpage 917).The
defaultfortheswitchistouse802.1tbridgeprioritymode.
Example
Thisexampleshowshowtosetthebridgeprioritymodeto802.1D:
C3(rw)->set spantree bridgeprioritymode 8021d
Syntax
clear spantree bridgeprioritymode
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
9-11
Example
Thisexampleshowshowtoresetthebridgeprioritymodeto802.1t:
C3(rw)->clear spantree bridgeprioritymode
Syntax
show spantree mstilist
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayalistofMSTinstances.Inthiscase,SID2hasbeenconfigured:
C3(su)->show spantree mstilist
Configured Multiple Spanning Tree instances:
2
Syntax
set spantree msti sid sid {create | delete}
Parameters
sidsid
SetstheMultipleSpanningTreeID.Validvaluesare14094.
SecureStackC3deviceswillsupportupto4MSTinstances.
create|delete
CreatesordeletesanMSTinstance.
Defaults
None.
Mode
Switchcommand,readwrite.
9-12
Example
ThisexampleshowshowtocreateanMSTinstance2:
C3(su)->set spantree msti sid 2 create
Syntax
clear spantree msti [sid sid]
Parameters
sidsid
(Optional)DeletesaspecificmultipleSpanningTreeID.
Defaults
Ifsidisnotspecified,allMSTinstanceswillbecleared.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodeleteallMSTinstances:
C3(su)->clear spantree msti
Syntax
show spantree mstmap [fid fid]
Parameters
fidfid
(Optional)DisplaysinformationforspecificFIDs.
Defaults
Iffidisnotspecified,informationforallassignedFIDswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySIDtoFIDmappinginformationforFID1.Inthiscase,no
newmappingshavebeenconfigured:
C3(su)->show spantree mstmap fid 1
9-13
FID:
1
SID:
0
Syntax
set spantree mstmap fid [sid sid]
Parameters
fid
SpecifiesoneormoreFIDstoassigntotheMST.Validvaluesare14093,
andmustcorrespondtoaVLANIDcreatedusingthesetvlancommand.
sidsid
(Optional)SpecifiesaMultipleSpanningTreeID.Validvaluesare14094,
andmustcorrespondtoaSIDcreatedusingthesetmsticommand.
Defaults
Ifsidisnotspecified,FID(s)willbemappedtoSpanningTree0.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtomapFID3toSID2:
C3(su)->set spantree mstmap 3 sid 2
Syntax
clear spantree mstmap fid
Parameters
fid
SpecifiesoneormoreFIDstoresetto0.
Defaults
Iffidisnotspecified,allSIDtoFIDmappingswillbereset.
Mode
Switchcommand,readwrite.
9-14
Example
ThisexampleshowshowtomapFID2backtoSID0:
C3(su)->clear spantree mstmap 2
Syntax
show spantree vlanlist [vlan-list]
Parameters
vlanlist
(Optional)DisplaysSIDsassignedtospecificVLAN(s).
Defaults
Ifnotspecified,SIDassignmentwillbedisplayedforallVLANs.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheSIDsmappedtoVLAN1.Inthiscase,SIDs2,16and42
aremappedtoVLAN1.Forthisinformationtodisplay,theSIDinstancemustbecreatedusingthe
setspantreemsticommandasdescribedinsetspantreemstionpage 912,andtheFIDsmust
bemappedtoSID 1usingthesetspantreemstmapcommandasdescribedinsetspantree
mstmaponpage 914:
C3(su)->show spantree vlanlist 1
The following SIDS are assigned to VLAN 1: 2 16 42
Syntax
show spantree mstcfgid
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
9-15
Example
ThisexampleshowshowtodisplaytheMSTconfigurationidentifierelements.Inthiscase,the
defaultrevisionlevelof0,andthedefaultconfigurationname(astringrepresentingthebridge
MACaddress)havenotbeenchanged.Forinformationonusingthesetspantreemstcfgid
commandtochangethesesettings,refertosetspantreemstcfgidonpage 916:
C3(su)->show spantree mstcfgid
MST Configuration Identifier:
Format Selector: 0
Configuration Name: 00:01:f4:89:51:94
Revision Level: 0
Configuration Digest: ac:36:17:7f:50:28:3c:d4:b8:38:21:d8:ab:26:de:62
Syntax
set spantree mstcfgid {cfgname name | rev level}
Parameters
cfgnamename
SpecifiesanMSTconfigurationname.
revlevel
SpecifiesanMSTrevisionlevel.Validvaluesare065535.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosettheMSTconfigurationnametomstconfig:
C3(su)->set spantree mstconfigid cfgname mstconfig
Syntax
clear spantree mstcfgid
Parameters
None.
Defaults
None.
9-16
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheMSTconfigurationidentifierelementstodefaultvalues:
C3(su)->clear spantree mstcfgid
Syntax
set spantree priority priority [sid]
Parameters
priority
Specifiesthepriorityofthebridge.Validvaluesarefrom0to61440(in
incrementsof4096),with0indicatinghighestpriorityand61440
lowestpriority.
sid
(Optional)SetsthepriorityonaspecificSpanningTree.Validvalues
are04094.Ifnotspecified,SID 0isassumed.
Defaults
Ifsidisnotspecified,prioritywillbesetonSpanningTree0.
Mode
Switchcommand,readwrite.
Usage
Thedevicewiththehighestpriority(lowestnumericalvalue)becomestheSpanningTreeroot
device.Ifalldeviceshavethesamepriority,thedevicewiththelowestMACaddresswillthen
becometherootdevice.Dependingonthebridgeprioritymode(setwiththesetspantree
bridgeprioritymodecommanddescribedinsetspantreebridgeprioritymodeonpage 911,
somepriorityvaluesmayberoundedupordown.
Example
Thisexampleshowshowtosetthebridgepriorityto4096onSID1:
C3(su)->set spantree priority 4096 1
Syntax
clear spantree priority [sid]
9-17
Parameters
sid
(Optional)ResetsthepriorityonaspecificSpanningTree.Validvalues
are04094.Ifnotspecified,SID 0isassumed.
Defaults
Ifsidisnotspecified,prioritywillberesetonSpanningTree0.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetthebridgepriorityonSID1:
C3(su)->clear spantree priority 1
Syntax
set spantree hello interval
Parameters
interval
Specifiesthenumberofsecondsthesystemwaitsbeforebroadcastinga
bridgehellomessage(amulticastmessageindicatingthatthesystemis
active).Validvaluesare110.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtogloballysettheSpanningTreehellotimeto10seconds:
C3(su)->set spantree hello 10
Syntax
clear spantree hello
9-18
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtogloballyresettheSpanningTreehellotime:
C3(su)->clear spantree hello
Syntax
set spantree maxage agingtime
Parameters
agingtime
Specifiesthemaximumnumberofsecondsthatthesystemretainsthe
informationreceivedfromotherbridgesthroughSTP.Validvaluesare6
40.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thebridgemaximumagingtimeisthemaximumtime(inseconds)adevicecanwaitwithout
receivingaconfigurationmessage(bridgehello)beforeattemptingtoreconfigure.Alldevice
ports(exceptfordesignatedports)shouldreceiveconfigurationmessagesatregularintervals.
AnyportthatagesoutSTPinformationprovidedinthelastconfigurationmessagebecomesthe
designatedportfortheattachedLAN.Ifitisarootport,anewrootportisselectedfromamong
thedeviceportsattachedtothenetwork.
Example
Thisexampleshowshowtosetthemaximumagingtimeto25seconds:
C3(su)->set spantree maxage 25
9-19
Syntax
clear spantree maxage
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtogloballyresetthemaximumagingtime:
C3(su)->clear spantree maxage
Syntax
set spantree fwddelay delay
Parameters
delay
Specifiesthenumberofsecondsforthebridgeforwarddelay.Validvalues
are430.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Theforwarddelayisthemaximumtime(inseconds)therootdevicewillwaitbeforechanging
states(i.e.,listeningtolearningtoforwarding).Thisdelayisrequiredbecauseeverydevicemust
receiveinformationabouttopologychangesbeforeitstartstoforwardframes.Inaddition,each
portneedstimetolistenforconflictinginformationthatwouldmakeitreturntoablockingstate;
otherwise,temporarydataloopsmightresult.
Example
Thisexampleshowshowtogloballysetthebridgeforwarddelayto16seconds:
9-20
Syntax
clear spantree fwddelay
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtogloballyresetthebridgeforwarddelay:
C3(su)->clear spantree fwddelay
Syntax
show spantree backuproot [sid]
Parameters
sid
(Optional)DisplaybackuprootstatusforaspecificSpanningTree
identifier.Validvaluesare04094.Ifnotspecified,SID0isassumed.
Defaults
IfaSIDisnotspecified,thenstatuswillbeshownforSpanningTreeinstance0.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythestatusofthebackuprootfunctiononSID0:
C3(rw)->show spantree backuproot
Backup root is set to disable on sid 0
9-21
Syntax
set spantree backuproot sid {disable | enable}
Parameters
sid
SpecifiestheSpanningTreeinstanceonwhichtoenableordisablethe
backuprootfunction.Validvaluesare04094.
disable|enable
Enablesordisablesthebackuprootfunction.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheSpanningTreebackuprootfunctionisdisabledbydefaultontheSecureStackC3.Whenthis
featureisenabledandtheswitchisdirectlyconnectedtotherootbridge,staleSpanningTree
informationispreventedfromcirculatingiftherootbridgeislost.Iftherootbridgeislost,the
backuprootwilldynamicallyloweritsbridgeprioritysothatitwillbeselectedasthenewroot
overthelostrootbridge.
Example
ThisexampleshowshowtoenablethebackuprootfunctiononSID2:
C3(rw)->set spantree backuproot 2 enable
Syntax
clear spantree backuproot sid
Parameters
sid
SpecifiestheSpanningTreeonwhichtoclearthebackuproot
function.Validvaluesare04094.
Defaults
None.
Mode
Switchcommand,readwrite.
9-22
Example
ThisexampleshowshowtoresetthebackuprootfunctiontodisabledonSID2:
C3(rw)->clear spantree backuproot 2
Syntax
show spantree tctrapsuppress
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythestatusoftopologychangetrapsuppression:
C3(rw)->show spantree tctrapsuppress
Topology change Trap Suppression is set to enabled
Syntax
set spantree tctrapsuppress {disable | enable}
Parameters
disable|enable
Disablesorenablestopologychangetrapsuppression.
Defaults
None.
Mode
Switchcommand,readwrite.
9-23
Usage
Bydefault,RSTPnonedge(bridge)portsthattransitiontoforwardingorblockingcausethe
switchtoissueatopologychangetrap.Whentopologychangetrapsuppressionisenabled,which
isthedevicedefault,edgeports(suchasendstationPCs)arepreventedfromsendingtopology
changetraps.Thisisbecausethereisusuallynoneedfornetworkmanagementtomonitoredge
portSTPtransitionstates,suchaswhenPCsarepoweredon.Whentopologychangetrap
suppressionisdisabled,allports,includingedgeandbridgeports,willtransmittopologychange
traps.
Example
ThisexampleshowshowtoallowRapidSpanningTreeedgeportstotransmittopologychange
traps:
C3(rw)->set spantree tctrapsuppress disable
Syntax
clear spantree tctrapsuppress
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtocleartopologychangetrapsuppressionsetting:
C3(rw)->clear spantree tctrapsuppress
Syntax
set spantree protomigration <port-string>
Parameters
portstring
9-24
Resettheprotocolstatemigrationmachineforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresettheprotocolstatemigrationmachineonport20:
C3(su)->set spantree protomigration ge.1.20
Syntax
show spantree spanguard
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheSpanGuardfunctionstatus:
C3(su)->show spantree spanguard
Spanguard is disabled
Syntax
set spantree spanguard {enable | disable}
Parameters
enable|disable
EnablesordisablestheSpanGuardfunction.
Defaults
None.
9-25
Mode
Switchcommand,readwrite.
Usage
SpanGuardisdesignedtodisable,orlockoutanedgeportwhenanunexpectedBPDUis
received.Theportcanbeconfiguredtobereenabledafterasettimeperiod,oronlyaftermanual
intervention.
Aportcanbedefinedasanedge(user)portusingthesetspantreeadminedgecommand,
describedinsetspantreeadminedgeonpage 940.Aportdesignatedasanedgeportis
expectedtobeconnectedtoaworkstationorotherendusertypeofdevice,andnottoanother
switchinthenetwork.WhenSpanGuardisenabled,ifanonloopbackBPDUisreceivedonan
edgeport,theSpanningTreestateofthatportwillbechangedtoblockingandwillnolonger
forwardtraffic.Theportwillremaindisableduntiltheamountoftimedefinedbysetspantree
spanguardtimeout(setspantreespanguardtimeoutonpage 927)haspassedsincethelastseen
BPDU,theportismanuallyunlocked(setorclearspantreespanguardlock,clear/setspantree
spanguardlockonpage 929),theconfigurationoftheportischangedsoitisnotlongeranedge
port,ortheSpanGuardfunctionisdisabled.
SpanGuardisenabledanddisabledonlyonaglobalbasis(acrossthestack,ifapplicable).By
default,SpanGuardisdisabledandSpanGuardtrapsareenabled.
Example
ThisexampleshowshowtoenabletheSpanGuardfunction:
C3(rw)->set spantree spanguard enable
Syntax
clear spantree spanguard
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetthestatusoftheSpanGuardfunctiontodisabled:
C3(rw)->clear spantree spanguard
9-26
Syntax
show spantree spanguardtimeout
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheSpanGuardtimeoutsetting:
C3(su)->show spantree spanguardtimeout
Spanguard timeout: 300
Syntax
set spantree spanguardtimeout timeout
Parameters
timeout
Specifiesatimeoutvalueinseconds.Validvaluesare0to65535.
Avalueof0willkeeptheportlockeduntilmanuallyunlocked.Thedefault
valueis300seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosettheSpanGuardtimeoutto600seconds:
C3(su)->set spantree spanguardtimeout 600
9-27
Syntax
clear spantree spanguardtimeout
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheSpanGuardtimeoutto300seconds:
C3(rw)->clear spantree spanguardtimeout
Syntax
show spantree spanguardlock [port-string]
Parameters
portstring
(Optional)Specifiestheport(s)forwhichtoshowSpanGuardlockstatus.
Foradetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifnoportstringisspecified,theSpanGuardlockstatusforallportsisdisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheSpanGuardlockstatusforge.1.1:
C3(su)->show spantree spanguardlock ge.1.1
Port ge.1.1 is Unlocked
9-28
Syntax
clear spantree spanguardlock port-string
set spantree spanguardlock port-string
Parameters
portstring
Specifiesport(s)tounlock.Foradetaileddescriptionofpossibleportstring
values,refertoPortStringSyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtounlockportge.1.16:
C3(rw)->clear spantree spanguardlock ge.1.16
Syntax
show spantree spanguardtrapenable
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythestateoftheSpanGuardtrapfunction:
C3(ro)->show spantree spanguardtrapenable
Spanguard SNMP traps are enabled
9-29
Syntax
set spantree spanguardtrapenable {disable | enable}
Parameters
disable|enable
DisablesorenablessendingSpanGuardtraps.Bydefault,sendingtraps
isenabled.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodisabletheSpanGuardtrapfunction:
C3(su)->set spantree spanguardtrapenable disable
Syntax
clear spantree spanguardtrapenable
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheSpanGuardtrapfunctiontoenabled:
C3(rw)->clear spantree spanguardtrapenable
9-30
Syntax
show spantree legacypathcost
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythedefaultSpanningTreepathcostsetting.
C3(su)->show spantree legacypathcost
Legacy Path Cost is disabled.
Syntax
set spantree legacypathcost {disable | enable}
Parameters
disable
Use802.1t2001valuestocalculatepathcost.
enable
Use802.1d1998valuestocalculatepathcost.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Bydefault,legacypathcostisdisabled.Enablingthedevicetocalculatelegacypathcostsaffects
therangeofvalidvaluesthatcanbeenteredinthesetspantreeadminpathcostcommand.
Example
Thisexampleshowshowtosetthedefaultpathcostvaluesto802.1D.
C3(rw)->set spantree legacypathcost enable
9-31
Syntax
clear spantree legacypathcost
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleclearsthelegacypathcostto802.1tvalues.
C3(rw)->clear spantree legacypathcost
Syntax
show spantree autoedge
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythestatusoftheautomaticedgeportdetectionfunction:
C3(rw)->show spantree autoedge
autoEdge is currently enabled.
Syntax
set spantree autoedge {disable | enable}
9-32
Parameters
disable|enable
Disablesorenablesautomaticedgeportdetection.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodisableautomaticedgeportdetection:
C3(rw)->set spantree autoedge disable
Syntax
clear spantree autoedge
Parameters
None.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Example
Thisexampleshowshowtoresetautomaticedgeportdetectiontoenabled:
C3(rw)->clear spantree autoedge
9-33
Commands
For information about...
Refer to page...
9-34
9-35
9-35
9-36
9-36
9-37
9-38
9-38
9-39
9-39
9-39
9-40
9-41
Syntax
set spantree portadmin port-string {disable | enable}
Parameters
portstring
Specifiestheport(s)forwhichtoenableordisableSpanningTree.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
disable|enable
DisablesorenablesSpanningTree.
Defaults
None.
Mode
Switchcommand,readwrite.
9-34
Example
ThisexampleshowshowtodisableSpanningTreeonge.1.5:
C3(rw)->set spantree portadmin ge.1.5 disable
Syntax
clear spantree portadmin port-string
Parameters
portstring
Resetsthedefaultadminstatusonspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetthedefaultSpanningTreeadminstatetoenableonge.1.12:
C3(rw)->clear spantree portadmin ge.1.12
Syntax
show spantree portadmin [port port-string]
Parameters
portportstring
(Optional)Displaysstatusforspecificport(s).Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLI
onpage 71.
Defaults
Ifportstringisnotspecified,statuswillbedisplayedforallports.
Mode
Switchcommand,readonly.
9-35
Example
Thisexampleshowshowtodisplayportadminstatusforge.1.1:
C3(ro)->show spantree portadmin port ge.1.1
Port ge.1.1 has portadmin set to enabled
Syntax
show spantree portpri [port port-string] [sid sid]
Parameters
portportstring
(Optional)Specifiestheport(s)forwhichtodisplaySpanningTreepriority.
Foradetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
sidsid
(Optional)DisplaysportpriorityforaspecificSpanningTreeidentifier.
Validvaluesare04094.Ifnotspecified,SID0isassumed.
Defaults
Ifportstringisnotspecified,portprioritywillbedisplayedforallSpanningTreeports.
Ifsidisnotspecified,portprioritywillbedisplayedforSpanningTree0.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheportpriorityforge.2.7:
C3(su)->show spantree portpri port ge.2.7
Port ge.2.7 has a Port Priority of 128 on SID 0
Syntax
set spantree portpri port-string priority [sid sid]
9-36
Parameters
portstring
Specifiestheport(s)forwhichtosetSpanningTreeportpriority.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
priority
SpecifiesanumberthatrepresentsthepriorityofalinkinaSpanningTree
bridge.Validvaluesarefrom0to240(inincrementsof16)with0
indicatinghighpriority.
sidsid
(Optional)SetsportpriorityforaspecificSpanningTreeidentifier.Valid
valuesare04094.Ifnotspecified,SID0isassumed.
Defaults
Ifsidisnotspecified,portprioritywillbesetforSpanningTree0.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthepriorityofge.1.3to240onSID1
C3(su)->set spantree portpri ge.1.3 240 sid 1
Syntax
clear spantree portpri port-string [sid sid]
Parameters
portstring
Specifiestheport(s)forwhichtosetSpanningTreeportpriority.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
sidsid
(Optional)ResetstheportpriorityforaspecificSpanningTreeidentifier.
Validvaluesare04094.Ifnotspecified,SID0willbeassumed.
Defaults
Ifsidisnotspecified,portprioritywillbesetforSpanningTree0.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresetthepriorityofge.1.3to128onSID1
C3(su)->clear spantree portpri ge.1.3 sid 1
9-37
Syntax
show spantree adminpathcost [port port-string] [sid sid]
Parameters
portportstring
(Optional)Displaystheadminpathcostvalueforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
sidsid
(Optional)DisplaystheadminpathcostforaspecificSpanningTree
identifier.Validvaluesare04094.Ifnotspecified,SID0willbeassumed.
Defaults
Ifportstringisnotspecified,adminpathcostforallSpanningTreeportswillbedisplayed.
Ifsidisnotspecified,adminpathcostforSpanningTree0willbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheadminpathcostforge.3.4onSID1:
C3(su)->show spantree adminpathcost port ge.3.4 sid 1
Port ge.3.4 has a Port Admin Path Cost of 0 on SID 1
Syntax
set spantree adminpathcost port-string cost [sid sid]
Parameters
portstring
Specifiestheport(s)onwhichtosetanadminpathcost.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
cost
Specifiestheportpathcost.Va1idvaluesare0200000000.
sidsid
(Optional)SetstheadminpathcostforaspecificSpanningTreeidentifier.
Validvaluesare04094.Ifnotspecified,SID0willbeassumed.
Defaults
Ifsidisnotspecified,adminpathcostwillbesetforSpanningTree0.
Mode
Switchcommand,readwrite.
9-38
Example
Thisexampleshowshowtosettheadminpathcostto200forge.3.2onSID1:
C3(su)->set spantree adminpathcost ge.3.2 200 sid 1
Syntax
clear spantree adminpathcost port-string [sid sid]
Parameters
portstring
Specifiestheport(s)forwhichtoresetadminpathcost.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntax
UsedintheCLIonpage 71.
sidsid
(Optional)ResetstheadminpathcostforspecificSpanningTree(s).
Validvaluesare04094.Ifnotspecified,SID0isassumed.
Defaults
Ifsidisnotspecified,adminpathcostwillberesetforSpanningTree0.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresettheadminpathcostto0forge.3.2onSID1:
C3(su)->clear spantree adminpathcost ge.3.2 sid 1
Syntax
show spantree adminedge [port port-string]
Parameters
portstring
(Optional)Displaysedgeportadministrativestatusforspecific
port(s).Foradetaileddescriptionofpossibleportstringvalues,
refertoPortStringSyntaxUsedintheCLIonpage 71.
Defaults
IfportstringisnotspecifiededgeportadministrativestatuswillbedisplayedforallSpanningTree
ports.
9-39
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheedgeportstatusforge.3.2:
C3(su)->show spantree adminedge port ge.3.2
Port ge.3.2 has a Port Admin Edge of Edge-Port
Syntax
set spantree adminedge port-string {true | false}
Parameters
portstring
Specifiestheedgeport.Foradetaileddescriptionofpossibleportstring
values,refertoPortStringSyntaxUsedintheCLIonpage 71.
true|false
Enables(true)ordisables(false)thespecifiedportasaSpanningTreeedge
port.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thedefaultbehavioroftheedgeportadministrativestatusbeginswiththevaluesettofalse
initiallyafterthedeviceispoweredup.IfaSpanningTreeBDPUisnotreceivedontheportwithin
afewseconds,thestatussettingchangestotrue.
Example
Thisexampleshowshowtosetge.1.11asanedgeport:
C3(su)->set spantree adminedge ge.1.11 true
Syntax
clear spantree adminedge port-string
9-40
Parameters
portstring
Specifiesport(s)onwhichtoresetedgeportstatus.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresetge.1.11asanonedgeport:
C3(su)->clear spantree adminedge ge.1.11
Syntax
show spantree operedge [port port-string]
Parameters
portportstring
Displaysedgeportoperatingstatusforspecificport(s).
Defaults
Ifportstringisnotspecified,edgeportoperatingstatuswillbedisplayedforallSpanningTree
ports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheedgeportstatusforge.2.7:
C3(rw)->show spantree operedge port ge.2.7
Port ge.2.7 has a Port Oper Edge of Edge-Port
9-41
Commands
For information about...
9-42
Refer to page...
set spantree lp
9-43
show spantree lp
9-43
clear spantree lp
9-44
9-44
9-45
9-46
9-46
9-47
9-47
9-48
9-48
9-49
9-49
9-50
9-50
9-51
9-51
9-52
9-53
9-53
9-54
set spantree lp
set spantree lp
UsethiscommandtoenableordisabletheLoopProtectfeatureperportandoptionally,perSID.
TheLoopProtectfeatureisdisabledbydefault.SeeLoopProtectonpage 2.formore
information.
Syntax
set spantree lp port-string {enable | disable} [sid sid]
Parameters
portstring
Specifiesport(s)onwhichtoenableordisabletheLoopProtectfeature.
enable|disable
Enablesordisablesthefeatureonthespecifiedport.
sidsid
(Optional)EnablesordisablesthefeatureforspecificSpanningTree(s).
Validvaluesare04094.Ifnotspecified,SID0isassumed.
Defaults
IfnoSIDisspecified,SID0isassumed.
Mode
Switchcommand,readwrite.
Usage
LoopProtecttakesprecedenceoverperportSTPenable/disable(portAdmin).Normally
portAdmindisabledwouldcauseaporttogoimmediatelytoforwarding.IfLoopProtectis
enabled,thatportshouldgotolisteningandremainthere.
Note: The Loop Protect enable/disable settings for an MSTI port should match those for the CIST
port.
Example
ThisexampleshowshowtoenableLoopProtectonge.2.3:
C3(su)->set spantree lp ge.1.11 enable
show spantree lp
UsethiscommandtodisplaytheLoopProtectstatusperportand/orperSID.
Syntax
show spantree lp [port port-string] [sid sid]
Parameters
portstring
(Optional)Specifiesport(s)forwhichtodisplaytheLoopProtect
featurestatus.
sidsid
(Optional)SpecifiesthespecificSpanningTree(s)forwhichtodisplay
theLoopProtectfeaturestatus.Validvaluesare04094.Ifnot
specified,SID0isassumed.
9-43
clear spantree lp
Defaults
Ifnoportstringisspecified,statusisdisplayedforallports.
IfnoSIDisspecified,SID0isassumed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayLoopProtectstatusonge.2.3:
C3(su)->show spantree lp port ge.2.3
LoopProtect is disabled on port ge.2.3
, SI
clear spantree lp
UsethiscommandtoreturntheLoopProtectstatusperportandoptionally,perSID,toitsdefault
stateofdisabled.
Syntax
clear spantree lp port-string [sid sid]
Parameters
portstring
Specifiesport(s)forwhichtocleartheLoopProtectfeaturestatus.
sidsid
(Optional)SpecifiesthespecificSpanningTree(s)forwhichtoclearthe
LoopProtectfeaturestatus.Validvaluesare04094.Ifnotspecified,
SID0isassumed.
Defaults
IfnoSIDisspecified,SID0isassumed.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoreturntheLoopProtectstateonge.2.3todisabled:
C3(rw)->clear spantree lp port ge.2.3
Syntax
show spantree lplock [port port-string] [sid sid]
9-44
Parameters
portstring
(Optional)Specifiesport(s)forwhichtodisplaytheLoopProtectlock
status.
sidsid
(Optional)SpecifiesthespecificSpanningTree(s)forwhichtodisplay
theLoopProtectlockstatus.Validvaluesare04094.Ifnotspecified,
SID0isassumed.
Defaults
Ifnoportstringisspecified,statusisdisplayedforallports.
IfnoSIDisspecified,SID0isassumed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayLoopProtectlockstatusonge.1.1:
C3(rw)->show spantree lplock port ge.1.1
The LoopProtect lock status for port ge.1.1
, SID 0 is UNLOCKED
Syntax
clear spantree lplock port-string [sid sid]
Parameters
portstring
Specifiesport(s)forwhichtocleartheLoopProtectlock.
sidsid
(Optional)SpecifiesthespecificSpanningTree(s)forwhichtoclearthe
LoopProtectlock.Validvaluesare04094.Ifnotspecified,SID0is
assumed.
Defaults
IfnoSIDisspecified,SID0isassumed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtoclearLoopProtectlockfromge.1.1:
C3(rw)->show spantree lplock port ge.1.1
The LoopProtect lock status for port ge.1.1
C3(rw)->clear spantree lplock ge.1.1
C3(rw)->show spantree lplock port ge.1.1
The LoopProtect lock status for port ge.1.1
, SID 0 is LOCKED
, SID 0 is UNLOCKED
9-45
Syntax
set spantree lpcapablepartner port-string {true | false}
Parameters
portstring
Specifiesport(s)forwhichtoconfigureaLoopProtectcapablelink
partner.
true|false
Specifieswhetherthelinkpartneriscapable(true)ornot(false).
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThedefaultvalueforLoopProtectcapablepartnerisfalse.IftheportisconfiguredwithaLoop
Protectcapablepartner(true),thenthefullfunctionalityoftheLoopProtectfeatureisused.Ifthe
valueisfalse,thenthereissomeambiguityastowhetheranActivePartnertimeoutisduetoa
loopprotectioneventorisanormalsituationduetothefactthatthepartnerportdoesnot
transmitAlternateAgreementBPDUs.Therefore,aconservativeapproachistakeninthat
designatedportswillnotbeallowedtoforwardunlessreceivingagreementsfromaportwithroot
role.
Thistypeoftimeoutwillnotbeconsideredaloopprotectionevent.Loopprotectionismaintained
bykeepingtheportfromforwardingbutsincethisisnotconsideredaloopeventitwillnotbe
factoredintolockingtheport.
Example
ThisexampleshowshowtosettheLoopProtectcapablepartnertotrueforge.1.1:
C3(rw)->set spantree lpcapablepartner ge.1.1 true
Syntax
show spantree lpcapablepartner [port port-string]
Parameters
portstring
9-46
(Optional)Specifiesport(s)forwhichtodisplayLoopProtectcapability
foritslinkpartner.
Defaults
Ifnoportstringisspecified,LoopProtectcapabilityforlinkpartnersisdisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheLoopProtectpartnercapabilityforge.1.1:
C3(rw)->show spantree lpcapablepartner port ge.1.1
Link partner of port ge.1.1 is not LoopProtect-capable
Syntax
clear spantree lpcapablepartner port-string
Parameters
portstring
Specifiesport(s)forwhichtocleartheirlinkpartnersLoopProtect
capability(resettofalse).
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheLoopProtectpartnercapabilityforge.1.1:
C3(rw)->clear spantree lpcapablepartner ge.1.1
Syntax
set spantree lpthreshold value
Parameters
value
Specifiesthenumberofeventsthatmustoccurduringtheevent
windowinordertolockaport/SID.Thedefaultvalueis3events.A
thresholdof0specifiesthatportswillneverbelocked.
9-47
Defaults
None.Thedefaulteventthresholdis3.
Mode
Switchcommand,readwrite.
Usage
TheLoopProtecteventthresholdisaglobalintegervariablethatprovidesprotectioninthecaseof
intermittentfailures.Thedefaultvalueis3.Iftheeventcounterreachesthethresholdwithina
givenperiod(theeventwindow),thentheport,forthegivenSID,becomeslocked(thatis,held
indefinitelyintheblockingstate).Ifthethresholdis0,theportsareneverlocked.
Example
ThisexampleshowshowtosettheLoopProtectthresholdvalueto4:
C3(rw)->set spantree lpthreshold 4
Syntax
show spantree lpthreshold
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythecurrentLoopProtectthresholdvalue:
C3(rw)->show spantree lpthreshold
The Loop Protect event threshold value is 4
Syntax
clear spantree lpthreshold
Parameters
None.
9-48
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheLoopProtecteventthresholdtothedefaultof3:
C3(rw)->clear spantree lpthreshold
Syntax
set spantree lpwindow value
Parameters
value
Specifiesthenumberofsecondsthatcomprisetheperiodduringwhich
LoopProtecteventsarecounted.Thedefaulteventwindowis180
seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheLoopProtectWindowisatimervalue,inseconds,thatdefinesaperiodduringwhichLoop
Protecteventsarecounted.Thedefaultvalueis180seconds.Ifthetimerissetto0,theevent
counterisnotresetuntiltheLoopProtecteventthresholdisreached.Ifthethresholdisreached,
thatconstitutesaloopprotectionevent.
Example
ThisexampleshowshowtosettheLoopProtecteventwindowto120seconds:
C3(rw)->set spantree lpwindow 120
Syntax
show spantree lpwindow
9-49
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythecurrentLoopProtectwindowvalue:
C3(rw)->show spantree lpwindow
The Loop Protect event window is set to 120 seconds
Syntax
clear spantree lpwindow
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheLoopProtecteventwindowtothedefaultof180seconds:
C3(rw)->clear spantree lpwindow
Syntax
set spantree lptrapenable {enable | disable}
Parameters
enable|disable
9-50
EnablesordisablesthesendingofLoopProtecttraps.Defaultis
disabled.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
LoopProtecttrapsaresentwhenaLoopProtecteventoccurs,thatis,whenaportgoestolistening
duetonotreceivingBPDUs.Thetrapindicatesport,SIDandloopprotectionstatus.
Example
ThisexampleshowshowtoenablesendingofLoopProtecttraps:
C3(rw)->set spantree lptrapenable enable
Syntax
show spantree lptrapenable
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythecurrentLoopProtecteventnotificationstatus:
C3(rw)->show spantree lptrapenable
The Loop Protect event notification status is enable
Syntax
clear spantree lptrapenable
Parameters
None.
9-51
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheLoopProtecteventnotificationstatetothedefaultof
disabled.
C3(rw)->clear spantree lptrapenable
Syntax
set spantree disputedbpduthreshold value
Parameters
value
SpecifiesthenumberofdisputedBPDUsthatmustbereceivedona
givenport/SIDtocauseadisputedBPDUtraptobesent.
Athresholdof0indicatesthattrapsshouldnotbesent.Thedefault
valueis0.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
AdisputedBPDUisoneinwhichtheflagsfieldindicatesadesignatedroleandlearning,andthe
priorityvectorisworsethanthatalreadyheldbytheport.IfadisputedBPDUisreceivedtheport
isforcedtothelisteningstate.Refertothe802.1Q2005standard,IEEEStandardforLocaland
MetropolitanAreaNetworksVirtualBridgedLocalAreaNetworks,forafulldescriptionofthedispute
mechanism,whichpreventsloopingincasesofonewaycommunication.
ThedisputedBPDUthresholdisanintegervariablethatrepresentsthenumberofdisputed
BPDUsthatmustbereceivedonagivenport/SIDuntiladisputedBPDUtrapissentandasyslog
messageisissued.Forexample,ifthethresholdis10,thenatrapisissuedwhen10,20,30,andso
on,disputedBPDUshavebeenreceived.
Ifthevalueis0,trapsarenotsent.Thetrapindicatesport,SIDandtotalDisputedBPDUcount.
Thedefaultis0.
9-52
Example
ThisexampleshowshowtosetthedisputedBPDUthresholdvalueto5:
C3(rw)->set spantree disputedbpduthreshold 5
Syntax
show spantree disputedbpduthreshold
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythecurrentdisputedBPDUthreshold:
C3(rw)->show spantree disputedbpduthreshold
The disputed BPDU threshold value is 0
Syntax
clear spantree disputedbpduthreshold
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetthedisputedBPDUthresholdtothedefaultof0:
C3(rw)->clear spantree disputedbpduthreshold
9-53
Syntax
show spantree nonforwardingreason port-string [sid sid]
Parameters
portstring
Specifiesport(s)forwhichtodisplaythenonforwardingreason.
sidsid
(Optional)SpecifiesthespecificSpanningTree(s)forwhichtodisplay
thenonforwardingreason.Validvaluesare04094.Ifnotspecified,
SID0isassumed.
Defaults
Ifnoportstringisspecified,nonforwardingreasonisdisplayedforallports.
IfnoSIDisspecified,SID0isassumed.
Mode
Switchcommand,readonly.
Usage
ExceptionalconditionscausingaporttobeplacedinlisteningorblockingstateincludeaLoop
Protectevent,receiptofdisputedBPDUs,andloopbackdetection.
Example
Thisexampleshowshowtodisplaythenonforwardingreasononge.1.1:
C3(rw)->show spantree nonforwardingreason port ge.1.1
on SID 0 is None
The non-forwarding reason for port ge.1.1
9-54
10
802.1Q VLAN Configuration
ThischapterdescribestheSecureStackC3systemscapabilitiestoimplement802.1QvirtualLANs
(VLANs).
For information about...
Refer to page...
10-1
Viewing VLANs
10-3
10-5
10-8
10-13
10-18
10-20
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of VLAN
configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
10-1
Task
Refer to page...
1.
10-5
2.
Set the PVID for the desired switch port to the VLAN created in Step 1.
10-9
3.
Add the desired switch port to the egress list for the VLAN created in
Step 1.
10-15
4.
10-18
5.
8-14
ThecommandsusedtocreateasecuremanagementVLANarelistedinTable 101.Thisexample
assumesthemanagementstationisattachedtoge.1.1andwantsuntaggedframes.
Theprocessdescribedherewouldberepeatedoneverydevicethatisconnectedinthenetworkto
ensurethateachdevicehasasecuremanagementVLAN.
Table 10-1
To do this...
10-2
Viewing VLANs
Viewing VLANs
Purpose
TodisplayalistofVLANscurrentlyconfiguredonthedevice,todeterminehowoneormore
VLANswerecreated,theportsallowedanddisallowedtotransmittrafficbelongingtoVLAN(s),
andifthoseportswilltransmitthetrafficwithaVLANtagincluded.
Command
For information about...
Refer to page...
show vlan
10-3
show vlan
UsethiscommandtodisplayallinformationrelatedtooneormoreVLANs.
Syntax
show vlan [static] [vlan-list] [portinfo [vlan vlan-list | vlan-name] [port portstring]]
Parameters
static
(Optional)DisplaysinformationrelatedtostaticVLANs.StaticVLANsare
manuallycreatedusingthesetvlancommand(setvlanonpage 105),
SNMPMIBs,ortheWebViewmanagementapplication.ThedefaultVLAN,
VLAN1,isalwaysstaticallyconfiguredandcantbedeleted.Onlyports
thatuseaspecifiedVLANastheirdefaultVLAN(PVID)willbedisplayed.
vlanlist
(Optional)DisplaysinformationforaspecificVLANorrangeofVLANs.
portinfo
(Optional)DisplaysVLANattributesrelatedtooneormoreports.
vlanvlanlist|
vlanname
(Optional)DisplaysportinformationforoneormoreVLANs.
portportstring
(Optional)Displaysportinformationforoneormoreports.
Defaults
Ifnooptionsarespecified,allinformationrelatedtostaticanddynamicVLANswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayinformationforVLAN1.Inthiscase,VLAN1isnamed
DEFAULTVLAN.PortsallowedtotransmitframesbelongingtoVLAN1arelistedasegress
ports.PortsthatwontincludeaVLANtagintheirtransmittedframesarelistedasuntagged
ports.Therearenoforbiddenports(preventedfromtransmittedframes)onVLAN1:
C3(su)->show vlan 1
VLAN: 1
NAME: DEFAULT VLAN
10-3
show vlan
Table 102providesanexplanationofthecommandoutput.
Table 10-2
10-4
Output Field
What It Displays...
VLAN
VLAN ID.
NAME
Status
VLAN Type
Egress Ports
Forbidden Egress
Ports
Untagged Ports
Commands
For information about...
Refer to page...
set vlan
10-5
10-6
clear vlan
10-6
10-7
set vlan
UsethiscommandtocreateanewstaticIEEE802.1QVLAN,ortoenableordisableanexisting
VLAN.
Syntax
set vlan {create | enable | disable} vlan-list
Parameters
create|enable|
disable
Creates,enablesordisablesVLAN(s).
vlanlist
SpecifiesoneormoreVLANIDstobecreated,enabledordisabled.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
OnceaVLANiscreated,youcanassignitanameusingthesetvlannamecommanddescribedin
setvlannameonpage 106.
EachVLANIDmustbeunique.IfaduplicateVLANIDisentered,thedeviceassumesthatthe
AdministratorintendstomodifytheexistingVLAN.
EntertheVLANIDusingauniquenumberbetween1and4093.TheVLANIDsof0and4094and
highermaynotbeusedforuserdefinedVLANs.
Examples
ThisexampleshowshowtocreateVLAN3:
C3(su)->set vlan create 3
SecureStack C3 Configuration Guide
10-5
Syntax
set vlan name vlan-list vlan-name
Parameters
vlanlist
SpecifiestheVLANIDoftheVLAN(s)tobenamed.
vlanname
SpecifiesthestringusedasthenameoftheVLAN(1to32characters).
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthenameforVLAN7togreen:
C3(su)->set vlan name 7 green
clear vlan
UsethiscommandtoremoveastaticVLANfromthelistofVLANsrecognizedbythedevice.
Syntax
clear vlan vlan-list
Parameters
vlanlist
SpecifiestheVLANIDoftheVLAN(s)toberemoved.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoremoveastaticVLAN9fromthedevicesVLANlist:
C3(su)->clear vlan 9
10-6
Syntax
clear vlan name vlan-list
Parameters
vlanlist
SpecifiestheVLANIDoftheVLAN(s)forwhichthenamewillbecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearthenameforVLAN9:
C3(su)->clear vlan name 9
10-7
Commands
For information about...
Refer to page...
10-8
10-9
10-9
10-10
10-11
10-11
10-12
Syntax
show port vlan [port-string]
Parameters
portstring
(Optional)DisplaysPVIDinformationforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,portVLANinformationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayPVIDsassignedtoge.2.1through6.Inthiscase,untagged
framesreceivedontheseportswillbeclassifiedtoVLAN1:
C3(su)->show port vlan ge.2.1-6
ge.2.1 is set to 1
ge.2.2 is set to 1
ge.2.3 is set to 1
ge.2.4 is set to 1
10-8
ge.2.5 is set to 1
ge.2.6 is set to 1
Syntax
set port vlan port-string pvid [modify-egress | no-modify-egress]
Parameters
portstring
Specifiestheport(s)forwhichtoconfigureaVLANidentifier.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
pvid
SpecifiestheVLANIDoftheVLANtowhichport(s)willbeadded.
modifyegress
(Optional)Addsport(s)toVLANsuntaggedegresslistandremovesthem
fromotheruntaggedegresslists.
nomodifyegress
(Optional)Doesnotpromptforormakeegresslistchanges.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThePVIDisusedtoclassifyuntaggedframesastheyingressintoagivenport.
Example
Thisexampleshowshowtoaddge.1.10totheportVLANlistofVLAN4(PVID4).
C3(su)->set vlan create 4
C3(su)->set port vlan ge.1.10 4 modify-egress
Syntax
clear port vlan port-string
10-9
Parameters
portstring
Specifiestheport(s)toberesettothehostVLANID1.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresetportsge.1.3through11toaVLAN IDof1(HostVLAN):
C3(su)->clear port vlan ge.1.3-11
Syntax
show port ingress-filter [port-string]
Parameters
portstring
(Optional)Specifiestheport(s)forwhichtodisplayingressfilteringstatus.
Foradetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,ingressfilteringstatusforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheportingressfilterstatusforports10through15inslot1.
Inthiscase,theportsaredisabledforingressfiltering:
C3(su)->show port ingress-filter ge.1.10-15
Port
State
-------- --------ge.1.10 disabled
ge.1.11 disabled
ge.1.12 disabled
ge.1.13 disabled
ge.1.14 disabled
ge.1.15 disabled
10-10
Syntax
set port ingress-filter port-string {disable | enable}
Parameters
portstring
Specifiestheport(s)onwhichtoenableofdisableingressfiltering.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
disable|enable
Disablesorenablesingressfiltering.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Wheningressfilteringisenabledonaport,theVLANIDsofincomingframesarecomparedtothe
portsegresslist.IfthereceivedVLANIDdoesnotmatchaVLANIDontheportsegresslist,then
theframeisdropped.
IngressfilteringisimplementedaccordingtotheIEEE802.1Qstandard.
Example
Thisexampleshowshowtoenableportingressfilteringonge.1.3:
C3(su)->set port ingress-filter ge.1.3 enable
Syntax
show port discard [port-string]
Parameters
portstring
(Optional)Displaystheframediscardmodeforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
If port-string is not specified, frame discard mode will be displayed for all
ports.
10-11
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheframediscardmodeforge.2.7.Inthiscase,theporthas
beensettodiscardalltaggedframes:
C3(su)->show port discard ge.2.7
Port
Discard Mode
------------ ------------ge.2.7
tagged
Syntax
set port discard port-string {tagged | untagged | both | none}
Parameters
portstring
Specifiestheport(s)forwhichtosetframediscardmode.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
tagged|
untagged|both|
none
TaggedDiscardallincoming(received)taggedpacketsonthedefined
port(s).
UntaggedDiscardallincominguntaggedpackets.
BothAlltrafficwillbediscarded(taggedanduntagged).
NoneNopacketswillbediscarded.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Theoptionsaretodiscardallincomingtaggedframes,allincominguntaggedframes,neither
(essentiallyallowalltraffic),orboth(essentiallydiscardingalltraffic).
Acommonpracticeistodiscardalltaggedpacketonuserports.TypicallyanAdministratordoes
notwanttheendusersdefiningwhatVLANtheyuseforcommunication.
Example
Thisexampleshowshowtodiscardalltaggedframesreceivedonportge.3.3:
C3(su)->set port discard ge.3.3 tagged
10-12
Commands
For information about...
Refer to page...
10-13
10-14
10-15
10-15
10-16
10-17
Syntax
show port egress [port-string]
Parameters
portstring
(Optional)DisplaysVLANmembershipforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,VLANmembershipwillbedisplayedforallports.
10-13
Mode
Switchcommand,readwrite.
Example
ThisexampleshowsyouhowtoshowVLANegressinformationforge.1.1through3.Inthiscase,
allthreeportsareallowedtotransmitVLAN1framesastaggedandVLAN10framesas
untagged.BotharestaticVLANs:
C3(su)->show port egress ge.1.1-3
Port
Vlan
Egress
Registration
Number
Id
Status
Status
------------------------------------------------------ge.1.1
1
tagged
static
ge.1.1
10
untagged
static
ge.1.2
1
tagged
static
ge.1.2
10
untagged
static
ge.1.3
1
tagged
static
ge.1.3
10
untagged
static
Syntax
set vlan forbidden vlan-id port-string
Parameters
vlanid
SpecifiestheVLANforwhichtosetforbiddenport(s).
portstring
Specifiestheport(s)tosetasforbiddenforthespecifiedvlanid.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowsyouhowtosetge.1.3toforbiddenforVLAN6:
C3(su)->set vlan forbidden 6 ge.1.3
10-14
Syntax
set vlan egress vlan-list port-string [untagged | forbidden | tagged]
Parameters
vlanlist
Specifies the VLAN where a port(s) will be added to the egress list.
portstring
SpecifiesoneormoreportstoaddtotheVLANegresslistofthespecified
vlanlist.Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
untagged|
forbidden|
tagged
(Optional)Addsthespecifiedportsas:
untaggedCausestheport(s)totransmitframeswithoutanIEEE
802.1Qheadertag.
forbiddenInstructsthedevicetoignoredynamicrequests(either
throughGVRPordynamicegress)fromtheport(s)tojointheVLAN
anddisallowsegressonthatport.
taggedCausestheport(s)totransmit802.1Qtaggedframes.
Defaults
Ifuntagged,forbiddenortaggedisnotspecified,theportwillbeaddedtotheVLANegresslist
astagged.
Mode
Switchcommand,readwrite.
Examples
Thisexampleshowshowtoaddge.1.5through10totheegresslistofVLAN7.Thismeansthat
theseportswilltransmitVLAN7framesastagged:
C3(su)->set vlan egress 7 ge.1.5-10 untagged
Thisexampleshowshowtoforbidports13through15inslot1fromjoiningVLAN7anddisallow
egressonthoseports:
C3(su)->set vlan egress 7 ge.1.13-15 forbidden
Thisexampleshowshowtoallowport2inslot1totransmitVLAN7framesasuntagged:
C3(su)->set vlan egress 7 ge.1.2 untagged
10-15
Syntax
clear vlan egress vlan-list port-string [forbidden]
Parameters
vlanlist
SpecifiesthenumberoftheVLANfromwhichaport(s)willberemoved
fromtheegresslist.
portstring
SpecifiesoneormoreportstoberemovedfromtheVLANegresslistofthe
specifiedvlanlist.Foradetaileddescriptionofpossibleportstringvalues,
refertoPortStringSyntaxUsedintheCLIonpage 71.
forbidden
(Optional)Clearstheforbiddensettingfromthespecifiedport(s)andresets
theport(s)asabletoegressframesifsoconfiguredbyeitherstaticor
dynamicmeans.
Defaults
Ifforbiddenisnotspecified,taggedanduntaggedsettingswillbecleared.
Mode
Switchcommand,readwrite.
Examples
Thisexampleshowshowtoremovege.3.14fromtheegresslistofVLAN 9:
C3(su)->clear vlan egress 9 ge.3.14
ThisexampleshowshowtoremoveallEthernetportsinslot2fromtheegresslistofVLAN4:
C3(su)->clear vlan egress 4 ge.2.*
Syntax
show vlan dynamicegress [vlan-list]
Parameters
vlanlist
(Optional)DisplaysdynamicegressstatusforspecificVLAN(s).
Defaults
Ifvlanlistisnotspecified,thedynamicegressstatusforallVLANswillbedisplayed.
Mode
Switchcommand,readwrite.
10-16
Example
ThisexampleshowshowtodisplaythedynamicegressstatusforVLANs5055:
C3(rw)->show vlan dynamicegress 50-55
VLAN 50 is disabled
VLAN 51 is disabled
VLAN 52 is disabled
VLAN 53 is enabled
VLAN 54 is enabled
VLAN 55 is enabled
Syntax
set vlan dynamicegress vlan-list {enable | disable}
Parameters
vlanlist
SpecifiestheVLANsbyIDtoenableordisabledynamicegress.
enable|disable
Enablesordisablesdynamicegress.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
IfdynamicegressisenabledforaparticularVLAN,whenaportreceivesaframetaggedwiththat
VLANsID,theswitchwilladdthereceivingporttothatVLANsegresslist.Dynamicegressis
disabledontheSecureStackC3bydefault.
Forexample,assumeyouhave20AppleTalkusersonyournetworkwhoaremobileusers(thatis,
usedifferentportseveryday),butyouwanttokeeptheAppleTalktrafficisolatedinitsown
VLAN.YoucancreateanAppleTalkVLANwithaVLANIDof55withaclassificationrulethatall
AppleTalktrafficgetstaggedwithVLANID55.Then,youenabledynamicegressforVLAN55.
Now,whenanAppleTalkuserplugsintoportge.3.5andsendsanAppleTalkpacket,theswitch
willtagthepackettoVLAN55andalsoaddportge.3.5toVLAN55segresslist,whichallowsthe
AppleTalkusertoreceiveAppleTalktraffic.
Example
ThisexampleshowshowtoenabledynamicegressonVLAN55:
C3(rw)->set vlan dynamicegress 55 enable
10-17
Commands
For information about...
show host vlan
10-18
10-18
10-19
Syntax
show host vlan
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythehostVLAN:
C3(su)->show host vlan
Host vlan is 7.
Syntax
set host vlan vlan-id
10-18
Refer to page...
Parameters
vlanid
SpecifiesthenumberoftheVLANtosetasthehostVLAN.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThehostVLANshouldbeasecureVLANwhereonlydesignatedusersareallowedaccess.For
example,ahostVLANcouldbespecificallycreatedfordevicemanagement.Thiswouldallowa
managementstationconnectedtothemanagementVLANtomanageallportsonthedeviceand
makemanagementsecurebypreventingmanagementviaportsassignedtootherVLANs.
Note: Before you can designate a VLAN as the host VLAN, you must create a VLAN using the set
of commands described in Creating and Naming Static VLANs on page 10-5.
Example
ThisexampleshowshowtosetVLAN7asthehostVLAN:
C3(su)->set host vlan 7
Syntax
clear host vlan
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthehostVLANtothedefaultsetting:
C3(su)->clear host vlan
10-19
Overview
ThepurposeofGVRPistodynamicallycreateVLANsacrossaswitchednetwork.WhenaVLAN
isdeclared,theinformationistransmittedoutGVRPconfiguredportsonthedeviceinaGARP
formattedframeusingtheGVRPmulticastMACaddress.Aswitchthatreceivesthisframe,
examinestheframe,andextractstheVLANIDs.GVRPthencreatestheVLANsandaddsthe
receivingporttoitstaggedmemberlistfortheextractedVLANID(s).Theinformationisthen
transmittedouttheotherGVRPconfiguredportsofthedevice.Figure 101showsanexampleof
howVLANbluefromendstationAwouldbepropagatedacrossaswitchnetwork.
How It Works
InFigure 101onpage 1021,Switch4,port1isregisteredasbeingamemberofVLANBlueand
thendeclaresthisfactoutallitsports(2and3)toSwitch1andSwitch 2.Thesetwodevices
registerthisintheportegresslistsoftheports(Switch1,port1andSwitch2,port1)thatreceived
theframeswiththeinformation.Switch2,whichisconnectedtoSwitch3andSwitch5declares
thesameinformationtothosetwodevicesandtheportegresslistofeachportisupdatedwiththe
newinformation,accordingly.
ConfiguringaVLANonan802.1QswitchcreatesastaticVLANentry.Theentrywillalways
remainregisteredandwillnottimeout.However,dynamicentrieswilltimeoutandtheir
registrationswillberemovedfromthememberlistiftheendstationAisremoved.Thisensures
that,ifswitchesaredisconnectedorifendstationsareremoved,theregisteredinformation
remainsaccurate.
TheendresultisthattheportegresslistofaportisupdatedwithinformationaboutVLANsthat
resideonthatport,eveniftheactualstationontheVLANisseveralhopsaway.
10-20
Figure 10-1
Switch 2
R 2D
Switch 1
2
End
Station A
D 3 D
R
D
Switch 4
R Switch 5
Purpose
TodynamicallycreateVLANsacrossaswitchednetwork.TheGVRPcommandsetisusedto
displayGVRPconfigurationinformation,thecurrentglobalGVRPstatesetting,individualport
settings(enableordisable)andtimersettings.Bydefault,GVRPisenabledgloballyonthedevice,
butdisabledonallports.
Commands
For information about...
Refer to page...
show gvrp
10-22
10-22
set gvrp
10-23
clear gvrp
10-24
10-24
10-25
10-21
show gvrp
show gvrp
UsethiscommandtodisplayGVRPconfigurationinformation.
Syntax
show gvrp [port-string]
Parameters
portstring
(Optional)DisplaysGVRPconfigurationinformationforspecificport(s).For
adetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,GVRPconfigurationinformationwillbedisplayedforallportsand
thedevice.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayGVRPstatusforthedeviceandforfw.2.1:
C3(su)->show gvrp ge.2.1
Global GVRP status is enabled.
Port Number
----------ge.2.1
GVRP status
----------disabled
Syntax
show garp timer [port-string]
Parameters
portstring
(Optional)DisplaysGARPtimerinformationforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,GARPtimerinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
10-22
set gvrp
Example
ThisexampleshowshowtodisplayGARPtimerinformationonports1through10inslot1:
Note: For a functional description of the terms join, leave, and leaveall timers, refer to the
standard IEEE 802.1Q documentation, which is not supplied with this device.
C3(su)->show garp timer ge.1.1-10
Port based GARP Configuration: (Timer units are centiseconds)
Port Number
Join
Leave
Leaveall
----------- ---------- ---------- ---------ge.1.1
20
60
1000
ge.1.2
20
60
1000
ge.1.3
20
60
1000
ge.1.4
20
60
1000
ge.1.5
20
60
1000
ge.1.6
20
60
1000
ge.1.7
20
60
1000
ge.1.8
20
60
1000
ge.1.9
20
60
1000
ge.1.10
20
60
1000
Table 103providesanexplanationofthecommandoutput.Fordetailsonusingthesetgvrp
commandtoenableordisableGVRP,refertosetgvrponpage 1023.Fordetailsonusingtheset
garptimercommandtochangedefaulttimervalues,refertosetgarptimeronpage 1024.
Table 10-3
Output Field
What It Displays...
Port Number
Join
Leave
Leaveall
set gvrp
UsethiscommandtoenableordisableGVRPgloballyonthedeviceorononeormoreports.
Syntax
set gvrp {enable | disable} [port-string]
Parameters
disable|
enable
DisablesorenablesGVRPonthedevice.
portstring
(Optional)DisablesorenablesGVRPonspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsedin
theCLIonpage 71.
Defaults
Ifportstringisnotspecified,GVRPwillbedisabledorenabledforallports.
10-23
clear gvrp
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtoenableGVRPgloballyonthedevice:
C3(su)->set gvrp enable
ThisexampleshowshowtodisableGVRPgloballyonthedevice:
C3(su)->set gvrp disable
ThisexampleshowshowtoenableGVRPonge.1.3:
C3(su)->set gvrp enable ge.1.3
clear gvrp
UsethiscommandtoclearGVRPstatusorononeormoreports.
Syntax
clear gvrp [port-string]
Parameters
portstring
(Optional)ClearsGVRPstatusonspecificport(s).Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLIon
page 71.
Defaults
Ifportstringisnotspecified,GVRPstatuswillbeclearedforallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearGVRPstatusgloballyonthedevice:
C3(su)->clear gvrp
Syntax
set garp timer {[join timer-value] [leave timer-value] [leaveall timer-value]}
port-string
Parameters
10-24
jointimervalue
SetstheGARPjointimerincentiseconds(Referto802.1Qstandard.)
leavetimervalue
SetstheGARPleavetimerincentiseconds(Referto802.1Qstandard.)
leavealltimer
value
SetstheGARPleavealltimerincentiseconds(Referto802.1Qstandard.)
portstring
Specifiestheport(s)onwhichtoconfigureGARPtimersettings.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thesettingofthesetimersiscriticalandshouldonlybechangedbypersonnelfamiliarwiththe
802.1Qstandardsdocumentation,whichisnotsuppliedwiththisdevice.
Examples
ThisexampleshowshowtosettheGARPjointimervalueto100centisecondsforallports:
C3(su)->set garp timer join 100 *.*.*
Thisexampleshowshowtosettheleavetimervalueto300centisecondsforallports:
C3(su)->set garp timer leave 300 *.*.*
Thisexampleshowshowtosettheleavealltimervalueto20000centisecondsforallports:
C3(su)->set garp timer leaveall 20000 *.*.*
Syntax
clear garp timer {[join] [leave] [leaveall]} port-string
Parameters
join
(Optional)Resetsthejointimerto20centiseconds.
leave
(Optional)Resetstheleavetimerto60centiseconds.
leaveall
(Optional)Resetstheleavealltimeto1000centiseconds.
portstring
SpecifiestheportorportsonwhichtoresettheGARPtimer(s).
Defaults
Atleastoneoptionalparametermustbeentered.
Mode
Switchcommand,readwrite.
10-25
Example
TheexampleshowshowtoresettheGARPleavetimerto60centiseconds.
C3(su)->clear garp timer leave ge.1.1
10-26
11
Policy Classification Configuration
ThischapterdescribesthePolicyClassificationsetofcommandsandhowtousethem.
For information about...
Refer to page...
11-1
11-2
11-6
11-15
11-17
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of Policy
configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
Create,changeorremovepolicyprofilesbasedonbusinessspecificuseofnetworkservices.
Permitordenyaccesstospecificservicesbycreatingandassigningclassificationruleswhich
mapuserprofilestoprotocolbasedframefilteringpoliciesconfiguredforaparticularVLAN
orClassofService(CoS).
Assignorunassignportstopolicyprofilessothatonlyportsactivatedforaprofilewillbe
allowedtotransmitframesaccordingly.
Note: It is recommended that you use Enterasys Networks NMS Policy Manager as an alternative
to CLI for configuring policy classification on the SecureStack C3 devices.
11-1
Commands
For information about...
Refer to page...
11-2
11-4
11-5
Syntax
show policy profile {all | profile-index [consecutive-pids] [-verbose]}
Parameters
all|profileindex
Displayspolicyinformationforallprofileindexesoraspecificprofileindex.
consecutivepids
(Optional)Displaysinformationforspecifiedconsecutiveprofileindexes.
verbose
(Optional)Displaysdetailedinformation.
Defaults
Ifoptionalparametersarenotspecified,summaryinformationwillbedisplayedforthespecified
indexorallindices.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaypolicyinformationforprofile11:
C3(su)->show policy profile 11
Profile Index
: 11
Profile Name
: MacAuth1
Row Status
: active
Port VID Status
: Enable
Port VID Override
: 11
CoS
: 0
11-2
CoS Status
Egress Vlans
Forbidden Vlans
Untagged Vlans
Rule Precedence
: Disable
: none
: none
: none
: 1-31
:MACSource(1),MACDest(2),Unknown(3),
:Unknown(4),Unknown(5),Unknown(6),
:Unknown(7),Unknown(8),Unknown(9),
:Unknown(10),Unknown(11),IPSource(12),
:IPDest(13),IPFrag(14),UDPSrcPort(15),
:UDPDestPort(16),TCPSrcPort(17),TCPDestPort(18),
:ICMPType(19),Unknown(20),IPTOS(21),
:IPProto(22),Unknown(23),Unknown(24),
:Ether(25),Unknown(26),VLANTag(27),
:Unknown(28),Unknown(29),Unknown(30),
:port(31)
: none
: none
: none
Table 111providesanexplanationofthecommandoutput.
Table 11-1
Output Field
What It Displays...
Profile Index
Profile Name
Row Status
Whether or not PVID override is enabled or disabled for this profile. If all
classification rules associated with this profile are missed, then this parameter, if
specified, determines default behavior.
CoS
CoS Status
Whether or not Class of Service override is enabled or disabled for this profile. If all
classification rules associated with this profile are missed, then this parameter, if
specified, determines default behavior.
Egress VLANs
VLAN(s) that ports to which the policy profile is assigned can use for tagged egress.
Forbidden VLANs
Untagged VLANs
VLAN(s) that ports to which the policy profile is assigned can use for untagged
egress.
Rule Precedence
Admin Profile Usage Ports administratively assigned to use this policy profile.
Oper Profile Usage
Dynamic Profile
Usage
11-3
Syntax
set policy profile profile-index [name name] [pvid-status {enable | disable}]
[pvid pvid] [cos-status {enable | disable}] [cos cos] [egress-vlans egressvlans][forbidden-vlans forbidden-vlans] [untagged-vlans untagged-vlans]
[precedence precedence-list] [append] [clear]
Parameters
profileindex
Specifiesanindexnumberforthepolicyprofile.Validvaluesare1255.
namename
(Optional)Specifiesanameforthepolicyprofile.Thisisastringfrom1to
64characters.
pvidstatus
enable|disable
(Optional)EnablesordisablesPVIDoverrideforthisprofile.Ifall
classificationrulesassociatedwiththisprofilearemissed,thenthis
parameter,ifspecified,determinesdefaultbehavior.
pvidpvid
(Optional)SpecifiesthePVIDtopackets,ifPVIDoverrideisenabledand
invokedasdefaultbehavior.
cosstatusenable
|disable
(Optional)EnablesordisablesClassofServiceoverrideforthisprofile.Ifall
classificationrulesassociatedwiththisprofilearemissed,thenthis
parameter,ifspecified,determinesdefaultbehavior.
Note: A maximum of 99 rules can be supported per policy profile for policy
profiles that have cos-status enabled.
coscos
(Optional)SpecifiesaCoSvaluetoassigntopackets,ifCoSoverrideis
enabledandinvokedasdefaultbehavior.Validvaluesare0to7.
egressvlans
egressvlans
(Optional)Specifiesthattheporttowhichthispolicyprofileisapplied
shouldbeaddedtotheegresslistoftheVLANsdefinedbyegressvlans.
Packetswillbeformattedastagged.
forbiddenvlans
forbiddenvlans
(Optional)Specifiesthattheporttowhichthispolicyprofileisapplied
shouldbeaddedasforbiddentotheegresslistoftheVLANsdefinedby
forbiddenvlans.Packetsfromthisportwillnotbeallowedtoparticipatein
thelistedVLANs.
untaggedvlans
untaggedvlans
(Optional)Specifiesthattheporttowhichthispolicyprofileisapplied
shouldbeaddedtotheegresslistoftheVLANsdefinedbyuntaggedvlans.
Packetswillbeformattedasuntagged.
append
(Optional)Appendsthispolicyprofilesettingtosettingspreviously
specifiedforthispolicyprofilebytheegressvlans,forbiddenvlans,or
untaggedvlansparameters.
Ifappendisnotused,previousVLANsettingsarereplaced.
11-4
clear
(Optional)Appendsthispolicyprofilesettingfromsettingspreviously
specifiedforthispolicyprofilebytheegressvlans,forbiddenvlans,or
untaggedvlansparameters.
precedence
precedencelist
(Optional)Assignsaruleprecedencetothisprofile.Lowervalueswillbe
givenhigherprecedence.Foralistofvalues,refertotheshowpolicy
profilecommandoutput.
Defaults
Ifoptionalparametersarenotspecified,nonewillbeapplied.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtocreateapolicyprofile1namednetadminwithPVIDoverride
enabledforPVID10,andClassofServiceoverrideenabledforCoS5.ThisprofilecanuseVLAN
10foruntaggedegress:
C3(su)->set policy profile 1 name netadmin pvid-status enable pvid 10 cos-status
enable cos 5 untagged-vlans 10
Syntax
clear policy profile profile-index
Parameters
profileindex
Specifiestheindexnumberoftheprofileentrytobedeleted.Validvalues
are1to255.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodeletepolicyprofile8:
C3(su)->clear policy profile 8
11-5
Commands
For information about...
Refer to page...
11-6
11-8
11-10
11-13
11-14
Syntax
show policy rule [all | admin-profile | profile-index] [ether |ipproto |
ipdestsocket | ipsourcesocket | iptos | macdest | macsource | tcpdestport |
tcpsourceport | udpdestport | udpsourceport] [data] [mask mask] [port-string portstring] [rule-status {active | not-in-service | not-ready}] [storage-type {nonvolatile | volatile}] [vlan vlan] | [drop | forward] [dynamic-pid dynamic-pid]
[cos cos] [admin-pid admin-pid] [-verbose] [usage-list] [display-if-used]
Parameters
11-6
all|admin
profile|profile
index
Displayspolicyclassificationrulesforallprofiles,theadminprofile,orfor
aspecificprofileindexnumber.Validvaluesare11023.
ether
DisplaysEthernettypeIIrules.
ipproto
DisplaysIPprotocolfieldinIPpacketrules.
ipdestsocket
DisplaysIPdestinationaddressrules.
ipsourcesocket
DisplaysIPsourceaddressrules.
iptos
DisplaysTypeofServicerules.
macdest
DisplaysMACdestinationaddressrules.
macsource
DisplaysMACsourceaddressrules.
tcpdestport
DisplaysTCPdestinationportrules.
tcpsourceport
DisplaysTCPsourceportrules.
udpdestport
DisplaysUDPdestinationportrules.
udpsourceport
DisplaysUDPsourceportrules.
data
Displaysrulesforapredefinedclassifier.Thisvalueisdependentonthe
classificationtypeentered.RefertoTable 113forvalidvaluesforeach
classificationtype.
maskmask
(Optional)Displaysrulesforaspecificdatamask.RefertoTable 113for
validvaluesforeachclassificationtypeanddatavalue.
portstringport
string
(Optional)Displaysrulesrelatedtoaspecificingressport.
rulestatusactive (Optional)Displaysrulesrelatedtoaspecificrulesstatus.
|notinservice|
notready
storagetypenon
volatile|volatile
(Optional)Displaysrulesconfiguredforeithernonvolatileorvolatile
storage.
vlanvlan
(Optional)DisplaysrulesforaspecificVLANID.
drop|forward
Displaysrulesbasedonwhethermatchingpacketswillbedroppedor
forwarded.
dynamicpid
dynamicpid
DisplaysrulesassociatedwithaspecificdynamicpolicyID.
coscos
(Optional)DisplaysrulesforaClassofServicevalue.(Notsupportedon
B3,C3,G3devices.)
adminpid
adminpid
DisplaysrulesassociatedwithaspecificadministrativepolicyID[1..1023].
verbose
(Optional)Displaysdetailedinformation.
usagelist
(Optional)Ifselected,eachrulesusagelistshallbecheckedandshall
displayonlythoseportswhichhaveappliedthisrule.
displayifused
(Optional)Displaysrule(s)onlyiftheyareappliedtoatleastoneport.
Defaults
Ifverboseisnotspecified,summaryinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaypolicyclassificationinformationforEthernettype2rules
C3(su)->show policy rule ether
|PID |Rule Type
|Rule Data
|02
|Ether
|2048 (0x0800)
|02
|Ether
|2049 (0x0801)
|02
|Ether
|2989 (0x0bad)
|02
|Ether
|33079 (0x8137)
|Mk|PortStr
|16|All
|16|All
|16|All
|16|All
|RS|ST|VLAN|CoS
| A|NV|fwrd|
| A|NV|drop|
| A|NV|drop|
| A|NV|drop|
|U|
|?|
|?|
|?|
|?|
Thisexampleshowshowtodisplaypolicyclassificationinformationforadministrativerule1
C3(su)->show policy rule admin-pid 1
|Admin|Rule Type
|Rule Data
|Mk|PortStr
|RS|ST|dPID|aPID|U|
11-7
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|admin|Port
|ge.1.1
|ge.1.2
|ge.1.3
|ge.1.4
|ge.1.5
|ge.1.6
|ge.1.7
|ge.1.8
|ge.1.9
|ge.1.10
|ge.1.11
|ge.1.12
|16|ge.1.1
|16|ge.1.2
|16|ge.1.3
|16|ge.1.4
|16|ge.1.5
|16|ge.1.6
|16|ge.1.7
|16|ge.1.8
|16|ge.1.9
|16|ge.1.10
|16|ge.1.11
|16|ge.1.12
|
|
|
|
|
|
|
|
|
|
|
|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
A|NV|
|
|
|
|
|
|
|
|
|
|
|
|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
1|?|
Table 112providesanexplanationofthecommandoutput.
Table 11-2
Output Field
What It Displays...
PID
Profile index number. Assigned to this classification rule with the set policy profile
command (set policy profile on page 11-4).
Rule Type
Rule Data
Rule data value. Refer to Table 11-3 for valid values for each classification type.
Mk
Rule data mask. Refer to Table 11-3 for valid values for each classification data
value.
PortStr
RS
Whether or not the status of this rule is active (A), not in service or not ready.
ST
Whether or not this rules storage type is non-volatile (NV) or volatile (V).
VLAN
VLAN ID to which this rule applies and whether or not matching packets will be
dropped or forwarded.
CoS
dPID
aPID
Syntax
show policy capability
Parameters
None.
Defaults
None.
11-8
Mode
Switchcommand,readonly.
Usage
Usethiscommandtodisplaydetailedpolicyclassificationcapabilitiessupportedbyyour
SecureStackC3device.Theoutputofthiscommandshowsatablelistingclassifiabletraffic
attributesandthetypeofactions,byruletype,thatcanbeexecutedrelativetoeachattribute.
Abovethetableisalistofalltheactionspossibleonthisdevice.
Theleftmostcolumnofthetablelistsallpossibleclassifiabletrafficattributes.Thenexttwo
columnsfromtheleftindicatehowpolicyprofilesmaybeassigned,eitheradministrativelyor
dynamically.Thenextfourcolumnsfromtheleftindicatetheactionsthatmaybeperformed.The
lastthreecolumnsindicateauditingoptions.
Anxinanactioncolumnforatrafficattributerowindicatesthatyoursystemhasthecapabilityto
performthatactionfortrafficclassifiedbythatattribute.
Example
Thisexampleshowshowtodisplaythedevicespolicyclassificationcapabilities.Refertoset
policyruleonpage 1110foradescriptionoftheparametersdisplayed:
C3(su)->show policy capability
The following supports related to policy are supported in this device:
VLAN Forwarding
Priority
Permit
Deny
Precedence Reordering
Rules Table
Longest Prefix Rules
=============================================================
|
| D |
|
|
|
| F |
|
| D |
|
| Y |
|
|
|
| O | S |
| I |
|
| N | A |
|
|
| R | Y |
| S |
|
| A | D | V |
| D | W | S | T | A |
|
| M | M | L | C | R | A | L | R | B |
|
| I | I | A | O | O | R | O | A | L |
| SUPPORTED RULE TYPES
| C | N | N | S | P | D | G | P | E |
=============================================================
|MAC source address
|
|
|
| X | X | X |
|
|
|
|MAC destination address |
|
|
| X | X | X |
|
|
|
|IPX source address
|
|
|
|
|
|
|
|
|
|
|IPX destination address |
|
|
|
|
|
|
|
|
|
|IPX source socket
|
|
|
|
|
|
|
|
|
|
|IPX destination socket
|
|
|
|
|
|
|
|
|
|
|IPX transmission control |
|
|
|
|
|
|
|
|
|
|IPX type field
|
|
|
|
|
|
|
|
|
|
|IPv6 source address
|
|
|
|
|
|
|
|
|
|
|IPv6 destination address |
|
|
|
|
|
|
|
|
|
|IPv6 flow label
|
|
|
|
|
|
|
|
|
|
|IP source address
|
|
|
| X | X | X |
|
|
|
|IP destination address
|
|
|
| X | X | X |
|
|
|
|IP fragmentation
|
|
|
|
|
|
|
|
|
|
|UDP port source
|
|
|
| X | X | X |
|
|
|
|UDP port destination
|
|
|
| X | X | X |
|
|
|
|TCP port source
|
|
|
| X | X | X |
|
|
|
|TCP port destination
|
|
|
| X | X | X |
|
|
|
|ICMP packet type
|
|
|
| | | |
|
|
|
|TTL
|
|
|
|
|
|
|
|
|
|
|IP type of service
|
|
|
| X | X | X |
|
|
|
|IP proto
|
|
|
| X | X | X |
|
|
|
11-9
|
|
|
|
|
Syntax
Thiscommandhastwoformsofsyntaxonetocreateanadminrule,andtheothertocreatea
trafficclassificationruleandattachittoapolicyprofile.
set policy rule admin-profile {vlantag data [mask mask] admin-pid profile-index}
[port-string port-string]
set policy rule profile-index {ether | ipproto | ipdestsocket | ipsourcesocket |
iptos | macdest | macsource | tcpdestport | tcpsourceport | udpdestport |
udpsourceport} data [mask mask] {[vlan vlan] [cos cos] | [drop | forward]}
Parameters
Thefollowingparametersapplytocreatinganadminrule.SeetheUsagesectionbelowformore
informationaboutadminrules.
adminprofile
Specifiesthatthisisanadminrule.
vlantagdata
ClassifiesbasedonVLANtagspecifiedbydata.Valueofdatacanrange
from1to4094or0xFFF.
maskmask
(Optional)Specifiesthenumberofsignificantbitstomatch,dependent
onthedatavalueentered.Valueofmaskcanrangefrom1to12.
RefertoTable 113forvalidvaluesforeachclassificationtypeanddata
value.
adminpid
profileindex
Associatesthisadminrulewithapolicyprofile,identifiedbyitsindex
number.Policyprofilesareconfiguredwiththesetpolicyprofile
commandasdescribedinsetpolicyprofileonpage 114.
Validprofileindexvaluesare1255.
portstringportstring
(Optional)Assignsthisrulewiththespecifiedpolicyprofileonspecific
ingressport(s).Rulewouldnotbeuseduntilpolicyisassignedtothe
specifiedport(s)usingthesetpolicyportcommandasdescribedinset
policyportonpage 1115.
Thefollowingparametersapplytocreatingatrafficclassificationrule.
11-10
profileindex
Specifiesapolicyprofilenumbertowhichthisrulewillbeassigned.
Policyprofilesareconfiguredwiththesetpolicyprofilecommandas
describedinsetpolicyprofileonpage 114.Validprofileindexvalues
are1255.
ether
Specifiesthattheruleshouldapplytotrafficwiththespecifiedtypefield
inEthernetIIpacket.
ipproto
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedProtocol
fieldinIPpacket.
ipdestsocket
Specifiesthattheruleshouldapplytotrafficwiththespecified
destinationIPaddresswithoptionalpostfixedport.
ipsourcesocket
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedsourceIP
address,withoptionalpostfixedport.
iptos
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedTypeof
ServicefieldinIPpacket.
macdest
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedMAC
destinationaddress.
macsource
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedMAC
sourceaddress.
tcpdestport
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedTCP
destinationport.
tcpsourceport
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedTCP
sourceport.
udpdestport
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedUDP
destinationport.
udpsourceport
SpecifiesthattheruleshouldapplytotrafficwiththespecifiedUDP
sourceport.
data
Specifiesthecodeforthespecifiedtrafficclassifier(listedabove).This
valueisdependentontheclassificationtypeentered.RefertoTable 113
forvalidvaluesforeachclassificationtype.
maskmask
(Optional)Specifiesthenumberofsignificantbitstomatch,dependenton
thedatavalueentered.RefertoTable 113forvalidvaluesforeach
classificationtypeanddatavalue.
vlanvlan
SpecifiestheactionoftheruleistoclassifytoaVLANID.
coscos
SpecifiestheactionoftheruleistoclassifytoaClassofServiceID.Valid
valuesare04095.Avalueof1indicatesthatnoCoSforwarding
behaviormodificationisdesired.(NotsupportedonB3,C3,andG3.)
drop|forward
Specifiesthatpacketswithinthisclassificationwillbedroppedor
forwarded.
Defaults
None.
Mode
Switchcommand,readwrite.
11-11
Usage
Anadminrulecanbeusedtomapincomingtaggedframestoapolicyrole(profile).Therecanbe
onlyoneadminruleconfiguredpersystem(stack).Typically,thisruleisusedtoimplementthe
User+IPphonelegacyfeature.RefertoConfiguringUser+IPPhoneAuthenticationon
page 2648formoreinformation.Youwouldconfigureapolicyprofile/roleforIPphones(for
example,assigningthetraffictoavoiceVLAN),thenassociatethatpolicyprofilewiththe
adminrule,andassociatetheadminrulewiththedesiredports.Usersauthenticatingoverthe
sameportwilltypicallyuseadynamicallyassignedpolicyrole.
Apolicyclassificationrulehastwomainparts:TrafficDescriptionandActions.TheTraffic
Descriptionidentifiesthetypeoftraffictowhichtherulewillpertain.Actionsspecifywhether
thattrafficwillbeassignedclassofservice,assignedtoaVLAN,orboth.
Table 113providesthesetpolicyruledatavaluesthatcanbeenteredforaparticularparameter,
andthemaskbitsthatcanbeenteredforeachclassifierassociatedwiththatparameter.
Table 11-3
data value
mask bits
ether
Not applicable.
ipproto
Not applicable.
1 - 48
iptos
Not applicable.
1 - 48
1 - 16
1 - 16
vlantag
Not applicable.
Examples
ThisexampleshowshowtouseTable 113toassignaruletopolicyprofile3thatwillfilter
EthernetIIType1526framestoVLAN7:
C3(su)->set policy rule 3 ether 1526 vlan 7
ThisexampleshowshowtouseTable 113toassignaruletopolicyprofile5thatwillforward
UDPpacketsfromsourceport45:
C3(su)->set policy rule 5 udpportsource 45 forward
11-12
ThisexampleshowshowtouseTable 113toassignaruletopolicyprofile1thatwilldropIP
sourcetrafficfromIPaddress1.2.3.4.Ifmask32isnotspecifiedasshown,adefaultmaskof48bits
(IPaddress+port)wouldbeapplied:
C3(su)->set policy rule 1 ipsourcesocket 1.2.3.4 mask 32 drop
Syntax
Thiscommandhastwoformsofsyntaxonetoclearanadminrule(forpolicyID0),andtheother
toclearaclassificationrule.
clear policy rule admin-profile {vlantag data [mask mask]
clear policy rule profile-index {all-pid-entries | {ether | ipproto | ipdestsocket
| ipsourcesocket | iptos | macdest | macsource | tcpdestport | tcpsourceport |
udpdestport | udpsourceport}}
Parameters
Thefollowingparametersapplytodeletinganadminrule.
adminprofile
SpecifiesthattheruletobedeletedisanadminruleforpolicyID0.
vlantagdata
DeletestherulebasedonVLANtagspecifiedbydata.Valueofdatacan
rangefrom1to4094or0xFFF.
maskmask
(Optional)Specifiesthenumberofsignificantbitstomatch,dependent
onthedatavalueentered.Valueofmaskcanrangefrom1to12.
RefertoTable 113forvalidvaluesforeachclassificationtypeanddata
value.
Thefollowingparametersapplytodeletingaclassificationrule.
profileindex
Specifiesapolicyprofileforwhichtodeleteclassificationrules.Valid
profileindexvaluesare1255.
allpidentries
Deletesallentriesassociatedwiththespecifiedpolicyprofile.
ether
DeletesassociatedEthernetIIclassificationrule.
ipproto
DeletesassociatedIPprotocolclassificationrule.
ipdestsocket
DeletesassociatedIPdestinationclassificationrule.
ipsourcesocket
DeletesassociatedIPsourceclassificationrule.
iptos
DeletesassociatedIPTypeofServiceclassificationrule.
macdest
DeletesassociatedMACdestinationaddressclassificationrule.
macsource
DeletesassociatedMACsourceaddressclassificationrule.
tcpdestport
DeletesassociatedTCPdestinationportclassificationrule.
tcpsourceport
DeletesassociatedTCPsourceportclassificationrule.
udpdestport
DeletesassociatedUDPdestinationportclassificationrule.
udpsourceport
DeletesassociatedUDPsourceportclassificationrule.
11-13
Defaults
Whenapplicable,dataandmaskmustbespecifiedforindividualrulestobecleared.
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtodeleteEthernetIIType1526classificationruleentriesassociatedwith
policyprofile1fromallports.
C3(su)->clear policy rule 1 ether 1526
Thisexampleshowshowtoremovearulefrompolicyprofile5thatwillforwardUDPframes
fromsourceport45.
C3(su)->clear policy rule 5 udpportsource 45 forward
Syntax
clear policy all-rules
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoremovealladministrativeandpolicyindexrules:
C3(su)->clear policy all-rules
11-14
Purpose
Toassignandunassignportstopolicyprofiles.
Commands
For information about...
Refer to page...
11-15
11-16
Syntax
set policy port port-string profile-index
Parameters
portstring
Specifiestheport(s)toaddtothepolicyprofile.Foradetaileddescription
ofpossibleportstringvalues,refertoPortStringSyntaxUsedintheCLI
onpage 71.
profileindex
SpecifiestheIDofthepolicyprofile(role)towhichtheport(s)willbe
added.Thisvaluemustmatchtheprofileindexvalueassignedusingthe
setpolicyprofilecommand(setpolicyprofileonpage 114)inorder
forapolicyprofiletobeactiveonthespecifiedport.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoallowGigabitEthernetports5through15inslot1totransmitframes
accordingtopolicyprofile1:
C3(su)->set policy port ge.1.5-15 1
11-15
Syntax
clear policy port port-string profile-index
Parameters
portstring
Specifiestheport(s)fromwhichtoremovethepolicyprofile.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
profileindex
SpecifiestheIDofthepolicyprofile(role)towhichtheport(s)willbe
added.Thisvaluemustmatchtheprofileindexvalueassignedusingthe
setpolicyprofilecommand(setpolicyprofileonpage 114)inorder
forapolicyprofiletobeactiveonthespecifiedport.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoremovepolicyprofile10fromport21inslot1:
C3(rw)->clear policy port ge.1.21 10
11-16
TheSecureStackC3supportsClassofService(CoS),whichallowsyoutoassignmissioncritical
datatoahigherprioritythroughthedevicebydelayinglesscriticaltrafficduringperiodsof
congestion.Thehigherprioritytrafficgoingthroughthedeviceisservicedfirst(beforelower
prioritytraffic).TheClassofServicecapabilityofthedeviceisimplementedbyapriority
queueingmechanism.ClassofServiceisbasedontheIEEE802.1D(802.1p)standardspecification,
andallowsyoutodefineeightpriorities(07,with7grantedhighestpriority)andupto8transmit
queues(07)foreachport.
Bydefault,policybasedCoSisdisabledonthedevice,anddefaultoruserassignedportbased
802.1D(802.1p)settingsareusedtodeterminetrafficprioritization.WhenpolicybasedCoSis
enabled,thedefaultanduserassignedpolicybasedsettingswilloverrideportbasedsettings
describedinChapter 12.
ClassofServicefunctionalitycanalsobeusedtocontrolbroadcast,unknownunicast,and/or
multicastflooding.Thisfeaturepreventsconfiguredportsfrombeingdisruptedbyatrafficstorm
byratelimitingspecifictypesofpacketsthroughthoseports.RefertoAboutCoSBasedFlood
Controlonpage 1119formoreinformation.
Step
Task
Command(s)
1.
Enable CoS
2.
3.
4.
5.
Example
Thisexamplecreatesdifferentinboundratelimitersfortwoportgroupsandthenassignsthemto
trafficwithaCoSsettingof0.
1.
Configuretwoportgroups,oneforuserportsandoneforuplinkportsandassignportstothe
groups.Portgroup1.0willrepresentuserports,group2.0willrepresentuplinkports.
C3(su)->set cos port-config irl 1.0 name Users ports ge.1.1-46
C3(su)->set cos port-config irl 2.0 name Uplink ports ge.1.47-48
C3(su)->show cos port-config
Inbound Rate Limiting Port Configuration Entries
11-17
2.
Configurephysicalinboundratelimitersforeachportgroup.Fortheuserportgroup(1.0),
createanIRL(irlindexof1)for512kbps.Fortheuplinkportgroup(2.0),createanIRL(irl
indexof1)for10megabitspersecond(10,000kbps).
C3(su)->set cos port-resource irl 1.0 1 unit kbps rate 512
C3(su)->set cos port-resource irl 2.0 1 unit kbps rate 10000
3.
IntheCoSIRLreferencemappingtableforeachportgroup,createareferenceforeachIRL
resourcecreatedinthepreviousstep.Wewillusereferencenumber1.
C3(su)->set cos reference irl 1.0 1 rate-limit 1
C3(su)->set cos reference irl 2.0 1 rate-limit 1
C3(su)->show cos reference irl 1.0
Group Index
----------1.0
1.0
1.0
1.0
...
1.0
1.0
1.0
Reference
--------0
1
2
3
Type
---irl
irl
irl
irl
Rate Limiter
-----------none
1
none
none
97
98
99
irl
irl
irl
none
none
none
11-18
Reference
--------0
1
2
3
Type
---irl
irl
irl
irl
Rate Limiter
-----------none
1
none
none
2.0
2.0
2.0
4.
97
98
99
irl
irl
irl
none
none
none
IntheCoSsettingstable,configureaCoSsettingforCoSindex1,whichhasapriorityof0.We
entertheIRLreference,createdinthepreviousstep.
C3(su)->set cos settings 0 irl-reference 1
C3(su)->show cos settings
CoS Index Priority
ToS
IRL
--------- ---------- ------- ----0
0
*
1
1
1
*
*
2
2
*
*
3
3
*
*
4
4
*
*
5
5
*
*
6
6
*
*
7
7
*
*
Note: CoS-based flood control does not require a policy license on SecureStack B3 switches or on
standalone D2 switches.
CoSbasedfloodcontrolpreventsconfiguredportsfrombeingdisruptedbyatrafficstormbyrate
limitingspecifictypesofpacketsthroughthoseports.Whenfloodcontrolisenabledonaport,
incomingtrafficismonitoredoveronesecondintervals.Duringaninterval,theincomingtraffic
rateforeachconfiguredtraffictype(unicast,broadcast,multicast)iscomparedwiththe
configuredtrafficfloodcontrolrate,specifiedinpacketspersecond.
If,duringaonesecondinterval,theincomingtrafficofaconfiguredtypereachesthetrafficflood
controlrateconfiguredontheport,CoSbasedfloodcontroldropsthetrafficuntiltheinterval
ends.Packetsarethenallowedtoflowagainuntilthelimitisagainreached.
ThefollowingproceduredescribesthestepsandcommandsrequiredtoconfigureCoSbased
floodcontrol.
Procedure 11-2
Step
Task
Command(s)
1.
Enable CoS.
2.
3.
Example
Thisexamplecreatesabroadcastratelimiter(index1.0)of5packetspersecondandassignsitto
portsge.1.2andge.2.2.
C3(su)->set cos state enable
C3(su)->set cos port-resource flood-ctrl 1.0 broadcast rate 5
C3(su)->set cos port-config flood-ctrl 1.0 ports ge.1.2;ge.2.2 append
11-19
Commands
For information about...
Refer to page...
11-20
11-21
11-21
11-22
11-23
11-23
11-24
11-25
11-26
11-27
11-28
11-29
11-30
11-31
11-31
11-32
11-33
11-34
11-35
11-35
Syntax
set cos state {enable | disable}
Parameters
enable|disable
EnablesordisablesClassofServiceontheswitch.Defaultstateis
disabled.
Defaults
None.
Mode
Switchcommand,readwrite.
11-20
Example
ThisexampleshowshowtoenableClassofService:
C3(rw)->set cos state enable
Syntax
show cos state
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtoshowtheClassofServiceenablestate:
C3(rw)->show cos state
Class-of-Service application is enabled
Syntax
clear cos state
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheCoSstatebacktoitsdefaultsettingofdisabled:
C3(su)->clear cos state
11-21
Syntax
set cos settings cos-index priority priority [tos-value tos-value] [irl-reference
irl-reference]
Parameters
cosindex
SpecifiesaClassofServiceentry.Validvaluesare0to255.
prioritypriority
Specifiesan802.1dpriorityvalue.Validvaluesare0to7,with0beingthe
lowestpriority.SeeUsagesectionbelowformoreinformation.
tosvaluetosvalue
(Optional)SpecifiesaTypeofServicevalue.Validvaluesare0to255.See
Usagesectionbelowformoreinformation.
irlreference
irlreference
(Optional)Settheinboundratelimiterassociatedwiththisentry.Valid
valuesare0to99.SeeUsagesectionbelowformoreinformation.
Defaults
Ifnooptionalparametersarespecified,nonewillbeapplied.
Mode
Switchcommand,readwrite.
Usage
TheCoSsettingstabletakesindividualclassofservicefeaturesanddisplaysthemasbelongingto
aCoSentry.Essentially,itisusedforCoSfeatureassignment.Eachclassofserviceentryconsists
ofanindex,802.1ppriority,anoptionalToSvalue,andanIRLreference.
CoSIndex
IndexesareuniqueidentifiersforeachCoSsetting.CoSindexes0through7arecreatedby
defaultandmappeddirectlyto802.1ppriorityforbackwardscompatibility.Theseentries
cannotberemoved,and802.1ppriorityvaluescannotbechanged.WhenCoSisenabled,
indexesareassigned.Upto256CoSindexesorentriescanbeconfigured.
Priority
802.1pprioritycanbeappliedperCoSindex.ForeachnewCoSindexcreated,theuserhasthe
optiontoassignan802.1ppriorityvalue0to7fortheclassofservice.CoSindexes0through7
mapdirectlyto802.1pprioritiesandcannotbechangedastheyexistforbackward
compatibility.
ToS
Thisvaluecanbesetperclassofservice,butisnotrequired.Whenaframeisassignedtoa
classofserviceforwhichthisvalueisconfigured,theToSfieldoftheincomingIPpacketwill
beoverwrittentotheuserdefinedvalue.AllbutthelasttwobitsoftheToSfieldare
rewritable.ToScanbesetforCoSindexes0through7.
IRLReference
TheCoSIRLreferencefieldisoptional,asratelimitsarenotrequired.TheIRLreferencedoes
notassignaninboundratelimitbutpointstotheCoSIRLReferenceMappingTable.This
referencemaybethoughtofasthevirtualratelimiterthatwillassignthephysicalratelimiter
definedbytheIRLReferenceMappingTable.
11-22
Example
ThisexampleshowshowtocreateCoSentry8withapriorityvalueof3:
C3(rw)->set cos settings 8 priority 3
Syntax
clear cos settings cos-list {[all] | [priority] [tos-value] [irl-reference]}
Parameters
coslist
SpecifiesaClassofServiceentrytoclear.
all
Clearsallsettingsassociatedwiththisentry.
priority
Clearsthepriorityvalueassociatedwiththisentry.
tosvalue
ClearstheTypeofServicevalueassociatedwiththisentry.
irlreference
CleartheIRLreferenceassociatedwiththisentry.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearthepriorityforCoSentry8:
C3(rw)->clear cos settings 8 priority
Syntax
show cos settings [cos-list]
Parameters
coslist
(Optional)SpecifiesaClassofServiceentrytodisplay.
Defaults
Ifnotspecified,allCoSentrieswillbedisplayed.
Mode
Switchcommand,readonly.
11-23
Example
ThisexampleshowshowtoshowallCoSsettings:
C3(su)->show cos settings
CoS Index Priority
ToS
IRL
--------- ---------- ------- ------0
0
48
*
1
1
*
*
2
2
*
*
3
3
*
*
4
4
*
*
5
5
*
*
6
6
*
*
7
7
*
*
flood-ctrl
---------enabled
enabled
enabled
enabled
enabled
enabled
enabled
enabled
Syntax
set cos port-config {irl|flood-ctrl} group-type-index [name name] [ports portlist] [append] | [clear]
Parameters
irl
Specifiesthatthisisaninboundratelimiting(IRL)portgroup.
floodctrl
Specifiesthatthisisafloodcontrolportgroup.
grouptypeindex
Specifiesaninboundratelimitingportgroup/typeindex.Validentriesare
intheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
namename
(Optional)Userdefinednameforthegroup.
portsportlist
(Optional)Portsassignedtothegroup.Allportsmustbeofthesameport
type(FastEthernet,GigabitEthernet).
append
(Optional)Append(add)theportstotheportsthatarealreadyinthe
group.
clear
(Optional)Clearthegivenportsfromthoseassignedtothegroup.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
CoSportgroupsareidentifiedbygroupnumberandthetypeofportsinthegroup,intheformof
group#.porttype.Theportgroup0.0existsbydefault.Thisdefaultportgroupcannotberemoved
andallphysicalportsinthesystemareassignedtoit.Uptosevenadditionalportgroups(1
11-24
through7)canbeconfigured.Currently,onlyoneporttype(type0)issupported.Thisporttype
supports100limiters.
Additionalportgroupsmaybecreatedforflexibility.Portsassignedtoanewportgroupmustbe
mutuallyexclusivefromtheotherportgroupentriesportsareautomaticallyremovedfromthe
defaultportgroupandmustbecomprisedofthesameporttypeasdefinedbytheportgroup.
Thecreationofadditionalportgroupscouldbeusedtocombinesimilarportsbytheirfunctionfor
flexibility.Forinstance,portsassociatedtouserscanbeaddedtoaportgroupcalledUsersand
portsassociatedtouplinkportscanbeaddedtoaportgroupcalledUplink.Usingtheseport
groups,asingleclassofservicecanassigndifferentratelimitstoeachportgroup.Userports
canbeassignedoneratelimit,whileUplinkportscanbeassignedanother.
Thecommandshowcosportconfigdisplayseachportgroupconfiguredbygroupandtype,with
thegroupnameandassociated(assigned)ports.Thecommandshowcosporttypedisplaysthe
availableinboundratelimitingresourcesfortheporttype.
Example
Thisexampleconfigurestwoportgroups,oneforuserportsandoneforuplinkportsandassign
portstothegroups.Portgroup1.0willrepresentuserports,group2.0willrepresentuplinkports.
C3(su)->set cos port-config irl 1.0 name Users ports ge.1.1-46
C3(su)->set cos port-config irl 2.0 name Uplink ports ge.1.47-48
Syntax
show cos port-config [irl|flood-ctrl [group-type-index]]
Parameters
irl
(Optional)Specifiesthatinboundratelimitingconfigurationinformation
shouldbedisplayed.
floodctrl
(Optional)Specifiesthatfloodcontrolrateconfigurationinformation
shouldbedisplayed.
grouptypeindex
(Optional)Showassignedportsforaspecificportgroup.Validentriesare
intheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
Defaults
Theshowcosportconfig commandbyitselfwillshowallPortGroups.
Mode
Switchcommand,readonly.
11-25
Example
Thisexampleshowsallinboundratelimitingportgroups.Notethatportsge.1.1throughge.1.48
wereremovedfromthedefaultportgroup0.0whentheywereaddedtoportgroups1.0and2.0.
C3(su)->show cos port-config irl
Inbound Rate Limiting Port Configuration Entries
---------------------------------------------------------------------Port Group Name :Default
Port Group
:0
Port Type
:0
Assigned Ports
:none
---------------------------------------------------------------------Port Group Name :Users
Port Group
:1
Port Type
:0
Assigned Ports
:ge.1.1-46
---------------------------------------------------------------------Port Group Name :Uplink
Port Group
:2
Port Type
:0
Assigned Ports
:ge.1.47-48
----------------------------------------------------------------------
Syntax
clear cos port-config {irl|flood-ctrl} {all | group-type-index [entry] | [name]
[ports]}
Parameters
irl
ClearanIRLportgroupconfiguration.
floodctrl
Clearafloodcontrolportgroupconfiguration.
all
Clearallinboundratelimitingportconfignondefaultentries.
grouptypeindex
Deleteaspecificportgrouporgroupname,orcleartheportsfromthat
group.Validentriesareintheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
entry
Deletethisnondefaultinboundratelimiterentry.
name
Cleartheadministrativelyassignedtextualdescriptionofthisportgroup
entrytoitsdefault.
ports
Cleartheportsassignedtothisgrouptoitsdefault.
Defaults
None.
11-26
Mode
Switchcommand,readwrite.
Usage
Thedefaultportgroup0.0cannotbedeleted.
Example
ThisexampledeletesallIRLPortGroupsexceptfortheDefaultgroup0.0:
C3(su)->clear cos port-config irl all
Syntax
set cos port-resource irl group-type-index irl-index {[unit {kbps}] [rate rate]
[type {drop}]}[syslog enable | disable] [trap enable|disable]
Parameters
grouptypeindex
Specifiesaninboundratelimitingportgroup/typeindex.Validentriesare
intheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
irlindex
Indexnumberoftheinboundratelimiterresourceassociatedwiththis
entry.Validvaluesrangefrom0to99.
unit
Unitofmeasurefortheinboundratelimiter(onlyoptionisKbps).
kbps
Kilobitspersecond.
raterate
Datarateforthisinboundratelimiter.Thisistheactualratelimit.Valid
valuesrangefrom512to1,000,000KbpsforaGigabitport.
typedrop
Actionfortheratelimiter.Theonlyactionoptionisdroptheframeifall
limitersareexceeded.
syslog
enable|disable
Enableordisablereportingasyslogentryiflimitersareexceeded.
trapenable|disable Enableordisablesendingatrapiflimitersareexceeded.
Defaults
None.
Mode
Switchcommand,readwrite.
11-27
Usage
CoSportresourcesarewhereactualphysicalratelimitersareconfigured.Resourcesmapdirectly
tothenumberofratelimiterssupportedbytheporttype.(Porttype0supports100IRLresources.)
Resourcesexistforeachportgroupandareindexedasgroup#.porttype.irlindex.Portresources
arenotinitiallyconfiguredasratelimiting.
Inboundratelimiting,orratepolicing,simplydropsorclipstrafficinboundifaconfiguredrateis
exceeded.CoSinboundratelimitingallowstheusertoconfigureratelimitsbasedonkilobitsper
second.
Theshowcosportresourcecommanddisplaystheresourcesavailableforeachportgroup.By
default,noIRLresourcesareconfigured.ThedefaultRateLimitingalgorithmisdropandcannot
beconfiguredotherwise.
Example
Thisexamplesetstheinboundratelimitresourceindexnumber1forportgroup2.0to10000Kbps
or1MB:
C3(su)->set cos port-resource irl 2.0 1 unit kbps rate 10000 type drop
Syntax
set cos port-resource flood-ctrl group-type-index {unicast | multicast | broadcast
| all} rate rate
Parameters
grouptypeindex
Specifiesaportgroup/typeindex.Validentriesareintheformof
group#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
unicast
Specifiesratelimitingwillbeappliedtounknownunicasttraffic.
multicast
Specifiesratelimitingwillbeappliedtomulticasttraffic.
broadcast
Specifiesratelimitingwillbeappliedtobroadcasttraffic.
all
Specifiesratelimitingwillbeappliedtounknownunicast,multicast,
andbroadcasttraffic.
raterate
Specifiesaratelimitinpacketspersecond.
Defaults
None.
Mode
Switchcommand,readwrite.
11-28
Usage
CoSportresourcesarewhereactualphysicalratelimitersareconfigured.Thiscommandcanbe
usedtocreateuptothreedifferentfloodcontrollimitresourcesfortheporttypeindexof0.The
resourcesareassignedtospecificportswiththesetcosportconfigcommand.
Example
Thisexamplecreatesaportresourcebroadcastratelimiterof5packetspersecondfortheport
grouptypeindexof1.0(group#1ofporttypeindex0).
C3(su)->set cos port-resource flood-ctrl 1.0 broadcast rate 5
Syntax
show cos port-resource [irl [group-type-index [irl-index]]] | [flood-ctrl [grouptype-index]]
Parameters
irl
(Optional)Specifiesthatinboundratelimitingportresourcesshouldbe
displayed.
floodctrl
(Optional)Specifiesthatfloodcontrolportresourcesshouldbedisplayed.
grouptypeindex
(Optional)Specifiesaportgroup/typeindex.Validentriesareintheform
ofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
irlindex
(Optional)Inboundratelimiterresourceindexconfiguredforthe
specifiedportgroup.Validvaluesrangefrom0to99.
Defaults
Ifirlorfloodctrlarenotspecified,allportresourcesareshown.
IfaportgroupandIRLindexarenotspecified,theIRLconfigurationforallresources(099)forall
configuredportgroupswillbeshown.
Ifaportgroupisnotspecifiedwiththefloodctrlparameter,floodcontrolresourcesforall
configuredportgroupswillbeshown.
Mode
Switchcommand,readonly.
Examples
ThisexampledisplaystheIRLresourceindexnumber1configurationforgroup2.0.
C3(su)->show cos port-resource irl 2.0 1
'?' after the rate value indicates an invalid rate value
Group Index Resource Type Unit
Rate
11-29
--------------- -----drop
none
Thisexampledisplaysthefloodcontrolresourcesconfiguredforgroup1.0.
C3(su)->show cos port-resource flood-ctrl 1.0
'?' after the rate value indicates an invalid rate value
Group
Index
--------1.0
1.0
1.0
Resource
Type
----------ucast
mcast
bcast
---------flood-ctrl
flood-ctrl
flood-ctrl
Unit
---pps
pps
pps
Rate
Rate Limit
type
---------- --------------20
drop
10
drop
5
drop
Action
-----none
none
none
Syntax
clear cos port-resource irl {all | group-type-index [irl-index [unit] [rate]
[type]]}
Parameters
all
ClearallIRLresourcesforallportgroups.
grouptypeindex
Specifiesaninboundratelimitingportgroup/typeindex.Validentriesare
intheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
irlindex
(Optional)Inboundratelimiterresourceindexassociatedwiththe
specifiedportgroup.Validvaluesrangefrom0to99.
unit
Cleartheunitofmeasurefortheinboundratelimiter.
rate
Clearthedatarateforthisinboundratelimiter.
type
Cleartheactionfortheratelimiter.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleclearsthedatarateto0forIRLresourceindex1forgroup2.0.
C3(su)->clear cos port-resource irl 2.0 1 rate
11-30
Syntax
clear cos port-resource flood-ctrl {all | group-type-index {unicast | multicast |
broadcast | all [rate]}}
Parameters
all
Clearallfloodcontrolresourcesforallportgroups.
grouptypeindex
Specifiesaportgroup/typeindex.Validentriesareintheformof
group#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
unicast
Clearunicastportresourcesforthespecifiedportgroup.
multicast
Clearmulticastportresourcesforthespecifiedportgroup.
broadcast
Clearbroadcastportresourcesforthespecifiedportgroup.
all
Clearallfloodcontrolportresourcesforthespecifiedportgroup.
rate
(Optional)Clearthedataratelimiterofthespecifiedtypeofport
resourcetothedefault(noneordisabled).
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleclearstheunicastportresourceforportgroup1.0todefaultvalues.
C3(su)->clear cos port-resource flood-ctrl 1.0 unicast
Syntax
set cos reference irl group-type-index reference rate-limit irl-index
11-31
Parameters
irl
SpecifiesthatanIRLreferenceisbeingconfigured.
grouptypeindex
Specifiesaninboundratelimitingportgroup/typeindex.Validentriesare
intheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
reference
IRLreferencenumberassociatedwiththisentry.
ratelimitirlindex
Ratelimiter(IRLresourceindex)tobindthisreferenceto.Validvalues
rangefrom0to99.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheCoSreferencetablemapstheuserdefinedIRLreferencesfoundintheCoSsettingstable(see
setcossettingsonpage 1122)toratelimiterscreatedintheportresourcetable(seesetcos
portresourceirlonpage 1127).TheCoSreferencetableindexescanbethoughtofasvirtualrate
limiters.Thetableaccountsforthemaximumnumberofratelimiterssupportedbythedevice.
Thevirtuallimitersthenmaptothephysicalratelimiters.TheCoSIRLReferenceTableisnot
configuredbydefault.
TheCoSIRLreferencetableuses100indexesorvirtualratelimiters,andmapseachvirtuallimiter
toaphysicallimiterorresource.AnIRLreferencetableexistsforeachportgroupconfigured,and
isindexedsimilarlytoportresources,asportgroup#,porttype,reference.IRLreferencesarenot
populatedwithlimiters(resources),butcanbeconfiguredbytheuser.TheIRLreferencetablecan
bedisplayedusingtheshowcosreferencecommand.
Example
IntheCoSIRLreferencemappingtableforportgroups1.0and2.0,createareferencefortheIRL
resourcenumber1createdforeachgroup.Thereferencenumber1isused.
C3(su)->set cos reference irl 1.0 1 rate-limit 1
C3(su)->set cos reference irl 2.0 1 rate-limit 1
Syntax
show cos reference [irl [group-type-index]]
11-32
Parameters
irl
(Optional)Specifiesthatinboundratelimitingreferenceinformation
shouldbedisplayed.
grouptypeindex
(Optional)Specifiesaninboundratelimitingportgroup/typeindex.Valid
entriesareintheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
Defaults
Ifirlisnotspecified,allCoSreferenceinformationisdisplayed.
Ifaspecificportgroupisnotspecified,informationforallportgroupsisdisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowstheClassofServiceIRLreferencesforportgroup1.0.Notethatnotallofthe
100possiblereferencesaredisplayedinthisoutputexample.
C3(su)->show cos reference irl 1.0
Group Index
----------1.0
1.0
1.0
1.0
...
1.0
1.0
1.0
Reference
--------0
1
2
3
Type
---irl
irl
irl
irl
Rate Limiter
-----------none
1
none
none
97
98
99
irl
irl
irl
none
none
none
Syntax
clear cos reference irl {all | group-type-index reference}
Parameters
irl
SpecifiesthatIRLreferencesarebeingcleared.
all
Clearallgroupsindexesandreferences.
11-33
grouptypeindex
Specifiesaninboundratelimitingportgroup/typeindex.Validentriesare
intheformofgroup#.porttype.
Validvaluesforgroup#canrangefrom0to7.Validvaluesforporttype
canrangefrom0to1,althoughonlyporttype0iscurrentlysupported.
Forexample,portgroup3wouldbespecifiedas3.0.
reference
Clearaspecificreferenceforthespecifiedportgroup.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheCoSinboundratelimitingreferenceconfigurationforall
groups:
C3(su)->clear cos reference irl all
Syntax
show cos unit [irl [port-type index] [kbps]] [flood-ctrl [port-type index] [pps]]
Parameters
irl
(Optional)DisplayonlyIRLunitinformation.
porttypeindex
(Optional)Displayinformationaboutthespecifiedporttype.(Only
porttypeindex0issupported.)
kbps
(Optional)Displaykbpsinformation.
floodctrl
(Optional)Displayonlyfloodcontrolunitinformation.
pps
(Optional)Displayppsinformation.
Defaults
Ifnoparametersareentered,allCosunitinformationisdisplayed.
Mode
Switchcommand,readonly.
Examples
Thisexampleshowspossibleunitentriesforinboundratelimiting:
C3(su)->show cos unit irl
Type:
irl = inbound rate limiting
11-34
Unit:
Kbps = Kilobits per second
Port Type
--------0
Type
---irl
Unit
---Kbps
Maximum Rate
-----------1000000
Minimum Rate
-----------64
Granularity
----------1
Thisexamplesshowsfloodcontrolunitinformation.
C3(su)->show cos unit flood-ctrl
Type:
flood-ctrl = flood control type
Port Type
----------0
Type
----------flood-ctrl
Unit
---pps
Unit:
pps = packets per second
Maximum Rate
-----------148810
Minimum Rate
-----------0
Granularity
----------1
Syntax
clear cos all-entries
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheCoSconfigurationforallentriesexceptentries07:
C3(su)->clear cos all-entries
Syntax
show cos port-type [irl [port-type]] [flood-ctrl [port-type]]
Parameters
irl
(Optional)Displaysinboundratelimitinginformation.
floodctrl
(Optional)Displaysfloodcontrolinformation.
porttype
(Optional)Displaysinformationforaspecificporttype.(Onlyporttype
0issupported.)
11-35
Defaults
Ifnoparametersarespecified,inboundratelimitingandfloodcontrolinformationforallport
typesisdisplayed.
Mode
Switchcommand,readonly.
Usage
TheC3implementationprovidesonedefaultporttype(0)fordesignatingavailableinboundrate
limitingorfloodcontrolresources.Porttype0includesallports.
Theporttype0IRLdescriptionisC3100IRL,whichindicatesthatthisporttypeprovidesa
maximumof100inboundratelimitingresourcesperportgroup.Theporttype0floodcontrol
descriptionisC33floodctrlwhichindicatesthatthisporttypeprovidesamaximumof3flood
controlresourcesperportgroup.
Examples
Thisexampleshowsinboundratelimitinginformationforporttype0.
C3(su)->show cos port-type irl 0
Number of resources:
irl = inbound rate limiter(s)
Index
----0
Port type
description
-----------C3 100 IRL
Number of
limiters
--------100
Eligible
ports
----------------ge.1.1-48
Unselected
ports
----------------ge.1.1-4
Thisexampleshowsfloodcontrolinformationforporttype0.
C3(su)->show cos port-type flood-ctrl 0
Number of resources:
flood-ctrl = flood control type
Index
----0
11-36
Port type
Number of
description
limiters
-------------------C3 3 flood-ctrl
3
Eligible
ports
---------------ge.1.1-24
Unselected
ports
-----------ge.1.1-24
12
Port Priority Configuration
ThischapterdescribesthePortPrioritysetofcommandsandhowtousethem.Refertothe
ConfiguringQoSFeatureGuidefordetailedinformationaboutconfiguringqualityofserviceon
theSecureStackC3.TheEnterasys NetworksfirmwareFeatureGuidesareavailableat:
http://www.enterasys.com/support/manuals
For information about...
Refer to page...
12-1
12-2
12-4
12-7
12-1
DisplayorchangetheportdefaultClassofService(CoS)transmitpriority(0through7)of
eachportforframesthatarereceived(ingress)withoutpriorityinformationintheirtag
header.
Displaythecurrenttrafficclassmappingtopriorityofeachport.
Seteachporttotransmitframesaccordingto802.1D(802.1p)prioritysetintheframeheader.
Commands
For information about...
Refer to page...
12-4
12-3
12-3
Syntax
show port priority [port-string]
Parameters
portstring
(Optional)Displayspriorityinformationforaspecificport.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
If port-string is not specified, priority for all ports will be displayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaytheportpriorityforthege.2.1through5.
C3(su)->show
ge.2.1 is set
ge.2.2 is set
ge.2.3 is set
ge.2.4 is set
ge.2.5 is set
12-2
Syntax
set port priority port-string priority
Parameters
portstring
Specifiestheportforwhichtosetpriority.Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLIon
page 71.
priority
Specifiesavalueof0to7tosettheCoSpriorityfortheportenteredinthe
portstring.Priorityvalueof0isthelowestpriority.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thesetportprioritycommandwillnotchangethe802.1pprioritytagontaggedtrafficwitha
defaultprioritytag.Thecommandonlyhasaneffectonhowuntaggedtrafficwillbeprioritized
asitpassesinternallythroughthedevice.
Example
Thisexampleshowshowtosetadefaultpriorityof6onge.1.3.Framesreceivedbythisport
withoutpriorityinformationintheirframeheaderaresettothedefaultsettingof6:
C3(su)->set port priority ge.1.3 6
Syntax
clear port priority port-string
Parameters
portstring
Specifiestheportforwhichtoclearpriority.Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLIon
page 71.
12-3
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresetge.1.11tothedefaultpriority:
C3(rw)->clear port priority ge.1.11
Viewthecurrentprioritytotransmitqueuemappingofeachphysicalport.
Configureeachporttoeithertransmitframesaccordingtotheportpriority,setusingtheset
portprioritycommanddescribedinsetportpriorityonpage 123,oraccordingtoapriority
basedonapercentageofporttransmissioncapacity,assignedtotransmitqueuesusingtheset
porttxqcommanddescribedinsetporttxqonpage 128.
Clearcurrentportpriorityqueuesettingsforoneormoreports.
Commands
For information about...
Refer to page...
12-4
12-5
12-6
Syntax
show port priority-queue [port-string]
Parameters
portstring
12-4
(Optional)Displaysthemappingofprioritiestotransmitqueuesforone
ormoreports.
Defaults
Ifportstringisnotspecified,priorityqueueinformationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaypriorityqueueinformationforge.1.1.Inthiscase,frameswith
apriorityof0areassociatedwithtransmitqueue1;frameswith1or2priority,areassociatedwith
transmitqueue0;andsoforth:
C3(su)->show
Port
P0
--------- -ge.1.1
1
Syntax
set port priority-queue port-string priority queue
Parameters
portstring
Specifiestheport(s)forwhichtosetprioritytoqueuemappings.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
priority
Specifiesavalueof0through7(0isthelowestlevel)thatdetermines
whatpriorityframeswillbetransmittedonthetransmitqueueenteredin
thiscommand.
queue
Specifiesavalueof0through5(0isthelowestlevel)thatdeterminesthe
queueonwhichtotransmittheframeswiththeportpriorityenteredin
thiscommand.
Note: Although there are 8 queues, only queues 0 through 5 may be configured.
Queues 6 and 7 are reserved for management traffic.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thiscommandenablesyoutochangethetransmitqueue(0to5,with0beingthelowestpriority
queue)foreachportpriorityoftheselectedport.Youcanapplythenewsettingstooneormore
ports.
12-5
Example
Thisexampleshowshowtosetpriority5framesreceivedonge.2.12totransmitonqueue0.
C3(su)->set port priority-queue ge.2.12 5 0
Syntax
clear port priority-queue port-string
Parameters
portstring
Specifiestheportforwhichtoclearprioritytoqueuemappings.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearthepriorityqueuesettingsonge.2.12:
C3(su)->clear port priority-queue ge.2.12
12-6
Purpose
Eighttransmitqueuesareimplementedintheswitchhardwareforeachport.Thecommandsin
thissectionallowyoutosettheprioritymodeandweightforeachoftheavailablequeues(0
through7)foreachphysicalportontheswitch.Prioritymodeandweightcannotbeconfiguredon
LAGs,onlyonthephysicalportsthatmakeuptheLAG.
Commands
For information about...
Refer to page...
12-7
12-8
12-9
Syntax
show port txq [port-string]
Parameters
portstring
(Optional)Specifiesport(s)forwhichtodisplayQoSsettings.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Onlyphysicalportswillbedisplayed.LAGportshavenotransmitqueue
information.
Defaults
Iftheportstringisnotspecified,theQoSsettingofallphysicalportswillbedisplayed.
Mode
Switchcommand,readonly.
12-7
Example
Thisexampleshowshowtodisplaythecurrentalgorithmandtransmitqueueweightsconfigured
onportge.1.10:
C3(su)->show port txq ge.1.10
Port
Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
------- --- --- --- --- --- --- --- ---
ge.1.10 WRR 10
10
15
20
25
20
Syntax
set port txq port-string value0 value1 value2 value3 value4 value5 value6 value7
Parameters
portstring
Specifiesport(s)onwhichtosetqueuearbitrationvalues.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Onlyphysicalportscanbeconfiguredwiththiscommand.LAGports
cannotbeconfigured.
value0value7
Specifiespercentagetoallocatetoaspecifictransmitqueue.Thevalues
musttotal100percent.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Queuescanbesetforstrictpriority(SP)orweightedroundrobin(WRR).IfsetforWRRmode,
weightsmaybeassignedtothosequeueswiththiscommand.Weightsarespecifiedintherangeof
0to100percent.Weightsspecifiedforqueues0through7onanyportmusttotal100percent.
Examples
Thisexampleshowshowtochangethearbitrationvaluesfortheeighttransmitqueuesbelonging
toge.1.1:
C3(su)->set port txq ge.1.1 10 10 10 10 10 10 10 30
Thisexampleshowshowtochangethealgorithmtostrictpriorityfortheeighttransmitqueues
belongingtoge.1.1:
C3(su)->set port txq ge.1.1 0 0 0 0 0 O O 100
C3(su)->show port txq ge.1.1
Port
Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
------- --- --- --- --- --- --- --- ---
ge.1.1
12-8
STR SP
SP
SP
SP
SP
SP
SP
SP
Syntax
clear port txq port-string
Parameters
portstring
Clearstransmitqueuevaluesonspecificport(s)backtotheirdefault
values.Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
Onlyphysicalportscanbeconfiguredwiththiscommand.LAGports
cannotbeconfigured.
Defaults
Bydefault,transmitqueuesaredefinedasfollows:
Queue
Mode
Weight
Queue
Mode
Weight
WRR
WRR
WRR
WRR
WRR
WRR
WRR
WRR
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtocleartransmitqueuevaluesonge.1.1:
C3(su)->clear port txq ge.1.1
12-9
12-10
13
IGMP Configuration
ThischapterdescribestheIGMPConfigurationsetofcommandsandhowtousethem.
For information about...
Refer to page...
IGMP Overview
13-1
13-2
13-10
IGMP Overview
About IP Multicast Group Management
TheInternetGroupManagementProtocol(IGMP)runsbetweenhostsandtheirimmediately
neighboringmulticastdevice.Theprotocolsmechanismsallowahosttoinformitslocaldevice
thatitwantstoreceivetransmissionsaddressedtoaspecificmulticastgroup.
Amulticastenableddevicecanperiodicallyaskitshostsiftheywanttoreceivemulticasttraffic.If
thereismorethanonedeviceontheLANperformingIPmulticasting,oneofthesedevicesis
electedquerierandassumestheresponsibilityofqueryingtheLANforgroupmembers.
BasedonthegroupmembershipinformationlearnedfromIGMP,adevicecandeterminewhich(if
any)multicasttrafficneedstobeforwardedtoeachofitsports.AtLayer3,multicastdevicesuse
thisinformation,alongwithamulticastroutingprotocol,tosupportIPmulticastingacrossanIP
network.
IGMPprovidesthefinalstepinanIPmulticastpacketdeliveryservice,sinceitisonlyconcerned
withforwardingmulticasttrafficfromthelocaldevicetogroupmembersonadirectlyattached
subnetworkorLANsegment.
ThisdevicesupportsIPmulticastgroupmanagementbypassivelysnoopingontheIGMPquery
andIGMPreportpacketstransferredbetweenIPmulticastdevicesandIPmulticasthostgroupsto
learnIPmulticastgroupmembers.
ThepurposeofIPmulticastgroupmanagementistooptimizeaswitchednetworksperformance
somulticastpacketswillonlybeforwardedtothoseportscontainingmulticastgrouphostsor
multicastdevicesinsteadoffloodingtoallportsinthesubnet(VLAN).
InadditiontopassivelymonitoringIGMPqueryandreportmessages,theSecureStackC3canalso
activelysendL3IGMPquerymessagestolearnlocationsofmulticastdevicesandmemberhosts
inmulticastgroupswithineachVLAN.
However,notethatIGMPneitheraltersnorroutesanyIPmulticastpackets.SinceIGMPisnot
concernedwiththedeliveryofIPmulticastpacketsacrosssubnetworks,multicastroutingis
neededifIPmulticastpacketshavetoberoutedacrossdifferentsubnetworks.
SecureStack C3 Configuration Guide
13-1
About Multicasting
Multicastingisusedtosupportrealtimeapplicationssuchasvideoconferencesorstreaming
audio.Amulticastserverdoesnothavetoestablishaseparateconnectionwitheachclient.It
merelybroadcastsitsservicetothenetwork,andanyhoststhatwanttoreceivethemulticast
registerwiththeirlocalmulticastswitch/router.Althoughthisapproachreducesthenetwork
overheadrequiredbyamulticastserver,thebroadcasttrafficmustbecarefullyprunedatevery
multicastswitch/routeritpassesthroughtoensurethattrafficisonlypassedtothehoststhat
subscribedtothisservice.
TheSecureStackC3switchdeviceusesIGMP(InternetGroupManagementProtocol)toqueryfor
anyattachedhostswhowanttoreceiveaspecificmulticastservice.ThedevicelooksuptheIP
MulticastGroupusedforthisserviceandaddsittotheegresslistoftheLevel3interface.Itthen
propagatestheservicerequestontoanyneighboringmulticastswitch/routertoensurethatitwill
continuetoreceivethemulticastservice.
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of
multicast configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
Commands
For information about...
13-2
Refer to page...
show igmpsnooping
13-3
13-3
13-4
13-4
13-5
13-6
13-6
13-7
13-8
13-8
clear igmpsnooping
13-9
IGMP Configuration
show igmpsnooping
show igmpsnooping
UsethiscommandtodisplayIGMPsnoopinginformation.
Syntax
show igmpsnooping
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
ConfiguredinformationisdisplayedwhetherornotIGMPsnoopingisenabled.Status
informationisdisplayedonlywhenthefunctionisenabled.ForinformationonenablingIGMPon
thesystem,refertosetigmpsnoopingadminmodeonpage 133.Forinformationonenabling
IGMPononeormoreports,refertosetigmpsnoopinginterfacemodeonpage 134.
Example
ThisexampleshowshowtodisplayIGMPsnoopinginformation:
C3(su)->show igmpsnooping
Admin Mode.....................................
Group Membership Interval......................
Max Response Time..............................
Multicast Router Present Expiration Time.......
Interfaces Enabled for IGMP Snooping...........
Multicast Control Frame Count..................
Data Frames Forwarded by the CPU...............
Enable
260
100
0
ge.1.1,ge.1.2,ge.1.3
0
0
Syntax
set igmpsnooping adminmode {enable | disable}
Parameters
enable|disable
EnablesordisablesIGMPsnoopingonthesystem.
Defaults
None.
Mode
Switchcommand,readwrite.
13-3
Usage
InorderforIGMPsnoopingtobeenabledononeorallports,itmustbegloballyenabledonthe
devicewiththiscommand,andthenenabledonaport(s)usingthesetigmpsnoopinginterface
modecommandasdescribedinsetigmpsnoopinginterfacemodeonpage 134.
Example
ThisexampleshowshowtoenableIGMPonthesystem:
C3(su)->set igmpsnooping adminmode enable
Syntax
set igmpsnooping interfacemode port-string {enable | disable}
Parameters
portstring
SpecifiesoneormoreportsonwhichtoenableordisableIGMP.
enable|disable
EnablesordisablesIGMP.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
InorderforIGMPsnoopingtobeenabledononeorallports,itmustbegloballyenabledonthe
deviceusingthesetigmpsnoopingadminmodecommandasdescribedinsetigmpsnooping
adminmodeonpage 133,andthenenabledonaport(s)usingthiscommand.
Example
ThisexampleshowshowtoenableIGMPonportge.1.10:
C3(su)->set igmpsnooping interfacemode ge.1.10 enable
Syntax
set igmpsnooping groupmembershipinterval time
13-4
IGMP Configuration
Parameters
time
SpecifiestheIGMPgroupmembershipinterval.Validvaluesare23600
seconds.
Thisvalueworkstogetherwiththesetigmpsnoopingmaxresponsetime
commandtoremoveportsfromanIGMPgroupandmustbegreaterthan
themaxresponsetimevalue.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheIGMPgroupmembershipintervaltimesetsthefrequencyofhostqueryframetransmissions
andmustbegreaterthantheIGMPmaximumresponsetimeasdescribedinsetigmpsnooping
maxresponseonpage 135.
Example
ThisexampleshowshowtosettheIGMPgroupmembershipintervalto250seconds:
C3(su)->set igmpsnooping groupmembershipinterval 250
Syntax
set igmpsnooping maxresponse time
Parameters
time
SpecifiestheIGMPmaximumqueryresponsetime.Validvaluesare100
255seconds.Thedefaultvalueis100seconds.
Thisvalueworkstogetherwiththesetigmpsnooping
groupmembershipintervalcommandtoremoveportsfromanIGMPgroup
andmustbelesserthanthegroupmembershipintervalvalue.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThisvaluemustbelessthantheIGMPmaximumresponsetimedescribedinsetigmpsnooping
groupmembershipintervalonpage 134.
13-5
Example
ThisexampleshowshowtosettheIGMPmaximumresponsetimeto100seconds:
C3(su)->set igmpsnooping maxresponse 100
Syntax
set igmpsnooping mcrtrexpire time
Parameters
time
SpecifiestheIGMPmulticastrouterexpirationtime.Validvaluesare0
3600seconds.Avalueof0willconfigurethesystemwithaninfinite
expirationtime.Thedefaultvalueis0.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thistimerisforexpiringtheswitchfromthemulticastdatabase.Ifthetimerexpires,andtheonly
addressleftisthemulticastswitch,thentheentrywillberemoved.
Example
ThisexampleshowshowtosettheIGMPmulticastrouterexpirationtimetoinfinity:
C3(su)->set igmpsnooping mcrtrexpiretime 0
Syntax
set igmpsnooping add-static group vlan-list [modify] [port-string]
Parameters
group
SpecifiesthemulticastgroupIPaddressfortheentry.
vlanlist
SpecifiestheVLANsonwhichtoconfiguretheentry.
modify
(Optional)Addsthespecifiedportorportstoanexistingentry.
portstring
(Optional)Specifiestheportorportstoaddtotheentry.
Defaults
Ifnoportsarespecified,allportsareaddedtotheentry.
13-6
IGMP Configuration
Ifmodifyisnotspecified,anewentryiscreated.
Mode
Switchcommand,readwrite.
Usage
UsethiscommandtocreateandconfigurestaticLayer2IGMPentries.Currently,upto100static
groupscanbeconfigured.Atotalof256dynamicandstaticIGMPgroupsaresupported.
Example
ThisexamplecreatesanIGMPentryforthemulticastgroupwithIPaddressof233.11.22.33
configuredonVLAN20configuredwiththeportge.1.1.
C3(su)->set igmpsnooping add-static 233.11.22.33 20 ge.1.1
Syntax
set igmpsnooping remove-static group vlan-list [modify] [port-string]
Parameters
group
SpecifiesthemulticastgroupIPaddressoftheentry.
vlanlist
SpecifiestheVLANsonwhichtheentryisconfigured.
modify
(Optional)Removesthespecifiedportorportsfromanexistingentry.
portstring
(Optional)Specifiestheportorportstoremovefromtheentry.
Defaults
Ifnoportsarespecified,allportsareremovedfromtheentry.
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesportge.1.1fromtheentryforthemulticastgroupwithIPaddressof
233.11.22.33configuredonVLAN20.
C3(su)->set igmpsnooping remove-static 233.11.22.33 20 ge.1.1
Syntax
show igmpsnooping static vlan-list [group group]
13-7
Parameters
vlanlist
SpecifiestheVLANforwhichtodisplaystaticIGMPports.
groupgroup
(Optional)SpecifiestheIGMPgroupforwhichtodisplaystaticIGMP
ports.
Defaults
Ifnogroupisspecified,informationforallgroupsisdisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampledisplaysthestaticIGMPportsforVLAN20.
C3(su)->show igmpsnooping static 20
-------------------------------------------------------------------------------Vlan Id
= 20
Static Multicast Group Address = 233.11.22.33
Type = IGMP
IGMP Port List = ge.1.1
Syntax
show igmpsnooping mfdb [stats]
Parameters
stats
(Optional)DisplaysMFDBstatistics.
Defaults
Ifstatsisnotspecified,allMFDBtableentrieswillbedisplayed.
Mode
Switchcommand,readonly.
Examples
Thisexampleshowshowtodisplaymulticastforwardingdatabaseentries:
C3(su)->show igmpsnooping mfdb
MAC Address
Type
Description
----------------------- ------- ---------------00:14:01:00:5E:02:CD:B0 Dynamic Network Assist
00:32:01:00:5E:37:96:D0 Dynamic Network Assist
00:32:01:00:5E:7F:FF:FA Dynamic Network Assist
Interfaces
------------------------Fwd: ge.1.1,ge.3.1,ge.4.1
Fwd: ge.4.7
Fwd: ge.4.7
Thisexampleshowshowtodisplaymulticastforwardingdatabasestatistics:
C3(su)->show igmpsnooping mfdb stats
Max MFDB Table Entries......................... 256
Most MFDB Entries Since Last Reset............. 1
Current Entries................................ 0
13-8
IGMP Configuration
clear igmpsnooping
clear igmpsnooping
UsethiscommandtoclearallIGMPsnoopingentries.
Syntax
clear igmpsnooping
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearallIGMPsnoopingentries:
C3(su)->clear igmpsnooping
Are you sure you want to clear all IGMP snooping entries? (y/n) y
IGMP Snooping Entries Cleared.
13-9
Purpose
ToconfigureIGMPonroutinginterfaces.
Commands
For information about...
Refer to page...
ip igmp
13-10
ip igmp enable
13-11
ip igmp version
13-11
13-12
13-13
ip igmp query-interval
13-13
ip igmp query-max-response-time
13-14
ip igmp startup-query-interval
13-14
ip igmp startup-query-count
13-15
ip igmp last-member-query-interval
13-15
ip igmp last-member-query-count
13-16
ip igmp robustness
13-16
ip igmp
UsethiscommandtoenabletheL3IGMPQuerierfunctionalityontheswitch.Thenoformofthis
commanddisablesIGMPQuerierfunctionality.
Syntax
ip igmp
no ip igmp
Parameters
None.
Defaults
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
13-10
IGMP Configuration
ip igmp enable
Usage
EnablingIGMPonaroutinginterfacerequiresboththeipigmpcommand(page1310),which
enablesitontherouter,andtheipigmpenablecommand(page1311),whichenablesitonan
interface.Oncethesecommandsareexecuted,thedevicewillstartsendingandprocessingIGMP
multicasttraffic.IGMPisdisabledbydefault,bothgloballyandonaperinterfacebasis.
Example
ThisexampleshowshowtoenableIGMPontherouter:
C3(su)->router(Config)#ip igmp
ip igmp enable
UsethiscommandtoenableIGMPonaninterface.ThenoformofthiscommanddisablesIGMP
onaninterface.
Syntax
ip igmp enable
no ip igmp enable
Parameters
None.
Defaults
None.
Usage
EnablingIGMPonaroutinginterfacerequiresboththeipigmpcommand(page1310),which
enablesitontherouter,andtheipigmpenablecommand(page1311),whichenablesitonan
interface.Oncethesecommandsareexecuted,thedevicewillstartsendingandprocessingIGMP
multicasttraffic.IGMPisdisabledbydefault,bothgloballyandonaperinterfacebasis.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenableIGMPontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp enable
ip igmp version
UsethiscommandtosettheversionofIGMPrunningontherouter.Thenoformofthiscommand
resetsIGMPtothedefaultversionof2(IGMPv2).
Syntax
ip igmp version version
no ip igmp
13-11
Parameters
version
SpecifiestheIGMPversionnumbertorunontherouter.Validvaluesare
1,2,or3.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIGMPversiontoversion1onVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp version 1
Syntax
show ip igmp interface [vlan vlan-id]
Parameters
vlanvlanid
(Optional)DisplaysinformationforoneormoreVLANs.
Defaults
Ifnotspecified,informationwillbedisplayedforallVLANsconfiguredforIGMProuting.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayIGMProutinginformationforVLAN1:
C3(su)->router#show ip igmp interface vlan 1
Vlan 1 is Admin UP
Vlan 1 is Oper UP
IGMP is configured via the Switch
IGMP ACL currently not supported
Multicast TTL currently defaults to 1
IGMP Version is 2
Query Interval is 125 (secs)
Query Max Response Time is 100 (1/10 of a second)
Robustness is 2
Startup Query Interval is 31 (secs)
Startup Query Count is 2
Last Member Query Interval is 10 (1/10 of a second)
Last Member Query Count is 2
13-12
IGMP Configuration
Syntax
show ip igmp groups
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayinformationaboutIGMPgroups:
C3(su)->router#show ip igmp groups
REGISTERED MULTICAST GROUP DETAILS
Multicast
IP Address
Last Reporter
Up Time Expiry Time Host Timer
--------------- --------------- ------- ------------ -----------228.1.1.1
12.12.12.2
27
Version1
----------
ip igmp query-interval
UsethiscommandtosettheIGMPqueryintervalonaroutinginterface.Thenoformofthis
commandresetstheIGMPqueryintervaltothedefaultvalueof125seconds.
Syntax
ip igmp query-interval time
no ip igmp query-interval
Parameters
time
SpecifiestheIGMPqueryinterval.Validvaluesarefrom1to3600
seconds.Defaultis125seconds.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIGMPqueryintervalto1800secondsonVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp query-interval 1800
13-13
ip igmp query-max-response-time
ip igmp query-max-response-time
UsethiscommandtosetthemaximumresponsetimeintervaladvertisedinIGMPv2queries.The
no form of this command resets the IGMP maximum response time to the default value of 100
(one tenth of a second).
Syntax
ip igmp query-max-response-time time
no ip igmp query-max-response-time
Parameters
time
SpecifiestheIGMPmaximumresponsetimeinterval.Validvaluesare
from0to255tenthsofasecond.The default value is 100 (one tenth of a
second).
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIGMPquerymaximumresponsetimeintervalto200(2tenths
ofasecond)onVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp query-max-response-time 200
ip igmp startup-query-interval
UsethiscommandtosettheintervalbetweengeneralIGMPqueriessentonstartup.Thenoform
ofthiscommandresetstheIGMPstartupqueryintervaltothedefaultvalueof31seconds.
Syntax
ip igmp startup-query-interval time
no ip igmp startup-query-interval
Parameters
time
SpecifiestheIGMPstartupqueryinterval.Validvaluesarefrom1to300
seconds.Thedefaultvalueis31seconds.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
13-14
IGMP Configuration
ip igmp startup-query-count
Example
ThisexampleshowshowtosettheIGMPstartupqueryintervalto100secondsonVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp startup-query-interval 100
ip igmp startup-query-count
UsethiscommandtosetthenumberofIGMPqueriessentoutonstartup,separatedbythe
startupqueryintervalasdescribedinipigmpstartupqueryinterval(page1314).Thenoformof
thiscommandresetstheIGMPstartupquerycounttothedefaultvalueof2.
Syntax
ip igmp startup-query-count count
no ip igmp startup-query-count
Parameters
count
SpecifiesthenumberofIGMPstartupqueries.Validvaluesarefrom1to
20.Thedefaultvalueis2.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIGMPstartupquerycountto10onVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp startup-query-count 10
ip igmp last-member-query-interval
Usethiscommandtosetthemaximumresponsetimebeinginsertedintogroupspecificqueries
sentinresponsetoleavegroupmessages.ThenoformofthiscommandresetstheIGMPlast
memberqueryintervaltothedefaultvalueof1second.
Syntax
ip igmp last-member-query-interval time
no ip igmp last-member-query-interval
Parameters
time
SpecifiestheIGMPlastmemberqueryinterval.Validvaluesarefrom0to
255seconds.Thedefaultvalueis1second.
Defaults
None.
13-15
ip igmp last-member-query-count
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIGMPlastmemberqueryintervalto10secondsonVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-interval 10
ip igmp last-member-query-count
Usethiscommandtosetthenumberofgroupspecificqueriessentbeforeassumingthereareno
localmembers.ThenoformofthiscommandresetstheIGMPlastmemberquerycounttothe
defaultvalueof2.
Syntax
ip igmp last-member-query-count count
no ip igmp last-member-query-count
Parameters
count
SpecifiesthenumberofIGMPstartupqueries.Validvaluesarefrom1to
20.Thedefaultvalueis2.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIGMPlastmemberquerycountto10onVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-count 10
ip igmp robustness
UsethiscommandtoconfiguretherobustnesstuningforexpectedpacketlossonanIGMP
routinginterface.ThenoformofthiscommandresetstheIGMProbustnessvaluetothedefaultof
2.
Syntax
ip igmp robustness robustness
no ip igmp robustness
Parameters
robustness
13-16
IGMP Configuration
SpecifiestheIGMProbustnessvalue.Validvaluesarefrom1to255.The
defaultvalueis2.
ip igmp robustness
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
ThisvaluedetermineshowmanytimesIGMPmessageswillbesent.Ahighernumberwillmean
thatendstationswillbemorelikelytoseethepacket.Aftertherobustnessvalueisreached,IGMP
willassumethereisnoresponsetoqueries.
Example
ThisexampleshowshowtosettheIGMProbustnessvalueto5onVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip igmp robustness 5
13-17
ip igmp robustness
13-18
IGMP Configuration
14
Logging and Network Management
Thischapterdescribesswitchrelatedloggingandnetworkmanagementcommandsandhowto
usethem.
Note: The commands in this chapter pertain to network management of the SecureStack C3
device from the switch CLI only. For information on router-related network management tasks,
including reviewing router ARP tables and IP traffic, refer to Chapter 19.
For information about...
Refer to page...
14-1
14-14
14-19
14-29
14-40
Purpose
Todisplayandconfiguresystemlogging,includingSyslogserversettings,Syslogdefaultsettings,
andtheloggingbuffer.
Commands
For information about...
Refer to page...
14-2
14-3
14-4
14-4
14-5
14-1
Refer to page...
14-6
14-6
14-7
14-9
14-9
14-10
14-10
14-11
14-11
14-12
14-13
Syntax
show logging server [index]
Parameters
index
(Optional)DisplaysSysloginformationpertainingtoaspecificserver
tableentry.Validvaluesare18.
Defaults
Ifindexisnotspecified,allSyslogserverinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySyslogserverconfigurationinformation:
C3(ro)->show logging server
IP Address
Facility Severity
Description
Port Status
------------------------------------------------------------------------1 132.140.82.111 local4 warning(5)
default
514 enabled
2 132.140.90.84 local4 warning(5)
default
514 enabled
Table 141providesanexplanationofthecommandoutput.
14-2
Table 14-1
Output Field
What It Displays...
IP Address
Syslog servers IP address. For details on setting this using the set logging server
command, refer to set logging server on page 14-3.
Facility
Syslog facility that will be encoded in messages sent to this server. Valid values are:
local0 to local7.
Severity
Description
Port
Status
Syntax
set logging server index [ip-addr ip-addr] [facility facility] [severity severity]
[descr descr] [port port] [state {enable | disable}]
Parameters
index
Specifiestheservertableindexnumberforthisserver.Validvaluesare1
8.
ipaddripaddr
(Optional)SpecifiestheSyslogmessageserversIPaddress.
facilityfacility
(Optional)Specifiestheserversfacilityname.Validvaluesare:local0to
local7.
severityseverity
(Optional)Specifiestheseveritylevelatwhichtheserverwilllog
messages.Validvaluesandcorrespondinglevelsare:
1emergencies(systemisunusable)
2alerts(immediateactionrequired)
3criticalconditions
4errorconditions
5warningconditions
6notifications(significantconditions)
7informationalmessages
8debuggingmessages
descrdescr
(Optional)Specifiesatextualstringdescriptionofthisfacility/server.
portport
(Optional)SpecifiesthedefaultUDPporttheclientusestosendtothe
server.
stateenable|
disable
(Optional)Enablesordisablesthisfacility/serverconfiguration.
14-3
Defaults
Ifipaddrisnotspecified,anentryintheSyslogservertablewillbecreatedwiththespecified
indexnumberandamessagewilldisplayindicatingthatnoIPaddresshasbeenassigned.
Ifnotspecified,facility,severityandportwillbesettodefaultsconfiguredwiththesetlogging
defaultcommand(setloggingdefaultonpage 145).
Ifstateisnotspecified,theserverwillnotbeenabledordisabled.
Mode
Switchcommand,readwrite.
Example
ThiscommandshowshowtoenableaSyslogserverconfigurationforindex1,IPaddress
134.141.89.113,facilitylocal4,severitylevel3onport514:
C3(su)->set logging server 1 ip-addr 134.141.89.113 facility local4 severity 3
port 514 state enable
Syntax
clear logging server index
Parameters
index
Specifiestheservertableindexnumberfortheservertoberemoved.
Validvaluesare18.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThiscommandshowshowtoremovetheSyslogserverwithindex1fromtheservertable:
C3(su)->clear logging server 1
Syntax
show logging default
Parameters
None.
14-4
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThiscommandshowshowtodisplaytheSyslogserverdefaultvalues.Foranexplanationofthe
commandoutput,referbacktoTable 141onpage 143.
C3(su)->show logging default
Defaults:
Facility
Severity
Port
----------------------------------------local4
warning(5)
514
Syntax
set logging default {[facility facility] [severity severity] port port]}
Parameters
facilityfacility
Specifiesthedefaultfacilityname.Validvaluesare:local0tolocal7.
severityseverity
Specifiesthedefaultloggingseveritylevel.Validvaluesand
correspondinglevelsare:
1emergencies(systemisunusable)
2alerts(immediateactionrequired)
3criticalconditions
4errorconditions
5warningconditions
6notifications(significantconditions)
7informationalmessages
8debuggingmessages
portport
SpecifiesthedefaultUDPporttheclientusestosendtotheserver.
Defaults
None.
Mode
Switchcommand,readwrite.
14-5
Example
ThisexampleshowshowtosettheSyslogdefaultfacilitynametolocal2andtheseveritylevelto4
(errorlogging):
C3(su)->set logging default facility local2 severity 4
Syntax
clear logging default {[facility] [severity] [port]}
Parameters
facility
(Optional)Resetsthedefaultfacilitynametolocal4.
severity
(Optional)Resetsthedefaultloggingseveritylevelto6(notificationsof
significantconditions).
port
(Optional)ResetsthedefaultUDPporttheclientusestosendtotheserver
to514.
Defaults
Atleastoneoptionalparametermustbeentered.
Allthreeoptionalkeywordsmustbeenteredtoresetallloggingvaluestodefaults.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresettheSyslogdefaultseveritylevelto6:
C3(su)->clear logging default severity
Syntax
show logging application [mnemonic | all]
14-6
Parameters
mnemonic
(Optional)Displaysseveritylevelforoneapplicationconfiguredfor
logging.Mnemonicswillvarydependingonthenumberandtypesof
applicationsrunningonyoursystem.Samplemnemonicsandtheir
correspondingapplicationsarelistedinTable 143onpage 148.
Note: Mnemonic values are case sensitive and must be typed as they appear in
Table 14-3.
all
(Optional)Displaysseveritylevelforallapplicationsconfiguredfor
logging.
Defaults
Ifnoparameterisspecified,informationforallapplicationswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaysystemlogginginformationpertainingtotheSNMP
application.
C3(ro)->show logging application SNMP
Application
Current Severity Level
--------------------------------------------90
SNMP
6
1(emergencies)
4(errors)
7(information)
2(alerts)
5(warnings)
8(debugging)
3(critical)
6(notifications)
Table 142providesanexplanationofthecommandoutput.
Table 14-2
Output Field
What it displays...
Application
Syntax
set logging application {[mnemonic | all]} [level level]
14-7
Parameters
mnemonic
Specifiesacasesensitivemnemonicabbreviationofanapplicationtobe
logged.Thisparameterwillvarydependingonthenumberandtypesof
applicationsrunningonyoursystem.Todisplayacompletelist,usethe
showloggingapplicationcommandasdescribedinshowlogging
applicationonpage 146.Samplemnemonicsandtheircorresponding
applicationsarelistedinTable 143onpage 148.
Note: Mnemonic values are case sensitive and must be typed as they appear in
Table 14-3.
all
Setstheloggingseveritylevelforallapplications.
levellevel
(Optional)Specifiestheseveritylevelatwhichtheserverwilllog
messagesforapplications.Validvaluesandcorrespondinglevelsare:
1emergencies(systemisunusable)
2alerts(immediateactionrequired)
3criticalconditions
4errorconditions
5warningconditions
6notifications(significantconditions)
7informationalmessages
8debuggingmessages
Table 14-3
Mnemonic
Application
CLIWEB
SNMP
STP
Driver
Hardware drivers
System
Stacking
UPN
Router
Router
Defaults
Iflevelisnotspecified,nonewillbeapplied.
Mode
Switchcommand,readwrite.
14-8
Example
ThisexampleshowshowtosettheseveritylevelforSNMPto4sothaterrorconditionswillbe
loggedforthatapplication.
C3(rw)->set logging application SNMP level 4
Syntax
clear logging application {mnemonic | all}
Parameters
mnemonic
Resetstheseveritylevelforaspecificapplicationto6.Validmnemonic
valuesandtheircorrespondingapplicationsarelistedinTable 143on
page 148.
all
Resetstheseveritylevelforallapplicationsto6.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresettheloggingseveritylevelto6forSNMP.
C3(rw)->clear logging application SNMP
Syntax
show logging local
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
14-9
Example
Thisexampleshowshowtodisplaythestateofmessagelogging.Inthiscase,loggingtothe
consoleisenabledandloggingtoapersistentfileisdisabled.
C3(su)->show logging local
Syslog Console Logging enabled
Syslog File Logging disabled
Syntax
set logging local console {enable | disable} file {enable | disable}
Parameters
consoleenable|disable
Enablesordisablesloggingtotheconsole.
fileenable|disable
Enablesordisablesloggingtoapersistentfile.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thiscommandshowshowtoenableloggingtotheconsoleanddisableloggingtoapersistentfile:
C3(su)->set logging local console enable file disable
Syntax
clear logging local
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
14-10
Example
Thisexampleshowshowtoclearlocallogging:
C3(su)->clear logging local
Syntax
show logging buffer
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowsaportionoftheinformationdisplayedwiththeshowloggingbuffer
command:
C3(su)->show logging buffer
<165>Sep 4 07:43:09 10.42.71.13 CLI[5]User:rw logged in from 10.2.1.122 (telnet)
<165>Sep 4 07:43:24 10.42.71.13 CLI[5]User: debug failed login from 10.4.1.100
(telnet)
Syntax
show logging interface
Parameters
None.
Defaults
None.
Mode
Switchmode,readonly.
14-11
Example
Thisexampledisplaystheoutputofthiscommand.Inthiscase,theIPaddressassignedto
loopbackinterface1willbeusedasthesourceIPaddressofthesystemlogging.
C3(rw)->show logging interface
loopback 1
192.168.10.1
Syntax
set logging interface {loopback loop-ID | vlan vlan-ID}
Parameters
loopbackloopID
Specifiestheloopbackinterfacetobeused.ThevalueofloopIDcan
rangefrom0to7.
vlanvlanID
SpecifiestheVLANinterfacetobeused.ThevalueofvlanIDcanrange
from1to4093.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThiscommandallowsyoutoconfigurethesourceIPaddressusedbythesystemlogging
applicationwhengeneratingpacketsformanagementpurposes.Anyofthemanagement
interfaces,includingVLANroutinginterfaces,canbeconfiguredasthesourceIPaddressusedin
packetsgeneratedbythesystemlogging.
AninterfacemusthaveanIPaddressassignedtoitbeforeitcanbesetbythiscommand.
Ifnointerfaceisspecified,thentheIPaddressoftheHostinterfacewillbeused.
Ifanonloopbackinterfaceisconfiguredwiththiscommand,applicationpacketegressis
restrictedtothatinterfaceiftheservercanbereachedfromthatinterface.Otherwise,thepackets
aretransmittedoverthefirstavailableroute.Packetsfromtheapplicationserverarereceivedon
theconfiguredinterface.
Ifaloopbackinterfaceisconfigured,andtherearemultiplepathstotheapplicationserver,the
outgoinginterface(gateway)isdeterminedbasedonthebestroutelookup.Packetsfromthe
applicationserverarethenreceivedonthesendinginterface.Ifrouteredundancyisrequired,
therefore,aloopbackinterfaceshouldbeconfigured.
Example
ThisexampleconfiguresanIPaddressonVLANinterface100andthensetsthatinterfaceasthe
systemloggingsourceIPaddress.
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
C3(rw)->router(Config-if(Vlan 100))#exit
14-12
C3(rw)->router(Config)#exit
C3(rw)->router#exit
C3(rw)->router>exit
C3(rw)->set logging interface vlan 100
192.168.10.1
Syntax
clear logging interface
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThiscommandreturnstheinterfaceusedforthesourceIPaddressofthesystemloggingbackto
thedefaultoftheHostinterface.
C3(rw)->show logging interface
vlan 100
192.168.10.1
14-13
Commands
For information about...
Refer to page...
history
14-14
show history
14-15
set history
14-15
ping
14-16
show users
14-16
disconnect
14-17
show netstat
14-17
history
Usethiscommandtodisplaythecontentsofthecommandhistorybuffer.Thecommandhistory
bufferincludesalltheswitchcommandsentereduptoamaximumof100,asspecifiedintheset
historycommand(sethistoryonpage 1415).
Syntax
history
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythecontentsofthecommandhistorybuffer.Itshowsthereare
fivecommandsinthebuffer:
C3(su)->history
1 hist
2 show gvrp
3 show vlan
4 show igmp
5 show ip address
14-14
show history
show history
Usethiscommandtodisplaythesize(inlines)ofthehistorybuffer.
Syntax
show history
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaythesizeofthehistorybuffer:
C3(su)->show history
History buffer size: 20
set history
Usethiscommandtosetthesizeofthehistorybuffer.
Syntax
set history size [default]
Parameters
size
Specifiesthesizeofthehistorybufferinlines.Validvaluesare1to100.
default
(Optional)Makesthissettingpersistentforallfuturesessions.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtosetthesizeofthecommandhistorybufferto30lines:
C3(su)->set history 30
14-15
ping
ping
UsethiscommandtosendICMPechorequestpacketstoanothernodeonthenetworkfromthe
switchCLI.
Syntax
ping host
Parameters
host
SpecifiestheIPaddressofthedevicetowhichthepingwillbesent.
Defaults
None.
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtopingIPaddress134.141.89.29.Inthiscase,thishostisalive:
C3(su)->ping 134.141.89.29
134.141.89.29 is alive
Inthisexample,thehostatIPaddressisnotresponding:
C3(su)->ping 134.141.89.255
no answer from 134.141.89.255
show users
UsethiscommandtodisplayinformationabouttheactiveconsoleportorTelnetsession(s)logged
intotheswitch.
Syntax
show users
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtousetheshowuserscommand.Inthisoutput,therearetwoTelnet
usersloggedinwithReadWriteaccessprivilegesfromIPaddresses134.141.192.119and
134.141.192.18:
14-16
disconnect
C3(su)->show users
Session User Location
-------- ----- -------------------------* telnet
rw
134.141.192.119
telnet
rw
134.141.192.18
disconnect
UsethiscommandtocloseanactiveconsoleportorTelnetsessionfromtheswitchCLI.
Syntax
disconnect {ip-addr | console}
Parameters
ipaddr
SpecifiestheIPaddressoftheTelnetsessiontobedisconnected.This
addressisdisplayedintheoutputshowninshowusersonpage 1215.
console
Closesanactiveconsoleport.
Defaults
None.
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtocloseaTelnetsessiontohost134.141.192.119:
C3(su)->disconnect 134.141.192.119
Thisexampleshowshowtoclosethecurrentconsolesession:
C3(su)->disconnect console
show netstat
Usethiscommandtodisplaynetworklayerstatistics.
Syntax
show netstat
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
14-17
show netstat
Example
Thefollowingexampleshowstheoutputofthiscommand.
C3(su)->show netstat
Prot Local Address
---- ----------------------------TCP 127.0.0.1.2222
TCP 0.0.0.0.80
TCP 0.0.0.0.23
TCP 10.1.56.17.23
UDP 0.0.0.0.17185
UDP 127.0.0.1.49152
UDP 0.0.0.0.161
UDP 0.0.0.0.*
UDP 0.0.0.0.514
Foreign Address
----------------------------0.0.0.0.*
0.0.0.0.*
0.0.0.0.*
134.141.99.104.47718
0.0.0.0.*
127.0.0.1.17185
0.0.0.0.*
0.0.0.0.*
0.0.0.0.*
Thefollowingtabledescribestheoutputofthiscommand.
Table 14-4
14-18
Output Field
What it displays...
Prot
Local Address
Foreign Address
State
State
----------LISTEN
LISTEN
LISTEN
ESTABLISHED
Commands
For information about...
Refer to page...
show arp
14-19
set arp
14-20
clear arp
14-21
traceroute
14-21
show mac
14-22
14-23
14-24
14-24
14-25
14-25
14-26
14-26
14-27
14-28
14-28
show arp
UsethiscommandtodisplaytheswitchsARPtable.
Syntax
show arp
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
14-19
set arp
Example
ThisexampleshowshowtodisplaytheARPtable:
C3(su)->show arp
LINK LEVEL ARP TABLE
IP Address
Phys Address
Flags
Interface
----------------------------------------------------10.20.1.1
00-00-5e-00-01-1
S
host
134.142.21.194
00-00-5e-00-01-1
S
host
134.142.191.192 00-00-5e-00-01-1
S
host
134.142.192.18
00-00-5e-00-01-1
S
host
134.142.192.119 00-00-5e-00-01-1
S
host
-----------------------------------------------------
Table 145providesanexplanationofthecommandoutput.
Table 14-5
Output Field
What It Displays...
IP Address
Phys Address
Flags
set arp
UsethiscommandtoaddmappingentriestotheswitchsARPtable.
Syntax
set arp ip-address mac-address
Parameters
ipaddress
SpecifiestheIPaddresstomaptotheMACaddressandaddtotheARP
table.
macaddress
SpecifiestheMACaddresstomaptotheIPaddressandaddtotheARP
table.TheMACaddresscanbeformattedasxx:xx:xx:xx:xx:xxorxxxx
xxxxxxxx.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtomapIPaddress192.168.219.232toMACaddress00000c400fbc:
C3(su)->set arp 192.168.219.232 00-00-0c-40-0f-bc
14-20
clear arp
clear arp
UsethiscommandtodeleteaspecificentryorallentriesfromtheswitchsARPtable.
Syntax
clear arp {ip-address | all}
Parameters
ipaddress|all
SpecifiestheIPaddressintheARPtabletobecleared,orclearsallARP
entries.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtodeleteentry10.1.10.10fromtheARPtable:
C3(su)->clear arp 10.1.10.10
traceroute
UsethiscommandtodisplayahopbyhoppaththroughanIPnetworkfromthedevicetoa
specificdestinationhost.ThreeUDPorICMPprobeswillbetransmittedforeachhopbetweenthe
sourceandthetraceroutedestination.
Syntax
traceroute [-w waittime] [-f first-ttl] [-m max-ttl] [-p port] [-q nqueries] [-r]
[-d] [-n] [-v] host
Parameters
wwaittime
(Optional)Specifiestimeinsecondstowaitforaresponsetoaprobe.
ffirstttl
(Optional)Specifiesthetimetolive(TTL)ofthefirstoutgoingprobe
packet.
mmaxttl
(Optional)Specifiesthemaximumtimetolive(TTL)usedinoutgoing
probepackets.
pport
(Optional)SpecifiesthebaseUDPportnumberusedinprobes.
qnqueries
(Optional)Specifiesthenumberofprobeinquiries.
(Optional)Bypassesthenormalhostroutingtables.
(Optional)Setsthedebugsocketoption.
(Optional)Displayshopaddressesnumerically.(Supportedinafuture
release.)
14-21
show mac
(Optional)Displaysverboseoutput,includingthesizeanddestinationof
eachresponse.
host
SpecifiesthehosttowhichtherouteofanIPpacketwillbetraced.
Defaults
Ifnotspecified,waittimewillbesetto5seconds.
Ifnotspecified,firstttlwillbesetto1second.
Ifnotspecified,maxttlwillbesetto30seconds.
Ifnotspecified,portwillbesetto33434.
Ifnotspecified,nquerieswillbesetto3.
Ifrisnotspecified,normalhostroutingtableswillbeused.
Ifdisnotspecified,thedebugsocketoptionwillnotbeused.
Ifvisnotspecified,summaryoutputwillbedisplayed.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtousetraceroutetodisplayaroundtrippathtohost192.167.252.17.In
thiscase,hop1istheSecureStackC3switch,hop2is14.1.0.45,andhop3isbacktothehostIP
address.RoundtriptimesforeachofthethreeUDPprobesaredisplayednexttoeachhop:
C3(su)->traceroute 192.167.252.17
traceroute to 192.167.252.17 (192.167.252.17), 30 hops max, 40 byte packets
1 matrix.enterasys.com (192.167.201.40) 20.000 ms 20.000 ms 20.000 ms
2 14.1.0.45 (14.1.0.45) 40.000 ms 10.000 ms 20.000 ms
3 192.167.252.17 (192.167.252.17) 50.000 ms 0.000 ms 20.000 ms
show mac
UsethiscommandtodisplayMACaddressesintheswitchsfilteringdatabase.Theseare
addresseslearnedonaportthroughtheswitchingprocess.
Syntax
show mac [address mac-address] [fid fid] [port port-string] [type {other | learned
| self | mgmt}]
Parameters
14-22
addressmacaddress
(Optional)DisplaysaspecificMACaddress(ifitisknownbythe
device).
fidfid
(Optional)DisplaysMACaddressesforaspecificfilterdatabase
identifier.
portportstring
(Optional)DisplaysMACaddressesforspecificport(s).
typeother|learned|
self|mgmt
(Optional)Displaysinformationrelatedtoother,learned,selfor
mgmt(management)addresstype.
Defaults
Ifnoparametersarespecified,allMACaddressesforthedevicewillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayMACaddressinformationforge.3.1:
C3(su)->show mac port ge.3.1
MAC Address
FID Port
Type
----------------- ---- ------------- -------00-09-6B-0F-13-E6 15
ge.3.1
Learned
MAC Address
VLAN Port
Type
Status Egress Ports
----------------- ---- ------------- ------- ------- --------------------------01-01-23-34-45-56 20
any
mcast
perm
ge.3.1
Table 146providesanexplanationofthecommandoutput.
Table 14-6
Output Field
What It Displays...
MAC Address
FID
Port
Port designation.
Type
VLAN
Status
Egress Ports
The ports which have been added to the egress ports list.
Syntax
show mac agetime
Parameters
None.
14-23
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaytheMACtimeoutperiod:
C3(su)->show mac agetime
Aging time: 300 seconds
Syntax
set mac agetime time
Parameters
time
SpecifiesthetimeoutperiodinsecondsforaginglearnedMAC
addresses.Validvaluesare10to1,000,000seconds.Defaultvalueis300
seconds.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtosettheMACtimeoutperiod:
C3(su)->set mac agetime 250
Syntax
clear mac agetime
Parameters
None.
Defaults
None.
14-24
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtoresettheMACtimeoutperiodtothedefaultvalueof300seconds.
C3(su)->clear mac agetime
Syntax
set mac algorithm {mac-crc16-lowerbits | mac-crc16-upperbits |
mac-crc32-lowerbits | mac-crc32-upperbits}
Parameters
maccrc16lowerbits
SelecttheMACCRC16lowerbitsalgorithmforhashing.
maccrc16upperbits
SelecttheMACCRC16upperbitsalgorithmforhashing.
maccrc32lowerbits
SelecttheMACCRC32lowerbitsalgorithmforhashing.
maccrc32upperbits
SelecttheMACCRC32upperbitsalgorithmforhashing.
Defaults
ThedefaultMACalgorithmismaccrc16upperbits.
Mode
Switchcommand,readwrite.
Usage
EachalgorithmisoptimizedforadifferentspreadofMACaddresses.Whenchangingthismode,
theswitchwilldisplayawarningmessageandpromptyoutorestartthedevice.
ThedefaultMACalgorithmismaccrc16upperbits.
Example
Thisexamplesetsthehashingalgorithmtomaccrc32upperbits.
C3(rw)->set mac algorithm mac-crc32-upperbits
Syntax
show mac algorithm
14-25
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowstheoutputofthiscommand.
C3(su)->show mac algorithm
Mac hashing algorithm is mac-crc16-upperbits.
Syntax
clear mac algorithm
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleresetstheMAChashingalgorithmtothedefaultvalue.
C3(su)->clear mac algorithm
Syntax
set mac multicast mac-address vlan-id [port-string] [{append | clear} port-string]
14-26
Parameters
macaddress
SpecifiesthemulticastMACaddress.TheMACaddresscanbe
formattedasxx:xx:xx:xx:xx:xxorxxxxxxxxxxxx.
vlanid
SpecifiestheVLANIDcontainingtheports.
portstring
SpecifiestheportorrangeofportsthemulticastMACaddresscanbe
learnedonorfloodedto.
append|clear
Appendsorclearstheportorrangeofportsfromtheegressportlist.
Defaults
Ifnoportstringisdefined,thecommandwillapplytoallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleconfiguresmulticastMACaddress010122334455forVLAN24.
C3(su)->set mac multicast 01-01-22-33-44-55 24
Syntax
clear mac address mac-address [vlan-id]
Parameters
macaddress
SpecifiesthemulticastMACaddresstobecleared.TheMACaddress
canbeformattedasxx:xx:xx:xx:xx:xxorxxxxxxxxxxxx.
vlanid
(Optional)SpecifiestheVLANIDfromwhichtoclearthestatic
multicastMACaddress.
Defaults
Ifnovlanidisspecified,themulticastMACaddressisclearedfromallVLANs.
Mode
Switchcommand,readwrite.
Example
ThisexampleclearsmulticastMACaddress010122334455fromVLAN24.
C3(su)->clear mac multicast 01-01-22-33-44-55 24
14-27
Syntax
show mac unreserved-flood
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledisplaysthestatusofmulticastfloodprotection.
C3(su)->show mac unreserved-flood
mac unreserved flood is disabled.
Syntax
set mac unreserved-flood {disable | enable}
Parameters
disable|enable
Disablesorenablesmulticastfloodprotection.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thefollowingaddresseswillbeforwardedwhenthisfunctionisenabled:
01:80:C2:00:00:11
01:80:C2:00:00:14
01:80:C2:00:00:15
Thedefaultstateisdisabled,andtheseaddresseswillnotbeforwarded.
14-28
Example
Thisexampleenablesmulticastfloodprotection.
C3(su)->set mac unreserved-flood enable
Commands
For information about...
Refer to page...
show sntp
14-29
14-31
14-31
14-32
14-32
14-33
14-33
14-34
14-34
14-35
14-35
set timezone
14-36
14-37
14-37
14-38
show sntp
UsethiscommandtodisplaySNTPclientsettings.
Syntax
show sntp
14-29
show sntp
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySNTPclientsettings:
C3(su)->show sntp
SNTP Version: 3
Current Time: TUE SEP 09 16:13:33 2003
Timezone: 'EST', offset from UTC is -4 hours and 0 minutes
Client Mode: unicast
Broadcast Count: 0
Poll Interval: 512 seconds
Poll Retry: 1
Poll Timeout: 5 seconds
SNTP Poll Requests: 1175
Last SNTP Update: TUE SEP 09 16:05:24 2003
Last SNTP Request: TUE SEP 09 16:05:24 2003
Last SNTP Status: Success
SNTP-Server
Precedence
Status
------------------------------------------10.2.8.6
2
Active
144.111.29.19
1
Active
Table 147providesanexplanationofthecommandoutput.
Table 14-7
Output Field
What It Displays...
SNTP Version
Current Time
Timezone
Time zone name and amount it is offset from UTC (Universal Time). Set using the
set timezone command (set timezone on page 14-36).
Client Mode
Whether SNTP client is operating in unicast or broadcast mode. Set using set sntp
client command (set sntp client on page 14-31).
Broadcast Count
Poll Interval
Interval between SNTP unicast requests. Default of 512 seconds can be reset using
the set sntp poll-interval command (set sntp poll-interval on page 14-33).
Poll Retry
Number of poll retries to a unicast SNTP server. Default of 1 can be reset using the
set sntp poll-retry command (set sntp poll-retry on page 14-34).
Poll Timeout
14-30
Table 14-7
Output Field
What It Displays...
SNTP-Server
Precedence
Status
Syntax
set sntp client {broadcast | unicast | disable}
Parameters
broadcast
EnablesSNTPinbroadcastclientmode.
unicast
EnablesSNTPinunicast(pointtopoint)clientmode.Inthismode,the
clientmustsupplytheIPaddressfromwhichtoretrievethecurrenttime.
disable
DisablesSNTP.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenableSNTPinbroadcastmode:
C3(su)->set sntp client broadcast
Syntax
clear sntp client
Parameters
None.
14-31
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheSNTPclientsoperationalmode:
C3(su)->clear sntp client
Syntax
set sntp server ip-address [precedence]
Parameters
ipaddress
SpecifiestheSNTPserversIPaddress.
precedence
(Optional)SpecifiesthisSNTPserversprecedenceinrelationtoitspeers.
Validvaluesare1(highest)to10(lowest).
Defaults
Ifprecedenceisnotspecified,1willbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosettheserveratIPaddress10.21.1.100 asan SNTPserver:
C3(su)->set sntp server 10.21.1.100
Syntax
clear sntp server {ip-address | all}
Parameters
14-32
ipaddress
SpecifiestheIPaddressofaservertoremovefromtheSNTPserverlist.
all
RemovesallserversfromtheSNTPserverlist.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoremovetheserveratIPaddress10.21.1.100 fromtheSNTPserverlist:
C3(su)->clear sntp server 10.21.1.100
Syntax
set sntp poll-interval value
Parameters
value
Thepollintervalis2tothepowerofvalueinseconds,wherevaluecanrange
from6to10.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosettheSNTPpollintervalto64seconds:
C3(su)->set sntp poll-interval 6
Syntax
clear sntp poll-interval
Parameters
None.
Defaults
None.
14-33
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheSNTPpollinterval:
C3(su)->clear sntp poll-interval
Syntax
set sntp poll-retry retry
Parameters
retry
Specifiesthenumberofretries.Validvaluesare0to10.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthenumberofSNTPpollretriesto5:
C3(su)->set sntp poll-retry 5
Syntax
clear sntp poll-retry
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
14-34
Example
ThisexampleshowshowtoclearthenumberofSNTPpollretries:
C3(su)->clear sntp poll-retry
Syntax
set sntp poll-timeout timeout
Parameters
timeout
Specifiesthepolltimeoutinseconds.Validvaluesare1to30.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosettheSNTPpolltimeoutto10seconds:
C3(su)->set sntp poll-timeout 10
Syntax
clear sntp poll-timeout
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheSNTPpolltimeout:
C3(su)->clear sntp poll-timeout
14-35
set timezone
set timezone
UsethiscommandtoconfigurethecurrenttimezoneasanoffsetfromUTC.
Syntax
set timezone name [hours] [minutes]
Parameters
name
Thenameofthetimezone.Typically,thisnameisastandard
abbreviationsuchasEST(EasternStandardTime)orEDT(Eastern
DaylightTime).
hours
(Optional)SpecifiestheoffsetinhoursfromUTC.Thevaluecanrange
from13to13.Thedefaultis0hours.
minutes
(Optional)SpecifiesadditionaloffsetinminutesfromUTC.Thevalue
canrangefrom0to59.Thedefaultis0minutes.
Defaults
Ifyouenteratimezonenamewithoutspecifyinganoffsetinhoursandminutes,thedefaultisan
offsetfromUTCof0hoursand0minutes.
Mode
Switchcommand,readwrite.
Usage
Typically,thiscommandisusedtoconfigurethelocaltimezoneoffsetfromUTC(UniveralTime)
whenSNTPisusedtosynchronizethetimeusedbydevicesonthenetwork.
TodisplaythecurrenttimezonesettingusedbySNTP,usetheshowsntpcommand.Toclearan
existingoffsettozero,enterthecommandwithoutspecifyinganyhoursorminutes.
StandardtimezonenamesandoffsetscanbefoundatthefollowingURL,amongothers:
http://www.timeanddate.com/library/abbreviations/timezones/
Example
ThefollowingexamplesetsthetimezonenametoESTandtheoffsettoNorthAmericanEastern
StandardTimeoffsetof5hoursfromUTC,thendisplaysthetimezoneusedwithSNTP.
C3(su)->set timezone EST -5
C3(su)->show sntp
SNTP Version: 3
Current Time: WED JUL 16 11:35:52 2008
Timezone: 'EST' offset from UTC is -5 hours and 0 minutes
Client Mode: unicast
Broadcast Count: 0
Poll Interval: 6 (64 seconds)
Poll Retry: 1
Poll Timeout: 5 seconds
SNTP Poll Requests: 2681
Last SNTP Update: WED JUL 16 16:35:23 2008
Last SNTP Request: WED JUL 16 16:35:23 2008
Last SNTP Status: Success
14-36
SNTP-Server
Precedence
Status
------------------------------------------192.255.255.254
2
Active
Syntax
show sntp interface
Parameters
None.
Defaults
None.
Mode
Switchmode,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.Inthiscase,theIPaddressassignedto
loopbackinterface1willbeusedasthesourceIPaddressoftheSNTPclient.
C3(rw)->show sntp interface
loopback 1
192.168.10.1
Syntax
set sntp interface {loopback loop-ID | vlan vlan-ID}
Parameters
loopbackloopID
Specifiestheloopbackinterfacetobeused.ThevalueofloopIDcan
rangefrom0to7.
vlanvlanID
SpecifiestheVLANinterfacetobeused.ThevalueofvlanIDcanrange
from1to4093.
Defaults
None.
Mode
Switchcommand,readwrite.
14-37
Usage
ThiscommandallowsyoutoconfigurethesourceIPaddressusedbytheSNTPapplicationwhen
generatingpacketsformanagementpurposes.Anyofthemanagementinterfaces,including
VLANroutinginterfaces,canbeconfiguredasthesourceIPaddressusedinpacketsgeneratedby
theSNTPclient.
AninterfacemusthaveanIPaddressassignedtoitbeforeitcanbesetbythiscommand.
Ifnointerfaceisspecified,thentheIPaddressoftheHostinterfacewillbeused.
Ifanonloopbackinterfaceisconfiguredwiththiscommand,applicationpacketegressis
restrictedtothatinterfaceiftheservercanbereachedfromthatinterface.Otherwise,thepackets
aretransmittedoverthefirstavailableroute.Packetsfromtheapplicationserverarereceivedon
theconfiguredinterface.
Ifaloopbackinterfaceisconfigured,andtherearemultiplepathstotheapplicationserver,the
outgoinginterface(gateway)isdeterminedbasedonthebestroutelookup.Packetsfromthe
applicationserverarethenreceivedonthesendinginterface.Ifrouteredundancyisrequired,
therefore,aloopbackinterfaceshouldbeconfigured.
Example
ThisexampleconfiguresanIPaddressonVLANinterface100andthensetsthatinterfaceasthe
SNTPclientsourceIPaddress.
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
C3(rw)->router(Config-if(Vlan 100))#exit
C3(rw)->router(Config)#exit
C3(rw)->router#exit
C3(rw)->router>exit
C3(rw)->set sntp interface vlan 100
192.168.10.1
Syntax
clear sntp interface
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
14-38
Example
ThiscommandreturnstheinterfaceusedforthesourceIPaddressoftheSNTPclientbacktothe
defaultoftheHostinterface.
C3(rw)->show sntp interface
vlan 100
192.168.10.1
14-39
Purpose
Toreview,disable,andreenablenode(port)aliasfunctionalityontheswitch.
Commands
For information about...
Refer to page...
14-40
set nodealias
14-41
14-42
Syntax
show nodealias config [port-string]
Parameters
portstring
(Optional)Displaysnodealiasconfigurationsettingsforspecificport(s).
Defaults
Ifportstringisnotspecified,nodealiasconfigurationswillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaynodealiasconfigurationsettingsforportsge.2.1through9:
C3(rw)->show nodealias config ge.2.1-9
Port Number
Max Entries
Used Entries
14-40
Status
set nodealias
----------ge.2.1
ge.2.2
ge.2.3
ge.2.4
ge.2.5
ge.2.6
ge.2.7
ge.2.8
ge.2.9
----------16
47
47
47
47
47
47
47
4000
-----------0
0
2
0
0
2
0
0
1
-----Enable
Enable
Enable
Enable
Enable
Enable
Enable
Enable
Enable
Table 148providesanexplanationofthecommandoutput.
Table 14-8
Output Field
What It Displays...
Port Number
Port designation.
Max Entries
Used Entries
Number of alias entries (out of the maximum amount configured) already used by
this port.
Status
Whether or not a node alias agent is enabled (default) or disabled on this port.
set nodealias
Usethiscommandtoenableordisableanodealiasagentononeormoreports,orsetthe
maximumnumberofaliasentriesstoredperport.
Syntax
set nodealias {enable | disable | maxentries maxentries} port-string
Parameters
enable|disable
Enablesordisablesanodealiasagent.
maxentriesmaxentries
Setthemaximumnumberofaliasentriesstoredperport.Validrange
is0to4096.Thedefaultvalueis32.
portstring
Specifiestheport(s)onwhichtoenable/disablenodealiasagentorset
amaximumnumberofstoredentries.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Uponpacketreception,nodealiasesaredynamicallyassignedtoportsenabledwithanalias
agent,whichisthedefaultsettingonSecureStackC3devices.Nodealiasescannotbestatically
created,butcanbedeletedusingthecommandclearnodealiasconfig(page 1442).
14-41
Itsimportanttomakesurethatinterswitchlinksarenotlearningnode/aliasinformation,asit
wouldslowdownsearchesbytheNetSightCompassandASMtoolsandgiveinaccurateresults.
Example
Thisexampleshowshowtodisablethenodealiasagentonge.1.3:
C3(su)->set nodealias disable ge.1.3
Syntax
clear nodealias config port-string
Parameters
portstring
Specifiestheport(s)onwhichtoresetthenodealiasconfiguration.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoresetthenodealiasconfigurationonge.1.3:
C3(su)->clear nodealias config ge.1.3
14-42
15
RMON Configuration
ThischapterdescribesthecommandsusedtoconfigureRMONonaSecureStackC3switch.
For information about...
Refer to page...
15-1
Design Considerations
15-2
15-3
15-6
15-9
15-13
15-17
15-22
What It Monitors...
CLI Command(s)
Records statistics
measured by the RMON
probe for each monitored
interface on the device.
15-1
Design Considerations
Table 15-1
RMON
Group
History
What It Monitors...
CLI Command(s)
Alarm
Event
Periodically gathers
statistical samples from
variables in the probe and
compares them with
previously configured
thresholds. If the monitored
variable crosses a
threshold, an event is
generated.
Filter
Allows packets to be
matched by a filter
equation. These matched
packets form a data stream
or channel that may be
captured.
Packet
Capture
Allows packets to be
captured upon a filter
match.
Design Considerations
TheC3supportsRMONPacketCapture/FilterSamplingthroughboththeCLIandMIBs,butwith
thefollowingconstraints:
15-2
RMON Configuration
RMONPacketCapture/FilterSamplingandPortMirroringcannotbeenabledonthesame
interfaceconcurrently.
Youcancaptureatotalof100packetsonaninterface,nomoreandnoless.
Thecapturedframeswillbeasclosetosequentialasthehardwarewillallow.
Onlyoneinterfacecanbeconfiguredforcapturingatatime.
Once100frameshavebeencapturedbythehardware,theapplicationwillstopwithout
manualintervention.
AsdescribedintheMIB,thefilterisonlyappliedaftertheframeiscaptured,thusonlya
subsetoftheframescapturedwillbeavailablefordisplay.
ThereisonlyoneBufferControlEntrysupported.
Duetothelimitationsofthehardware,theBufferControlEntrytablewillhavelimitsonafew
ofitselements:
MaxOctetsRequestedcanonlybesettothevalue1whichindicatestheapplicationwill
captureasmanypacketsaspossiblegivenitsrestrictions.
CaptureSliceSizecanonlybesetto1518.
TheFullActionelementcanonlybesettolocksincethedevicedoesnotsupport
wrappingthecapturebuffer.
Duetohardwarelimitations,theonlyframeerrorcountedisoversizedframes.
TheapplicationdoesnotsupportEvents.Therefore,thefollowingelementsoftheChannel
EntryTablearenotsupported:TurnOnEventIndex,TurnOffEventIndex,EventIndex,and
EventStatus.
ThereisonlyoneChannelEntryavailableatatime.
ThereareonlythreeFilterEntriesavailable,andausercanassociateallthreeFilterEntries
withtheChannelEntry.
Configuredchannel,filter,andbufferinformationwillbesavedacrossresets,butnotframes
withinthecapturebuffer.
Note: Due to hardware limitations, the only frame error counted is oversized frames.
Commands
For information about...
Refer to page...
15-4
15-4
15-5
15-3
Syntax
show rmon stats [port-string]
Parameters
portstring
(Optional)DisplaysRMONstatisticsforspecificport(s).
Defaults
Ifportstringisnotspecified,RMONstatswillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayRMONstatisticsforGigabitEthernetport1inswitch1.
:
=
=
=
=
=
=
=
=
=
0
0
0
0
0
0
0
0
0
Packets
Octets
0
64
65
- 127
128 - 255
256 - 511
512 - 1023
1024 - 1518
Octets
Octets
Octets
Octets
Octets
Octets
=
=
=
=
=
=
=
=
0
0
0
0
0
0
0
0
Table 152providesanexplanationofthecommandoutput.
Syntax
set rmon stats index port-string [owner]
Parameters
15-4
index
Specifiesanindexforthisstatisticsentry.
portstring
Specifiesport(s)towhichthisentrywillbeassigned.
owner
(Optional)Assignsanownerforthisentry.
RMON Configuration
Defaults
Ifownerisnotspecified,monitorwillbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoconfigureRMONstatisticsentry2forge.1.20:
C3(rw)->set rmon stats 2 ge.1.20
Syntax
clear rmon stats {index-list | to-defaults}
Parameters
indexlist
Specifiesoneormorestatsentriestobedeleted,causingthemtodisappear
fromanyfutureRMONqueries.
todefaults
Resetsallhistoryentriestodefaultvalues.Thiswillcauseentriesto
reappearinRMONqueries.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodeleteRMONstatisticsentry2:
C3(rw)->clear rmon stats 2
15-5
Commands
For information about...
Refer to page...
15-6
15-7
15-7
Syntax
show rmon history [port-string]
Parameters
portstring
(Optional)DisplaysRMONhistoryentriesforspecificport(s).
Defaults
Ifportstringisnotspecified,informationaboutallRMONhistoryentrieswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayRMONhistoryentriesforGigabitEthernetport1inswitch1.
Acontrolentrydisplaysfirst,followedbyactualentriescorrespondingtothecontrolentry.Inthis
case,thedefaultsettingsforentryowner,samplinginterval,andmaximumnumberofentries.
(buckets)havenotbeenchangedfromtheirdefaultvalues.Foradescriptionofthetypesof
statisticsshown,refertoTable 152.
:
15-6
RMON Configuration
Sample 2779
Drop Events
Octets
Packets
Broadcast Pkts
Multicast Pkts
CRC Align Errors
=
=
=
=
=
=
Syntax
set rmon history index [port-string] [buckets buckets] [interval interval] [owner
owner]
Parameters
indexlist
Specifiesanindexnumberforthisentry.
portstring
(Optional)Assignsthisentrytoaspecificport.
bucketsbuckets
(Optional)Specifiesthemaximumnumberofentriestomaintain.
intervalinterval
(Optional)Specifiesthesamplingintervalinseconds.
ownerowner
(Optional)Specifiesanownerforthisentry.
Defaults
Ifbucketsisnotspecified,themaximumnumberofentriesmaintainedwillbe50.
Ifnotspecified,intervalwillbesetto30seconds.
Ifownerisnotspecified,monitorwillbeapplied.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowconfigureRMONhistoryentry1onportge.2.1tosampleevery20
seconds:
C3(rw)->set rmon history 1 ge.2.1 interval 20
Syntax
clear rmon history {index-list | to-defaults}
15-7
Parameters
indexlist
Specifiesoneormorehistoryentriestobedeleted,causingthemto
disappearfromanyfutureRMONqueries.
todefaults
Resetsallhistoryentriestodefaultvalues.Thiswillcauseentriesto
reappearinRMONqueries.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodeleteRMONhistoryentry1:
C3(rw)->clear rmon history 1
15-8
RMON Configuration
Commands
For information about...
Refer to page...
15-9
15-10
15-11
15-12
Syntax
show rmon alarm [index]
Parameters
index
(Optional)DisplaysRMONalarmentriesforaspecificentryindexID.
Defaults
Ifindexisnotspecified,informationaboutallRMONalarmentrieswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayRMONalarmentry3:
C3(rw)->show rmon alarm 3
Index 3
--------------------Owner
=
Status
=
Variable
=
Sample Type
=
Interval
=
Rising Threshold
=
Rising Event Index =
Manager
valid
1.3.6.1.4.1.5624.1.2.29.1.2.1.0
delta
Startup Alarm
30
Value
1
Falling Threshold
2
Falling Event Index
=
=
=
=
rising
0
0
0
Table 152providesanexplanationofthecommandoutput.
SecureStack C3 Configuration Guide
15-9
Table 15-2
Output Field
What It Displays...
Index
Owner
Status
Variable
Sample Type
Startup Alarm
Whether alarm generated when this entry is first enabled is rising, falling, or either.
Interval
Rising Threshold
Falling Threshold
Index number of the RMON event to be triggered when the rising threshold is
crossed.
Index number of the RMON event to be triggered when the falling threshold is
crossed.
Syntax
set rmon alarm properties index [interval interval] [object object] [type
{absolute | delta}] [startup {rising | falling | either}] [rthresh rthresh]
[fthresh fthresh] [revent revent] [fevent fevent] [owner owner]
Parameters
index
Specifiesanindexnumberforthisentry.Maximumnumberorentriesis
50.Maximumvalueis65535.
intervalinterval
(Optional)Specifiesaninterval(inseconds)forRMONtoconductsample
monitoring.
objectobject
(Optional)SpecifiesaMIBobjecttobemonitored.
Note: This parameter is not mandatory for executing the command, but
must be specified in order to enable the alarm entry configuration.
typeabsolute|
delta
15-10
RMON Configuration
(Optional)Specifiesthemonitoringmethodas:samplingtheabsolute
valueoftheobject,orthedifference(delta)betweenobjectsamples.
startuprising|
falling|either
(Optional)Specifiesthetypeofalarmgeneratedwhenthiseventisfirst
enabledas:
RisingSendsalarmwhenanRMONeventreachesamaximum
thresholdconditionisreached,forexample,morethan30collisions
persecond.
FallingSendsalarmwhenRMONeventfallsbelowaminimum
thresholdcondition,forexamplewhenthenetworkisbehaving
normallyagain.
EitherSendsalarmwheneitherarisingorfallingthresholdis
reached.
rthreshrthresh
(Optional)Specifiesaminimumthresholdforcausingarisingalarm.
fthreshfthresh
Specifiesamaximumthresholdforcausingafallingalarm.
reventrevent
SpecifiestheindexnumberoftheRMONeventtobetriggeredwhenthe
risingthresholdiscrossed.
feventfevent
SpecifiestheindexnumberoftheRMONeventtobetriggeredwhenthe
fallingthresholdiscrossed.
ownerowner
(Optional)Specifiesthenameoftheentitythatconfiguredthisalarm
entry.
Defaults
interval3600seconds
typeabsolute
startuprising
rthresh0
fthresh0
revent0
fevent0
ownermonitor
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoconfigurearisingRMONalarm.Thisentrywillconductmonitoring
ofthedeltabetweensamplesevery30seconds:
C3(rw)->set rmon alarm properties 3 interval 30 object
1.3.6.1.4.1.5624.1.2.29.1.2.1.0 type delta rthresh 1 revent 2 owner Manager
Syntax
set rmon alarm status index enable
SecureStack C3 Configuration Guide
15-11
Parameters
index
Specifiesanindexnumberforthisentry.Maximumnumberorentriesis
50.Maximumvalueis65535.
enable
Enablesthisalarmentry.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
AnRMONalarmentrycanbecreatedusingthiscommand,configuredusingthesetrmonalarm
propertiescommand(setrmonalarmpropertiesonpage 1510),thenenabledusingthis
command.AnRMONalarmentrycanbecreatedandconfiguredatthesametimebyspecifying
anunusedindexwiththesetrmonalarmpropertiescommand.
Example
ThisexampleshowshowtoenableRMONalarmentry3:
C3(rw)->set rmon alarm status 3 enable
Syntax
clear rmon alarm index
Parameters
index
Specifiestheindexnumberofentrytobecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearRMONalarmentry1:
C3(rw)->clear rmon alarm 1
15-12
RMON Configuration
Commands
For information about...
Refer to page...
15-13
15-14
15-15
15-15
Syntax
show rmon event [index]
Parameters
index
(Optional)DisplaysRMONpropertiesandlogentriesforaspecificentry
indexID.
Defaults
Ifindexisnotspecified,informationaboutallRMONentrieswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayRMONevententry3:
C3(rw)->show rmon event 3
Index 3
---------------Owner
=
Status
=
Description
=
Type
=
Community
=
Last Time Sent =
Manager
valid
STP Topology change
log-and-trap
public
0 days 0 hours 0 minutes 37 seconds
Table 153providesanexplanationofthecommandoutput.
15-13
Table 15-3
Output Field
What It Displays...
Index
Owner
Status
Description
Type
Whether the event notification will be a log entry, and SNMP trap, both, or none.
Community
Syntax
set rmon event properties index [description description] [type {none | log | trap
| both}] [community community] [owner owner]
Parameters
index
Specifiesanindexnumberforthisentry.Maximumnumberofentriesis
100.Maximumvalueis65535.
description
description
(Optional)Specifiesatextstringdescriptionofthisevent.
typenone|log|
trap|both
(Optional)SpecifiesthetypeofRMONeventnotificationas:none,alog
tableentry,anSNMPtrap,orbothalogentryandatrapmessage.
community
community
(Optional)SpecifiesanSNMPcommunitynametouseifthemessage
typeissettotrap.FordetailsonsettingSNMPtrapsandcommunity
names,refertoCreatingaBasicSNMPTrapConfigurationon
page 837.
ownerowner
(Optional)Specifiesthenameoftheentitythatconfiguredthisentry.
Defaults
Ifdescriptionisnotspecified,nonewillbeapplied.
Ifnotspecified,typenonewillbeapplied.
Ifownerisnotspecified,monitorwillbeapplied.
Mode
Switchcommand,readwrite.
15-14
RMON Configuration
Example
ThisexampleshowshowtocreateandenableanRMONevententrycalledSTPtopology
changethatwillsendbothalogentryandanSNMPtrapmessagetothepubliccommunity:
C3(rw)->set rmon event properties 2 description "STP topology change" type both
community public owner Manager
Syntax
set rmon event status index enable
Parameters
index
Specifiesanindexnumberforthisentry.Maximumnumberofentriesis
100.Maximumvalueis65535.
enable
Enablesthisevententry.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
AnRMONevententrycanbecreatedusingthiscommand,configuredusingthesetrmonevent
propertiescommand(setrmoneventpropertiesonpage 1514),thenenabledusingthis
command.AnRMONevententrycanbecreatedandconfiguredatthesametimebyspecifyingan
unusedindexwiththesetrmoneventpropertiescommand.
Example
ThisexampleshowshowtoenableRMONevententry1:
C3(rw)->set rmon event status 1 enable
Syntax
clear rmon event index
Parameters
index
Specifiestheindexnumberoftheentrytobecleared.
15-15
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearRMONevent1:
C3(rw)->clear rmon event 1
15-16
RMON Configuration
Note: Packet capture is sampling only and does not guarantee receipt of back to back packets.
Onechannelatatimecanbesupported,withuptothreefilters.Configuredchannel,filter,and
buffercontrolinformationwillbesavedacrossresets,butcapturedframeswithinthebufferwill
notbesaved.
Thisfunctioncannotbeusedconcurrentlywithportmirroring.Thesystemwillchecktoprevent
concurrentlyenablingbothfunctions,andawarningwillbegeneratedintheCLIifattempted.
Commands
For information about...
Refer to page...
15-17
15-18
15-19
15-19
15-20
15-21
Syntax
show rmon channel [port-string]
Parameters
portstring
(Optional)DisplaysRMONchannelentriesforaspecificport(s).
Defaults
Ifportstringisnotspecified,informationaboutallchannelswillbedisplayed.
Mode
Switchcommand,readonly.
15-17
Example
ThisexampleshowshowtodisplayRMONchannelinformationforge.2.12:
C3(rw)->show rmon channel ge.2.12
Port ge.2.12
Channel index= 628
EntryStatus= valid
---------------------------------------------------------Control
off
AcceptType
matched
OnEventIndex
0
OffEventIndex
0
EventIndex
0
Status
ready
Matches
4498
Description
Thu Dec 16 12:57:32 EST 2004
Owner
NetSight smith
Syntax
set rmon channel index port-string [accept {matched | failed}] [control {on | off}]
[description description] [owner owner]
Parameters
index
Specifiesanindexnumberforthisentry.Anentrywillautomaticallybe
createdifanunusedindexnumberischosen.Maximumnumberof
entriesis2.Maximumvalueis65535.
portstring
Specifiestheportonwhichtrafficwillbemonitored.
acceptmatched|
failed
(Optional)Specifiestheactionofthefiltersonthischannelas:
matchedPacketswillbeacceptedonfiltermatches
failedPacketswillbeacceptediftheyfailamatch
controlon|off
(Optional)Enablesordisablescontroloftheflowofdatathroughthe
channel.
description
description
(Optional)Specifiesadescriptionforthischannel.
ownerowner
(Optional)Specifiesthenameoftheentitythatconfiguredthisentry.
Defaults
Ifanactionisnotspecified,packetswillbeacceptedonfiltermatches.
Ifnotspecified,controlwillbesettooff.
Ifadescriptionisnotspecified,nonewillbeapplied.
Ifownerisnotspecified,itwillbesettomonitor.
Mode
Switchcommand,readwrite.
15-18
RMON Configuration
Example
ThisexampleshowshowtocreateanRMONchannelentry:
C3(rw)->set rmon channel 54313 ge.2.12 accept failed control on description
"capture all"
Syntax
clear rmon channel index
Parameters
index
Specifiesthechannelentrytobecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearRMONchannelentry2:
C3(rw)->clear rmon channel 2
Syntax
show rmon filter [index index | channel channel]
Parameters
indexindex|
channelchannel
(Optional)Displaysinformationaboutaspecificfilterentry,oraboutall
filterswhichbelongtoaspecificchannel.
Defaults
Ifnooptionsarespecified,informationforallfilterentrieswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayallRMONfilterentriesandchannelinformation:
15-19
Syntax
set rmon filter index channel-index [offset offset] [status status] [smask smask]
[snotmask snotmask] [data data] [dmask dmask] [dnotmask dnotmask] [owner owner]
Parameters
index
Specifiesanindexnumberforthisentry.Anentrywillautomaticallybe
createdifanunusedindexnumberischosen.Maximumnumberof
entriesis10.Maximumvalueis65535.
channelindex
Specifiesthechanneltowhichthisfilterwillbeapplied.
offsetoffset
(Optional)Specifiesanoffsetfromthebeginningofthepackettolookfor
matches.
statusstatus
(Optional)Specifiespacketstatusbitsthataretobematched.
smasksmask
(Optional)Specifiesthemaskappliedtostatustoindicatewhichbitsare
significant.
snotmasksnotmask
(Optional)Specifiestheinversionmaskthatindicateswhichbitsshould
besetornotset
datadata
(Optional)Specifiesthedatatobematched.
dmaskdmask
(Optional)Specifiesthemaskappliedtodatatoindicatewhichbitsare
significant.
dnotmaskdnotmask
(Optional)Specifiestheinversionmaskthatindicateswhichbitsshould
besetornotset.
owner
(Optional)Specifiesthenameoftheentitythatconfiguredthisentry.
Defaults
Ifownerisnotspecified,itwillbesettomonitor.
Ifnootheroptionsarespecified,none(0)willbeapplied.
15-20
RMON Configuration
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocreateRMONfilter1andapplyittochannel9:
C3(rw)->set rmon filter 1 9 offset 30 data 0a154305 dmask ffffffff
Syntax
clear rmon filter {index index | channel channel}
Parameters
indexindex|
channelchannel
Clearsaspecificfilterentry,orallentriesbelongingtoaspecificchannel.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearRMONfilterentry1:
C3(rw)->clear rmon filter index 1
15-21
Purpose
TodisplayRMONcaptureentries,configure,enable,ordisablecaptureentries,andclearcapture
entries.
Commands
For information about...
Refer to page...
15-22
15-23
15-24
Syntax
show rmon capture [index [nodata]]
Parameters
index
(Optional)Displaysthespecifiedbuffercontrolentryandallcaptured
packetsassociatedwiththatentry.
nodata
(Optional)Displaysonlythebuffercontrolentryspecifiedbyindex.
Defaults
Ifnooptionsarespecified,allbuffercontrolentriesandassociatedcapturedpacketswillbe
displayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayRMONcaptureentriesandassociatedbufferentries:
C3(rw)->show rmon capture
Buf.control= 28062 Channel= 38283
EntryStatus= valid
---------------------------------------------------------FullStatus
avail
FullAction
lock
Captured packets
251
Capture slice
1518
Download size
100
Download offset
0
Max Octet Requested 50000
Max Octet Granted
50000
Start time
1 days 0 hours 51 minutes 15 seconds
15-22
RMON Configuration
Owner
monitor
captureEntry= 1
Buff.control= 28062
-------------------------------------------Pkt ID
9
Pkt time
1 days 0 hours 51 minutes 15 seconds
Pkt Length 93
Pkt status 0
Data:
00 00 5e 00 01 01 00 01 f4 00 7d ce 08 00 45 00
00 4b b4 b9 00 00 40 11 32 5c 0a 15 43 05 86 8d
bf e5 00 a1 0e 2b 00 37 cf ca 30 2d 02 01 00 04
06 70 75 62 6c 69 63 a2 20 02 02 0c 92 02 01 00
02 01 00 30 14 30 12 06 0d 2b 06 01 02 01 10 07
01 01 0b 81 fd 1c 02 01 01 00 11 0b 00
Syntax
set rmon capture index {channel [action {lock}] [slice slice] [loadsize loadsize]
[offset offset] [asksize asksize] [owner owner]}
Parameters
index
Specifiesabuffercontrolentry.
channel
Specifiesthechanneltowhichthiscaptureentrywillbeapplied.
actionlock
(Optional)Specifiestheactionofthebufferwhenitisfullas:
lockPacketswillceasetobeaccepted
sliceslice
(Optional)Specifiesthemaximumoctetsfromeachpackettobesavedin
abuffer.Currently,theonlyvalueallowedis1518.
loadsizeloadsize
(Optional)Specifiesthemaximumoctetsfromeachpackettobe
downloadedfromthebuffer.Thedefaultis100.
offsetoffset
(Optional)Specifiesthefirstoctetfromeachpacketthatwillberetrieved.
asksizeasksize
(Optional)Specifiestherequestedmaximumoctetstobesavedinthis
buffer.Currently,theonlyvalueacceptedis1,whichrequestsasmany
octetsaspossible.
owner
(Optional)Specifiesthenameoftheentitythatconfiguredthisentry.
Defaults
Ifnotspecified,actiondefaultstolock.
Ifnotspecified,offsetdefaultsto0.
Ifnotspecified,asksizedefaultsto1(whichwillrequestasmanyoctetsaspossible).
Ifsliceisnotspecified,1518willbeapplied.
Ifloadsizeisnotspecified,100willbeapplied.
Ifownerisnotspecified,itwillbesettomonitor.
15-23
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocreateRMONcaptureentry1tolistenonchannel628:
C3(rw)->set rmon capture 1 628
Syntax
clear rmon capture index
Parameters
index
Specifiesthecaptureentrytobecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearRMONcaptureentry1:
C3(rw)->clear rmon capture 1
15-24
RMON Configuration
16
DHCP Server Configuration
ThischapterdescribesthecommandstoconfiguretheIPv4DHCPserverfunctionalityona
SecureStackC3switch.
For information about...
Refer to page...
DHCP Overview
16-1
16-3
16-12
DHCP Overview
DynamicHostConfigurationProtocol(DHCP)forIPv4isanetworklayerprotocolthat
implementsautomaticormanualassignmentofIPaddressesandotherconfigurationinformation
toclientdevicesbyservers.ADHCPservermanagesauserconfiguredpoolofIPaddressesfrom
whichitcanmakeassignmentsuponclientrequests.ArelayagentpassesDHCPmessages
betweenclientsandserverswhichareondifferentphysicalsubnets.
DHCP Server
DHCPserverfunctionalityallowstheSecureStackC3switchtoprovidebasicIPconfiguration
informationtoaclientonthenetworkwhorequestssuchinformationusingtheDHCPprotocol.
DHCPprovidesthefollowingmechanismsforIPaddressallocationbyaDHCPserver:
AutomaticDHCPserverassignsanIPaddresstoaclientforalimitedperiodoftime(or
untiltheclientexplicitlyrelinquishestheaddress)fromadefinedpoolofIPaddresses
configuredontheserver.
ManualAclientsIPaddressisassignedbythenetworkadministrator,andDHCPisused
simplytoconveytheassignedaddresstotheclient.Thisismanagedbymeansofstatic
addresspoolsconfiguredontheserver.
TheamountoftimethataparticularIPaddressisvalidforasystemiscalledalease.The
SecureStackC3maintainsaleasedatabasewhichcontainsinformationabouteachassignedIP
16-1
DHCP Overview
address,theMACaddresstowhichitisassigned,theleaseexpiration,andwhethertheaddress
assignmentisdynamic(automatic)orstatic(manual).TheDHCPleasedatabaseisstoredinflash
memory.
InadditiontoassigningIPaddresses,theDHCPservercanalsobeconfiguredtoassignthe
followingtorequestingclients:
Defaultrouter(s)
DNSserver(s)anddomainname
NetBIOSWINSserver(s)andnodename
Bootfile
DHCPoptionsasdefinedbyRFC2132
Note: A total of 16 address pools, dynamic and/or static, and a maximum of 256 addresses for the
entire switch, can be configured on the SecureStack C3.
Configurethesystem(stack)hostportIPaddresswiththesetipaddresscommand.Oncethe
systemsIPaddressisconfigured,thesystemthenknowsabouttheconfiguredsubnet.For
example:
set ip address 192.0.0.50 mask 255.255.255.0
2.
EnableDHCPserverfunctionalityonthesystemwiththesetdhcpenablecommand.
3.
ConfigureanIPaddresspoolfordynamicIPaddressassignment.Theonlyrequiredstepsare
tonamethepoolanddefinethenetworknumberandmaskforthepool.Notethatthepool
hastobeinthesamesubnetandusethesamemaskasthesystemhostportIPaddress.For
example:
set dhcp pool auto-pool network 192.0.0.0 255.255.255.0
AllDHCPclientsservedbythisswitchmustbeinthesameVLANasthesystemshostport.
ThefollowingtasksprovidebasicDHCPserverfunctionalitywhentheDHCPpoolisassociated
witharoutedinterface.
1.
CreateaVLANandaddportstotheVLAN.OnlyDHCPclientsassociatedwiththisVLAN
willbeservedIPaddressesfromtheDHCPaddresspoolassociatedwiththisroutedinterface
(VLAN).Inthisexample,VLAN6iscreatedandportsge.1.1throughge.1.10areaddedto
VLAN6:
set vlan create 6
16-2
2.
CreatearoutedinterfacefortheVLANinrouterconfigurationmode.Inthefollowing
example,anIPaddressisassociatedwithroutedinterfaceVLAN6:
Inrouterconfigurationmode:
interface vlan 6
no shutdown
ip address 6.6.1.1 255.255.0.0
3.
EnableDHCPserverfunctionalityonthesystemwiththesetdhcpenablecommand.
4.
CreatetheDHCPaddresspool.Theonlyrequiredstepsaretonamethepoolanddefinethe
networknumberandmaskforthepool.Notethatthepoolhastobeinthesamesubnetasthe
routedinterfaceandusethesamemaskconfiguredontheroutedinterface.Forexample:
set dhcp pool auto-pool network 6.6.0.0 255.255.0.0
DHCPclientsinVLAN6willbeservedIPaddressesfromthisDHCPaddresspool.
OptionalDHCPservertasksinclude:
Youcanlimitthescopeofaddressesassignedtoapoolfordynamicaddressassignmentwith
thesetdhcpexcludecommand.Upto128nonoverlappingaddressrangescanbeexcluded
ontheSecureStackC3.Forexample:
set dhcp exclude 192.0.0.1 192.0.0.10
Note: The IP address of the systems host port or the routed interface is automatically
excluded.
Configurestaticaddresspoolsformanualaddressassignment.Theonlyrequiredstepsareto
namethepool,configureeitherthehardwareaddressoftheclientortheclientidentifier,and
configuretheIPaddressandmaskforthemanualbinding.Forexample:
set dhcp pool static-pool hardware-address 0011.2233.4455
set dhcp pool static-pool host 192.0.0.200 255.255.255.0
SetotherDHCPserverparameterssuchasthenumberofpingpacketstobesentbefore
assigninganIPaddress,orenablingconflictlogging.
Commands
For information about...
Refer to page...
set dhcp
16-4
16-4
16-5
16-5
16-3
set dhcp
Refer to page...
16-6
16-7
16-7
16-8
16-8
16-9
16-9
16-10
16-10
set dhcp
UsethiscommandtoenableordisabletheDHCPserverfunctionalityontheSecureStackC3.
Syntax
set dhcp {enable | disable}
Parameters
enable|disable
EnablesordisablesDHCPserverfunctionality.Bydefault,DHCPserveris
disabled.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleenablesDHCPserverfunctionality.
C3(rw)->set dhcp enable
Syntax
set dhcp bootp {enable | disable}
Parameters
enable|disable
16-4
EnablesordisablesaddressallocationforBOOTPclients.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleenablesaddressallocationforBOOTPclients.
C3(rw)->set dhcp bootp enable
Syntax
set dhcp conflict logging
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleenablesDHCPconflictlogging.
C3(rw)->set dhcp conflict logging
Syntax
show dhcp conflict [address]
Parameters
address
[Optional]Specifiestheaddressforwhichtodisplayconflictinformation.
Defaults
Ifnoaddressisspecified,conflictinformationforalladdressesisdisplayed.
16-5
Mode
Readonly.
Example
Thisexampledisplaysconflictinformationforalladdresses.Notethatpingistheonlydetection
methodused.
C3(ro)->show dhcp conflict
IP address
----------192.0.0.2
192.0.0.3
192.0.0.4
192.0.0.12
Detection Method
----------------Ping
Ping
Ping
Ping
Detection Time
--------------0 days 19h:01m:23s
0 days 19h:00m:46s
0 days 19h:01m:25s
0 days 19h:01m:26s
Syntax
clear dhcp conflict {logging | ip-address| *}
Parameters
logging
Disablesconflictlogging.
ipaddress
ClearstheconflictinformationforthespecifiedIPaddress.
ClearstheconflictinformationforallIPaddresses.
Defaults
None.
Mode
Switchcommand,readwrite.
Examples
ThisexampledisablesDHCPconflictlogging.
C3(rw)->clear dhcp conflict logging
ThisexampleclearstheconflictinformationfortheIPaddress192.0.0.2.
C3(rw)->clear dhcp conflict 192.0.0.2
16-6
Syntax
set dhcp exclude low-ipaddr [high-ipaddr]
Parameters
lowipaddr
SpecifiesthefirstIPaddressintheaddressrangetobeexcludedfrom
assignment.
highipaddr
(Optional)SpecifiesthelastIPaddressintheaddressrangetobe
excluded.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplefirstconfigurestheaddresspoolnamedauto1with255addressesfortheClassC
network172,20.28.0,withthesetdhcppoolnetworkcommand.Then,theexamplelimitsthe
scopeoftheaddressesthatcanbeassignedbyaDHCPserverbyexcludingaddresses172.20.28.80
100,withthesetdhcpexcludecommand.
C3(rw)->set dhcp pool auto1 network 172.20.28.0 24
C3(rw)->set dhcp exclude 172.20.28.80 172.20.28.100
Syntax
clear dhcp exclude low-ipaddr [high-ipaddr]
Parameters
lowipaddr
SpecifiesthefirstIPaddressintheaddressrangetobecleared.
highipaddr
(Optional)SpecifiesthelastIPaddressintheaddressrangetobecleared.
Defaults
None.
Mode
Switchcommand,readwrite.
16-7
Example
ThisexampleclearsthepreviouslyexcludedrangeofIPaddressesbetween192.168.1.88through
192.168.1.100.
C3(rw)->clear dhcp exclude 192.168.1.88 192.168.1.100
Syntax
set dhcp ping packets number
Parameters
packetsnumber
Specifiesthenumberofpingpacketstobesent.Thevalueofnumbercan
be0,orrangefrom2to10.Entering0disablesthisfunction.Thedefault
valueis2packets.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsthenumberofpingpacketssentto3.
C3(rw)->set dhcp ping packets 3
Syntax
clear dhcp ping packets
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
16-8
Example
Thisexampleresetsthenumberofpingpacketssentbacktothedefaultvalue.
C3(rw)->clear dhcp ping packets
Syntax
show dhcp binding [ip-address]
Parameters
ipaddress
(Optional)SpecifiestheIPaddressforwhichtodisplaybinding
information.
Defaults
IfnoIPaddressisspecified,bindinginformationforalladdressesisdisplayed.
Mode
Readonly.
Example
Thisexampledisplaysbindinginformationaboutalladdresses.
C3(rw)->show dhcp binding
IP address
Hardware Address
--------------------------192.0.0.6
00:33:44:56:22:39
192.0.0.8
00:33:44:56:22:33
192.0.0.10
00:33:44:56:22:34
192.0.0.11
00:33:44:56:22:35
192.0.0.12
00:33:44:56:22:36
192.0.0.13
00:33:44:56:22:37
192.0.0.1400:33:44:56:22:38
Lease Expiration
----------------00:11:02
00:10:22
00:09:11
00:10:05
00:10:30
infinite
infinite
Type
----Automatic
Automatic
Automatic
Automatic
Automatic
Manual
Manual
Syntax
clear dhcp binding {ip-addr | *}
Parameters
ipaddr
SpecifiestheIPaddressforwhichtoclear/deletetheDHCPbinding.
Deletesalladdressbindings.
Defaults
None.
SecureStack C3 Configuration Guide
16-9
Mode
Switchcommand,readwrite.
Example
ThisexampledeletestheDHCPaddressbindingforIPaddress192.168.1.1.
C3(rw)->clear dhcp binding 192.168.1.1
Syntax
show dhcp server statistics
Parameters
None.
Defaults
None.
Mode
Readonly.
Example
Thisexampledisplaysserverstatistics.
C3(ro)->show dhcp server statistics
Automatic Bindings
Expired Bindings
Malformed Bindings
Messages
---------DHCP DISCOVER
DHCP REQUEST
DHCP DECLINE
DHCP RELEASE
DHCP INFORM
36
6
0
Received
---------382
3855
0
67
1
Messages
---------DHCP OFFER
DHCP ACK
DHCP NACK
Syntax
clear dhcp server statistics
16-10
Sent
-----381
727
2
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleclearsallDHCPservercounters.
C3(rw)->clear dhcp server statistics
16-11
ThesubnetoftheIPaddressbeingissuedshouldbeonthesamesubnetastheingress
interface(thatis,thesubnetofthehostIPaddressoftheswitch,orifroutinginterfacesare
configured,thesubnetoftheroutinginterface).
Amanualpoolcanbeconfiguredusingeithertheclientshardwareaddress(setdhcppool
hardwareaddress)ortheclientsclientidentifier(setdhcppoolclientidentifier),butusing
bothisnotrecommended.
IftheincomingDHCPrequestpacketcontainsaclientidentifier,thenamanualpool
configuredwiththatclientidentifiermustexistontheswitchinorderfortherequesttobe
processed.Thehardwareaddressisnotchecked.
Ahardwareaddressandtype(EthernetorIEEE802)configuredinamanualpoolischecked
onlywhenaclientidentifierisnotalsoconfiguredforthepoolandtheincomingDHCP
requestpacketdoesnotincludeaclientidentifieroption.
Purpose
ToconfigureandclearDHCPaddresspoolparameters,andtodisplayaddresspoolconfiguration
information.
Note: A total of 16 address pools, dynamic and/or static, can be configured on the SecureStack C3.
Commands
For information about...
16-12
Refer to page...
16-13
16-14
16-14
16-15
16-15
16-16
16-16
16-17
16-17
16-18
16-19
16-19
16-20
16-20
Refer to page...
16-21
16-21
16-22
16-22
16-23
16-23
16-24
16-24
16-25
16-25
16-26
16-26
16-27
16-27
16-28
16-29
16-29
Syntax
set dhcp pool poolname
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplecreatesanaddresspoolnamedauto1.
C3(rw)->set dhcp pool auto1
16-13
Syntax
clear dhcp pool poolname
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledeletestheaddresspoolnamedauto1.
C3(rw)->clear dhcp pool auto1
Syntax
set dhcp pool poolname network number {mask | prefix-length}
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
number
SpecifiesanIPsubnetfortheaddresspool.
mask
Specifiesthesubnetmaskindottedquadnotation.
prefixlength
Specifiesthesubnetmaskasaninteger.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
UsethiscommandtoconfigureasetofIPaddressestobeassignedbytheDHCPserverusingthe
specifiedaddresspool.Inordertolimitthescopeoftheaddressesconfiguredwiththiscommand,
usethesetdhcpexcludecommandonpage167.
16-14
Examples
ThisexampleconfigurestheIPsubnet172.20.28.0withaprefixlengthof24fortheautomatic
DHCPpoolnamedauto1.Alternatively,themaskcouldhavebeenspecifiedas255.255.255.0.
C3(rw)->set dhcp pool auto1 network 172.20.28.0 24
Thisexamplelimitsthescopeof255addressescreatedfortheClassCnetwork172,20.28.0bythe
previousexample,byexcludingaddresses172.20.28.80100.
C3(rw)->set dhcp exclude 172.20.28.80 172.20.28.100
Syntax
clear dhcp pool poolname network
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledeletesthenetworkandmaskfromtheaddresspoolnamedauto1.
C3(rw)->clear dhcp pool auto1 network
Syntax
set dhcp pool poolname hardware-address hw-addr [type]
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
hwaddr
SpecifiestheMACaddressoftheclientshardwareplatform.Thisvalue
canbeenteredusingdottedhexadecimalnotationorcolons.
type
(Optional)Specifiestheprotocolofthehardwareplatform.Validvalues
are1forEthernetor6forIEEE802.Defaultvalueis1,Ethernet.
16-15
Defaults
Ifnotypeisspecified,Ethernetisassumed.
Mode
Switchcommand,readwrite.
Example
Thisexamplespecifies0001.f401.2710astheEthernetMACaddressforthemanualaddresspool
namedmanual1.Alternatively,theMACaddresscouldhavebeenteredas00:01:f4:01:27:10.
C3(rw)->set dhcp pool manual1 hardware-address 0001.f401.2710
Syntax
clear dhcp pool poolname hardware-address
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledeletestheclienthardwareaddressfromtheaddresspoolnamedmanual1.
C3(rw)->clear dhcp pool manual1 hardware-address
Syntax
set dhcp pool poolname host ip-address [mask | prefix-length]
Parameters
16-16
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
ipaddress
SpecifiestheIPaddressformanualbinding.
mask
(Optional)Specifiesthesubnetmaskindottedquadnotation.
prefixlength
(Optional)Specifiesthesubnetmaskasaninteger.
Defaults
Ifamaskorprefixisnotspecified,theclassA,B,orCnaturalmaskwillbeused.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoconfiguretheminimumrequirementsforamanualbindingaddress
pool.First,thehardwareaddressoftheclientshardwareplatformisconfigured,followedby
configurationoftheaddresstobeassignedtothatclientmanually.
C3(rw)->set dhcp pool manual1 hardware-address 0001.f401.2710
C3(rw)->set dhcp pool manual1 host 15.12.1.99 255.255.248.0
Syntax
clear dhcp pool poolname host
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampledeletesthehostIPaddressfromtheaddresspoolnamedmanual1.
C3(rw)->clear dhcp pool manual1 host
Syntax
set dhcp pool poolname client-identifier id
16-17
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
id
Specifiestheuniqueclientidentifierforthisclient.Thevaluemustbe
enteredinxx:xx:xx:xx:xx:xxformat.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheclientidentifierisformedbyconcatenatingthemediatypeandtheMACaddress.For
example,iftheclienthardwaretypeisEthernetandtheclientMACaddressis00:01:22:33:44:55,
thentheclientidentifierconfiguredwiththiscommandmustbe01:00:01:22:33:44:55.
Example
Thisexampleshowshowtoconfiguretheminimumrequirementsforamanualbindingaddress
pool,usingaclientidentifierratherthanthehardwareaddressoftheclientshardwareplatform.
C3(rw)->set dhcp pool manual2 client-identifier 01:00:01:22:33:44:55
C3(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0
Syntax
clear dhcp pool poolname client-identifier
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledeletestheclientidentifierfromtheaddresspoolnamedmanual1.
C3(rw)->clear dhcp pool manual1 client-identifier
16-18
Syntax
set dhcp pool poolname client-name name
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
name
Specifiesthenametobeassignedtothisclient.Clientnamesmaybeupto
31charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleconfigurestheclientnameappsvr1tothemanualbindingpoolmanual2.
C3(rw)->set dhcp pool manual2 client-identifier 01:22:33:44:55:66
C3(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0
C3(rw)->set dhcp pool manual2 client-name appsvr1
Syntax
clear dhcp pool poolname client-name
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampledeletestheclientnamefromthemanualbindingpoolmanual2.
C3(rw)->clear dhcp pool manual2 client-name
16-19
Syntax
set dhcp pool poolname bootfile filename
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
filename
Specifiesthebootimagefilename.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsthebootimagefilenameforaddresspoolnamedauto1.
C3(rw)->set dhcp pool auto1 bootfile image1.img
Syntax
clear dhcp pool poolname bootfile
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesthebootimagefilenamefromaddresspoolnamedauto1.
C3(rw)->clear dhcp pool auto1 bootfile
16-20
Syntax
set dhcp pool poolname next-server ip-address
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
ipaddress
SpecifiestheIPaddressofthefileservertheDHCPclientshouldcontact
toloadthedefaultbootimage.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplespecifiesthefileserverfromwhichclientsbeingservedbyaddresspoolauto1
shoulddownloadthebootimagefileimage1.img.
C3(rw)->set dhcp pool auto1 bootfile image1.img
C3(rw)->set dhcp pool auto1 next-server 10.1.1.10
Syntax
clear dhcp pool poolname next-server
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesthefileserverfromaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 next-server
16-21
Syntax
set dhcp pool poolname lease {days [hours [minutes]] | infinite}
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
days
Specifiesthenumberofdaysanaddressleasewillremainvalid.Valuecan
rangefrom0to59.
hours
(Optional)Whenadaysvaluehasbeenassigned,specifiesthenumberof
hoursanaddressleasewillremainvalid.Valuecanrangefrom0to1439.
minutes
(Optional)Whenadaysvalueandanhoursvaluehavebeenassigned,
specifiesthenumberofminuteanaddressleasewillremainvalid.Value
canrangefrom0to86399.
infinite
Specifiesthatthedurationoftheleasewillbeunlimited.
Defaults
Ifnoleasetimeisspecified,aleasedurationof1dayisconfigured.
Mode
Switchcommand,readwrite.
Example
Thisexampleconfiguresaleasedurationof12hoursfortheaddresspoolbeingconfigured.Note
thattoconfigurealeasetimelessthanoneday,enter0fordays,thenthenumberofhoursand
minutes.
C3(rw)->set dhcp pool auto1 lease 0 12
Syntax
clear dhcp pool poolname lease
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
Clearstheleasetimeforthisaddresspooltothedefaultvalueofoneday.
16-22
Mode
Switchcommand,readwrite.
Example
Thisexamplerestoresthedefaultleasedurationofonedayforaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 lease
Syntax
set dhcp pool poolname default-router address [address2 ... address8]
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
address
SpecifiestheIPaddressofadefaultrouter.
address2...address8
(Optional)Specifies,inorderofpreference,upto7additionaldefault
routeraddresses.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleassignsadefaultrouterat10.10.10.1totheaddresspoolnamedauto1.
C3(rw)->set dhcp pool auto1 default-router 10.10.10.1
Syntax
clear dhcp pool poolname default-router
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
16-23
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesthedefaultrouterfromtheaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 default-router
Syntax
set dhcp pool poolname dns-server address [address2 ... address8]
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
address
SpecifiestheIPaddressofaDNSserver.
address2...address8
(Optional)Specifies,inorderofpreference,upto7additionalDNS
serveraddresses.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleassignsaDNSserverat10.14.10.1totheaddresspoolauto1.
C3(rw)->set dhcp pool auto1 dns-server 10.14.10.1
Syntax
clear dhcp pool poolname dns-server
Parameters
poolname
Defaults
None.
16-24
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Mode
Switchcommand,readwrite.
Example
ThisexampleremovestheDNSserverlistfromtheaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 dns-server
Syntax
set dhcp pool poolname domain-name domain
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
domain
Specifiesthedomainnamestring.Thedomainnamecanbeupto255
charactersinlength.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleassignsthemycompany.comdomainnametotheaddresspoolauto1.
C3(rw)->set dhcp pool auto1 domain-name mycompany.com
Syntax
clear dhcp pool poolname domain-name
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
16-25
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesthedomainnamefromtheaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 domain-name
Syntax
set dhcp pool poolname netbios-name-server address [address2 ... address8]
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
address
SpecifiestheIPaddressofaNetBIOSnameserver.
address2...address8
(Optional)Specifies,inorderofpreference,upto7additionalNetBIOS
nameserveraddresses.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleassignsaNetBIOSnameserverat10.15.10.1totheaddresspoolbeingconfigured.
C3(rw)->set dhcp pool auto1 netbios-name-server 10.15.10.1
Parameters
poolname
Defaults
None.
16-26
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Mode
Switchcommand,readwrite.
Example
ThisexampleremovestheNetBIOSnameserverlistfromtheaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 netbios-name-server
Syntax
set dhcp pool poolname netbios-node-type {b-node | h-node | p-node | m-node}
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
bnode
SpecifiestheNetBIOsnodetypetobebroadcast(noWINS).
hnode
SpecifiestheNetBIOsnodetypetobehybrid(WINS,thenbroadcast).
pnode
SpecifiestheNetBIOsnodetypetobepeer(WINSonly).
mnode
SpecifiestheNetBIOsnodetypetobemixed(broadcast,thenWINS).
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexamplespecifieshybridastheNetBIOSnodetypefortheaddresspoolauto1.
C3(rw)->set dhcp pool auto1 netbios-node-type h-node
Syntax
clear dhcp pool poolname netbios-node-type
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
16-27
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleremovestheNetBIOSnodetypefromtheaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 netbios-node-type
Syntax
set dhcp pool poolname option code {ascii string | hex string-list | ip addresslist}
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
code
SpecifiestheDHCPoptioncode,asdefinedinRFC2132.Valuecanrange
from1to254.
asciistring
SpecifiesthedatainASCIIformat.AnASCIIcharacterstringcontaininga
spacemustbeenclosedinquotations.
hexstringlist
SpecifiesthedatainHEXformat.Upto8HEXstringscanbeentered.
ipaddresslist
SpecifiesthedatainIPaddressformat.Upto8IPaddressescanbeentered.
Defaults
None.
Mode
Switchcommand,readwrite.
Examples
ThisexampleconfiguresDHCPoption19,whichspecifieswhethertheclientshouldconfigureits
IPlayerforpacketforwarding.Inthiscase,IPforwardingisenabledwiththe01value.
C3(rw)->set dhcp pool auto1 option 19 hex 01
ThisexampleconfiguresDHCPoption72,whichassignsoneormoreWebserversforDHCP
clients.Inthiscase,twoWebserveraddressesareconfigured.
C3(rw)->set dhcp pool auto1 option 72 ip 168.24.3.252 168.24.3.253
16-28
Syntax
clear dhcp pool poolname option code
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
code
SpecifiestheDHCPoptioncode,asdefinedinRFC2132.Valuecanrange
from1to254.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesoption19fromaddresspoolauto1.
C3(rw)->clear dhcp pool auto1 option 19
Syntax
show dhcp pool configuration {poolname | all}
Parameters
poolname
Specifiesthenameoftheaddresspool.Poolnamesmaybeupto31
charactersinlength.
Defaults
None.
Mode
Readonly.
Example
Thisexampledisplaysconfigurationinformationforalladdresspools.
C3(rw)->show dhcp pool configuration all
Pool: Atg_Pool
Pool Type
Dynamic
16-29
16-30
Network
Lease Time
Default Routers
192.0.0.0 255.255.255.0
1 days 0 hrs 0 mins
192.0.0.1
Pool: static1
Pool Type
Client Name
Client Identifier
Host
Lease Time
Option
Manual
appsvr1
01:00:01:f4:01:27:10
10.1.1.1 255.0.0.0
infinite
19 hex 01
Pool: static2
Pool Type
Hardware Address
Hardware Address Type
Host
Lease Time
Manual
00:01:f4:01:27:10
ieee802
192.168.10.1 255.255.255.0
infinite
17
DHCP Snooping and
Dynamic ARP Inspection
Thischapterdescribestwosecurityfeatures:
DHCPsnooping,whichmonitorsDHCPmessagesbetweenaDHCPclientandDHCPserver
tofilterharmfulDHCPmessagesandtobuildadatabaseofauthorizedaddressbindings
DynamicARPinspection,whichusesthebindingsdatabasecreatedbytheDHCPsnooping
featuretorejectinvalidandmaliciousARPpackets
Refer to page...
17-1
17-4
17-15
17-20
DHCPpacketsfromaDHCPserver(DHCPOFFER,DHCPACK,DHCPNAK)aredroppedif
receivedonanuntrustedport.
DHCPRELEASEandDHCPDECLINEmessagesaredroppediftheyareforaMACaddress
inthesnoopingdatabasebutthebindingsinterfaceinthedatabaseisdifferentfromthe
interfacewherethemessagewasreceived.
Onuntrustedinterfaces,theswitchdropsDHCPpacketswhosesourceMACaddressdoesnot
matchtheclienthardwareaddress.Thisfeatureisaconfigurableoption.
17-1
thehardwareforwardsclientmessagesandcopiesservermessagestotheCPUsoDHCPsnooping
canlearnthebinding.
TheDHCPsnoopingapplicationprocessesincomingDHCPmessages.ForDHCPRELEASEand
DHCPDECLINEmessages,theapplicationcomparesthereceiveinterfaceandVLANwiththe
clientsinterfaceandVLANinthebindingsdatabase.Iftheinterfacesdonotmatch,the
applicationlogstheeventanddropsthemessage.Forvalidclientmessages,DHCPsnooping
comparesthesourceMACaddresstotheDHCPclienthardwareaddress.Wherethereisa
mismatch,DHCPsnoopinglogsanddropsthepacket.Youcandisablethisfeatureusingtheset
dhcpsnoopingverifymacaddressdisablecommand.
Note: If the switch has been configured as a DHCP relay agent, to forward client requests to a
DHCP server that does not reside on the same broadcast domain as the client, MAC address
verification should be disabled in order to allow DHCP RELEASE packets to be processed by the
DHCP snooping functionality and client bindings removed from the bindings database.
DHCPsnoopingcanbeconfiguredonswitchingVLANsandroutingVLANs.WhenaDHCP
packetisreceivedonaroutingVLAN,theDHCPsnoopingapplicationappliesitsfilteringrules
andupdatesthebindingsdatabase.Ifaclientmessagepassesfilteringrules,themessageisplaced
intothesoftwareforwardingpath,whereitmaybeprocessedbytheDHCPrelayagent,thelocal
DHCPserver,orforwardedasanIPpacket.
DHCPsnoopingforwardsvalidDHCPclientmessagesreceivedonnonroutingVLANs.The
messageisforwardedonalltrustedinterfacesintheVLAN.IfaDHCPrelayagentorlocalDHCP
servercoexistwiththeDHCPsnoopingfeature,DHCPclientmessageswillbesenttotheDHCP
relayagentorlocalDHCPservertoprocessfurther.
TheDHCPsnoopingapplicationdoesnotforwardservermessagessincetheyareforwardedin
hardware.
ClientMACaddress
ClientIPaddress
Timewhenclientsleaseexpires
ClientVLANID
Clientport
DHCPsnoopingcreatesatentativebindingfromDHCPDISCOVERandREQUESTmessages.
Tentativebindingstieaclienttoaport(theportwheretheDHCPclientmessagewasreceived).
TentativebindingsarecompletedwhenDHCPsnoopinglearnstheclientsIPaddressfroma
DHCPACKmessageonatrustedport.DHCPsnoopingremovesbindingsinresponseto
DECLINE,RELEASE,andNACKmessages.TheDHCPsnoopingapplicationignorestheACK
messagessentinreplytotheDHCPInformmessagesreceivedontrustedports.Youcanalso
enterstaticbindingsintothebindingsdatabase.
Whenaswitchlearnsofnewbindingsorwhenitlosesbindings,theswitchimmediatelyupdates
theentriesinthedatabase.
Iftheabsoluteleasetimeofasnoopingdatabaseentryexpires,thenthatentrywillberemoved.
Careshouldbetakentoensurethatsystemtimeisconsistentacrossthereboots.Otherwise,
snoopingentrieswillnotexpireproperly.IfahostsendsaDHCPRELEASEmessagewhilethe
17-2
switchisrebooting,whentheswitchreceivesaDHCPDISCOVERYorREQUESTmessage,the
clientsbindingwillgotoatentativebindingstate.
Rate Limiting
ToprotecttheswitchagainstDHCPattackswhenDHCPsnoopingisenabled,thesnooping
applicationenforcesaratelimitforDHCPpacketsreceivedonuntrustedinterfaces.DHCP
snoopingmonitorsthereceiverateoneachinterfaceseparately.Ifthereceiverateexceedsa
configurablelimit,DHCPsnoopingbringsdowntheinterface.Usethesetportenablecommand
toreenabletheinterface.Boththerateandtheburstintervalcanbeconfigured.
Basic Configuration
Thefollowingconfigurationproceduredoesnotchangethewritedelaytothesnoopingdatabase
oranyofthedefaultratelimitingvalues.Additionalconfigurationnotesfollowthisprocedure.
Procedure 17-1
Step
Task
Command(s)
1.
2.
3.
4.
5.
Configuration Notes
DHCP Server
Whentheswitchisoperatinginswitchmode,thentheDHCPserverandDHCPclientsmust
beinthesameVLAN.
Iftheswitchisinroutingmode(onthoseplatformsthatsupportrouting),thentheDCHP
servercanberemotelyconnectedtoaroutinginterface,orrunninglocally.
IftheDHCPserverisremotelyconnected,thentheuseofanIPhelperaddressisrequiredand
MACaddressverificationshouldbedisabled(setdhcpsnoopingverifymacaddress
disable).
TheDHCPservermustuseScopesinordertoprovidetheIPaddressesperVLAN.
DHCPsnoopingmustbeenabledontheinterfaceswheretheDHCPclientsareconnected,
andtheinterfacesmustbeuntrustedDHCPsnoopingports.
TheroutinginterfacethatisconnectedtotheDHCPservermustbeenabledforDHCP
snoopingandmustbeatrustedDHCPsnoopingport.
17-3
Refer to page...
set dhcpsnooping
17-4
17-5
17-5
17-6
17-7
17-7
17-8
17-9
show dhcpsnooping
17-10
17-11
17-11
17-12
17-13
17-14
17-14
17-14
17-15
set dhcpsnooping
UsethiscommandtoenableordisableDHCPsnoopingglobally.
Syntax
set dhcpsnooping {enable | disable}
Parameters
enable
EnableDHCPsnoopinggloballyontheswitch.
disable
DisableDHCPsnoopinggloballyontheswitch.
Defaults
Disabledglobally.
Mode
Switchcommand,readwrite.
Usage
Bydefault,DHCPsnoopingisdisabledgloballyandonallVLANs.Youmustenableitglobally
withthiscommand,andthenenableitonspecificVLANs.
17-4
Example
ThefollowingexampleenablesDHCPsnoopingglobally.
C3(rw)->set dhcpsnooping enable
Syntax
set dhcpsnooping vlan vlan-range {enable | disable}
Parameters
vlanrange
SpecifiestheVLANorrangeofVLANsonwhichDHCPsnoopingisto
beenabledordisabled.
enable|disable
EnablesordisablesDHCPsnoopingforthespecifiedVLANs.
Defaults
DHCPsnoopingisdisabledbydefaultonallVLANs.
Mode
Switchcommand,readwrite.
Usage
Bydefault,DHCPsnoopingisdisabledgloballyandonallVLANs.Youmustenableitglobally
withthesetdhcpsnoopingcommand,andthenenableitonspecificVLANswiththiscommand.
Example
ThisexampleenablesDHCPsnoopingonVLANS10through20.
C3(rw)->set dhcpsnooping vlan 10-20 enable
Syntax
set dhcpsnooping database write-delay seconds
Parameters
second
Specifytheintervalinsecondsbetweenupdatestothestoredbindings
database.Thevaluecanrangefrom15to86400seconds.
Defaults
Every5minutes(300seconds).
17-5
Mode
Switchcommand,readwrite.
Usage
Whenaswitchlearnsofnewbindingsorwhenitlosesbindings,theswitchupdatestheentriesin
thebindingsdatabaseaccordingtothewritedelaytimer.Theswitchalsoupdatestheentriesin
thebindingfile.Thefrequencyatwhichthefileisupdatedisbasedonthedelayconfiguredwith
thiscommand,andtheupdatesarebatched.
Example
Thefollowingexamplespecifiesthatthestoreddatabaseshouldbeupdatedonceanhour.
C3(rw)->set dhcpsnooping database write-delay 3600
Syntax
set dhcpsnooping trust port port-string {enable | disable}
Parameters
portportstring
Specifiestheportorportstobeenabledordisabledastrustedports.The
portscanbephysicalportsorLAGsthataremembersofaVLAN.
enable|disable
Enablesordisablesthespecifiedportsastrustedports.
Defaults
Bydefault,portsareuntrusted.
Mode
Switchcommand,readwrite.
Usage
InorderforDHCPsnoopingtooperate,snoopinghastobeenabledgloballyandonspecific
VLANs,andtheportswithintheVLANshavetobeconfiguredastrustedoruntrusted.On
trustedports,DHCPclientmessagesareforwardeddirectlybythehardware.Onuntrustedports,
clientmessagesaregiventotheDHCPsnoopingapplication.
TheDHCPsnoopingapplicationbuildsthebindingsdatabasefromclientmessagesreceivedon
untrustedports.DHCPsnoopingcreatesatentativebindingfromDHCPDISCOVERand
REQUESTmessages.Tentativebindingstieaclienttotheportonwhichthemessagepacketwas
received.TentativebindingsarecompletedwhenDHCPsnoopinglearnstheclientsIPaddress
fromaDHCPACKmessageonatrustedport.
TheportsontheswitchthroughwhichDHCPserversarereachedmustbeconfiguredastrusted
portssothatpacketsreceivedfromthoseportswillbeforwardedtoclients.DCHPpacketsfroma
DHCPserver(DHCPOFFER,DHCPACK,DHCPNAK)aredroppedifreceivedonanuntrusted
port.
17-6
Example
Thisexampleconfiguresportge.1.1asatrustedport.
C3(rw)->set dhcpsnooping trust port ge.1.1 enable
Syntax
set dhcpsnooping binding mac-address vlan vlan-id ipaddr port port-string
Parameters
macaddress
SpecifiestheMACaddressofthebindingentry.
vlanvlanid
SpecifiestheVLANofthebindingentry.
ipaddr
SpecifiestheIPaddressofthebindingentry.
portportstring
Specifiestheportofthebindingentry.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
WhenenabledgloballyandonVLANs,DHCPsnoopingbuildsitsbindingsdatabasefromDHCP
clientmessagesreceivedonuntrustedports.Suchentriesinthedatabasearedynamicentries
whichwillberemovedinresponsetovalidDECLINE,RELEASE,andNACKmessagesorwhen
theabsoluteleasetimeoftheentryexpires.
Youcanaddstaticentriestothebindingsdatabasewiththiscommand.
Example
Thisexamplecreatesastaticentry,associatingMACaddress00:01:02:33:44:55withIPaddress
192.168.10.10andVLAN10,portge.1.1.
C3(rw)->set dhcpsnooping binding 00:01:02:33:44:55 vlan 10 192.168.10.10 port
ge.1.1
Syntax
set dhcpsnooping verify mac-address {enable | disable}
17-7
Parameters
enable
EnablesverificationofthesourceMACaddressinclientmessages
againsttheclienthardwareaddress.
disable
DisablesverificationofthesourceMACaddressinclientmessages
againsttheclienthardwareaddress.
Defaults
SourceMACaddressverificationisenabledbydefault.
Mode
Switchcommand,readwrite.
Usage
Whenthisverificationisenabled,theDHCPsnoopingapplicationcomparesthesourceMAC
addresscontainedinvalidclientmessageswiththeclientshardwareaddress.Ifthereisa
mismatch,DHCPsnoopinglogstheeventanddropsthepacket.
Usetheshowdhcpsnoopingcommandtodisplaythestatus(enabledordisabled)ofsourceMAC
addressverificationforeachinterfaceinanenabledVLAN.Theshowdhcpsnoopingstatistics
commandshowstheactualnumberofMACverificationerrorsthatoccurredonuntrustedports.
Example
ThisexampledisablessourceMACaddressverificationandlogging.
C3(rw)->set dhcpsnooping verify mac-address disable
Syntax
set dhcpsnooping log-invalid port port-string {enable | disable}
Parameters
portportstring
Specifiestheportorportsonwhichtoenableordisableloggingof
invalidpackets.
enable|disable
Enablesordisablesloggingonthespecifiedports.
Defaults
Disabled.
Mode
Switchcommand,readwrite.
Usage
TheDHCPsnoopingapplicationprocessesincomingDHCPmessages.ForDHCPRELEASEand
DHCPDECLINEmessages,theapplicationcomparesthereceiveinterfaceandVLANwiththe
17-8
clientsinterfaceandVLANinthebindingsdatabase.Iftheinterfacesdonotmatch,the
applicationlogstheeventiflogginghasbeenenabled.
Usetheshowdhcpsnoopingcommandtodisplaythestatus(enabledordisabled)oflogging
invalidpacketsforeachinterfaceinanenabledVLAN.Theshowdhcpsnoopingstatistics
commandshowstheactualnumberofservermessagesreceivedonuntrustedports.
Example
ThisexampleenablesloggingofinvalidDHCPmessagesonportge.1.1andthendisplaysthe
DHCPconfigurationsettings.
C3(rw)->set dhcpsnooping log invalid port ge.1.1 enable
C3(su)->show dhcpsnooping
DHCP snooping is Disabled
DHCP snooping source MAC verification is enabled
DHCP snooping is enabled on the following VLANs:
3
Interface
Trusted
-----------
----------
----------------
ge.1.1
No
Yes
ge.1.2
No
No
ge.1.3
Yes
No
Syntax
set dhcpsnooping limit port-string {none | rate pps {burst interval secs]}
Parameters
portstring
Specifiestheportorportstowhichtoapplytheseratelimiting
parameters.
none
ConfiguresnolimitonincomingDHCPpackets.
ratepps
Specifiesaratelimitinpacketspersecond.Thevalueofppscanrange
from0to100packetspersecond.
burstintervalsecs
Specifiesaburstintervalinseconds.Thevalueofsecscanrangefrom1
to15seconds.
Defaults
Rate=15packetspersecond
BurstInterval=1second
Mode
Switchcommand,readwrite.
17-9
show dhcpsnooping
Usage
ToprotecttheswitchfromDHCPattackswhenDHCPsnoopingisenabled,thesnooping
applicationenforcesaratelimitforDHCPpacketsreceivedonuntrustedinterfaces.DHCP
snoopingmonitorsthereceiverateoneachinterfaceseparately.Ifthereceiverateexceedsthe
configuredlimit,DHCPsnoopingbringsdowntheinterface.Youcanreenabletheinterfacewith
thesetportenablecommand.Boththerateandtheburstintervalcanbeconfigured.
Youcandisplaythecurrentlyconfiguredratelimitparameterswiththeshowdhcpsnoopingport
command.
Example
Thisexampleconfiguresratelimitparametersonportge.1.1.
C3(rw)->set dhcpsnooping limit ge.1.1 rate 20 burst interval 2
C3(rw)->show dhcpsnooping port ge.1.1
Interface
Trust State
Rate Limit
Burst Interval
(pps)
(seconds)
----------
-------------
-------------
---------------
ge.1.1
No
20
show dhcpsnooping
UsethiscommandtodisplayDHCPsnoopingconfigurationparameters.
Syntax
show dhcpsnooping
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thiscommanddisplaysthestatus(enabledordisabled)ofDHCPsnoopingglobally,liststhe
VLANsonwhichDHCPsnoopingisenabled,displayswhethersourceMACaddressverification
isenabledordisabled,andforportsthatareenabledforsnooping,displayswhethertheyare
trustedoruntrustedandwhetherloggingofinvalidpacketshasbeenenabled.
Example
Thisexampleshowstheoutputoftheshowdhcpsnoopingcommand.
C3(su)->show dhcpsnooping
DHCP snooping is Enabled
DHCP snooping source MAC verification is enabled
DHCP snooping is enabled on the following VLANs:
17-10
Interface
Trusted
-----------
----------
----------------
ge.1.47
Yes
No
ge.1.48
No
No
lag.0.1
No
No
Syntax
show dhcpsnooping database
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thiscommanddisplayswherethedatabasefileisstored(locally)andwhatthewritedelayvalue
is.
Example
Thisexampleshowstheoutputoftheshowdhcpsnoopingdatabasecommand.
C3(su)->show dhcpsnooping database
agent url:
local
write-delay:
300
Syntax
show dhcpsnooping port port-string
Parameters
portstring
Specifiestheportorportsforwhichtodisplayconfiguration
information.
17-11
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thiscommanddisplaysthetruststateandratelimitingparametersconfiguredonthespecified
ports.
Example
Thisexampleshowstheoutputoftheshowdhcpsnoopingportcommand.
C3(su)->show dhcpsnooping port ge.1.1
Interface
Trust State
Rate Limit
----------
-------------
-------------
---------------
ge.1.1
No
20
(pps)
Burst Interval
(seconds)
Syntax
show dhcpsnooping binding [dynamic | static] [port port-string] [vlan vlan-id]
Parameters
dynamic|static
(Optional)Limitsthedisplayofbindingsinthedatabasebytypeof
entry,eitherdynamicorstatic.
portportstring
(Optional)Limitsthedisplayofbindingsinthedatabasebyport.
vlanvlanid
(Optional)LimitsthedisplayofbindingsinthedatabasebyVLANid.
Defaults
Ifnoparametersareentered,allbindingsinthedatabasearedisplayed.
Mode
Switchcommand,readwrite.
Usage
ThiscommanddisplaysinformationabouttheDHCPbindingsintheDHCPsnoopingdatabase.
Example
Thisexampleshowstheoutputoftheshowdhcpsnoopingbindingcommandwhenno
parametersareentered.
C3(su)->show dhcpsnooping binding
Total number of bindings:
17-12
MAC Address
IP Address
VLAN
Interface
Type
Lease (min)
-----------
-----------------
---------------
----
-----------
-------
00:02:B3:06:60:80
192.168.10.10
ge.1.1
STATIC
00:0F:FE:00:13:04
192.168.20.1
ge.1.30
DYNAMIC
1440
Syntax
show dhcpsnooping statistics
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
TheDHCPsnoopingapplicationprocessesincomingDHCPmessagesonenableduntrusted
interfaces.ForDHCPRELEASEandDHCPDECLINEmessages,theapplicationcomparesthe
receiveinterfaceandVLANwiththeclientsinterfaceandVLANinthebindingsdatabase.Ifthe
interfacesdonotmatch,theapplicationlogstheevent(ifloggingofinvalidmessagesisenabled)
anddropsthemessage.IfsourceMACverificationisenabled,forvalidclientmessages,DHCP
snoopingcomparesthesourceMACaddresstotheDHCPclienthardwareaddress.Wherethereis
amismatch,DHCPsnoopinglogsanddropsthepacket.
Thiscommanddisplays,foreachenableduntrustedinterface,thenumberofsourceMAC
verificationfailuresandclientinterfacemismatchesthatoccurredsincethelasttimethese
statisticswerecleared.
SinceDHCPserversshouldnotbeconnectedthroughanuntrustedport,theDHCPsnooping
applicationwilldropincomingDHCPservermessagesonuntrustedinterfacesandincrementa
counterthatisdisplayedwiththiscommand.
Example
Thisexampleshowstheoutputoftheshowdhcpsnoopingstatisticscommand.
C3(su)->show dhcpsnooping statistics
Interface
-----------
MAC Verify
Client Ifc
DHCP Server
Failures
Mismatch
Msgs Rec'd
----------
----------
-----------
ge.1.48
lag.0.1
17-13
Syntax
clear dhcpsnooping binding [port port-string | mac mac-addr]
Parameters
portportstring
(Optional)Specifiestheentryorentriestoremovebyportidentifier.
macmacaddr
(Optional)SpecifiestheentrytoremovebyMACaddress.
Defaults
Ifnoparametersareentered,allbindings(staticanddynamic)areremoved.
Mode
Switchcommand,readwrite.
Example
Thisexampleclearsthestaticbindingentrythatincludesportge.1.2.
C3(su)->clear dhcpsnooping binding port ge.1.2
Syntax
clear dhcpsnooping statistics
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleclearstheDHCPsnoopingstatisticscountersforallenableduntrustedports.
C3(su)->clear dhcpsnooping statistics
17-14
Syntax
clear dhcpsnooping database [write-delay]
Parameters
writedelay
(Optional)Specifiesthatthewritedelayvalueshouldbereturnedtothe
defaultvalueof300seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Thiscommandwillsetthedatabasewritedelayvaluetothedefaultof300seconds.
Example
Thisexamplesetsthedatabasestoragelocationtothedefaultoflocal.
C3(su)->clear dhcpsnooping database
Syntax
clear dhcpsnooping limit port-string
Parameters
portstring
Specifiestheportorportstowhichthiscommandapplies.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleresetstheratelimitvaluestotheirdefaultsonportge.1.1.
C3(su)->clear dhcpsnooping limit ge.1.1
17-15
interceptstrafficforotherstationsbypoisoningtheARPcachesofitsunsuspectingneighbors.
ARPpoisoningisatacticwhereanattackerinjectsfalseARPpacketsintothesubnet,normallyby
broadcastingARPresponsesinwhichtheattackerclaimstobesomeoneelse.Bypoisoningthe
ARPcache,amalicioususercaninterceptthetrafficintendedforotherhostsonthenetwork.
TheDynamicARPInspectionapplicationperformsARPpacketvalidation.WhenDAIisenabled,
itverifiesthatthesenderMACaddressandthesourceIPaddressareavalidpairintheDHCP
snoopingbindingdatabaseanddropsARPpacketswhosesenderMACaddressandsenderIP
addressdonotmatchanentryinthedatabase.AdditionalARPpacketvalidationcanbe
configured.
IfDHCPsnoopingisdisabledontheingressVLANorthereceiveinterfaceistrustedforDHCP
snooping,ARPpacketsaredropped.
Functional Description
DAIisenabledonVLANs,effectivelyenablingDAIontheinterfaces(physicalportsorLAGs)that
aremembersofthatVLAN.Individualinterfacesareconfiguredastrustedoruntrusted.Thetrust
configurationforDAIisindependentofthetrustconfigurationforDHCPsnooping.Atrusted
portisaportthenetworkadministratordoesnotconsidertobeasecuritythreat.Anuntrusted
portisonewhichcouldpotentiallybeusedtolaunchanetworkattack.
DAIconsidersallphysicalportsandLAGsuntrustedbydefault.
Static Mappings
StaticmappingsareusefulwhenhostsconfigurestaticIPaddresses,DHCPsnoopingcannotbe
run,orotherswitchesinthenetworkdonotrundynamicARPinspection.Astaticmapping
associatesanIPaddresstoaMACaddressonaVLAN.DAIconsultsitsstaticmappingsbeforeit
consultsDHCPsnoopingthus,staticmappingshaveprecedenceoverDHCPsnooping
bindings.
ARPACLsareusedtodefinestaticmappingsforDAI.Inthisimplementation,onlythesubsetof
ARPACLsyntaxrequiredforDAIissupported.ARPACLsarecompletelyindependentofACLs
usedforQoS.Amaximumof100ARPACLscanbeconfigured.WithinanACL,amaximumof20
rulescanbeconfigured.
17-16
0.0.0.0
255.255.255.255
AllIPmulticastaddresses
AllclassEaddresses(240.0.0.0/4)
Loopbackaddresses(intherange127.0.0.0/8)
Packet Forwarding
DAIforwardsvalidARPpacketswhosedestinationMACaddressisnotlocal.TheingressVLAN
couldbeaswitchingorroutingVLAN.ARPrequestsarefloodedintheVLAN.ARPresponsesare
unicasttowardtheirdestination.DAIqueriestheMACaddresstabletodeterminetheoutgoing
port.IfthedestinationMACaddressislocal,DAIgivesvalidARPpacketstotheARPapplication.
Rate Limiting
ToprotecttheswitchfromDHCPattackswhenDAIisenabled,theDAIapplicationenforcesarate
limitforARPpacketsreceivedonuntrustedinterfaces.DAImonitorsthereceiverateoneach
interfaceseparately.Ifthereceiverateexceedsaconfigurablelimit,DAIerrordisablesthe
interface,whicheffectivelybringsdowntheinterface.Youcanusethesetportenablecommand
toreenabletheport.
Youcanconfigureboththerateandtheburstinterval.Thedefaultrateis15ppsoneachuntrusted
interfacewitharangeof0to100pps.Thedefaultburstintervalis1secondwitharangeto1to15
seconds..TheratelimitcannotbesetontrustedinterfacessinceARPpacketsreceivedontrusted
interfacesdonotcometotheCPU.
Eligible Interfaces
DynamicARPinspectionisenabledperVLAN,effectivelyenablingDAIonthemembersofthe
VLAN,eitherphysicalportsorLAGs.TrustisspecifiedontheVLANmembers.
DAIcannotbeenabledonportbasedroutinginterfaces.Itmaybeconnectedto:
Asinglehostthroughatrustedlink(forexample,aserver)
Ifmultiplehostsneedtoconnected,theremustbeaswitchbetweentherouterandthehosts,
withDAIenabledonthatswitch
DAIreliesontheDHCPsnoopingapplicationtoverifythata{IPaddress,MACaddress,
VLAN,interface}tupleisvalid.
DAIregisterswithdot1qtoreceivenotificationofVLANmembershipchangesfortheVLANs
whereDAIisenabled.
DAItellsthedriverabouteachuntrustedinterface(physicalportorLAG)whereDAIis
enabledsothatthehardwarewillinterceptARPpacketsandsendthemtotheCPU.
17-17
Basic Configuration
Thefollowingbasicconfigurationdoesnotchangethedefaultratelimitingparameters.
Procedure 17-2
Step
Task
Command(s)
1.
2.
3.
4.
5.
17-18
Example Configuration
T
ThefollowingexampleconfiguresDHCPsnoopinganddynamicARPinspectioninarouting
environmentusingRIP.Theexampleconfigurestwointerfacesontheswitch,configuringRIPon
bothinterfaces,assigningeachtoadifferentVLAN,andthenenablingDHCPsnoopingand
dynamicARPinspectiononthem:
Interfacege.1.1,whichisconnectedtoaremoteDHCPserver,onVLAN192
Interfacege.1.2,whichisconnectedtoDHCPclients,onVLAN10
Inaddition,thedefaultVLAN,VLAN1,isalsoenabledforDHCPsnoopinganddynamicARP
inspection.
SincetheDHCPserverisremote,theswitchhasbeenconfiguredasaDHCPrelayagent(withthe
iphelperaddresscommand),toforwardclientrequeststotheDHCPserver.Therefore,MAC
addressverificationisdisabled(withthesetdhcpsnoopingverifymacaddressdisable
command)inordertoallowDHCPRELEASEpacketstobeprocessedbytheDHCPsnooping
functionalityandclientbindingsremovedfromthebindingsdatabase
Router Configuration
router
enable
configure
interface vlan 10
no shutdown
ip address 10.2.0.1 255.255.0.0
ip helper-address 192.168.0.200
ip rip send version 2
ip rip receive version 2
ip rip enable
exit
VLAN Configuration
set vlan create 10
set vlan create 192
clear vlan egress 1 ge.1.1-2
17-19
enable
Refer to page...
17-20
17-21
17-22
17-23
17-24
17-24
17-25
17-26
17-26
17-27
17-28
17-29
17-30
17-31
Syntax
set arpinspection vlan vlan-range [logging]
17-20
Parameters
vlanrange
SpecifiestheVLANorrangeofVLANsonwhichtoenabledynamic
ARPinspection.
logging
(Optional)EnablesloggingofinvalidARPpacketsforthatVLAN.
Defaults
Loggingisdisabledbydefault.
Mode
Switchcommand,readwrite.
Usage
ThiscommandenablesdynamicARPinspection(DAI)ononeormoreVLANs.WhenDAIis
enabledonaVLAN,DAIiseffectivelyenabledontheinterfaces(physicalportsorLAGs)thatare
membersofthatVLAN.
DAIusestheDHCPsnoopingbindingsdatabasetoverifythatthesenderMACaddressandthe
sourceIPaddressareavalidpairinthedatabase.ARPpacketswhosesenderMACaddressand
senderIPaddressdonotmatchanentryinthedatabasearedropped.
Ifloggingisenabled,invalidARPpacketsarealsologged.
Example
ThisexampleenablesDAIonVLANs2through5andalsoenablesloggingofinvalidARPpackets
onthoseVLANs.
C3(su)->set arpinspection vlan 2-5 logging
Syntax
set arpinspection trust port port-string {enable | disable}
Parameters
portstring
SpecifiestheportorportstobeenabledordisabledasDAItrusted
ports.TheportscanbephysicalportsorLAGsthataremembersofa
VLAN.
enable|disable
EnablesordisablesthespecifiedportsastrustedforDAI.
Defaults
Bydefault,allphysicalportsandLAGsareuntrusted.
Mode
Switchcommand,readwrite.
17-21
Usage
Individualinterfacesareconfiguredastrustedoruntrusted.ThetrustconfigurationforDAIis
independentofthetrustconfigurationforDHCPsnooping.Atrustedportisaportthenetwork
administratordoesnotconsidertobeasecuritythreat.Anuntrustedportisonewhichcould
potentiallybeusedtolaunchanetworkattack.
DAIconsidersallphysicalportsandLAGsuntrustedbydefault.Packetsarrivingontrusted
interfacesbypassallDAIvalidationchecks.
Example
Thisexampleenablesportge.1.1astrustedforDAI.
C3(su)->set arpinspection trust port ge.1.1 enable
Syntax
set arpinspection validate {[src-mac] [dst-mac] [ip]}
Parameters
srcmac
SpecifiesthatDAIshouldverifythatthesenderMACaddressequals
thesourceMACaddressintheEthernetheader.
dstmac
SpecifiesthatDAIshouldverifythatthetargetMACaddressequalsthe
destinationMACaddressintheEthernetheader.
ThischeckonlyappliestoARPresponses,sincethetargetMACaddress
isunspecifiedinARPrequests.
ip
SpecifiesthatDAIshouldchecktheIPaddressanddropARPpackets
withaninvalidaddress.Aninvalidaddressisoneofthefollowing:
0.0.0.0
255.255.255.255
All IP multicast addresses
All class E addresses (240.0.0.0/4)
Loopback addresses (in the range 127.0.0.0/8)
Defaults
Allparametersareoptional,butatleastoneparametermustbespecified.
Mode
Switchcommand,readwrite.
Usage
ThiscommandaddsadditionalvalidationofARPpacketsbyDAI,beyondthebasicvalidation
thattheARPpacketssenderMACaddressandsenderIPaddressmatchanentryintheDHCP
snoopingbindingsdatabase.
17-22
Example
ThisexampleaddstheoptionalverificationthatsenderMACaddressesarethesameasthesource
MACaddressesintheEthernetheadersofARPpackets.
C3(su)->set arpinspection validate src-mac
Syntax
set arpinspection limit port port-string {none | rate pps {burst interval secs]}
Parameters
portstring
Specifiestheportorportstowhichtoapplytheseratelimiting
parameters.
none
ConfiguresnolimitonincomingARPpackets.
ratepps
Specifiesaratelimitinpacketspersecond.Thevalueofppscanrange
from0to100packetspersecond.
burstintervalsecs
Specifiesaburstintervalinseconds.Thevalueofsecscanrangefrom1
to15seconds.
Defaults
Rate=15packetspersecond
BurstInterval=1second
Mode
Switchcommand,readwrite.
Usage
ToprotecttheswitchagainstDHCPattackswhenDAIisenabled,theDAIapplicationenforcesa
ratelimitforARPpacketsreceivedonuntrustedinterfaces.DAImonitorsthereceiverateoneach
interfaceseparately.Ifthereceiverateexceedsthelimitconfiguredwiththiscommand,DAI
disablestheinterface,whicheffectivelybringsdowntheinterface.Youcanusethesetportenable
commandtoreenabletheport.
Youcanconfigureboththerateandtheburstinterval.Thedefaultrateis15ppsoneachuntrusted
interfacewitharangeof0to100pps.Thedefaultburstintervalis1secondwitharangeto1to15
seconds..TheratelimitcannotbesetontrustedinterfacessinceARPpacketsreceivedontrusted
interfacesdonotcometotheCPU.
Example
Thisexamplesetstherateto20packetspersecondandtheburstintervalto2secondsonports
ge.1.1andge.1.2.
C3(su)->set arpinspection limit port ge.1.1-2 rate 20 burst interval 2
17-23
Syntax
set arpinspection filter name {permit ip host sender-ipaddr mac host
sender-macaddr | vlan vlan-range [static]}
Parameters
name
SpecifiesthenameoftheARPACL.
permit
Specifiesthatapermitruleisbeingcreated.
iphostsenderipaddr
SpecifiestheIPaddressintherulebeingcreated.
machost
sendermacaddr
SpecifiestheMACaddressintherulebeingcreated.
vlanvlanrange
SpecifiestheVLANorVLANstowhichthisARPACLisassigned.
static
(Optional)SpecifiesthatthisARPACLconfiguresstaticmappingsfor
theVLANorVLANs.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ARPACLsareusedtodefinestaticmappingsforDAI.ARPACLsarecompletelyindependentof
ACLsusedforQoS.Amaximumof100ARPACLscanbeconfigured.WithinanACL,a
maximumof20rulescanbeconfigured.
AstaticmappingassociatesanIPaddresstoaMACaddressonaVLAN.DAIconsultsitsstatic
mappingsbeforeitconsultstheDHCPsnoopingbindingsdatabasethus,staticmappingshave
precedenceoverDHCPsnoopingbindings.
Example
ThisexamplecreatesanACLnamedstaticARPandcreatesapermitruleforIPaddress
192.168.1.10.Then,theACLisassignedtoaVLANasastaticmapping.
C3(su)->set arpinspection filter staticARP permit ip host 192.168.1.10 mac host
00:01:22:33:44:55
C3(su)->set arpinspection filter staticARP vlan 10 static
Syntax
show arpinspection access-list [acl-name]
17-24
Parameters
aclname
(Optional)SpecifiestheARPACLtodisplay.
Defaults
IfaspecificACLisnotspecified,informationaboutallconfiguredARPACLsisdisplayed.
Mode
Switchcommand,readwrite.
Example
ThisexampledisplaysinformationabouttheARPACLnamedstaticARP.
C3(su)->show arpinspection access-list staticARP
ARP access list
staticARP
Syntax
show arpinspection ports [port-string]
Parameters
portstring
(Optional)SpecifiestheportorportsforwhichtodisplayARP
configurationinformation.
Defaults
Ifaportstringisnotspecified,informationaboutallDAIenableduntrustedportsisdisplayed.
Mode
Switchcommand,readwrite.
Example
ThisexampledisplaystheARPconfigurationoflag.0.1.
C3(su)->show arpinspection ports lag.0.1
Interface
Trust State
---------lag.0.1
------------No
Rate Limit
(pps)
------------15
Burst Interval
(seconds)
--------------1
17-25
Syntax
show arpinspection vlan vlan-range
Parameters
vlanrange
SpecifiestheVLANsforwhichtodisplayconfigurationinformation.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampledisplaysARPconfigurationinformationforVLAN5.
C3(su)->show arpinspection vlan 5
Source MAC Validation
Destination MAC Validation
IP Address Validation
Vlan
---5
Disabled
Disabled
Disabled
Static flag
----------Enabled
Syntax
show arpinspection statistics [vlan vlan-range]
Parameters
vlanvlanrange
(Optional)SpecifiestheVLANsforwhichtodisplaystatistics.
Defaults
IfnoVLANsarespecified,limitedstatisticsforallDAIenabledVLANsisdisplayed.
Mode
Switchcommand,readwrite.
Usage
WhennospecificVLANsareentered,thiscommanddisplaysthenumberofForwardedand
DroppedARPpacketsperDAIenabledVLAN.WhenoneormoreVLANsarespecified,this
commanddisplaysmoredetailedstatistics.
17-26
Examples
ThisexampleshowswhatisdisplayedwhennoVLANsarespecified.
C3(su)->show arpinspection statistics
VLAN
---5
Forwarded
-----------0
Dropped
--------0
ThisexampleshowswhatinformationisdisplayedwhenoneormoreVLANsarespecified.
C3(su)->show arpinspection statistics vlan 5
VLAN
DHCP
ACL
DHCP
ACL
Bad Src
Bad Dest
Invalid
Drops
Drops
Permits
Permits
MAC
MAC
IP
---- ---------- ---------- ---------- ---------- ---------- ---------- --------5
0
0
0
0
0
0
0
Syntax
clear arpinspection validate {[src-mac] [dst-mac] [ip]}
Parameters
srcmac
Clear,orremove,theverificationthatthesenderMACaddressequals
thesourceMACaddressintheEthernetheader.
dstmac
Clear,orremove,theverificationthatthetargetMACaddressequals
thedestinationMACaddressintheEthernetheader.
ip
Clear,orremove,checkingtheIPaddressanddroppingARPpackets
withaninvalidaddress.
Defaults
Allparametersareoptional,butatleastoneparametermustbespecified.
Mode
Switchcommand,readwrite.
Usage
ThiscommandremovespreviouslyconfiguredadditionalvalidationofARPpacketsbyDAI,
beyondthebasicvalidationthattheARPpacketssenderMACaddressandsenderIPaddress
matchanentryintheDHCPsnoopingbindingsdatabase.
Usetheshowarpinspectionvlancommandtodisplaythecurrentstatusoftheadditional
validationrules.
Example
Thisexampleremovesall3additionalvalidationconditions.
C3(su)->clear arpinspection validate src-mac dst-mac ip
17-27
Syntax
clear arpinspection vlan vlan-range [logging]
Parameters
vlanrange
SpecifiestheVLANorrangeofVLANsonwhichtodisabledynamic
ARPinspection.
logging
(Optional)DisableloggingofinvalidARPpacketsforthespecified
VLANs.
Defaults
IfloggingisenabledforthespecifiedVLANbutloggingisnotenteredwiththiscommand,
loggingwillremainenabled.
Mode
Switchcommand,readwrite.
Usage
YoucanusethiscommandtodisabledynamicARPinspectionononeormoreVLANs,oryoucan
disableloggingofinvalidARPpacketsonspecifiedVLANs.TodisablebothloggingandDAI,you
mustenterthiscommandtwice.
Example
ThisexamplefirstdisplaystheDAIconfigurationforVLAN5,thendisablesDAIonVLAN5,then
disablesloggingofinvalidARPpacketsonVLAN5.
C3(su)->show arpinspection vlan 5
Source MAC Validation
Destination MAC Validation
IP Address Validation
Vlan
---5
Disabled
Disabled
Disabled
Static flag
----------Enabled
17-28
Disabled
Disabled
Disabled
Static flag
----------Enabled
Disabled
Disabled
Disabled
Static flag
----------Enabled
Syntax
clear arpinspection filter name [permit ip host sender-ipaddr mac host
sender-macaddr] | [vlan vlan-range [static]
Parameters
name
SpecifiesthenameoftheARPACL.
permit
(Optional)Specifiesthatapermitruleisbeingdeleted.
iphostsenderipaddr
SpecifiestheIPaddressintherulebeingdeleted.
machost
sendermacaddr
SpecifiestheMACaddressintherulebeingdeleted.
vlanvlanrange
(Optional)SpecifiestheVLANorVLANstowhichthiscommand
shouldapply.RemovetheACLfromtheVLAN,ifstaticisnotspecified
also.
static
(Optional)SpecifiesthatstaticmappingshouldbedisabledforthisARP
ACLforthespecifiedVLANorVLANs.
Defaults
Ifonlythenameisspecified,theACLisdeletedfromtheswitch.
Mode
Switchcommand,readwrite.
Usage
Youcanusethiscommandto:
RemoveaconfiguredARPACLfromtheswitch,or
RemoveapermitrulefromaconfiguredARPACL,or
RemovetheassociationofanARPACLwithaVLANorVLANs,or
DisablestaticmappingofanARPACLassociatedwithaVLANorVLANs.
UsethesetarpinspectionfiltercommandtocreateandassignanARPACL.
UsetheshowarpinspectionaccesslistcommandtodisplaycurrentlyconfiguredARPACLs.
17-29
Examples
ThisexampleremovesapermitrulefromtheARPACLnamedstaticARP.
C3(su)->clear arpinspection filter staticARP permit ip host 192.168.1.10 mac host
00:01:22:33:44:55
ThisexampledisablesstaticmappingoftheARPACLnamedstaticARPthatisassociatedwith
VLAN5.
C3(su)->clear arpinspection filter staticARP vlan 5 static
ThisexampleremovestheARPACLnamedstaticARPfromVLAN5.
C3(su)->clear arpinspection filter staticARP vlan 5
ThisexampleremovestheARPACLnamedstaticARPfromtheswitchcompletely.
C3(su)->clear arpinspection filter staticARP
Syntax
clear arpinspection limit port port-string
Parameters
portstring
Specifiestheportsonwhichtoreturntheratelimitingvaluesto
defaults.
Defaults
Rate=15packetspersecond
BurstInterval=1second
Mode
Switchmode,readwrite.
Usage
Usethesetarpinspectionlimitcommandtochangethevaluesoftheratelimitandburstinterval.
Usetheshowarpinspectionportscommandtodisplaythecurrentlyconfiguredratelimits.
Example
ThisexamplereturnstheDAIratelimitingvaluestotheirdefaultsforportge.1.1.
C3(su)->clear arpinspection limit port ge.1.1
17-30
Syntax
clear arpinspection statistics
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleclearsallDAIstatisticsfromtheswitch.
C3(su)->clear arpinspection statistics
17-31
17-32
18
Preparing for Router Mode
Thischapterdescribeshowtopreparetheswitchforrouting.
For information about...
Refer to page...
18-1
18-2
StartinguptheCLI.(UsingtheCommandLineInterfaceonpage16)
Settingthesystempassword.(setpasswordonpage35)
Configuringbasicplatformsettings,suchashostname,systemclock,andterminaldisplay
settings.(SettingBasicSwitchPropertiesonpage39)
SettingthesystemIPaddress.(setipaddressonpage311)
CreatingandenablingVLANs.(Chapter 10)
Filemanagementtasks,includinguploadingordownloadingflashortextconfigurationfiles,
anddisplayingdirectoryandfilecontents.(ManagingSwitchConfigurationandFileson
page339)
Configuringtheswitchtoruninroutermode.(EnablingRouterConfigurationModeson
page182)
Enablingadvancedrouterfeatures.(ActivatingAdvancedRoutingFeaturesonpage201)
Note: The command prompts used as examples in Table 18-1 and throughout this guide show
switch operation for a user in admin (su) access mode, and a system where the VLAN 1 interface
has been configured for routing. The prompt changes depending on your current configuration
mode, your specific switch, and the interface types and numbers configured for routing on your
system.
18-1
Table 18-1
Step
To do this task...
At this prompt...
router
Switch:
C3(su)->
enable
Router:
C3(su)->router>
configure
Router:
C3(su)->router#
Enable interface
configuration mode using the
routing VLAN or loopback id.
Router:
C3(su)>router(Config)#
interface on page
19-3
Router:
C3(su)->router (Config-if
(Vlan 1))#
interface on page
19-3
no shutdown
Router:
C3(su)->router(Config-if
(Vlan 1))#
no shutdown on
page 19-6
Example
ThefollowingexampleshowshowtoconfigureVLAN1onIPaddress182.127.63.1255.255.255.0
asaroutinginterface.
C3(su)->router
C3(su)->router>enable
C3(su)->router#configure
Enter configuration commands:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip address 182.127.63.1 255.255.255.0
C3(su)->router(Config-if(Vlan 1))#no shutdown
To...
Access method...
Resulting Prompt...
Privileged EXEC
Mode
C3(su)->router>
Show configuration
parameters
Type enable.
C3(su)->router#
Save/copy
configurations
18-2
Global Configuration
Mode
Set system-wide
parameters.
C3(su)->router (Config)#
Interface
Configuration Mode
Configure router
interfaces.
C3(su)->router(Config-if
(Vlan 1))#
C3(su)->router(Config-if
(Lpbk 1))#
Table 18-2
To...
Access method...
Resulting Prompt...
Router Configuration
Mode
Set IP protocol
parameters.
C3(su)->router(Config-router)#
Note: To jump to a lower configuration mode, type exit at the command prompt. To revert back to
switch CLI, type exit from Privileged EXEC router mode.
18-3
18-4
19
IP Configuration
ThischapterdescribestheInternetProtocol(IP)configurationsetofcommandsandhowtouse
them.
Router: Unless otherwise noted, the commands covered in this chapter can be executed only
when the device is in router mode. For details on how to enable router configuration modes, refer
to Enabling Router Configuration Modes on page 18-2.
For information about...
Refer to page...
19-1
19-8
19-12
19-16
19-19
19-23
Commands
For information about...
Refer to page...
show interface
19-2
interface
19-3
show ip interface
19-4
ip address
19-5
19-1
show interface
Refer to page...
show running-config
19-6
no shutdown
19-6
no ip routing
19-7
show interface
Usethiscommandtodisplayinformationaboutoneormoreinterfaces(VLANsorloopbacks)
configuredontherouter.
Syntax
show interface [vlan vlan-id] [loopback loop-id]
Parameters
vlanvlanid
(Optional)DisplaysinterfaceinformationforaspecificVLANinterface.
ThisinterfacemustbeconfiguredforIProutingasdescribedinPre
RoutingConfigurationTasksonpage 181.
loopbackloopid
(Optional)Displaysinterfaceinformationforaspecificloopbackinterface.
Defaults
Ifinterfacetypeisnotspecified,informationforallroutinginterfaceswillbedisplayed.
Mode
Anyroutermode.
Examples
Thisexampleshowshowtodisplayinformationforallinterfacesconfiguredontherouter.Fora
detaileddescriptionofthisoutput,refertoTable 191:
C3(su)->router#show interface
Vlan 1 is Administratively DOWN
Vlan 1 is Operationally DOWN
Mac Address is: 0001.f4da.2cba
The name of this device is Vlan 1
The MTU is 1500 bytes
The bandwidth is 10000 Mb/s
Encapsulation ARPA, Loopback not set
ARP type: ARPA, ARP Timeout: 14400 seconds
Thisexampleshowshowtodisplayinformationforloopbackinterface1.
C3(su)->router#show interface loopback 1
Loopback 1 is Administratively UP
Loopback 1 is Operationally UP
Internet Address is 10.1.192.100, Subnet Mask is 255.255.255.0
The name of this device is Loopback 1
The MTU is 1500 bytes
19-2
IP Configuration
interface
interface
UsethiscommandtoconfigureinterfacesforIProuting.
Syntax
interface vlan vlan-id | loopback loop-id
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANinterfacetobeconfiguredforrouting.
ThisinterfacemustbeconfiguredforIProutingasdescribedinPre
RoutingConfigurationTasksonpage 181.
loopbackloopid
Specifiesthenumberoftheloopbackinterfacetobeconfiguredforrouting.
Thevalueofloopidcanrangefrom0to7.
Defaults
None.
Mode
Routerglobalconfigurationmode:C3(su)>router(Config)#
Usage
Thiscommandenablesinterfaceconfigurationmodefromglobalconfigurationmode,and,ifthe
interfacehasnotpreviouslybeencreated,thiscommandcreatesanewroutinginterface.For
detailsonconfigurationmodessupportedbytheSecureStackC3deviceandtheiruses,referto
Table 182inEnablingRouterConfigurationModesonpage 182.
VLANsmustbecreatedfromtheswitchCLIbeforetheycanbeconfiguredforIProuting.For
detailsoncreatingVLANsandconfiguringthemforIP,refertoEnablingRouterConfiguration
Modesonpage 182.
EachVLANinterfacemustbeconfiguredforroutingseparatelyusingtheinterfacecommand.To
endconfigurationononeinterfacebeforeconfiguringanother,typeexitatthecommandprompt.
Enablinginterfaceconfigurationmodeisrequiredforcompletinginterfacespecificconfiguration
tasks.Foranexampleofhowthesecommandsareused,refertoPreRoutingConfiguration
Tasksonpage 181.
Aloopbackinterfaceisalwaysexpectedtobeup.Thisinterfacecanprovidethesourceaddressfor
sentpacketsandcanreceivebothlocalandremotepackets.Theloopbackinterfaceistypically
usedbyroutingprotocols,butitcanalsobeusedformanagementornetworkservicessuchas
RADIUS,SNMP,Syslog,SNTP,orsFlow.Bydefault,ifRADIUSisconfiguredwithnohostIP
addressonthedevice,itwillusetheloopbackinterface0IPaddress(ifithasbeenconfigured)as
itssourcefortheNASIPattribute.(Administratorscanassignwheretosourcemanagementor
networkserviceIPpacketsviathesetinterfacecommands.)
EachSecureStackC3system(stack)cansupportupto24routinginterfaces.Eachinterfacecanbe
configuredfortheRIPand/orOSPFroutingprotocols.
Note: For information about configuring tunnel interfaces, see Configuring Tunnel Interfaces on
page 19-8.
19-3
show ip interface
Examples
ThisexampleshowshowtoenterconfigurationmodeforVLAN1:
C3(su)->router#configure
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#
Thisexampleshowshowtoenterconfigurationmodeforloopback1:
C3(su)->router#configure
C3(su)->router(Config)#interface loopback 1
C3(su)->router(Config-if(Lpbk 1))#
show ip interface
Usethiscommandtodisplayinformation,includingadministrativestatus,IPaddress,MTU
(MaximumTransmissionUnit)sizeandbandwidth,andACLconfigurations,forinterfaces
configuredforIP.
Syntax
show ip interface [vlan vlan-id] [loopback loop-id]
Parameters
vlanvlanid
(Optional)DisplaysinformationforaspecificVLANinterface.This
interfacemustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage 181.
loopbackloopid
(Optional)Displaysinterfaceinformationforaspecificloopbackinterface.
Defaults
Ifinterfacetypeisnotspecified,statusinformationforallroutinginterfaceswillbedisplayed.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayconfigurationinformationforVLAN1:
C3(su)->router#show ip interface vlan 1
Vlan 1 is Admin DOWN
Vlan 1 is Oper DOWN
Primary IP Address is 192.168.10.1
Frame Type Ethernet
MAC-Address 0001.F45C.C993
Incoming Accesslist is not set
Outgoing AccessList is not set
MTU is 6145 bytes
ARP Timeout is 1 seconds
Direct Broadcast Disabled
Proxy ARP is Disabled
Mask 255.255.255.0
Table 191providesanexplanationofthecommandoutput.
19-4
IP Configuration
ip address
Table 19-1
Output Field
What It Displays...
Vlan N
Primary IP Address
Intefaces primary IP address and mask. Set using the ip address command as
described in ip address on page 19-5.
Frame Type
Encapsulation type used by this interface. Set using the arp command as described
in arp on page 19-13.
MAC-Address
Incoming Access
List
Whether or not an access control list (ACL) has been configured for ingress on this
interface using the commands described in Configuring Access Lists on
page 26-79.
Outgoing Access
List
Not supported.
MTU
ARP Timeout
Duration for entries to stay in the ARP table before expiring. Set using the arp
timeout command as described in arp timeout on page 19-15.
Direct Broadcast
Proxy Arp
Whether or not proxy ARP is enabled or disabled for this interface. Set using the ip
proxy arp command as described in ip proxy-arp on page 19-14.
ip address
Usethiscommandtoset,remove,ordisableaprimaryorsecondaryIPaddressforaninterface.
ThenoformofthiscommandremovesthespecifiedIPaddressanddisablestheinterfaceforIP
processing.
Syntax
ip address ip-address ip-mask [secondary]
no ip address ip-address ip-mask
Parameters
ipaddress
SpecifiestheIPaddressoftheinterfacetobeaddedorremoved.
ipmask
SpecifiesthemaskfortheassociatedIPsubnet.
secondary
(Optional)SpecifiesthattheconfiguredIPaddressisasecondaryaddress.
Defaults
Ifsecondaryisnotspecified,theconfiguredaddresswillbetheprimaryaddressfortheinterface.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
EachSecureStackC3systemsupportsupto24routinginterfaces,withupto8secondary
addressesallowedforeachprimaryIPaddress.
19-5
show running-config
Example
ThisexamplesetstheIPaddressto192.168.1.1andthenetworkmaskto255.255.255.0forVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip address 192.168.1.1 255.255.255.0
show running-config
Usethiscommandtodisplaythenondefault,usersuppliedcommandsenteredwhileconfiguring
thedevice.
Syntax
show running-config
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
Thisexampleshowshowtodisplaythecurrentrouteroperatingconfiguration:
C3(su)->router#show running-config
!
interface vlan 10
ip address 99.99.2.10 255.255.255.0
no shutdown
!
router ospf 1
network 99.99.2.0
0.0.0.255 area 0.0.0.0
network 192.168.100.1 0.0.0.0
area 0.0.0.0
no shutdown
UsethiscommandtoenableaninterfaceforIProutingandtoallowtheinterfacetoautomatically
beenabledatdevicestartup.
Syntax
no shutdown
shutdown
Parameters
None.
Defaults
None.
19-6
IP Configuration
no ip routing
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
TheshutdownformofthiscommanddisablesaninterfaceforIProuting.
Example
ThisexampleshowshowtoenableVLAN1forIProuting:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#no shutdown
no ip routing
UsethiscommandtodisableIProutingonthedevice.Bydefault,IProutingisenabledwhen
interfacesareconfiguredforitasdescribedinConfiguringRoutingInterfaceSettingson
page 191.
Syntax
no ip routing
Parameters
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
Defaults
None.
Example
This example shows how to disable IP routing on the device:
C3(su)->router(Config)#no ip routing
19-7
Commands
For information about...
Refer to page...
interface tunnel
19-8
tunnel source
19-9
tunnel destination
19-10
tunnel mode
19-10
19-11
interface tunnel
Usethiscommandtoconfigureatunnelinterface.
Syntax
interface tunnel tunnel-id
no interface tunnel tunnel-id
Parameters
tunnelid
Specifiesthenumberofthetunnelinterfacetobeconfiguredfor
routing.Thevalueoftunnelidcanrangefrom0to7.
Defaults
None.
Mode
Routerglobalconfigurationmode:C3(su)>router(Config)#
19-8
IP Configuration
tunnel source
Usage
Thiscommandenablestunnelinterfaceconfigurationmodefromglobalconfigurationmode,and,
iftheinterfacehasnotpreviouslybeencreated,thiscommandcreatesanewtunnelrouting
interface.
Thenoformofthiscommandremovesthetunnelinterfaceandassociatedconfiguration
parameters.
Example
Thisexamplecreatesaconfiguredtunnelinterface1.
C3(su)->router(Config)# interface tunnel 1
C3(su)->router(Config-if(Tnnl 1))#
tunnel source
ThiscommandspecifiestheIPv4sourcetransportaddressofthetunnel.
Syntax
tunnel source {ipv4-addr | interface vlan vlan-id}
no tunnel source
Parameters
ipv4addr
TheIPv4sourceaddressofthetunnel.
interfacevlanvlanid
Specifyaninterfacetousealinklocaladdress.TheVLANmustbe
configuredinswitchmode.
Defaults
None.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Tnnl1))#
Usage
ThenoformofthiscommandremovesthesourceIPv4addressforthetunnelinterfacebeing
configured.
Example
ThefollowingexampleconfiguresthesourceIPv4addressfortunnel1.
C3(su)->router(Config)# interface tunnel 1
C3(su)->router(Config-if(Tnnl 1))#
C3(su)->router(Config-if(Tnnl 1))# tunnel source 192.168.10.10
19-9
tunnel destination
tunnel destination
ThiscommandspecifiestheIPv4destinationtransportaddressofthetunnel.
Syntax
tunnel destination ipv4-addr
no tunnel destination
Parameters
ipv4addr
TheIPv4destinationaddressofthetunnel.
Defaults
None.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Tnnl1))#
Usage
ThenoformofthiscommandremovesthedestinationIPv4addressforthetunnelinterfacebeing
configured.
Example
ThefollowingexampleconfiguresthedestinationIPv4addressfortunnel1.
C3(su)->router(Config)# interface tunnel 1
C3(su)->router(Config-if(Tnnl 1))#
C3(su)->router(Config-if(Tnnl 1))# tunnel destination 192.168.10.20
tunnel mode
Thiscommandspecifiesthemodeofthetunnelinterface.
Syntax
tunnel mode ipv6ip
no tunnel mode ipv6ip
Parameters
ipv6ip
SpecifiesthatthetunnelmodeisIPv6overIPv4
Defaults
None.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Tnnl1))#
Usage
Thenoformofthiscommandremovesthemodeofthetunnel.
19-10
IP Configuration
Example
ThisexamplesetsthetunnelmodetoIPv6overIPv4.
C3(su)->router(Config)# interface tunnel 1
C3(su)->router(Config-if(Tnnl 1))#
C3(su)->router(Config-if(Tnnl 1))# tunnel mode ipv6ip
Syntax
show interface tunnel tunnel-id
Parameters
tunnelid
Specifiesthetunnelforwhichtodisplayinformation.
Defaults
None.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Routerprivilegedexec:C3(su)>router#
Usage
Usethiscommandtodisplaygeneralinterfaceinformation.RefertoinChapter 22,IPv6
Configurationforadescriptionoftheshowipv6interfacetunnelcommand.
Example
Thisexampleshowstheoutputofthiscommand.
C3(su)->router(Config)#show interface tunnel 1
Tunnel 1 is Operationally DOWN
The name of this device is Tunnel 1
The MTU is 1480 bytes
19-11
Commands
For information about...
Refer to page...
show ip arp
19-12
arp
19-13
ip proxy-arp
19-14
arp timeout
19-15
clear arp-cache
19-15
show ip arp
UsethiscommandtodisplayentriesintheARP(AddressResolutionProtocol)table.ARP
convertsanIPaddressintoaphysicaladdress.
Syntax
show ip arp [ip-address]|[vlan vlan-id]|[output-modifier]
Parameters
ipaddress
(Optional)DisplaysARPentriesrelatedtoaspecificIPaddress.
vlanvlanid
(Optional)DisplaysonlyARPentrieslearnedthroughaspecificVLAN
interface.ThisVLANmustbeconfiguredforIProutingasdescribedin
PreRoutingConfigurationTasksonpage 181.
outputmodifier
(Optional)DisplaysARPentrieswithinaspecificrange.Optionsare:
|beginipaddressDisplaysonlyARPentriesthatbeginwiththe
specifiedIPaddress.
|excludeipaddressExcludesARPentriesmatchingthespecified
IPaddress.
|includeipaddressIncludesARPentriesmatchingthespecified
IPaddress.
Defaults
Ifnoparametersarespecified,allentriesintheARPcachewillbedisplayed.
Mode
Anyroutermode.
19-12
IP Configuration
arp
Example
Thisexampleshowshowtousetheshowiparpcommand:
C3(su)->router#show ip arp
Protocol
Address
Type
Interface
-----------------------------------------------------------------------------Internet
134.141.235.251
0003.4712.7a99
ARPA
Vlan1
Internet
134.141.235.165
0002.1664.a5b3
ARPA
Vlan1
Internet
134.141.235.167
00d0.cf00.4b74
ARPA
Vlan2
Address
Age (min)
Interface
-----------------------------------------------------------------------------Internet
134.141.235.165
0002.1664.a5b3
ARPA
Vlan2
Address
Interface
-----------------------------------------------------------------------------Internet
134.141.235.251
0003.4712.7a99 ARPA
Vlan2
Table 192providesanexplanationofthecommandoutput.
Table 19-2
Output Field
What It Displays...
Protocol
Address
Age (min)
Interval (in minutes) since the entry was entered in the table.
Hardware Addr
Type
Interface
arp
Usethiscommandtoaddorremovepermanent(static)ARPtableentries.Upto1,000staticARP
entriesaresupportedperSecureStackC3system.AmulticastMACaddresscanbeusedinastatic
ARPentry.ThenoformofthiscommandremovesthespecifiedpermanentARPentry:
Syntax
arp ip-address mac-address
no arp ip-address
Parameters
ipaddress
SpecifiestheIPaddressofadeviceonthenetwork.ValidvaluesareIP
addressesindotteddecimalnotation.
macaddress
Specifiesthe48bithardwareaddresscorrespondingtotheipaddress
expressedinhexadecimalnotation.
SecureStack C3 Configuration Guide
19-13
ip proxy-arp
Defaults
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
Usage
TheIPaddressspecifiedforthestaticARPentrymustfallwithinoneofthesubnetsornetworks
definedontheroutedinterfacesofthesystem(orstack,ifapplicable).Thesystemcanthenmatch
theIPaddressofthestaticARPentrywiththeappropriateroutedinterfaceandassociateitwith
thecorrectVLAN.
Example
ThisexampleshowshowtoaddapermanentARPentryfortheIPaddress130.2.3.1andMAC
address0003.4712.7a99:
C3(su)->router(Config)#arp 130.2.3.1 0003.4712.7a99
ip proxy-arp
UsethiscommandtoenableproxyARPonaninterface.Thenoformofthiscommanddisables
proxyARP.
Syntax
ip proxy-arp
no ip proxy-arp
Parameters
None.
Defaults
Disabled.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
ThisvariationoftheARPprotocolallowstheroutertosendanARPresponseonbehalfofanend
nodetotherequestinghost.ProxyARPcanbeusedtoresolveroutingissuesonendstationsthat
areunabletorouteinthesubnettedenvironment.TheSecureStackC3willanswertoARP
requestsonbehalfoftargetedendstationsonneighboringnetworks.Itisdisabledbydefault.
Example
ThisexampleshowshowtoenableproxyARPonVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip proxy-arp
19-14
IP Configuration
arp timeout
arp timeout
Usethiscommandtosettheduration(inseconds)fordynamicallylearnedentriestoremaininthe
ARPtablebeforeexpiring.Thenoformofthiscommandrestoresthedefaultvalueof14,400
seconds.
arp timeout seconds
no arp timeout
Parameters
seconds
SpecifiesthetimeinsecondsthatanentryremainsintheARPcache.Valid
valuesare065535.Avalueof0specifiesthatARPentrieswillneverbe
agedout.
Defaults
14,400seconds.
Mode
Globalconfiguration:C3(su)>router(Config)#
Example
ThisexampleshowshowtosettheARPtimeoutto7200seconds:
C3(su)->router(Config)#arp timeout 7200
clear arp-cache
Usethiscommandtodeleteallnonstatic(dynamic)entriesfromtheARPtable.
clear arp-cache
Parameters
None.
Mode
PrivilegedEXEC:C3(su)>router#
Defaults
None.
Example
ThisexampleshowshowtodeletealldynamicentriesfromtheARPtable:
C3(su)->router#clear arp-cache
19-15
Commands
For information about...
Refer to page...
ip directed-broadcast
19-16
ip forward-protocol
19-17
ip helper-address
19-18
ip directed-broadcast
UsethiscommandtoenableordisableIPdirectedbroadcastsonaninterface.Bydefault,
interfacesontheSecureStackC3donotforwarddirectedbroadcasts.Thenoformofthis
commanddisablesIPdirectedbroadcastontheinterface.
Syntax
ip directed-broadcast
no ip directed-broadcast
Parameters
None.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>Router1(Configif(Vlan1))#
Usage
Directedbroadcastisanefficientmechanismforcommunicatingwithmultiplehostsonanetwork
whileonlytransmittingasingledatagram.Adirectedbroadcastisapacketsenttoallhostsona
specificnetworkorsubnet.Thedirectedbroadcastaddressincludesthenetworkorsubnetfields,
withthebinarybitsofthehostportionoftheaddresssettoone.Forexample,foranetworkwith
theaddress192.168.0.0/16,thedirectedbroadcastaddresswouldbe192.168.255.255.Forasubnet
withtheaddress192.168.12.0/24,thedirectedbroadcastaddresswouldbe192.168.12.255.
InordertominimizebroadcastDoSattacks,forwardingofdirectedbroadcastsisdisabledby
defaultontheSecureStackC3,asrecommendedbyRFC2644.
Iftheabilitytosenddirectedbroadcaststoanetworkisrequired,youshouldenabledirected
broadcastsonlyontheoneinterfacethatwillbetransmittingthedatagrams.Forexample,ifa
SecureStackC3hasfiveroutedinterfacesforthe10,20,30,40,and50networks,enablingdirected
19-16
IP Configuration
ip forward-protocol
broadcastonlyonthe30networkinterfacewillallowanyonefromanyothernetworks(10,20,40,
50)tosenddirectedbroadcasttothe30network.
Example
ThisexampleshowshowtoenableIPdirectedbroadcastsonVLAN1:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip directed-broadcast
ip forward-protocol
UsethiscommandtoenableUDPbroadcastforwardingandspecifywhichprotocolswillbe
forwarded.
Syntax
ip forward-protocol udp [port]
no ip forward-protocol udp [port]
Parameters
udp
SpecifiesUDPastheIPforwardingprotocol.
port
(Optional)SpecifiesadestinationportthatcontrolswhichUDPservices
areforwarded.
Defaults
Ifportisnotspecified,thefollowingdefaultsareused:
TrivialFileTransferProtocol(TFTP)(port69)
DomainNamingSystem(port53)
Timeservice(port37)
NetBIOSNameServer(port137)
NetBIOSDatagramServer(port138)
TACACSservice(port49)
EN116NameService(port42)
Mode
Routercommand,Globalconfiguration:C3(su)>router(Config)#
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1)#
Usage
Inordertoactuallyforwardprotocols,youmustconfigureanIPhelperaddressontheindividual
routerinterfaceswiththecommandiphelperaddress(page 1918).
Ifacertainserviceexistsinsidethenode,andthereisnoneedtoforwardtherequesttoremote
networks,thenoformofthiscommandshouldbeusedtodisabletheforwardingforthespecific
port.Suchrequestswillnotbeautomaticallyblockedfrombeingforwardedjustbecauseaservice
forthemexistsinthenode.
ThenoformofthiscommandremovesaUDPportorprotocol,disablingforwarding.
19-17
ip helper-address
Examples
ThefollowingexamplegloballydisablesIPforwardingforUDPport69.
C3(su)->router(Config)#no ip forward-protocol udp 69
ThefollowingexampledisablesIPforwardingforUDPport69onaspecificinterface.
C3(su)->router(Config)#interface vlan 10
C3(su)->router(Config-if(Vlan 10))#no ip forward-protocol udp 69
ip helper-address
UsethiscommandtoenabletheDHCP/BOOTPrelayagentonaSecureStackC3routedinterface
and/ortoforwardbroadcasttrafficidentifiedwiththeipforwardprotocolcommandtoaunicast
address.EnablingtherelayagentallowsforwardingofclientDHCP/BOOTPrequeststoaDHCP/
BOOTPserverthatdoesnotresideonthesamebroadcastdomainastheclient.Upto6IPhelper
addressesmaybeconfiguredperinterface.
ThenoformofthiscommanddisablestheforwardingofUDPdatagramstothespecifiedaddress.
Syntax
ip helper-address address
no ip helper-address address
Parameters
address
AddressofthehostwhereUDPbroadcastpacketsshouldbeforwarded.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>Router1(Configif(Vlan1))#
Usage
TypicallyforDHCP/BootP,whenahostrequestsanIPaddress,itsendsoutaDHCPbroadcast
packet.Normally,therouterdropsallbroadcastpackets.However,byexecutingthiscommand,
youenabletheroutedinterfacetopassDHCPbroadcastframesthrough,sendingthemdirectlyto
theremoteDHCPserversIPaddress.
TheDHCP/BOOTPrelayagentwilldetectDHCP/BOOTPrequestsbasedonUDPsourceand
destinationports.Itwillthenmakethenecessarychangestothepacketandsendthepackettothe
DHCPserver.Thechangesinclude:
ReplacingthedestinationIPaddresswiththeaddressoftheDHCPserver,
ReplacingthesourceIPaddresswithitsownaddress(thatis,theIPaddressofthelocal
routedinterface),and
WithintheBOOTPpartofthepacket,changingtheRelayAgentIPaddressfrom0.0.0.0tothe
addressofthelocalroutedinterface.
ThelastchangetotheBootPpackettellstheDHCPserverthatitneedstoassignanIPaddress
thatisinthesamesubnetastheRelayAgentIP.Whentheresponsecomesfromtheserver,the
DHCP/BOOTPrelayagentsendsittothehost.
19-18
IP Configuration
Forotherprotocolsspecifiedthroughtheipforwardprotocolcommand,thesystemforwards
broadcastUDPtrafficasaunicastpackettothespecifiedIPaddresses.
Example
ThisexampleshowhowtohaveallclientDHCPrequestsforusersinVLAN1tobeforwardedto
theremoteDHCPserverwithIPaddress192.168.1.28.
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip helper-address 192.168.1.28
Commands
For information about...
Refer to page...
show ip route
19-19
ip route
19-21
ping
19-21
traceroute
19-22
show ip route
UsethiscommandtodisplayinformationaboutIProutes.
Syntax
show ip route [destination-prefix [destination-prefix-match] | connected | ospf |
rip | static | summary]
Parameters
destinationprefix
destinationprefix
match
(Optional)Convertsthespecifiedaddressandmaskintoaprefixand
displaysanyroutesthatmatchtheprefix.
connected
(Optional)Displaysconnectedroutes.
ospf
(Optional)DisplaysroutesconfiguredfortheOSPFroutingprotocol.For
detailsonconfiguringOSPF,refertoConfiguringOSPFonpage 2011.
rip
(Optional)DisplaysroutesconfiguredfortheRIProutingprotocol.For
detailsonconfiguringRIP,refertoConfiguringRIPonpage 202.
static
(Optional)Displaysstaticroutes.
summary
(Optional)DisplaysasummaryoftheIProutingtable.
19-19
show ip route
Defaults
Ifnoparametersarespecified,allIProuteinformationwillbedisplayed.
Mode
Anyroutermode.
Usage
Theroutingtablecontainsallactivestaticroutes,alltheRIProutes,anduptothreebestOSPF
routeslearnedforeachnetwork.
Example
ThisexampleshowshowtousetheshowiproutecommandtodisplayallIProuteinformation.A
portionoftheoutputisshown:
C3(su)->router#show ip route
Codes: C - connected, S - static, R - RIP, O - OSPF, IA - OSPF interarea
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
E - EGP, i - IS-IS, L1 - IS-IS level-1, LS - IS-IS level-2
* - candidate default, U - per user static route
IA
O
O
C
O
O
O
E2
IA
IA
E2
O
C
O
O
E2
E2
IA
E2
E2
E2
O
E2
O
E2
E2
O
O
IA
IA
IA
O
IA
E2
E2
C
19-20
IP Configuration
ip route
O
E2
C
O
E2
22.22.28.0/24 [8/20] via 168.1.0.249, Vlan 1300 via 168.1.0.254, Vlan 1200
22.22.29.0/24 [150/20] via 168.0.0.249, Vlan 3205
26.0.0.0/8 [0/0] directly connected, Vlan 26
33.9.8.0/28 [8/20] via 168.1.0.254, Vlan 1200
33.33.0.0/16 [150/20] via 168.0.0.249, Vlan 3205
ip route
UsethiscommandtoaddorremoveastaticIProute.Thenoformofthiscommandremovesthe
staticIProute.
ip route prefix mask dest-addr [distance]
no ip route prefix mask forward-addr
Parameters
prefix
SpecifiesadestinationIPaddressprefix.
mask
Specifiesadestinationprefixmask.
destaddr
Specifiesaforwarding(gateway)IPaddress.
distance
(Optional)Specifiesanadministrativedistancemetricforthisroute.Valid
valuesare1(default)to255.Routeswithlowervaluesreceivehigher
preferenceinrouteselection.
Defaults
Ifdistanceisnotspecified,thedefaultvalueof1willbeapplied.
Mode
Globalconfiguration:C3(su)>router(Config)#
Example
ThisexampleshowshowtosetIPaddress10.1.2.3asthenexthopgatewaytodestinationaddress
10.0.0.0:
C3(su)->router(Config)#ip route 10.0.0.0 255.0.0.0 10.1.2.3
ping
UsethiscommandtotestroutingnetworkconnectivitybysendingIPpingrequests.
Syntax
ping ip-address
Parameters
ipaddress
SpecifiestheIPaddressofthesystemtoping.
Defaults
None.
19-21
traceroute
Mode
PrivilegedEXEC:C3(su)>router#
Usage
Thiscommandisalsoavailableinswitchmode.
Examples
ThisexampleshowsoutputfromasuccessfulpingtoIPaddress182.127.63.23:
C3(su)->router#ping 182.127.63.23
182.127.63.23 is alive
ThisexampleshowsoutputfromanunsuccessfulpingtoIPaddress182.127.63.24:
C3(su)->router#ping 182.127.63.24
no answer from 182.127.63.24
traceroute
UsethiscommandtodisplayahopbyhoppaththroughanIPnetworkfromthedevicetoa
specificdestinationhost.ThreeICMPprobeswillbetransmittedforeachhopbetweenthesource
andthetraceroutedestination.
Syntax
traceroute host
Parameters
host
SpecifiesahosttowhichtherouteofanIPpacketwillbetraced.
Defaults
None.
Mode
PrivilegedEXEC:C3(su)>router#
Usage
Thereisalsoatraceroutecommandavailableinswitchmode.
Example
Thisexampleshowshowtousetraceroutetodisplayaroundtrippathtohost192.141.90.183.
C3(su)->router#traceroute 192.141.90.183
Traceroute to 192.141.90.183, 30 hops max, 40 byte packets
1 10.1.56.1
0.000 ms
0.000 ms
2 10.1.48.254
10.000 ms
0.000 ms
3 10.1.0.2
0.000 ms
0.000 ms
4 192.141.89.17
0.000 ms
0.000 ms
5 192.141.100.13
0.000 ms
10.000 ms
6 192.141.100.6
0.000 ms
0.000 ms
7 192.141.90.183
0.000 ms
0.000 ms
19-22
IP Configuration
0.000
0.000
0.000
10.000
0.000
10.000
0.000
ms
ms
ms
ms
ms
ms
ms
Commands
For information about...
Refer to page...
19-23
19-24
Syntax
ip icmp redirect enable
no ip icmp redirect enable
Parameters
None.
Defaults
Bydefault,sendingICMPredirectstotheCPUisenabledgloballyandonallinterfaces.
Mode
Routerglobalconfigurationmode:C3(su)>router(Config)#
Interfaceconfigurationmode:C3(su)>Router1(Configif(Vlan1))#
Usage
YoucanusethiscommandinrouterglobalconfigurationmodetoenableordisablesendingICMP
redirectsgloballyontheswitch.
Youcanusethiscommandinrouterinterfaceconfigurationmodetoenableordisablesending
ICMPredirectsonlyonspecificinterfaces.
Examples
ThisexampledisablessendingICMPredirectsontheinterfaceVLAN5.
C3(su)->router#configure
C3(su)->router(Config)#interface vlan 5
C3(su)->Router1(Config-if(Vlan 5))# no ip icmp redirect enable
19-23
ThisexampledisablessendingICMPredirectsglobally.
C3(su)->router#configure
C3(su)->router(Config)#no ip icmp redirect enable
Syntax
show ip icmp redirect {status | interface [vlan vlan-id]}
Parameters
status
DisplaytheglobalICMPredirectstatus.
interface
DisplayICMPredirectstatusforinterfaces.
vlanvlanid
(Optional)DisplayICMPredirectstatusforthespecifiedVLAN.
Defaults
IfnoVLANisspecifiedwiththeinterfaceparameter,informationforallVLANinterfacesis
displayed.
Mode
PrivilegedEXECmode:C3(su)>router#
Routerglobalconfigurationmode:C3(su)>router(Config)#
Examples
ThisexampledisplaystheglobalICMPredirectstatus.
C3(su)->router#show ip icmp redirect status
Global ICMP Redirect status - Enabled
ThisexampledisplaystheICMPredirectstatusforVLAN5.
C3(su)->router#show ip icmp redirect interface vlan 5
Vlan Id
Admin Status
-----------------5
Enabled
19-24
IP Configuration
20
IPv4 Routing Protocol Configuration
ThischapterdescribestheIPv4RoutingProtocolConfigurationsetofcommandsandhowtouse
them.
Router: The commands covered in this chapter can be executed only when the device is in router
mode. For details on how to enable router configuration modes, refer to Enabling Router
Configuration Modes on page 18-2.
For information about...
Refer to page...
20-1
Configuring RIP
20-2
Configuring OSPF
20-11
Configuring DVMRP
20-33
Configuring IRDP
20-37
Configuring VRRP
20-42
Configuring PIM-SM
20-49
20-1
Configuring RIP
Configuring RIP
Purpose
ToenableandconfiguretheRoutingInformationProtocol(RIP).
To do this...
router rip
UsethiscommandtoenableordisableRIPconfigurationmode.Thenoformofthiscommand
disablesRIP.
Syntax
router rip
no router rip
Parameters
None.
Defaults
None.
20-2
ip rip enable
Mode
Globalconfiguration:C3(su)>router(Config)#
Usage
YoumustexecutetherouterripcommandtoenabletheprotocolbeforecompletingmanyRIP
specificconfigurationtasks.Fordetailsonenablingconfigurationmodes,refertoTable 182in
EnablingRouterConfigurationModesonpage182.
Example
ThisexampleshowshowtoenableRIP:
C3(su)->router#configure
C3(su)->router(Config)#router rip
C3(su)->router(Config-router)#
ip rip enable
UsethiscommandtoenableRIPonaninterface.ThenoformofthiscommanddisablesRIPonan
interface:Bydefault,RIPisdisabledonallinterfaces.
Syntax
ip rip enable
no ip rip enable
Parameters
None.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenableRIPontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip rip enable
distance
UsethiscommandtoconfiguretheadministrativedistanceforRIProutes.Thenoformofthis
commandresetsRIPadministrativedistancetothedefaultvalueof120.
Syntax
distance weight
no distance [weight]
20-3
Parameters
weight
SpecifiesanadministrativedistanceforRIProutes.Validvaluesare1255.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
Ifseveralroutes(comingfromdifferentprotocols)arepresentedtotheSecureStackC3,the
protocolwiththelowestadministrativedistancewillbechosenforrouteinstallation.Bydefault,
RIPadministrativedistanceissetto120.Thedistancecommandcanbeusedtochangethisvalue,
resettingRIPsroutepreferenceinrelationtootherroutesasshowninthetablebelow.
Route Source
Default Distance
Connected
Static
OSPF
110
RIP
120
Example
ThisexampleshowshowtochangethedefaultadministrativedistanceforRIPto1001:
C3(su)->router(Config)#router rip
C3(su)->router(Config-router)#distance 100
Syntax
ip rip send version {1 | 2 | r1compatible}
no ip rip send version
Parameters
1
SpecifiesRIPversion1.Thisisthedefaultsetting.
SpecifiesRIPversion2.
r1compatible
Specifiesthatpacketsbesentasversion2packets,buttransmitstheseas
broadcastpacketsratherthanmulticastpacketssothatsystemswhichonly
understandRIPversion1canreceivethem.
Defaults
None.
20-4
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheRIPsendversionto2forpacketstransmittedontheVLAN1
interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip rip send version 2
Syntax
ip rip receive version {1 | 2 | 1 2 | none}
no ip rip receive version
Parameters
1
SpecifiesRIPversion1.Thisisthedefaultsetting.
SpecifiesRIPversion2.
12
SpecifiesRIPversions1and2.
none
SpecifiesthatnoRIProuteswillbeprocessedonthisinterface.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Defaults
None.
Example
ThisexampleshowshowtosettheRIPreceiveversionto2forupdatepacketsreceivedonthe
VLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip rip receive version 2
ip rip authentication-key
UsethiscommandtoenableordisableaRIPauthenticationkey(password)foruseonan
interface.ThenoformofthiscommandpreventsRIPfromusingauthentication.
Syntax
ip rip authentication-key name
no ip rip authentication-key
20-5
ip rip message-digest-key
Parameters
name
SpecifiesthepasswordtoenableordisableforRIPauthentication.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheRIPauthenticationkeychaintopasswordontheVLAN1
interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip rip authentication-key password
ip rip message-digest-key
UsethiscommandtoenableordisableaRIPMD5authenticationkey(password)foruseonan
interface.ThenoformofthiscommandpreventsRIPfromusingauthentication.
Syntax
ip rip message-digest-key keyid md5 key
no ip rip message-digest-key keyid
Parameters
keyid
SpecifiesthekeyIDtoenableordisableforRIPauthentication.Validvalues
are1to255.
md5
SpecifiesuseoftheMD5algorithm.
key
SpecifiestheRIPauthenticationpassword.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Defaults
None.
Examples
ThisexampleshowshowtosettheMD5authenticationIDto5fortheRIPauthenticationkeyset
ontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip rip message-digest-key 5 md5 password
20-6
no auto-summary
no auto-summary
Usethiscommandtodisableautomaticroutesummarization.
Syntax
no auto-summary
auto-summary
Parameters
None.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
Bydefault,RIPversion2supportsautomaticroutesummarization,whichsummarizes
subprefixestotheclassfulnetworkboundarywhencrossingnetworkboundaries.Disabling
automaticroutesummarizationenablesCIDR,allowingRIPtoadvertiseallsubnetsandhost
routinginformationontheSecureStackC3device.Toverifywhichroutesaresummarizedforan
interface,usetheshowiproutecommandasdescribedinshowiprouteonpage1919.The
reverseofthecommandreenablesautomaticroutesummarization.Bydefault,RIPauto
summarizationaffectsbothRIPv1andRIPv2routes.
Note: This command is necessary for enabling CIDR for RIP on the SecureStack C3 device.
Example
ThisexampleshowshowtodisableRIPautomaticroutesummarization:
C3(su)->router(Config)#router rip
C3(su)->router(Config-router)#no auto-summary
split-horizon poison
UsethiscommandtoenableordisablesplithorizonpoisonreversemodeforRIPpackets.Theno
formofthiscommanddisablessplithorizonpoisonreverse.
Syntax
split-horizon poison
no split-horizon poison
Parameters
None.
Defaults
None.
20-7
passive-interface
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
Splithorizonpreventsanetworkfrombeingadvertisedoutthesameinterfaceitwasreceivedon.
Thisfunctionisdisabledbydefault.
Example
ThisexampleshowshowtodisablesplithorizonpoisonreverseforRIPpacketstransmittedon
theVLAN1interface:
C3(su)->router(Config)#router rip
C3(su)->Router1(Config-router)#no split-horizon poison
passive-interface
UsethiscommandtopreventRIPfromtransmittingupdatepacketsonaninterface.Thenoform
ofthiscommanddisablespassiveinterface.
Syntax
passive-interface vlan vlan-id
no passive-interface vlan vlan-id
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANtomakeapassiveinterface.ThisVLAN
mustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
ThiscommanddoesnotpreventRIPfrommonitoringupdatesontheinterface.
Example
ThisexampleshowshowtosetVLAN2asapassiveinterface.NoRIPupdateswillbetransmitted
onVLAN2:
C3(su)->router(Config)#router rip
C3(su)->router(Config-router)#passive-interface vlan 2
20-8
receive-interface
receive-interface
UsethiscommandtoallowRIPtoreceiveupdatepacketsonaninterface.Thenoformofthis
commanddeniesthereceptionofRIPupdates.Bydefault,receivingisenabledonallrouting
interfaces.
Syntax
receive-interface vlan vlan-id
no receive-interface vlan vlan-id
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANtomakeareceiveinterface.ThisVLAN
mustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
ThiscommanddoesnotaffectthesendingofRIPupdatesonthespecifiedinterface.
Example
ThisexampleshowshowtodenythereceptionofRIPupdatesonVLAN2:
C3(su)->router(Config)#router rip
C3(su)->router(Config-router)#no receive-interface vlan 2
redistribute
UsethiscommandtoallowroutinginformationdiscoveredthroughnonRIPprotocolstobe
distributedinRIPupdatemessages.Thenoformofthiscommandclearsredistribution
parameters.
Syntax
redistribute {connected | ospf process-id | static} [metric metric value]
[subnets]
no redistribute {connected | ospf process-id | static}
Parameters
connected
SpecifiesthatnonRIProutinginformationdiscoveredviadirectly
connectedinterfaceswillberedistributed.
ospf
SpecifiesthatOSPFroutinginformationwillberedistributedinRIP.
processid
SpecifiestheprocessID,aninternallyusedidentificationnumberforeach
instanceoftheOSPFroutingprocessrunonarouter.Validvaluesare1to
65535.
20-9
redistribute
static
SpecifiesthatnonRIProutinginformationdiscoveredviastaticrouteswill
beredistributed.Staticroutesarethosecreatedusingtheiproute
commanddetailediniprouteonpage1921.
metricmetricvalue
(Optional)Specifiesametricfortheconnected,OSPForstatic
redistributionroute.Thisvalueshouldbeconsistentwiththedesignation
protocol.
subnets
(Optional)Specifiesthatconnected,OSPForstaticroutesthatare
subnettedwillberedistributed.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Defaults
Ifmetricvalueisnotspecified,1willbeapplied.
Ifsubnetsisnotspecified,onlynonsubnettedrouteswillberedistributed.
Example
Thisexampleshowshowtoredistributeroutinginformationdiscoveredthroughstaticrouteswill
beredistributedintoRIPupdatemessages:
C3(su)->router(Config)#router rip
C3(su)->router(Config-router)#redistribute static
20-10
Configuring OSPF
Configuring OSPF
* Advanced License Required *
OSPF is an advanced routing feature that must be enabled with a license key. If you have purchased an
advanced license key, and have enabled routing on the device, you must activate your license as described in
the chapter entitiled Activating Licensed Features in order to enable the OSPF command set. If you wish to
purchase an advanced routing license, contact Enterasys Networks Sales.
Purpose
ToenableandconfiguretheOpenShortestPathFirst(OSPF)routingprotocol.
To do this...
20-11
router id
Table 20-2
To do this...
router id
UsethiscommandtosettheOSPFrouterIDforthedevice.ThisIPaddressmustbesetmanually
inordertorunOSPF.ThenoformofthiscommandremovestherouterIDforthedevice.
Syntax
router id ip-address
no router id
Parameters
ipaddress
SpecifiestheIPaddressthatOSPFwilluseastherouterID.
Defaults
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
Usage
ThiscommandsetstheOSPFrouterID.TheOSPFareaIDofaroutedVLANisconfiguredoneach
interfacewiththeinterfacecommandipospfareaidonpage2014.Ifyoudonotconfigurean
areaIDonaroutedinterfacerunningOSPF,thedefaultareaIDof0.0.0.0willbeused.
Example
ThisexampleshowshowtosettheOSPFrouterIDtoIPaddress182.127.62.1:
C3(su)->router(Config-router)#router id 182.127.62.1
20-12
router ospf
router ospf
UsethiscommandtoenableordisableOpenShortestPathFirst(OSPF)configurationmode.The
noformofthiscommanddisablesOSPFconfigurationmode.
Syntax
router ospf process-id
no router ospf process-id
Parameters
processid
SpecifiestheprocessID,aninternallyusedidentificationnumberforan
OSPFroutingprocessrunonarouter.OnlyoneOSPFprocessisallowedper
stackorstandalone.Validvaluesare1to65535.
Defaults
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
Usage
YoumustexecutetherouterospfcommandtoenabletheprotocolbeforecompletingmanyOSPF
specificconfigurationtasks.Fordetailsonenablingconfigurationmodes,refertoTable 182on
page 182.
OnlyoneOSPFprocess(processid)isallowedperSecureStackC3router.
Example
ThisexampleshowshowtoenableroutingforOSPFprocess1:
C3(su)->router#conf terminal
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#
1583compatibility
UsethiscommandtoenableRFC1583compatibilityonOSPFinterfaces.Thenoformofthis
commanddisablesRFC1583compatibilityonOSPFinterfaces.
Syntax
1583compatability
no 1583compatability
Parameters
None.
Defaults
None.
20-13
ip ospf enable
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
ThisexampleshowshowtoenableRFC1583compatibility:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#1583compatability
ip ospf enable
UsethiscommandtoenableOSPFonaninterface.ThenoformofthiscommanddisablesOSPFon
aninterface.
Syntax
ip ospf enable
no ip ospf enable
Parameters
None.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenableOSPFontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf enable
ip ospf areaid
UsethiscommandtoconfigureareaIDsforOSPFinterfaces.IfOSPFisenabledonaninterfaceas
describedinipospfenableonpage2014,theOSPFareawilldefaultto0.0.0.0.Thenoformof
thiscommandremovesOSPFroutingfortheinterfaces.
Syntax
ip ospf areaid area-id
no ip ospf areaid
Parameters
areaid
Defaults
None.
20-14
SpecifiestheareaidtobeassociatedwiththeOSPFinterface.Validvalues
aredecimalvaluesorIPaddresses.
ip ospf cost
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoconfiguretheVLAN1interfaceasarea0.0.0.31:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf areaid 0.0.0.31
ip ospf cost
UsethiscommandtosetthecostofsendinganOSPFpacketonaninterface.Thenoformofthis
commandresetstheOSPFcosttothedefaultof10.
Syntax
ip ospf cost cost
no ip ospf cost
Parameters
cost
Specifiesthecostofsendingapacket.Validvaluesrangefrom1to65535.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
EachrouterinterfacethatparticipatesinOSPFroutingisassignedadefaultcost.Thiscommand
overwritesthedefaultof10.
Example
ThisexampleshowshowtosettheOSPFcostto20fortheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf cost 20
ip ospf priority
UsethiscommandtosettheOSPFpriorityvalueforrouterinterfaces.Thenoformofthis
commandresetsthevaluetothedefaultof1.
Syntax
ip ospf priority number
no ip ospf priority
20-15
timers spf
Parameters
number
SpecifiestheroutersOSPFpriorityinarangefrom0to255.Defaultvalueis
1.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Thepriorityvalueiscommunicatedbetweenroutersbymeansofhellomessagesandinfluences
theelectionofadesignatedrouter.
Example
ThisexampleshowshowtosettheOSPFpriorityto20fortheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf priority 20
timers spf
UsethiscommandtochangeOSPFtimervaluestofinetunetheOSPFnetwork.Thenoformof
thiscommandrestoresthedefaulttimervalues(5secondsfordelayand10secondsforholdtime).
Syntax
timers spf spf-delay spf-hold
no timers spf
Parameters
spfdelay
Specifiesthedelay,inseconds,betweenthereceiptofanupdateandtheSPF
execution.Validvaluesare0to4294967295.
spfhold
Specifiestheminimumamountoftime,inseconds,betweentwo
consecutiveOSPFcalculations.Validvaluesare0to4294967295.Avalueof
0meansthattwoconsecutiveOSPFcalculationsareperformedone
immediatelyaftertheother.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
ThisexampleshowshowtosetSPFdelaytimeto7secondsandholdtimeto3:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#timers spf 7 3
20-16
ip ospf retransmit-interval
ip ospf retransmit-interval
Usethiscommandtosettheamountoftimebetweenretransmissionsoflinkstateadvertisements
(LSAs)foradjacenciesthatbelongtoaninterface.Thenoformofthiscommandresetsthe
retransmitintervalvaluetothedefault,5seconds.
Syntax
ip ospf retransmit-interval seconds
no ip ospf retransmit-interval
Parameters
seconds
Specifiestheretransmittimeinseconds.Validvaluesare1to65535.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheOSPFretransmitintervalfortheVLAN1interfaceto20:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf retransmit-interval 20
ip ospf transmit-delay
Usethiscommandtosettheamountoftimerequiredtotransmitalinkstateupdatepacketonan
interface.Thenoformofthiscommandresetstheretransmitintervalvaluetothedefault,1
second.
Syntax
ip ospf transmit-delay seconds
no ip ospf transmit-delay
Parameters
seconds
Specifiesthetransmitdelayinseconds.Validvaluesarefrom1to65535.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
20-17
ip ospf hello-interval
Example
Thisexampleshowshowtosetthetimerequiredtotransmitalinkstateupdatepacketonthe
VLAN1interfaceat20seconds:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf transmit-delay 20
ip ospf hello-interval
Usethiscommandtosetthenumberofsecondsaroutermustwaitbeforesendingahellopacket
toneighborroutersonaninterface.Thenoformofthiscommandsetsthehellointervalvalueto
thedefaultvalueof10seconds.
Syntax
ip ospf hello-interval seconds
no ip ospf hello-interval
Parameters
seconds
Specifiesthehellointervalinseconds.Hellointervalmustbethesameon
neighboringrouters(onaspecificsubnet),butcanvarybetweensubnets.
Thisparameterisanunsignedintegerwithvalidvaluesbetween1and
65535.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
Thisexampleshowshowtosetthehellointervalto5fortheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf hello-interval 5
ip ospf dead-interval
Usethiscommandtosetthenumberofsecondsaroutermustwaittoreceiveahellopacketfrom
itsneighborbeforedeterminingthattheneighborisoutofservice.Thenoformofthiscommand
setsthedeadintervalvaluetothedefaultvalueof40seconds.
Syntax
ip ospf dead-interval seconds
no ip ospf dead-interval
20-18
ip ospf authentication-key
Parameters
seconds
Specifiesthenumberofsecondsthataroutermustwaittoreceiveahello
packetbeforedeclaringtheneighborasdeadandremovingitfromthe
OSPFneighborlist.Deadintervalmustbethesameonneighboringrouters
(onaspecificsubnet),butcanvarybetweensubnets.Thisparameterisan
unsignedintegerrangingfrom1to65535.Defaultvalueis40seconds.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
Thisexampleshowshowtosetthedeadintervalto20fortheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf dead-interval 20
ip ospf authentication-key
UsethiscommandtoassignapasswordtobeusedbyneighboringroutersusingOSPFssimple
passwordauthentication.ThenoformofthiscommandremovesanOSPFauthentication
passwordonaninterface.
Syntax
ip ospf authentication-key password
no ip ospf authentication-key
Parameters
password
SpecifiesanOSPFauthenticationpassword.Validvaluesarealphanumeric
stringsupto8charactersinlength.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
ThispasswordisusedasakeythatisinserteddirectlyintotheOSPFheaderinroutingprotocol
packets.AseparatepasswordcanbeassignedtoeachOSPFnetworkonaperinterfacebasis.
Allneighboringroutersonthesamenetworkmusthavethesamepasswordconfiguredtobeable
toexchangeOSPFinformation.
20-19
Example
ThisexampleshowshowtoenablesanOSPFauthenticationkeyontheVLAN1interfacewiththe
passwordyourpass:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf authentication-key yourpass
Syntax
ip ospf message-digest-key keyid md5 key
no ip ospf message-digest-key keyid
Parameters
keyid
SpecifiesthekeyidentifierontheinterfacewhereMD5authenticationis
enabled.Validvaluesareintegersfrom1to255.
key
SpecifiesapasswordforMD5authenticationtobeusedwiththekeyid.Valid
valuesarealphanumericstringsofupto16characters.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenableOSPFMD5authenticationontheVLAN1interface,setthekey
identifierto20,andsetthepasswordtopassone:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip ospf message-digest-key 20 md5 passone
distance ospf
UsethiscommandtoconfiguretheadministrativedistanceforOSPFroutes.Thenoformofthis
commandresetsOSPFadministrativedistancetothedefaultvalues.
Syntax
distance ospf {external | inter-area | intra-area} weight
no distance ospf {external | inter-area | intra-area}
20-20
area range
Parameters
external|inter
area|intraarea
Appliesthedistancevaluetoexternal(type5andtype7),tointerarea,orto
intraarearoutes.
Note: The value for intra-area distance must be less than the value for
inter-area distance, which must be less than the value for external distance.
weight
SpecifiesanadministrativedistanceforOSPFroutes.Validvaluesare1
255.
Defaults
Ifroutetypeisnotspecified,thedistancevaluewillbeappliedtoallOSPFroutes.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
Ifseveralroutes(comingfromdifferentprotocols)arepresentedtotheSecureStackC3,the
protocolwiththelowestadministrativedistancewillbechosenforrouteinstallation.Bydefault,
OSPFadministrativedistanceissetto110.Thedistanceospfcommandcanbeusedtochangethis
value,resettingOSPFsroutepreferenceinrelationtootherroutesasshowninthetablebelow.
Route Source
Default Distance
Connected
Static
OSPF
RIP
15
Example
ThisexampleshowshowtochangethedefaultadministrativedistanceforexternalOSPFroutesto
100:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#distance ospf external 100
area range
UsethiscommandtodefinetherangeofaddressestobeusedbyAreaBorderRouters(ABRs)
whentheycommunicateroutestootherareas.EachSecureStackC3stackcansupportupto4
OSPFareas.Thenoformofthiscommandstopstheroutesfrombeingsummarized.
Syntax
area area-id range ip-address ip-mask [advertise | no-advertise]
no area area-id range ip-address ip-mask
20-21
area stub
Parameters
areaid
Specifiestheareafromwhichroutesaretobesummarized.Thisisa
decimalvaluefrom0to429496295.
ipaddress
SpecifiestheIPaddressassociatedwiththeareaID.
ipmask
SpecifiesthemaskfortheIPaddress.
advertise|no
advertise
(Optional)Entersaddressrangeinadvertisemode,ordonotadvertise
mode.
Defaults
Ifnotspecified,advertisemodewillbeset.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
Thisexampleshowshowtodefinetheaddressrangeas172.16.0.0/16forsummarizedroutesfrom
area0.0.0.8:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#area 0.0.0.8 range 172.16.0.0 255.255.0.0
area stub
UsethiscommandtodefineanOSPFareaasastubarea.ThisisanareaintowhichAutonomous
SystemexternalASAswillnotbeflooded.Thenoformofthiscommandchangesthestubbackto
aplainarea.
Syntax
area area-id stub [no-summary]
no area area-id stub [no-summary]
Parameters
areaid
Specifiesthestubarea.Validvaluesaredecimalvaluesoripaddresses.
nosummary
(Optional)PreventsanAreaBorderRouter(ABR)fromsendingLinkState
Advertisements(LSAs)intothestubarea.Whenthisparameterisused,it
meansthatalldestinationsoutsideofthestubareaarerepresentedby
meansofadefaultroute.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Defaults
Ifnosummaryisnotspecified,thestubareawillbeabletoreceiveLSAs.
20-22
Example
ThefollowingexampleshowshowtodefineOSPFarea10asastubarea:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#area 10 stub
Syntax
area area-id default-cost cost
no area area-id default-cost
Parameters
areaid
Specifiesthestubarea.ValidvaluesaredecimalvaluesorIPaddresses.
cost
Specifiesacostvalueforthesummaryroutethatissentintoastubareaby
default.Validvaluesare24bitnumbers,from0to16777215.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
TheuseofthiscommandisrestrictedtoABRsattachedtostubandNSSAareas.
Example
Thisexampleshowshowtosetthecostvalueforstubarea10to99:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#area 10 default-cost 99
area nssa
UsethiscommandtoconfigureanareaasaNotSoStubbyArea(NSSA).Thenoformofthis
commandchangestheNSSAbacktoaplainarea.
Syntax
area area-id nssa [default-information-originate]
no area area-id nssa [default-information-originate]
20-23
area virtual-link
Parameters
areaid
SpecifiestheNSSAarea.ValidvaluesaredecimalvaluesorIPaddresses.
default
information
originate
(Optional)GeneratesadefaultofType7intotheNSSA.Thisisusedwhen
therouterisanNSSAABR.
Defaults
Ifdefaultinformationoriginateisnotspecified,nodefaulttypewillbegenerated.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
AnNSSAallowssomeexternalroutesrepresentedbyexternalLinkStateAdvertisements(LSAs)
tobeimportedintoit.Thisisincontrasttoastubareathatdoesnotallowanyexternalroutes.
ExternalroutesthatarenotimportedintoanNSSAcanberepresentedbymeansofadefault
route.ThisconfigurationisusedwhenanOSPFinternetworkisconnectedtomultiplenonOSPF
routingdomains.
Example
Thisexampleshowshowtoconfigurearea10asanNSSAarea:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#area 10 nssa default-information-originate
area virtual-link
UsethiscommandtodefineanOSPFvirtuallink,whichrepresentsalogicalconnectionbetween
thebackboneandanonbackboneOSPFarea.Thenoformofthiscommandremovesthevirtual
linkand/oritsassociatedsettings.
Syntax
area area-id virtual-link router-id
no area area-id virtual-link router-id
Inadditiontothesyntaxabove,theoptionsforusingthiscommandare:
area area-id virtual-link router-id authentication-key key
no area area-id virtual-link router-id authentication-key key
area area-id virtual-link router-id dead-interval seconds
no area area-id virtual-link router-id dead-interval seconds
area area-id virtual-link router-id hello-interval seconds
no area area-id virtual-link router-id hello-interval seconds
area area-id virtual-link router-id retransmit-interval seconds
no area area-id virtual-link router-id retransmit-interval seconds
area area-id virtual-link router-id transmit-delay seconds
no area area-id virtual-link router-id transmit-delay seconds
20-24
redistribute
Parameters
areaid
Specifiesthetransitareaforthevirtuallink.Validvaluesaredecimalvalues
orIPaddresses.Atransitareaisanareathroughwhichavirtuallinkis
established.
routerid
SpecifiestherouterIDofthevirtuallinkneighbor.
authentication
keykey
Specifiesapasswordtobeusedbythevirtuallink.Validvaluesare
alphanumericstringsofupto8characters.Neighborvirtuallinkrouterson
anetworkmusthavethesamepassword.
deadinterval
seconds
Specifiesthenumberofsecondsthataroutermustwaittoreceiveahello
packetbeforedeclaringtheneighborasdeadandremovingitfromthe
OSPFneighborlist.Thisvaluemustbethesameforallvirtuallinksattached
toacertainsubnet,anditisavaluerangingfrom1to8192.
hellointerval
seconds
Specifiesthenumberofsecondsbetweenhellopacketsonthevirtuallink.
Thisvaluemustbethesameforallvirtuallinksattachedtoanetworkandit
isavaluerangingfrom1to8192.
retransmit
intervalseconds
Specifiesthenumberofsecondsbetweensuccessiveretransmissionsofthe
sameLSAs.Validvaluesaregreaterthantheexpectedamountoftime
requiredfortheupdatepackettoreachandreturnfromtheinterface,and
rangefrom1to8192.Defaultis5seconds.
transmitdelay
seconds
Specifiestheestimatednumberofsecondsbeforealinkstateupdatepacket
ontheinterfacetobetransmitted.Validvaluesrangefrom1to8192.Default
is1second.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
Thisexampleshowshowtoconfigureavirtuallinkovertransitionarea0.0.0.2torouterID
192.168.7.2:
C3(su)->router(Config)#router ospf 1
C3(su)->router(Config-router)#area 0.0.0.2 virtual-link 192.168.7.2
redistribute
UsethiscommandtoallowroutinginformationdiscoveredthroughnonOSPFprotocolstobe
distributedinOSPFupdatemessages.Thenoformofthiscommandclearsredistribution
parameters.
Syntax
redistribute {connected | rip | static} [metric metric value] [metric-type typevalue] [subnets]
no redistribute {connected | rip | static}
20-25
show ip ospf
Parameters
connected
SpecifiesthatnonOSPFinformationdiscoveredviadirectlyconnected
interfaceswillberedistributed.
rip
SpecifiesthatRIProutinginformationwillberedistributedinOSPF.
static
SpecifiesthatnonOSPFinformationdiscoveredviastaticrouteswillbe
redistributed.Staticroutesarethosecreatedusingtheiproutecommand
detailediniprouteonpage1921.
metricmetricvalue
(Optional)Specifiesametricfortheconnected,RIPorstaticredistribution
route.Thisvalueshouldbeconsistentwiththedesignationprotocol.
metrictypetype
value
(Optional)Specifiestheexternallinktypeassociatedwiththedefault
connected,RIPorstaticrouteadvertisedintotheOSPFroutingdomain.
Validvaluesare1fortype1externalroute,and2fortype2externalroute.
subnets
(Optional)Specifiesthatconnected,RIP,orstaticroutesthataresubnetted
routeswillberedistributed.
Defaults
Ifmetricvalueisnotspecified,0willbeapplied.
Iftypevalueisnotspecified,type2(externalroute)willbeapplied.
Ifsubnetsisnotspecified,onlytheshortestprefixmatchingrouteswillberedistributed.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
ThisexampleshowshowtoredistributeRIProutinginformationtononsubnettedroutesinOSPF
routes:
C3(su)->router(Config)#router ospf
C3(su)->router(Config-router)#redistribute rip
show ip ospf
UsethiscommandtodisplayOSPFinformation.
Syntax
show ip ospf
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
20-26
Example
ThisexampleshowshowtodisplayOSPFinformation:
C3(su)->router#show ip ospf
Routing process "ospf 1" with ID 155.155.155.155
Supports only Normal TOS route.
It is not an area border router and is an autonomous system boundary router.
Redistributing External Routes from static
Number of areas in this router is 2
Area 0.0.0.0
SPF algorithm executed 0 times
Area ranges are
Link State Age Interval is 10
Area 0.0.0.8
SPF algorithm executed 302 times
Area ranges are
Link State Age Interval is 10
Syntax
show ip ospf database
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayallOSPFlinkstatedatabaseinformation.Thisisaportionof
thecommandoutput:
C3(su)->router#show ip ospf database
OSPF Router with ID(155.155.155.155)
Displaying Ipnet Sum Link States(Area 0.0.0.0)
LinkID
ADV Router
Age
Seq#
192.168.16.0
155.155.155.155 1751
0x80000036
LinkID
191.2.2.0
191.3.3.3
191.3.3.4
191.3.3.5
191.3.3.6
191.3.3.7
191.3.3.8
191.3.3.9
Checksum
0x18a
Checksum
0x9096
0x5bc6
0x51cf
0x47d8
0x3de1
0x33ea
0x29f3
0x1ffc
20-27
191.4.0.0
155.155.155.155
1307
0x8000003c
0x8e98
Checksum
0xb6f9
0x6e96
Checksum
0x59ab
0xc07c
0xb586
0xaa90
Checksum
0x311d
0x3de1
0x32eb
0x27f5
0x1c00
Table 203providesanexplanationofthecommandoutput.
Table 20-3
Output Field
What It Displays...
Link ID
Link ID, which varies as a function of the link state record type, as follows:
Net Link States - Shows the interface IP address of the designated router to the
broadcast network.
Router Link States - Shows the ID of the router originating the record.
Summary Link States - Shows the summary network prefix.
ADV Router
Age
Seq#
Checksum
Field in the link state record used to verify the contents upon receipt by another
router.
LinkCount
Link count of router link state records. This number is equal to, or greater than, the
number of active OSPF interfaces on the originating router.
Syntax
show ip ospf interface [vlan vlan-id]
Parameters
vlanvlanid
20-28
(Optional)DisplaysOSPFinformationforaspecificVLAN.ThisVLAN
mustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
Defaults
Ifvlanidisnotspecified,OSPFstatisticswillbedisplayedforallVLANs.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayallOSPFrelatedinformationfortheVLAN6interface:
C3(su)->router#show ip ospf interface vlan 6
Vlan 6
Internet Address 192.168.6.2 Mask 255.255.255.0, Area 0.0.0.0
Router ID 3.3.3.3 , Cost: 10 (computed)
Transmit Delay is 1 sec , State designated-router , Priority 1
Designated Router id 3.3.3.3 , Interface Addr 192.168.6.2
Backup Designated Router id 2.2.2.2 ,
Timer intervals configured ,
Hello 10 , Dead 40 , Retransmit 5
Table 204providesanexplanationofthecommandoutput.
Table 20-4
Output Field
What It Displays...
Vlan
VLAN ID
Internet Address
Area
Area ID
Router ID
Cost
OSPF interface cost, which is either default, or assigned with the ip ospf cost
command. For details, refer to ip ospf cost on page 20-15.
Transmit Delay
The number (in seconds) added to the LSA (Link State Advertisement) age field.
State
The interface state (versus the state between neighbors). Valid values include
Backup Designated Router, Designated Router, and Err for error.
Priority
The interface priority value, which is either default, or assigned with the ip ospf
priority command. For details, refer to ip ospf priority on page 20-15.
Designated Router
id
The router ID of the designated router on this subnet, if one exists, in which case Err
will be displayed.
Interface Addr
Backup Designated
Router id
IP address of the backup designated router on this interface, if one exists, in which
case Err will be displayed.
Timer intervals
configured
OSPF timer intervals. These are either default, or configured with the ip ospf
retransmit-interval (ip ospf retransmit-interval on page 20-17), the ip ospf hellointerval (ip ospf hello-interval on page 20-18), the ip ospf retransmit-delay (ip
ospf transmit-delay on page 20-17) and the ip ospf dead interval (ip ospf deadinterval on page 20-18) commands.
20-29
Syntax
show ip ospf neighbor [detail] [ip-address] [vlan vlan-id]
Parameters
detail
(Optional)Displaysdetailedinformationabouttheneighbors,includingthe
areainwhichtheyareneighbors,whothedesignatedrouter/backup
designatedrouterisonthesubnet,ifapplicable,andthedecimalequivalent
oftheEbitvaluefromthehellopacketoptionsfield.
ipaddress
(Optional)DisplaysOSPFneighborsforaspecificIPaddress.
vlanvlanid
(Optional)DisplaysOSPFneighborsforaspecificVLAN.ThisVLANmust
beconfiguredforIProutingasdescribedinPreRoutingConfiguration
Tasksonpage181.
Defaults
Ifdetailisnotspecified,summaryinformationwillbedisplayed.
Ifipaddressisnotspecified,OSPFneighborswillbedisplayedforallIPaddressesconfiguredfor
routing.
Ifvlanidisnotspecified,OSPFneighborswillbedisplayedforallVLANsconfiguredforrouting.
Mode
Anyroutermode.
Example
Thisexampleshowshowtousetheshowospfneighborcommand:
C3(su)->router#show ip ospf neighbor
ID
Pri
State
Dead-Int
182.127.62.1
1
FULL
40
Address
182.127.63.1
Interface
vlan1
Table 205providesanexplanationofthecommandoutput.
Table 20-5
20-30
Output Field
What It Displays...
ID
Pri
State
Dead-Int
Interval (in seconds) this router will wait without receiving a Hello packet from a
neighbor before declaring the neighbor is down.
Address
Neighbors IP address.
Interface
Syntax
show ip ospf virtual-links
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayOSPFvirtuallinksinformation:
C3(su)->router#show ip ospf virtual-links
Neighbor ID 155.155.155.155
Transit area 0.0.0.8
Transmit delay is 1 sec State point-to-point
Timer intervals configured:
Hello 10, Dead 40, Retransmit 5
Adjacency State Full
Table 206providesanexplanationofthecommandoutput.
Table 20-6
Output Field
What It Displays...
Neighbor ID
ID of the virtual link neighbor, and the virtual link status, which is up or down.
Transit area
Transmit delay
State
Timer intervals
configured
Timer intervals configured for the virtual link, including Hello, Wait, and Retransmit
intervals.
Adjacency State
State of adjacency between this router and the virtual link neighbor of this router.
Syntax
clear ip ospf process process-id
20-31
Parameters
processid
SpecifiestheprocessID,aninternallyusedidentificationnumberforeach
instanceoftheOSPFroutingprocessrunonarouter.Validvaluesare1to
65535.
Defaults
None.
Mode
PrivilegedEXEC:C3(su)>router#
Example
ThisexampleshowshowtoresetOSPFprocess1:
C3(su)->router#clear ip ospf process 1
20-32
Configuring DVMRP
Configuring DVMRP
* Advanced License Required *
DVMRP is an advanced routing feature that must be enabled with a license key. If you have purchased an
advanced license key, and have enabled routing on the device, you must activate your license as described in
the chapter entitled Activating Licensed Features in order to enable the DVMRP command set. If you wish
to purchase an advanced routing license, contact Enterasys Networks Sales.
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of
multicast configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
Purpose
ToenableandconfiguretheDistanceVectorMulticastRoutingProtocol(DVMRP)onaninterface.
DVMRProutesmulticasttrafficusingatechniqueknownasReversePathForwarding.Whena
routerreceivesapacket,itfloodsthepacketoutofallpathsexcepttheonethatleadsbacktothe
packetssource.DoingsoallowsadatastreamtoreachallVLANs(possiblymultipletimes).Ifa
routerisattachedtoasetofVLANsthatdonotwanttoreceivefromaparticularmulticastgroup,
theroutercansendaprunemessagebackupthedistributiontreetostopsubsequentpackets
fromtravelingwheretherearenomembers.DVMRPwillperiodicallyrefloodinordertoreach
anynewhoststhatwanttoreceivefromaparticulargroup.
Note: IGMP must be enabled on all VLANs running DVMRP, and must also be globally enabled
on the SecureStack C3. For details on enabling IGMP, refer to Chapter 13.
Commands
Refer to page...
ip dvmrp
20-34
ip dvmrp enable
20-34
ip dvmrp metric
20-35
show ip dvmrp
20-35
Seealsoshowipmrouteonpage2059,whichcanbeusedtodisplaytheIPmulticastrouting
table.
20-33
ip dvmrp
Table 20-1
To do this...
ip dvmrp
UsethiscommandtoenabletheDVMRPprocess.Thenoformofthiscommanddisablesthe
DVMRPprocess:
Syntax
ip dvmrp
no ip dvmrp
Parameters
None.
Defaults
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
Example
ThisexampleshowshowtoenabletheDVMRPprocess:
C3(su)->router(Config)#ip dvmrp
ip dvmrp enable
UsethiscommandtoenableDVMRPonaninterface.Thenoformofthiscommanddisables
DVMRPonaninterface:
Syntax
ip dvmrp enable
no ip dvmrp enable
Parameters
None.
Defaults
None.
20-34
ip dvmrp metric
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenableDVMRPontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip dvmrp enable
ip dvmrp metric
UsethiscommandtoconfigurethemetricassociatedwithasetofdestinationsforDVMRP
reports.
Syntax
ip dvmrp metric metric
Parameters
metric
SpecifiesametricassociatedwithasetofdestinationsforDVMRP
reports.Validvaluesarefrom1to31.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
ToresettheDVMRPmetricbacktothedefaultvalueof1,enteripdvmrpmetric1.
Example
ThisexampleshowshowtosetaDVMRPof16ontheVLAN1interface:
C3(su)->router(Config-if(Vlan 1))#ip dvmrp metric 16
show ip dvmrp
UsethiscommandtodisplayDVMRProutinginformation.
Syntax
show ip dvmrp [route | neighbor | status]
Parameters
route|neighbor|
status
(Optional)Displays,DVMRProutinginformation,neighborinformation,
orDVMRPenablestatus.
20-35
show ip dvmrp
Defaults
Ifnooptionalparametersarespecified,statusinformationwillbedisplayed.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayDVMRPstatusinformation:
C3(su)->router#show ip dvmrp
Vlan Id
Metric
Admin Status
-----------------------10
Enabled
18
Enabled
20
Enabled
25
Enabled
32
Enabled
500
Enabled
20-36
Oper. Status
-----------Enabled
Enabled
Enabled
Enabled
Enabled
Disabled
Configuring IRDP
Configuring IRDP
Purpose
ToenableandconfiguretheICMPRouterDiscoveryProtocol(IRDP)onaninterface.Thisprotocol
enablesahosttodeterminetheaddressofarouteritcanuseasadefaultgateway.Itisdisabledby
default.
Commands
For information about...
Refer to page...
ip irdp enable
20-37
ip irdp maxadvertinterval
20-38
ip irdp minadvertinterval
20-38
ip irdp holdtime
20-39
ip irdp preference
20-39
ip irdp broadcast
20-40
show ip irdp
20-40
ip irdp enable
UsethiscommandtoenableIRDPonaninterface.ThenoformofthiscommanddisablesIRDPon
aninterface.
Syntax
ip irdp enable
no ip irdp enable
Parameters
None.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenableIRDPontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip irdp enable
20-37
ip irdp maxadvertinterval
ip irdp maxadvertinterval
UsethiscommandtosetthemaximumintervalinsecondsbetweenIRDPadvertisements.Theno
formofthiscommandresetsthemaximumadvertisementintervaltothedefaultvalueof600
seconds.
Syntax
ip irdp maxadvertinterval interval
no irdp maxadvertinterval
Parameters
interval
Specifiesamaximumadvertisementintervalinseconds.Validvaluesare
4to1800.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosetthemaximumIRDPadvertisementintervalto1000secondsonthe
VLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip irdp maxadvertinterval 1000
ip irdp minadvertinterval
UsethiscommandtosettheminimumintervalinsecondsbetweenIRDPadvertisements.Theno
formofthiscommanddeletesthecustomholdtimesetting,andresetstheminimum
advertisementintervaltothedefaultvalueofthreefourthsofthemaxadvertintervalvalue,which
isequalto450seconds.
Syntax
ip irdp minadvertinterval interval
no irdp minadvertinterval
Parameters
interval
Specifiesaminimumadvertisementintervalinseconds.Validvaluesare3
to1800.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
20-38
ip irdp holdtime
Example
ThisexampleshowshowtosettheminimumIRDPadvertisementintervalto500secondsonthe
VLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip irdp minadvertinterval 500
ip irdp holdtime
UsethiscommandtosetthelengthoftimeinsecondsIRDPadvertisementsareheldvalid.Theno
formofthiscommandresetstheholdtimetothedefaultvalueofthreetimesthe
maxadvertintervalvalue,whichisequalto1800seconds.
Syntax
ip irdp holdtime holdtime
no irdp holdtime
Parameters
holdtime
Specifiestheholdtimeinseconds.Validvaluesare0to
9000.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheIRDPholdtimeto4000secondsontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip irdp holdtime 4000
ip irdp preference
UsethiscommandtosettheIRDPpreferencevalueforaninterface.ThisvalueisusedbyIRDPto
determinetheinterfacesselectionasadefaultgatewayaddress.Thenoformofthiscommand
resetstheinterfacesIRDPpreferencevaluetothedefaultof0.
Syntax
ip irdp preference preference
no irdp preference
Parameters
preference
Specifiesthevaluetoindicatetheinterfacesuseasadefaultrouter
address.Validvaluesare2147483648to2147483647.
Theminimumvalueindicatesthattheaddress,eventhoughitmaybe
advertised,isnottobeusedbyneighboringhostsasadefaultrouter
address.
20-39
ip irdp broadcast
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosetIRDPpreferenceontheVLAN1interfacesothattheinterfaces
addressmaystillbeadvertised,butcannotbeusedbyneighboringhostsasadefaultrouter
address:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip irdp preference -2147483648
ip irdp broadcast
UsethiscommandtoconfigureIRDPtousethelimitedbroadcastaddressof255.255.255.255.The
defaultismulticastwithaddress224.0.0.1.ThenoformofthiscommandresetsIRDPtouse
multicastonIPaddress224.0.0.1.
Syntax
ip irdp broadcast
no ip irdp broadcast
Parameters
None.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenablebroadcastforIRDPontheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip irdp broadcast
show ip irdp
UsethiscommandtodisplayIRDPinformation.
Syntax
show ip irdp [vlan vlan-id]
20-40
show ip irdp
Parameters
vlanvlanid
(Optional)DisplaysIRDPinformationforaspecificVLAN.ThisVLAN
mustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
Defaults
Ifvlanvlanidisnotspecified,IRDPinformationforallinterfaceswillbedisplayed.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtodisplayIRDPinformationfortheVLAN1interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(vlan 1))#show ip irdp vlan 1
Interface vlan 1 has router discovery enabled
Advertisements will occur between 450 and 600 seconds
Advertisements are sent with broadcasts
Advertisements are valid for 1800 seconds
Default preference will be 0
20-41
Configuring VRRP
Configuring VRRP
* Advanced License Required *
VRRP is an advanced routing feature that must be enabled with a license key. If you have purchased an
advanced license key, and have enabled routing on the device, you must activate your license as described in
the chapter entitled Activating Licensed Features in order to enable the VRRP command set. If you wish to
purchase an advanced routing license, contact Enterasys Networks Sales.
Purpose
ToenableandconfiguretheVirtualRouterRedundancyProtocol(VRRP).Thisprotocoleliminates
thesinglepointoffailureinherentinthestaticdefaultroutedenvironmentbytransferringthe
responsibilityfromoneroutertoanotheriftheoriginalroutergoesdown.VRRPenabledrouters
decidewhowillbecomemasterandwhowillbecomebackupintheeventthemasterfails.
Commands
For information about...
Refer to page...
router vrrp
20-42
create
20-43
address
20-44
priority
20-45
advertise-interval
20-45
preempt
20-46
enable
20-47
ip vrrp authentication-key
20-48
show ip vrrp
20-48
router vrrp
UsethiscommandtoenableordisableVRRPconfigurationmode.Thenoformofthiscommand
removesallVRRPconfigurationsfromtherunningconfiguration.
Syntax
router vrrp
no router vrrp
Parameters
None.
Defaults
None.
Mode
Globalconfiguration:C3(su)>router(Config)#
20-42
create
Usage
Youmustexecutetheroutervrrpcommandtoenabletheprotocolbeforecompletingother
VRRPspecificconfigurationtasks.Fordetailsonenablingconfigurationmodes,refertoTable 182
onpage 182.
Example
ThisexampleshowshowenableVRRPconfigurationmode:
C3(su)->router#configure
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#
create
UsethiscommandtocreateaVRRPsession.EachSecureStackC3systemsupportsupto20VRRP
sessions.ThenoformofthiscommanddisablestheVRRPsession.
Syntax
create vlan vlan-id vrid
no create vlan vlan-id vrid
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANonwhichtocreateaVRRPsession.This
VLANmustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
vrid
SpecifiesauniqueVirtualRouterID(VRID)toassociatewiththerouting
interface.
Defaults
None.
Mode
Router configuration: C3(su)->router(Config-router)#
Usage
ThiscommandmustbeexecutedtocreateaninstanceofVRRPonaroutinginterface(VLAN)
beforeanyotherVRRPsettingscanbeconfigured.
Example
ThisexampleshowshowtocreateaVRRPsessionontheVLAN1interfacewithaVRIDof1:
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#create vlan 1 1
20-43
address
address
UsethiscommandtoconfigureavirtualrouterIPaddress.Thenoformofthiscommandclears
theVRRPaddressconfiguration.
Syntax
address vlan vlan-id vrid ip-address owner
no address vlan vlan-id vrid ip-address owner
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANonwhichtoconfigureavirtualrouter
address.ThisVLANmustbeconfiguredforIProutingasdescribedinPre
RoutingConfigurationTasksonpage181.
vrid
SpecifiesauniqueVirtualRouterID(VRID)associatedwiththerouting
interface.
ipaddress
SpecifiesthevirtualrouterIPaddresstoassociatewiththerouter.
owner
SpecifiesavaluetoindicateiftherouterownstheIPaddressasoneofits
interfaces.Validvaluesare:
1toindicatetherouterownstheaddress.
0toindicatetherouterdoesnotowntheaddress.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
IfthevirtualrouterIPaddressisthesameastheinterface(VLAN)addressownedbyaVRRP
router,thentherouterowningtheaddressbecomesthemaster.Themastersendsan
advertisementtoallotherVRRProutersdeclaringitsstatusandassumesresponsibilityfor
forwardingpacketsassociatedwithitsvirtualrouterID(VRID).
IfthevirtualrouterIPaddressisnotownedbyanyoftheVRRProuters,thentherouterscompare
theirprioritiesandthehigherpriorityownerbecomesthemaster.Ifpriorityvaluesarethesame,
thentheVRRProuterwiththehigherIPaddressisselectedmaster.Fordetailsonusingthe
prioritycommand,refertopriorityonpage2045.
Example
Thisexampleshowshowtoconfigureavirtualrouteraddressof182.127.62.1ontheVLAN1
interface,VRID1,andtosettherouterconnectedtotheVLANviathisinterfaceasthemaster:
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#address vlan 1 1 182.127.62.1 1
20-44
priority
priority
UsethiscommandtosetapriorityvalueforaVRRProuter.Thenoformofthiscommandclears
theVRRPpriorityconfiguration.
Syntax
priority vlan vlan-id vrid priority-value
no priority vlan vlan-id vrid priority-value
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANonwhichtoconfigureVRRPpriority.
ThisVLANmustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
vrid
SpecifiesauniqueVirtualRouterID(VRID)associatedwiththerouting
interface.Validvaluesarefrom1to255.
priorityvalue
SpecifiestheVRRPpriorityvaluetoassociatewiththevrid.Validvaluesare
from1to254,withthehighestvaluesettingthehighestpriority.Priority
valueof255isreservedfortheVRRProuterthatownstheIPaddress
associatedwiththevirtualrouter.Priority0isreservedforsignalingthatthe
masterhasstoppedworkingandthebackuproutermusttransitionto
masterstate.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
ThisexampleshowshowsetaVRRPpriorityof200ontheVLAN1interface,VRID1:
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#priority vlan 1 1 200
advertise-interval
UsethiscommandtosettheintervalinsecondsbetweenVRRPadvertisements.Thenoformof
thiscommandclearstheVRRPadvertiseintervalvalue.
Syntax
advertise-interval vlan vlan-id vrid interval
no advertise-interval vlan vlan-id vrid interval
20-45
preempt
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANonwhichtoconfiguretheVRRP
advertisementinterval.ThisVLANmustbeconfiguredforIProutingas
describedinPreRoutingConfigurationTasksonpage181.
vrid
SpecifiesauniqueVirtualRouterID(VRID)associatedwiththerouting
interface.Validvaluesarefrom1to255.
interval
SpecifiesaVRRPadvertisementintervaltoassociatewiththevrid.Valid
valuesarefrom1to255seconds.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
VRRPadvertisementsaresentbythemasterroutertootherroutersparticipatingintheVRRP
masterselectionprocess,informingthemofitsconfiguredvalues.Oncethemasterisselected,
thenadvertisementsaresenteveryadvertisingintervaltoletotherVRRProutersinthisVLAN/
VRIDknowtherouterisstillactingasmasteroftheVLAN/VRID.
AllrouterswiththesameVRIDshouldbeconfiguredwiththesameadvertisementinterval.
Example
Thisexampleshowshowsetanadvertiseintervalof3secondsontheVLAN1interface,VRID1:
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#advertise-interval vlan 1 1 3
preempt
UsethiscommandtoenableordisablepreemptmodeonaVRRProuter.Thenoformofthis
commanddisablespreemptmode.
Syntax
preempt vlan-id vrid
no preempt vlan-id vrid
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANonwhichtosetpreemptmode.This
VLANmustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
vrid
SpecifiesauniqueVirtualRouterID(VRID)associatedwiththerouting
interface.Validvaluesarefrom1to255.
Defaults
None.
20-46
enable
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Usage
PreemptisenabledonVRRProutersbydefault,whichallowsahigherprioritybackuprouterto
preemptalowerprioritymaster.
TherouterthatownsthevirtualrouterIPaddressalwayspreemptsotherrouters,regardlessof
thissetting.
Example
ThisexampleshowshowtodisablepreemptmodeontheVLAN1interface,VRID1:
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#no preempt vlan 1 1
enable
UsethiscommandtoenableVRRPonaninterface.ThenoformofthiscommanddisablesVRRP
onaninterface.
Syntax
enable vlan vlan-id vrid
no enable vlan vlan-id vrid
Parameters
vlanvlanid
SpecifiesthenumberoftheVLANonwhichtoenableVRRP.ThisVLAN
mustbeconfiguredforIProutingasdescribedinPreRouting
ConfigurationTasksonpage181.
vrid
SpecifiestheVirtualRouterID(VRID)associatedwiththevlanid.Valid
valuesarefrom1to255.
Defaults
None.
Mode
Routerconfiguration:C3(su)>router(Configrouter)#
Example
ThisexampleshowshowtoenableVRRPontheVLAN1interface,VRID1:
C3(su)->router(Config)#router vrrp
C3(su)->router(Config-router)#enable vlan 1 1
20-47
ip vrrp authentication-key
ip vrrp authentication-key
UsethiscommandtoenableordisableaVRRPauthenticationkey(password)foruseonan
interface.ThenoformofthiscommandpreventsVRRPfromusingauthentication.
Syntax
ip vrrp authentication-key name
no ip vrrp authentication-key
Parameters
name
SpecifiesthepasswordtoenableordisableforVRRPauthentication.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtosettheVRRPauthenticationkeychaintopasswordontheVLAN1
interface:
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip vrrp authentication-key password
show ip vrrp
UsethiscommandtodisplayVRRProutinginformation.
Syntax
show ip vrrp
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayVRRPinformation
C3(su)->router(Config)#show ip vrrp
-----------VRRP CONFIGURATION----------Vlan
Vrid
State
Owner AssocIpAddr
2
1
Initialize
0 25.25.2.1
20-48
Priority
100
Configuring PIM-SM
Configuring PIM-SM
* Advanced License Required *
PIM-SM is an advanced routing feature that must be enabled with a license key. If you have purchased an
advanced license key, and have enabled routing on the device, you must activate your license as described in
the chapter entitled Activating Licensed Features in order to enable the PIM-SM command set. If you wish
to purchase an advanced routing license, contact Enterasys Networks Sales.
Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of
multicast configuration is located on the Enterasys Networks web site:
http://www.enterasys.com/support/manuals/
Design Considerations
Enterasys Networksrecommendsthatadministratorsconsiderthefollowingrecommendations
beforeconfiguringtheSecureStackC3foraPIMSMenvironment.
ASecureStackC3cannotbeconfiguredasaCandidateRPoraCandidateBSR.
ASecureStackC3shouldnotbethefirsthoprouterforamulticaststream.Inotherwords,the
multicaststreamshouldnotoriginateonaSecureStackC3.
ASecureStackC3shouldnotbepositionedinthecoreofaPIMSMtopology,andshould
onlybepositionedattheedgeinaPIMSMtopology.Inotherwords,theSecureStackC3
shouldonlybeusedtodelivermulticaststreamstoendclients.
Purpose
ToenableandconfigureProtocolIndependentMulticastinSparseMode(PIMSM).Thisprotocol
providesthemeansofdynamicallylearninghowtoforwardmulticasttrafficinanenvironment
wheregroupmembersaresparselylocatedthroughoutthenetworkandbandwidthislimited.In
situationswheremembersaredenselylocatedandbandwidthisplentiful,DVMRPwouldsuffice
(seeConfiguringDVMRPonpage2033.)
PIMSMdeterminesthenetworktopologyusingtheunderlyingunicastroutingprotocoltobuild
aMulticastRoutingInformationBase(MRIB).
Note: IGMP must be enabled on all VLANs running PIM-SM, and must also be globally enabled
on the SecureStack C3. For details on enabling IGMP, refer to Chapter 13.
Commands
For information about...
Refer to page...
20-50
ip pimsm staticrp
20-50
20-51
ip pimsm query-interval
20-52
20-49
ip pimsm
Refer to page...
Display commands
show ip pimsm
20-52
20-53
20-54
20-55
show ip pimsm rp
20-56
20-57
20-58
show ip mroute
20-59
ip pimsm
ThiscommandsetsadministrativemodeofPIMSMmulticastroutingacrosstherouterto
enabled.IGMPmustbeenabledbeforePIMSMcanbeenabled.Bydefault,bothIGMPandPIM
aregloballydisabled.ThenoformofthiscommanddisablesPIMSM(acrosstheentirestack,if
applicable).
Syntax
ip pimsm
no ip pimsm
Parameters
None.
Defaults
None.
Mode
Globalrouterconfiguration:C3(su)>router(Config)#
Example
ThisexampleshowshowtogloballyenableanddisablePIM:
C3(su)->router(Config)# ip pimsm
C3(su)->router(Config)# no ip pimsm
ip pimsm staticrp
ThiscommandisusedtocreateamanualRendezvousPointIPaddressforthePIMSMrouter.
ThenoformofthiscommandremovesapreviouslyconfiguredRP.
Syntax
ip pimsm staticrp ipaddress groupadress groupmask
no ip pimsm staticrp ipaddress groupadress groupmask
20-50
ip pimsm enable
Parameters
ipaddress
TheIPaddressoftheRendezvousPoint
groupadress
ThegroupaddresssupportedbytheRendezvousPoint
groupmask
Thegroupmaskforthegroupaddress
Defaults
None.
Mode
GlobalRouterconfiguration:C3(su)>router(Config)#
Example
ThisexampleshowshowtosetanRPforaspecificmulticastgroup.
C3(su)->router(Config)# ip pimsm staticrp 192.15.18.3 224.0.0.0 240.0.0.0
ip pimsm enable
ThiscommandsetstheadministrativemodeofPIMSMmulticastroutingonaroutinginterfaceto
enabled.Bydefault,PIMisdisabledonallIPinterfaces.Thenoformofthiscommanddisables
PIMonthespecificinterface.
Syntax
ip pimsm enable
no ip pimsm enable
Parameters
None.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
ThisexampleshowshowtoenablePIMonIPinterfaceforVLAN1.
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip pimsm enable
20-51
ip pimsm query-interval
ip pimsm query-interval
Thiscommandconfiguresthetransmissionfrequencyofhellomessagesinsecondsbetween
PIMenabledneighbors.Thenoformofthiscommandresetsthehellointervaltothedefault,30
seconds.
Syntax
ip pimsm query-interval seconds
no ip pimsm query-interval
Parameters
seconds
Thisfieldhasarangeof10to3600seconds.Defaultis30.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Example
Thisexampleshowshowtosetthehellointervalrateto100seconds.
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip pimsm query-interval 100
show ip pimsm
UsethiscommandtodisplaysystemwidePIMSMroutinginformation.
Syntax
show ip pimsm
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayPIMinformation.
C3(su)->router# show ip pimsm
Admin Mode Enable
Join/Prune Interval (secs) 60
20-52
Protocol State
---------------Non-Operational
Operational
Operational
Operational
Operational
Non-Operational
Non-Operational
Non-Operational
Table 207providesanexplanationofthecommandoutput.
Table 20-7
Output Field
What it displays
Admin Mode
Join/Prune Interval
(secs)
This field shows the interval at which periodic PIM-SM Join/Prune messages are to
be sent.
VlanId
Interface Mode
This field indicates whether PIM-SM is enabled or disabled on the interface. This is a
configured value.
Protocol State
This field indicates the current state of the PIM-SM protocol on the interface.
Possible values are Operational or Non-Operational.
Syntax
show ip pimsm componenttable
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayPIMrouterinformation:
C3(su)->router> show ip pimsm componenttable
20-53
COMPONENT TABLE
Component
Index
Component
BSR Address
Component
BSR Expiry Time
(hh:mm:ss)
--------------- --------------192.168.30.2
00:02:10
---------1
Component
CRP Hold Time
(hh:mm:ss)
------------00:00:00
Table 208providesanexplanationofthecommandoutput.
Table 20-8
Output Field
What it displays
Component Index
Component BSR
Address
This field displays the IP address of the bootstrap router (BSR) for the local PIM
region.
Component BSR
Expiry Time
This field displays the minimum time remaining before the BSR in the local domain
will be declared down.
Component CRP
Hold Time
This field displays the hold time of the component when it is a candidate rendezvous
point.
Syntax
show ip pimsm interface {vlan vlan-id | stats {vlan-id | all}}
Parameters
vlanvlanid
DisplayPIMSMinformationforthespecifiedIPinterfaceenabledfor
PIM.
stats
DisplayPIMSMinterfacestatistics.
vlanid|all
DisplaystatisticsforaspecificVLANorallVLANs.
Defaults
None.
Mode
Anyroutermode.
Examples
ThisexampleshowshowtodisplayPIMinterfaceinformation.
.
20-54
30
192.168.30.1
255.255.255.0
enable
30 secs
-1
-1
30
Table 209providesanexplanationoftheshowippimsminterfacevlancommandoutput.
Table 20-9
Output Field
What it displays
IP Address
Subnet Mask
Mode
Hello Interval
Indicates the frequency at which PIM hello messages are transmitted on this
interface. This is a configured value. By default, the value is 30 seconds
CBSR Preference
The preference value for the local interface as a candidate bootstrap router.
CRP Preference
ThisexampleshowshowtodisplayPIMinterfacestatistics.
.
IP Address
--------------192.168.6.2
192.168.7.1
192.168.8.1
192.168.30.1
Subnet Mask
--------------255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
Neighbor
Designated Router count
----------------- ---------0.0.0.0
0
192.168.7.1
0
0.0.0.0
0
192.168.30.2
1
Table 2010providesanexplanationoftheshowippimsminterfacestatscommandoutput.
Table 20-10
Output Field
What it displays
IP Address
Subnet Mask
Designated Router
Neighbor Count
Syntax
show ip pimsm neighbor [vlan-id]
20-55
show ip pimsm rp
Parameters
vlanid
(Optional)DisplayallneighborsdiscoveredonaspecificInterface.
Mode
Anyroutermode.
Defaults
IftheVLANidisomitted,allneighborsoffallinterfaceswillbedisplayed.
Example
ThisexampleshowshowtodisplayPIMinformation:
C3(su)->router> show ip pimsm neighbor
Vlan ID
--------30
6
NEIGHBOR TABLE
IP Address
Up Time
(hh:mm:ss)
---------------- ---------192.168.30.2
01:36:41
192.168.6.1
01:36:41
Expiry Time
(hh:mm:ss)
-----------00:01:25
00:01:25
Table 2011providesanexplanationofthecommandoutput.
Table 20-11
Output Field
What it displays
Vlan ID
IP Address
Up Time
The time since this neighbor has become active on this interface.
Expiry Time
show ip pimsm rp
ThiscommanddisplaysthePIMinformationforcandidateRendezvousPoints(RPs)forallIP
multicastgroupsorforaspecificgroupaddress.Theinformationinthetableisdisplayedforeach
IPmulticastgroup.
Syntax
show ip pimsm rp {group-address group-mask | all | candidate}
Parameters
20-56
groupaddress
ThemulticastgroupIPaddress.
groupmask
Themulticastgroupaddresssubnetmask.
all
Forallknowngroupaddresses.
candidate
DisplayPIMSMcandidateRPtableinformation.
Defaults
None.
Mode
Anyroutermode.
Examples
ThisexampleshowshowtodisplaytheRPsetforaspecificgroupaddress.
C3(su)->router> show ip pimsm rp 224.0.0.0 240.0.0.0
RP SET TABLE
Group
Address
Group Mask
Address
Table 2012providesanexplanationofthecommandoutput.
Table 20-12
Output Field
What it displays
Group Address
Group Mask
Address
Hold Time
Expiry Time
Component
C-RP Priority
ThisexampleshowshowtodisplaythecandidateRPsforeachgroupaddress.
C3(su)->router> show ip pimsm rp candidate
CANDIDATE RP TABLE
Group Address
Group Mask
Address
--------------- --------------- --------------224.0.0.0
240.0.0.0
192.168.30.2
Syntax
show ip pimsm rphash group-address
20-57
Parameters
groupaddress
TheGroupAddressfortheRP.
Defaults
None.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayRPthatwillbeselectedforgroupaddress224.0.0.0:
C3(su)->router> show ip pimsm rphash 224.0.0.0
192.168.129.223
Syntax
show ip pimsm staticrp
Parameters
None.
Mode
Anyroutermode.
Defaults
None.
Example
ThisexampleshowshowtodisplayPIMinformation.
C3(su)->router# show ip pimsm staticrp
STATIC RP TABLE
Address
Group Address
Group Mask
--------------- --------------- --------------123.231.111.121 234.0.0.0
255.0.0.0
192.168.129.223 224.0.0.0
240.0.0.0
Table 2013providesanexplanationofthecommandoutput.
20-58
show ip mroute
Table 20-13
Output Field
What it displays
Address
Group Address
Group Mask
show ip mroute
UsethiscommandtodisplaytheIPmulticastroutingtable.
Syntax
show ip mroute
Parameters
None.
Defaults
None.
Mode
Anyroutermode.
Usage
Themulticastroutingtableshowshowamulticastroutingprotocol,suchasPIMandDVMRP,
willforwardamulticastpacket.Informationinthetableincludessourcenetwork/maskand
upstreamneighbors.
ForinformationaboutDVMRP,seeConfiguringDVMRPonpage2033.
Example
Thisexampleshowstheoutputofthiscommand.
C3(su)->router#show ip mroute
Active IP Multicast Sources
Flags: D - Dense, S - Sparse, C - Connected, L - Local,P - Pruned, R - RP-bit set,
F - Register flag, T - SPT-bit set,Outgoing interface flags: H - Hardware switched
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
Source Network
:
Source Mask
:
MultiCast Group :
Uptime
:
Upstream Neighbor:
Upstream Vlan
:
Downstream Vlans :
192.168.111.10
0.0.0.0
239.1.8.9
6336
0.0.0.0
111
8
Source Network
Source Mask
MultiCast Group
Uptime
192.168.111.10
0.0.0.0
239.1.7.105
6336
:
:
:
:
20-59
show ip mroute
20-60
Source Network
:
Source Mask
:
MultiCast Group :
Uptime
:
Upstream Neighbor:
Upstream Vlan
:
Downstream Vlans :
192.168.111.10
0.0.0.0
239.1.8.169
6582
0.0.0.0
111
8
Source Network
:
Source Mask
:
MultiCast Group :
Uptime
:
Upstream Neighbor:
Upstream Vlan
:
Downstream Vlans :
192.168.111.10
0.0.0.0
239.1.4.173
6582
0.0.0.0
111
8
21
IPv6 Management
ThischapterdescribestheswitchmodesetofcommandsusedtomanageIPv6.
Purpose
ToenableordisabletheIPv6managementfunction,toconfigureanddisplaytheIPv6host
addressandIPv6gatewayfortheswitch,andtodisplayIPv6statusinformation.
Commands
For information about...
Refer to page...
21-1
set ipv6
21-2
21-3
21-4
21-4
21-5
21-6
21-6
21-7
ping ipv6
21-8
traceroute ipv6
21-9
Syntax
show ipv6 status
Parameters
None.
21-1
set ipv6
Defaults
None.
Mode
Switchmode,readonly.
Example
ThisexampleshowshowtodisplayIPv6managementfunctionstatus.
C3(ro)->show ipv6 status
IPv6 Administrative Mode: Disabled
set ipv6
UsethiscommandtogloballyenableordisabletheIPv6managementfunction.
Syntax
set ipv6 {enable | disable}
Parameters
enable|disable
EnableordisabletheIPv6managementfunction.
Defaults
Bydefault,IPv6managementisdisabled.
Mode
Switchmode,readwrite.
Usage
WhenyouenableIPv6managementontheswitch,thesystemautomaticallygeneratesalinklocal
hostaddressfortheswitchfromthehostMACaddress.YoucansetadifferenthostIPv6address
withthesetipv6addresscommand.
Example
ThisexampleshowshowtoenableIPv6management.
C3(su)-> set ipv6 enable
C3(su)->show ipv6 status
IPv6 Administrative Mode: Enabled
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
21-2
IPv6 Management
Syntax
set ipv6 address ipv6-addr/prefix-length [eui64]
Parameters
ipv6addr
TheIPv6addressorprefixtobeconfigured.Thisparametermustbeinthe
formdocumentedinRFC4291,withtheaddressspecifiedinhexadecimal
using16bitvaluesbetweencolons.
prefixlength
ThelengthoftheIPv6prefixforthisaddress.Thevalueofprefixlengthisa
decimalnumberindicatingthenumberofhighordercontiguousbitsofthe
addressthatcomprisethenetworkportionoftheaddress.
eui64
(Optional)FormulatetheIPv6addressusinganEUI64IDinthelower
order64bitsoftheaddress.
Defaults
NoglobalunicastIPv6addressisdefinedbydefault.
Mode
Switchmode,readwrite.
Usage
UsethiscommandtomanuallyconfigureaglobalunicastIPv6addressforIPv6management.You
canspecifytheaddresscompletely,oryoucanusetheoptionaleui64parametertoallowthe
switchtogeneratethelowerorder64bitsoftheaddress.
Whenusingtheeui64parameter,youspecifyonlythenetworkprefixandlength.
Examples
ThisexampleshowshowtocompletelyspecifyanIPv6addressbyenteringall128bitsandthe
prefix:
C3(su)->set ipv6 address 2001:0db8:1234:5555::9876:2/64
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
host
2001:DB8:1234:5555::9876:2/64
Thisexampleshowshowtousetheeui64parametertoconfigurethelowerorder64bits:
C3(su)->set ipv6 address 2001:0db8:1234:5555::/64 eui64
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
host
2001:DB8:1234:5555:201:F4FF:FE5C:2880/64
21-3
Syntax
show ipv6 address
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Usage
ThiscommanddisplaystheIPv6addressesconfiguredautomaticallyandwiththesetipv6
addressandsetipv6gatewaycommands.
Example
ThisexampledisplaysthreeIPv6managementaddressesconfiguredfortheswitch.
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
host
2001:DB8:1234:5555:201:F4FF:FE5C:2880/64
gateway
FE80::201:F4FF:FE5D:1234
Syntax
clear ipv6 [address {all|ipv6-addr/prefix-length}]
Parameters
ipv6addr
TheIPv6addresstobecleared.Thisparametermustbeintheform
documentedinRFC4291,withtheaddressspecifiedinhexadecimalusing
16bitvaluesbetweencolons.
prefixlength
ThelengthoftheIPv6prefixforthisaddress.Thevalueofprefixlengthisa
decimalnumberindicatingthenumberofhighordercontiguousbitsofthe
addressthatcomprisethenetworkportionoftheaddress.
all
DeletesallIPv6globaladdresses.
Defaults
Ifaddressisnotentered,allmanuallyconfiguredglobalIPv6addressesarecleared.
21-4
IPv6 Management
Mode
Switchmode,readwrite.
Usage
Thiscommandclearsaddressesmanuallyconfiguredwiththesetipv6addresscommand.Usethe
clearipv6gatewaycommandtocleartheIPv6gatewayaddress.
Example
ThisexampleillustratesthatthiscommandclearsonlythoseIPv6addressesconfiguredwiththe
setipv6addresscommand.Thelinklocaladdressforthehostinterfaceandthegatewayaddress
arenotremovedwiththiscommand.
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
host
2001:DB8:1234:5555:201:F4FF:FE5C:2880/64
host
2001:DB8:1234:5555::9876:2/64
gateway
FE80::201:F4FF:FE5D:1234
C3(su)->clear ipv6 address all
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
gateway
FE80::201:F4FF:FE5D:1234
Syntax
set ipv6 gateway ipv6-addr
Parameters
ipv6addr
TheIPv6addresstobeconfigured.Theaddresscanbeaglobalunicastor
linklocalIPv6address,intheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
Defaults
None.
Mode
Switchmode,readwrite.
Usage
ThiscommandconfigurestheIPv6gatewayaddress.OnlyoneIPv6gatewayaddresscanbe
configuredfortheswitch,soexecutingthiscommandwhenagatewayaddresshasalreadybeen
configuredwilloverwritethepreviouslyconfiguredaddress.
21-5
Usetheshowipv6addresscommandtodisplayaconfiguredIPv6gatewayaddress.
Example
ThisexampleshowshowtoconfigureanIPv6gatewayaddressusingalinklocaladdress.
C3(su)->set ipv6 gateway fe80::201:f4ff:fe5d:1234
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
gateway
FE80::201:F4FF:FE5D:1234
Syntax
clear ipv6 gateway
Parameters
None.
Defaults
None.
Mode
Switchmode,readwrite.
Example
ThisexampleshowshowtoremoveaconfiguredIPv6gatewayaddress.
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
gateway
FE80::201:F4FF:FE5D:1234
C3(su)->clear ipv6 gateway
C3(su)->show ipv6 address
Name
IPv6 Address
--------------------------------------------------host
FE80::201:F4FF:FE5C:2880/64
Syntax
show ipv6 neighbors
21-6
IPv6 Management
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowsexampleoutputofthiscommand.
C3(su)->show ipv6 neighbors
Last
IPv6 Address
MAC Address
isRtr State
Updated
--------------------------------------- ----------------- ----- ------- ------2001:db8:1234:6666::2310:3
00:04:76:73:42:31 True Reachable 00:01:16
Syntax
show ipv6 netstat
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowstheoutputofthiscommand.
C3(su)->show ipv6 netstat
Prot Local
Address
Foreign Address
---- -------------------------------------------TCP 3333::211:88FF:FE59:4424.22
2020::D480:1384:F58C:B114.1049
TCP 3333::211:88FF:FE59:4424.443
2020::D480:1384:F58C:B114.1056
TCP ::.23
::.*
TCP 3333::211:88FF:FE59:4424.22
2020::D480:1384:F58C:B114.1050
TCP 3333::211:88FF:FE59:4424.22
3333::2117:F1C0:90B:910D.1045
TCP ::.80
State
----------ESTABLISHED
TIME_WAIT
LISTEN
ESTABLISHED
ESTABLISHED
LISTEN
21-7
ping ipv6
TCP
TCP
TCP
TCP
TCP
TCP
::.*
::.22
::.*
LISTEN
3333::211:88FF:FE59:4424.80
2020::D480:1384:F58C:B114.1053
3333::211:88FF:FE59:4424.80
2020::D480:1384:F58C:B114.1054
::.443
::.*
3333::211:88FF:FE59:4424.22
2020::D480:1384:F58C:B114.1048
3333::211:88FF:FE59:4424.443
2020::D480:1384:F58C:B114.1055
ESTABLISHED
ESTABLISHED
LISTEN
ESTABLISHED
TIME_WAIT
ping ipv6
UsethiscommandtotestroutingnetworkconnectivitybysendingIPpingrequests.
Syntax
ping ipv6-addr [size num]
Parameters
ipv6addr
SpecifiestheIPv6addressofthesystemtoping.Entertheaddressinthe
formdocumentedinRFC4291,withtheaddressspecifiedinhexadecimal
using16bitvaluesbetweencolons.
sizenum
(Optional)Specifiesthesizeofthedatagrampacket.Thevalueofnumcan
rangefrom48to2048bytes.
Defaults
None.
Mode
Switchmode,readwrite.
Usage
Thiscommandisalsoavailableinroutermode.
Examples
ThisexampleshowsoutputfromasuccessfulpingtoIPv6address2001:0db8:1234:5555::1234:1.
C3(su)->ping ipv6 2001:0db8:1234:5555::1234:1
2001:DB8:1234:5555::1234:1 is alive
ThisexampleshowsoutputfromanunsuccessfulpingtoIPv6address
2001:0db8:1234:5555::1234:1.
C3(su)->ping ipv6 2001:0db8:1234:5555::1234:1
no answer from 2001:DB8:1234:5555::1234:1
21-8
IPv6 Management
traceroute ipv6
traceroute ipv6
Usethiscommandtodiscovertheroutesthatpacketsactuallytakewhentravelingtotheir
destinationthroughthenetworkonahopbyhopbasis.
Syntax
traceroute ipv6 ipv6-addr
Parameters
ipv6addr
SpecifiesahosttowhichtherouteofanIPv6packetwillbetraced.Enterthe
addressintheformdocumentedinRFC4291,withtheaddressspecifiedin
hexadecimalusing16bitvaluesbetweencolons.
Defaults
None.
Mode
Switchmode,readwrite.
Usage
Thiscommandisalsoavailableinroutermode.
Example
Thisexampleshowshowtousetraceroutetodisplayaroundtrippathtohost
2001:0db8:1234:5555
C3(su)->router#traceroute ipv6 2001:0db8:1234:5555::1
Traceroute to 2001:0db8:1234:5555, 30 hops max, 40 byte packets
1 2001:0db8:1234:5555
1.000000e+00 ms
1.000000e+00 ms
1.000000e+00 ms
21-9
traceroute ipv6
21-10
IPv6 Management
22
IPv6 Configuration
* IPv6 Routing License Required *
IPv6 routing must be enabled with a license key. If you have purchased an IPv6 routing license key, and have
enabled routing on the device, you must activate your license as described in the chapter entitled Activating
Licensed Features in order to enable the IPv6 routing configuration command set. If you wish to purchase an
IPv6 routing license, contact Enterasys Networks Sales.
ThecommandsinthischapterperformconfigurationofIPv6parametersontheSecureStackC3.
ForinformationaboutspecificIPv6routingprotocols,suchasOSFPv3,refertotheappropriate
chapters.ForinformationaboutmanagingIPv6functionalityattheswitchlevel,referto
Chapter 21,IPv6Management.
For information about...
Refer to page...
22-3
22-10
22-14
Query Commands
22-22
Overview
IPv6andIPv4coexistontheSecureStackC3.AswithIPv4,IPv6routingcanbeenabledonVLAN
interfaces.EachLayer3routinginterfacecanbeusedforIPv4,IPv6,orboth.
TheSecureStackC3supportsallIPv6addressformats,includingglobalunicastaddresses,link
localunicast,globalmulticast,scopedmulticast(includinglocalscopedmulticast),IPv4
compatibleaddresses,unspecifiedaddresses,loopbackaddresses,andanycastaddresses.
RefertothefollowingRFCsformoreinformationaboutIPv6addressformats:
RFC4291,IPVersion6AddressingArchitecture
RFC3587,IPv6GlobalUnicastAddressFormat
RFC4007,IPv6ScopedAddressArchitecture
ThebasicIPv6protocolspecifiesPDUoptionsoftwoclasses,bothofwhicharesupported:hop
byhopoptionsanddestinationoptions.Whilenewoptionscanbedefinedinthefuture,the
followingarecurrentlysupported:routing(forsourcerouting),fragment,routeralertandpad.
Jumbogramsarenotsupported.InIPv6,onlysourcenodesfragment.PathMTUdiscoveryis
thereforearequirement.Flowlabelsareignored.
NeighborDiscoveryistheIPv6replacementforARP.TheSecureStackC3supportsneighbor
advertiseandsolicit,duplicateaddressdetection,andunreachabilitydetection.Router
AdvertisementispartoftheNeighborDiscoveryprocessandisrequiredforIPv6.Stateless
SecureStack C3 Configuration Guide
22-1
Overview
autoconfigurationispartofRouterAdvertisementandtheSecureStackC3cansupportboth
statelessandstatefulautoconfigurationofendnodes.TheSecureStackC3supportsbothEUI64
interfaceidentifiersandmanuallyconfiguredinterfaceIDs.
RefertothefollowingRFCsformoreinformationaboutNeighborDiscoveryandstatelessaddress
autoconfiguration:
RFC2461,NeighborDiscoveryforIPVersion6
RFC2462,IPv6StatelessAddressAutoconfiguration
ForICMPv6,errorPDUgenerationissupported,asarepathMTU,echo,andredirect.
RouterAdvertisementisanintegralpartofIPv6andissupported.Numerousoptionsare
availableincludingstateless/statefuladdressconfiguration,routerandaddresslifetimes,and
NeighborDiscoverytimercontrol.PingandtracerouteapplicationsforIPv6areprovided.
ManagementofIPv6featuresisprovidedbymeansofCLIcommandsandSNMP.SeeChapter 21,
IPv6ManagementfordescriptionsoftheCLIcommands.
Default Conditions
ThefollowingtableliststhedefaultIPv6conditions.
Condition
Default Value
IPv6 forwarding
Enabled
IPv6 unicast-routing
Disabled
IPv6 enable
Disabled
IPv6 mtu
1500
IPv6 nd managed-config-flag
False
IPv6 nd ns-interval
IPv6 nd other-config-flag
False
IPv6 nd ra-interval
600
IPv6 nd ra-lifetime
1800
IPv6 nd reachable-time
IPv6 nd suppress-ra
Disabled
IPv6 nd prefix
Valid-lifetime 604800
Preferred-lifetime 2592000
Autoconfig enabled
On-link enabled
22-2
IPv6 Configuration
Refer to page...
ipv6 forwarding
22-3
ipv6 hop-limit
22-3
ipv6 route
22-4
22-5
ipv6 unicast-routing
22-6
ping ipv6
22-6
22-7
traceroute ipv6
22-8
ipv6 forwarding
ThiscommandenablesordisablesIPv6forwardingontherouter.
Syntax
ipv6 forwarding
no ipv6 forwarding
Parameters
None.
Defaults
IPv6forwardingisenabled.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
ThenoformofthiscommanddisablesIPv6forwardingontherouter.
Example
ThisexampledisablesIPv6forwarding.
C3(su)->router(Config)# no ipv6 forwarding
ipv6 hop-limit
ThiscommandsetsthemaximumnumberofIPv6hopsusedinIPv6packetsandrouter
advertisementsgeneratedbythisdevice.
Syntax
ipv6 hop-limit hops
no ipv6 hop-limit
22-3
ipv6 route
Parameters
hops
SpecifiesthemaximumnumberofIPv6hopsusedinIPv6packetsand
routeradvertisementsgeneratedbythisdevice.Valuecanrangefrom1
to255.Thedefaultvalueis64.
Defaults
ThedefaultmaximumnumberofIPv6hopsis64.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
ThiscommandsetsthevalueofthehoplimitfieldinIPv6packetsoriginatedbythisdevice.This
valueisalsoplacedintheCurHopLimitfieldofrouteradvertisementsgeneratedbythisrouter.
Usethenoformofthiscommandtoresetthelimittothedefaultvalue.
Example
Thisexamplesetsthehoplimitto50.
C3(su)->router(Config)# ipv6 hop-limit 50
ipv6 route
ThiscommandconfiguresstaticIPv6routes.
Syntax
ipv6 route ipv6-prefix/prefix-length interface {tunnel tunnel-id | vlan vlan-id}
next-hop-addr [pref]
no ipv6 route ipv6-prefix/prefix-length interface {tunnel tunnel-id | vlan vlanid} next-hop-addr [pref]
Parameters
ipv6prefix/prefixlength
TheIPv6networkprefixthatisthedestinationofthestaticroute,and
theprefixlength.
TheprefixmustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
Theprefixlengthisadecimalnumberindicatingthenumberofhigh
ordercontiguousbitsoftheaddressthatcomprisethenetwork
portionoftheaddress.
interfacetunnel
tunnel-id | vlan
vlan-id
22-4
IPv6 Configuration
SpecifiestheinterfacetypeandIDofdirectstaticroutesfrompointto
pointandbroadcastinterfaces.
nexthopaddr
Linklocaladdressoftheinterface.
pref
(Optional)Specifiesthepreferencevaluetherouterusestocompare
thisroutewithroutesfromotherroutesourcesthathavethesame
destination.
Thevalueofprefcanrangefrom1to255.Thedefaultvalueis1,which
givesstaticroutesprecedenceoveranyothertypeofrouteexcept
connectedroutes.
Aroutewithapreferenceof255cannotbeusedtoforwardtraffic.
Defaults
Defaultpreferenceoradministrativedistanceis1.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
Usethenoformofthiscommandtoremoveastaticroute.Ifyoudonotspecifyanexthopaddress
withthenoform,allstaticroutestothespecifieddestinationwillberemoved.
Example
ThiscommandcreatesastaticIPv6routetonetwork2001:0DB8:2222:4455::/64bywayofinterface
VLAN6andgivesitapreferenceof5.
C3(su)->router(Config)# ipv6 route 2001:0DB8:2222:4455::/64 interface vlan 6
fe80::1234:5678:2dd:1 5
Syntax
ipv6 route distance pref
no ipv6 route distance
Parameters
pref
Adistancevalueusedwhennodistanceisspecifiedwhenastatic
routeisconfigured.
Thevaluecanrangefrom1to255.Lowerroutedistancevaluesare
preferredwhendeterminingthebestroute.
Defaults
Defaultpreferenceoradministrativedistanceis1.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
22-5
ipv6 unicast-routing
Usage
Thedefaultdistanceisusedwhennodistanceisspecifiedintheipv6routecommand.Changing
thedefaultdistancedoesnotupdatethedistanceofexistingstaticroutes,eveniftheywere
assignedtheoriginaldefaultdistance.Thenewdefaultdistancewillonlybeappliedtostatic
routescreatedafterinvokingtheipv6routedistancecommand.
Usethenoformofthiscommandtoreturnthedefaultdistanceto1.
Example
Thiscommandsetsthedefaultdistancevalueto3.
C3(su)->router(Config)# ipv6 route distance 3
ipv6 unicast-routing
Thiscommandenables/disablesforwardingofIPv6unicastdatagrams.
Syntax
ipv6 unicast-routing
no ipv6 unicast-routing
Parameters
None.
Defaults
Disabled.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
UsethiscommandtoenableforwardingofIPv6unicastdatagramsontheSecureStackC3.Usethe
noformofthecommandtodisableforwardingofIPv6unicastdatagrams.
Example
ThiscommandenablesforwardingofIPv6unicastdatagramsontherouter.
C3(su)->router(Config)# ipv6 unicast-routing
ping ipv6
UsethiscommandtotestroutingnetworkconnectivitybysendingIPpingrequests.
Syntax
ping ipv6 ipv6-addr [size num]
22-6
IPv6 Configuration
Parameters
ipv6addr
SpecifiestheglobalIPv6addressofthesystemtoping.Entertheaddressin
theformdocumentedinRFC4291,withtheaddressspecifiedin
hexadecimalusing16bitvaluesbetweencolons.
sizenum
(Optional)Specifiesthesizeofthedatagrampacket.Thevalueofnumcan
rangefrom48to2048bytes.
Defaults
None.
Mode
Routerprivilegedexec:C3(su)>router#
Routeruserexec:C3(su)>router>
Usage
Usethiscommandtodeterminewhetheranothercomputerisonthenetwork.Tousethis
command,configuretheswitchfornetwork(inband)connection.Thesourceandtargetdevices
musthavethepingutilityenabledandrunningontopofTCP/IP.
TheswitchcanbepingedfromanyIPworkstationwithwhichtheswitchisconnectedthroughthe
defaultVLAN(VLAN1),aslongasthereisaphysicalpathbetweentheswitchandthe
workstation.Theterminalinterfacesendsthreepingstothetargetstation.
Examples
ThisexampleshowsoutputfromasuccessfulpingtoIPv6address2001:0db8:1234:5555::1234:1.
C3(su)->router#ping ipv6 2001:0db8:1234:5555::1234:1
Send count=3, Receive count=3 from 2001:DB8:1234:5555::1234:1
Average round trip time = 1.00 ms
ThisexampleshowsoutputfromanunsuccessfulpingtoIPv6address
2001:0db8:1234:5555::1234:1.
C3(su)->ping ipv6 2001:0db8:1234:5555::1234:1
no answer from 2001:DB8:1234:5555::1234:1
Syntax
ping ipv6 interface {vlan vlan-id | tunnel tunnel-id | loopback loop-id}
{link-local-address ipv6-lladdr | ipv6-addr} [size num]
Parameters
vlanvlanid
SpecifiesaVLANinterfaceasthesource.
tunneltunnelid
Specifiesatunnelinterfaceasthesource.
loopbackloopid
Specifiesaloopbackinterfaceasthesource.
linklocaladdress
ipv6lladdr
SpecifiesalinklocalIPv6addresstoping.
22-7
traceroute ipv6
ipv6addr
SpecifiestheglobalIPv6addressofthesystemtoping.Entertheaddress
intheformdocumentedinRFC4291,withtheaddressspecifiedin
hexadecimalusing16bitvaluesbetweencolons.
sizenum
(Optional)Specifiesthesizeofthedatagrampacket.Thevalueofnumcan
rangefrom48to2048bytes.
Defaults
None.
Mode
Routerprivilegedexec:C3(su)>router#
Usage
UsethiscommandtopinganinterfacebyusingthelinklocaladdressortheglobalIPv6address
oftheinterface.Youcanusealoopback,tunnel,orlogicalinterfaceasthesource.Thesourceand
targetdevicesmusthavethepingutilityenabledandrunningontopofTCP/IP.
TheswitchcanbepingedfromanyIPworkstationwithwhichtheswitchisconnectedthroughthe
defaultVLAN(VLAN1),aslongasthereisaphysicalpathbetweentheswitchandthe
workstation.Theterminalinterfacesendsthreepingstothetargetstation.
Example
Thisexampleshowsoutputfromasuccessfulpingtolinklocaladdressfe80::211:88ff:fe55:4a7f.
C3(su)->router#ping ipv6 interface vlan 6 link-local-address
fe80::211:88ff:fe55:4a7f
Send count=3, Receive count=3 from fe80::211:88ff:fe55:4a7f
Average round trip time = 1.00 ms
traceroute ipv6
Usethiscommandtodiscovertheroutesthatpacketsactuallytakewhentravelingtotheir
destinationthroughthenetworkonahopbyhopbasis.
Syntax
traceroute ipv6 ipv6-addr
Parameters
ipv6addr
SpecifiesahosttowhichtherouteofanIPv6packetwillbetraced.Enterthe
addressintheformdocumentedinRFC4291,withtheaddressspecifiedin
hexadecimalusing16bitvaluesbetweencolons.
Defaults
None.
Mode
Routerprivilegedexec:C3(su)>router#
22-8
IPv6 Configuration
traceroute ipv6
Example
Thisexampleshowshowtousetraceroutetodisplayaroundtrippathtohost
2001:0db8:1234:5555::1.
C3(su)->router#traceroute ipv6 2001:0db8:1234:5555::1
Traceroute to 2001:0db8:1234:5555::1, 30 hops max, 40 byte packets
1 2001:0db8:1234:5555::1
1.000000e+00 ms 1.000000e+00 ms 1.000000e+00 ms
22-9
Refer to page...
ipv6 address
22-10
ipv6 enable
22-11
ipv6 mtu
22-12
ipv6 address
ThiscommandconfiguresaglobalIPv6addressonaninterface,includingVLAN,tunnel,and
loopbackinterfaces,andenablesIPv6processingontheinterface.
Syntax
ipv6 address {ipv6-addr/prefix-length | ipv6-prefix/prefix-length eui64}
no ipv6 address [ipv6-addr/prefix-length | ipv6-prefix/prefix-length eui64]
Parameters
ipv6addr
TheIPv6addresstobeconfiguredontheinterface.
ThisparametermustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
prefixlength
ThelengthoftheIPv6prefixforthisaddress.Thevalueofprefixlength
isadecimalnumberindicatingthenumberofhighordercontiguous
bitsoftheaddressthatcomprisethenetworkportionoftheaddress.
Iftheeui64parameterisused,thisvaluemustbe64bits.
ipv6prefix
TheIPv6prefixtobeconfiguredontheinterface.
ThisparametermustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
eui64
ConfiguresanIPv6addressforaninterfaceusinganEUI64interfaceID
intheloworder64bitsoftheaddressandenablesIPv6processingon
theinterface.
Defaults
NoIPv6addressesaredefinedforanyinterface.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
UsethiscommandtomanuallyconfigureaglobalIPv6addressonaninterface.Youcanenterthe
complete128bitaddressandprefix,orusetheeui64parametertoconfigureaglobalIPv6address
usinganEUI64identifierintheloworder64bitsoftheaddress.Whenusingtheeui64parameter,
youspecifyonlythenetworkprefixandlength,andtheSecureStackC3generatestheloworder64
bits.
ThehexadecimallettersintheIPv6addressesarenotcasesensitive.
22-10
IPv6 Configuration
ipv6 enable
ThiscommandalsoenablesIPv6processingontheinterfaceandautomaticallygeneratesalink
localaddress.
Youcanassignmultiplegloballyreachableaddressestoaninterfacewiththiscommand.
Usethenoipv6addresscommandwithoutanyparameterstoremoveallmanuallyconfigured
IPv6addressesfromtheinterface.
Example
ThisexampleconfiguresanIPv6addressbyusingtheeui64parameter.Then,theshowipv6
interfaceisexecutedtodisplaytheconfiguration.Notethatalinklocaladdresshasalso
automaticallybeengenerated.
C3(su)->router(Config-if(Vlan 7))# ipv6 address 3FFE:501:FFFF:101/64 eui64
C3(su)->router>show ipv6 interface vlan 7
Vlan
Vlan
IPv6
IPv6
7 Administrative Mode
7 IPv6 Routing Operational Mode
is
Prefix is
Enabled
Enabled
Enabled
FE80::211:88FF:FE55:4A7F/128
3FFE:501:FFFF:101:211:88FF:FE55:4A7F/64
Routing Mode
Enabled
Interface Maximum Transmit Unit
1500
Router Duplicate Address Detection Transmits
1
Router Advertisement NS Interval
0
Router Lifetime Interval
1800
Router Advertisement Reachable Time
0
Router Advertisement Interval
600
Router Advertisement Managed Config Flag
Disabled
Router Advertisement Other Config Flag
Disabled
Router Advertisement Suppress Flag
Disabled
ipv6 enable
ThiscommandenablesIPv6routingonaninterfacethathasnotbeenconfiguredwithanexplicit
IPv6address.
Syntax
ipv6 enable
no ipv6 enable
Parameters
None.
Defaults
IPv6isdisabled.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Whenthiscommandisexecuted,anIPv6linklocalunicastaddressisconfiguredontheinterface
andIPv6processingisenabled.YoudonotneedtousethiscommandifyouconfiguredanIPv6
globaladdressonaninterfacewiththeipv6addresscommand.
22-11
ipv6 mtu
Thenoipv6enablecommanddisablesIPv6routingonaninterfacethathasbeenenabledwiththe
ipv6enablecommand,butitdoesnotdisableIPv6processingonaninterfacethatisconfigured
withanexplicitIPv6address.
Example
ThisexampleenablesIPv6processingonVLAN7.Notethatalinklocaladdresshasbeen
automaticallyconfigured.
C3(su)->router(Config-if(Vlan 7))# ipv6 enable
C3(su)->router>show ipv6 interface vlan 7
Vlan 7 Administrative Mode
Vlan 7 IPv6 Routing Operational Mode
IPv6 is
IPv6 Prefix is
Routing Mode
Interface Maximum Transmit Unit
Router Duplicate Address Detection Transmits
Router Advertisement NS Interval
Router Lifetime Interval
Router Advertisement Reachable Time
Router Advertisement Interval
Router Advertisement Managed Config Flag
Router Advertisement Other Config Flag
Router Advertisement Suppress Flag
Enabled
Enabled
Enabled
FE80::211:88FF:FE55:4A7F/128
Enabled
1500
1
0
1800
0
600
Disabled
Disabled
Disabled
ipv6 mtu
Thiscommandconfiguresthemaximumtransmissionunit(MTU)sizeofIPv6packetsthatcanbe
sentonaninterface.
Syntax
ipv6 mtu bytes
no ipv6 mtu
Parameters
bytes
SpecifiestheMTUvalueinbytes.Thevaluecanrangefrom1280to1500
bytes.TheMTUcannotbelargerthanthevaluesupportedbythe
underlyinginterface.
Defaults
1480bytes
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Themaximumtransmissionunitisthelargestpossibleunitofdatathatcanbesentonagiven
physicalmedium.UsethiscommandtosettheMTUforanIPv6interface.Thenoformofthis
commandresetstheMTUtothedefaultvalueof1480bytes.
Usetheshowipv6interfacetodisplaythecurrentsettingforthisinterface.
22-12
IPv6 Configuration
ipv6 mtu
Note: All interfaces attached to the same physical medium must be configured with the same MTU
to operate properly.
Example
ThisexamplesetstheMTUvalueto1500bytes.
C3(su)->router(Config-if(Vlan 1))# ipv6 mtu 1500
22-13
Refer to page...
22-14
22-15
ipv6 nd ns-interval
22-15
ipv6 nd reachable-time
22-16
ipv6 nd other-config-flag
22-17
ipv6 nd ra-interval
22-18
ipv6 nd ra-lifetime
22-18
ipv6 nd suppress-ra
22-19
ipv6 nd prefix
22-19
Syntax
clear ipv6 neighbor [vlan vlan-id]
Parameters
vlanvlanid
(Optional)Clearonlytheentriesonthespecifiedinterface.
Defaults
None.
Mode
Routerprivilegedexec:C3(su)>router#
Usage
ToclearalldynamicallylearnedNeighborCacheentries,usethiscommandwithoutany
parameters.
Example
Thisexampleclearsalldynamicallylearnedcacheentries.
C3(su)->router#clear ipv6 neighbors
22-14
IPv6 Configuration
Syntax
ipv6 nd dad attempts number
no ipv6 nd dad attempts
Parameters
number
SpecifiesthenumberofconsecutiveNeighborSolicitationmessage
transmittedontheinterface,whenDuplicateAddressDetection(DAD)
isperformedonaunicastIPv6addressassignedtotheinterface.
Thevaluecanrangefrom0to600.Avalueof0disablesDuplicate
AddressDetectionontheinterface.Avalueof1,whichisthedefault,
specifiesasingletransmissionwithnofollowuptransmissions.
Defaults
Duplicateaddressdetectionenabled,for1attempt.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
IPv6DuplicateAddressDetectionisdescribedinRFC2462.DuplicateAddressDetectionuses
NeighborSolicitationandNeighborAdvertisementmessagestoverifytheuniquenessofan
address.DuplicateAddressDetectionmustbeperformedonunicastaddressespriortoassigning
themtoaninterface.AnaddressremainsinatentativestatewhileDuplicateAddressDetectionis
beingperformed.Ifatentativeaddressisfoundtobeaduplicate,anerrormessageisreturned
andtheaddressisnotassignedtotheinterface.
UsethiscommandtochangethenumberofNeighborSolicitationmessagesthatcanbesentfor
DuplicateAddressDetectionfromthedefaultvalueof1.Thenoformofthecommandreturnsthe
valuetothedefaultof1.Avalueof0disablesDuplicateAddressDetectionontheinterface.
Theshowipv6interfacecommanddisplaysthecurrentDADattemptsetting.
Example
ThisexamplechangesthenumberofconsecutiveNeighborSolicitationmessagessentforDADto
3onthisinterface.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd dad attempts 3
ipv6 nd ns-interval
ThiscommandconfigurestheintervalbetweenNeighborSolicitationssentonaninterface.
Syntax
ipv6 nd ns-interval {msec | 0}
no ipv6 nd ns-interval
22-15
ipv6 nd reachable-time
Parameters
msec
SetstheintervalinmillisecondsbetweenretransmissionsofNeighbor
Solicitationmessagesontheinterface.Thevaluecanrangefrom1000
(onesecond)to3,600,000(onehour)milliseconds.
Anadvertisedvalueof0meanstheintervalisunspecified.
Defaults
Bydefault,avalueof0isadvertisedinRAmessages.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
TheNSintervalisusedtodeterminethetimebetweenretransmissionsofneighborsolicitation
messagestoaneighborwhenresolvingaunicastaddress(DAD)orwhenprobingthereachability
ofaneighbor.ThisvalueisalsoadvertisedinRouterAdvertisement(RA)messagessentonthe
interface.
Usethenoformofthiscommandtosettheintervaltothedefaultof0.
Example
ThisexamplesetstheNSintervalto2seconds.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd ns-interval 2000
ipv6 nd reachable-time
Thiscommandconfiguresthelengthoftimewithinwhichsomereachabilityconfirmationmustbe
receivedfromaneighborfortheneighbortobeconsideredreachable.
Syntax
ipv6 nd reachable-time msec
no ipv6 nd reachable-time
Parameters
msec
TheamountoftimeinmillisecondsthataremoteIPv6nodeis
consideredreachable.Thevaluecanrangefrom0to4,294,967,295
milliseconds.
Thedefaultvalueis0,whichmeansthatthetimeisunspecified.
Defaults
Bydefault,avalueof0isadvertisedinRAmessages.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
ThistimerallowstheC3todetectunavailableneighbors.Theshorterthetime,themorequickly
unavailableneighborsaredetected.Veryshortconfiguredtimesarenotrecommendedinnormal
22-16
IPv6 Configuration
ipv6 nd other-config-flag
IPv6operation,however,becauseshortertimesconsumemoreIPv6networkbandwidthand
processingresources.
ThisvalueisalsoincludedinallRouterAdvertisementsmessagessentoutontheinterface.By
default,avalueof0,indicatingthattheconfiguredtimeisunspecifiedbythisrouter,issentoutin
RAmessages.
Usethenoformofthiscommandtoresetthisvaluetothedefault.
Theshowipv6interfacecommanddisplaysthecurrentreachabletimesetting.
Example
Thisexamplesetsthereachabletimeto60seconds.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd reachable-time 60000
ipv6 nd other-config-flag
Thiscommandsetstheotherstatefulconfigurationflaginrouteradvertisementssentonthis
interfacetotrue.
Syntax
ipv6 nd other-config-flag
no ipv6 nd other-config-flag
Parameters
None.
Defaults
Flagissettofalsebydefault.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Whenthevalueoftheotherstatefulconfigurationflagistrue,endnodesshouldusestateful
autoconfiguration(DHCPv6)toobtainadditionalinformation(excludingaddresses).Whenthe
valueisfalse,endnodesdonot.RefertoRFC2462,IPv6StatelessAddressAutoconfiguration,
formoreinformation.
Usethenoformofthiscommandtoresettheflagtofalse.
Example
Thisexamplesetstheotherstatefulconfigurationflagtotrue.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd other-config-flag
22-17
ipv6 nd ra-interval
ipv6 nd ra-interval
Thiscommandsetsthetransmissionintervalbetweenrouteradvertisements.
Syntax
ipv6 nd ra-interval sec
no ipv6 nd ra-interval
Parameters
sec
Specifiesthevalueinsecondsoftherouteradvertisementtransmission
interval.Thevaluecanrangefrom4to1800seconds.
Defaults
600seconds.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Thenoformofthiscommandresetstheintervalvaluetothedefaultof600seconds.
Example
Thisexamplesetstherouteradvertisementtransmissionintervalto120seconds.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd ra-interval 120
ipv6 nd ra-lifetime
Thiscommandsetsthevalue,inseconds,thatisplacedintheRouterLifetimefieldofrouter
advertisementssentfromthisinterface.
Syntax
ipv6 nd ra-lifetime sec | 0
no ipv6 nd ra-lifetime
Parameters
sec
SpecifiesthevalueoftheRouterLifetimeinseconds.Thevaluemustbe
0,oranintegerbetweenthevalueoftherouteradvertisementinterval
and9000seconds.
Avalueof0meansthatthisrouterisnottobeusedasthedefaultrouter.
Defaults
1800seconds.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
22-18
IPv6 Configuration
ipv6 nd suppress-ra
Usage
Thenoformofthiscommandresetsthelifetimevaluetothedefaultof1800seconds.
Example
Thisexamplesetstherouteradvertisementlifetimevalueto3600seconds.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd ra-lifetime 3600
ipv6 nd suppress-ra
Thiscommandsuppressesrouteradvertisementtransmissiononthisinterface.
Syntax
ipv6 nd suppress-ra
no ipv6 nd suppress-ra
Parameters
None.
Defaults
Suppressiondisabled.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Bydefault,transmissionofrouteradvertisementsisenabled.Thiscommanddisablessuch
transmissions.Usethenoformofthiscommandtoreenabletransmission.
Example
Thisexampledisablesrouteradvertisementtransmission.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd suppress-ra
ipv6 nd prefix
ThiscommandconfigurestheIPv6prefixestobeincludedinrouteradvertisementssentbythis
interface.
Syntax
ipv6 nd prefix {ipv6-prefix/prefix-length} [{valid-lifetime | infinite}
{preferred-lifetime | infinite}] [no-autoconfig] [off-link]
no ipv6 nd prefix {ipv6-prefix/prefix-length}
22-19
ipv6 nd prefix
Parameters
ipv6prefix/prefixlength TheIPv6networkprefixandtheprefixlengthbeingconfigured.
TheprefixmustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
Theprefixlengthisadecimalnumberindicatingthenumberofhigh
ordercontiguousbitsoftheaddressthatcomprisethenetworkportion
oftheaddress.
validlifetime|infinite
(Optional)Specifiesthelengthoftimeinseconds(relativetothetime
thepacketissent)thattheprefixisvalidforthepurposeofonlink
determination.
Thelifetimevaluecanrangefrom0to4,294,967,295.
Specifyinginfinitemeansthattheprefixisalwaysvalid.
preferredlifetime|
infinite
(Optional)Specifiesthelengthoftimeinseconds(relativetothetime
thepacketissent)thataddressesgeneratedfromtheprefixbymeansof
statelessaddressautoconfigurationremainpreferred.
Thelifetimevaluecanrangefrom0to4,294,967,295.
Specifyinginfinitemeansthattheprefixisalwayspreferred.
noautoconfig
Unsetstheautonomousaddressconfigurationflag.Whennotset,
meansthatthisprefixcannotbeusedforautonomousaddress
configuration.Bydefault,theautonomousaddressconfigurationflagis
set/enabled.
offlink
Unsetstheonlinkflag.Whennotset,meansthatthisprefixcannotbe
usedforonlinkdetermination.Bydefault,theonlinkflagisset/
enabled.
Defaults
Validlifetime604800
Preferredlifetime2592000
Autoconfigenabled
Onlinkenabled
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
RefertoRFC2461,NeighborDiscoveryforIPVersion6,formoreinformationaboutrouter
advertisements.
Routeradvertisementscontainalistofprefixesusedforonlinkdeterminationand/or
autonomousaddressconfiguration.Flagsassociatedwiththeprefixesspecifytheintendedusesof
aparticularprefix.Hostsusetheadvertisedonlinkprefixestobuildandmaintainalistthatis
usedindecidingwhenapacketsdestinationisonlinkorbeyondarouter.Hostscanusethe
advertisedautoconfigurationprefixestoperformautonomous(stateless)addressconfiguration,if
statelessconfigurationisallowed(seeipv6ndotherconfigflag).
Thenoformofthiscommandremovestheprefixfromthelistofprefixesadvertisedinrouter
advertisementsbythisinterface.
22-20
IPv6 Configuration
ipv6 nd prefix
Example
Thisexampleconfiguresaprefixthatcanbeusedforbothonlinkdeterminationand
autoconfiguration,usingthedefaultvaluesforvalidlifetimeandpreferredlifetime.
C3(su)->router(Config-if(Vlan 1))# ipv6 nd prefix 2001:0db8:4444:5555/64
22-21
Query Commands
Query Commands
For information about...
Refer to page...
show ipv6
22-22
22-22
22-24
22-25
22-27
22-28
22-29
22-34
show ipv6
ThiscommanddisplaysthestatusofIPv6forwardingmodeandunicastroutingmode.
Syntax
show ipv6
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
TheoutputofthiscommanddisplayswhetherIPv6forwardingmodeandunicastroutingmode
areenabledordisabled.
Example
ThisexampledisplaysinformationaboutIPv6modes.
C3(su)>router# show ipv6
IPv6 Forwarding Mode
IPv6 Unicast Routing Mode
Enabled
Enabled
Syntax
show ipv6 interface [vlan vlan-id | tunnel tunnel-id | loopback loop-id]
22-22
IPv6 Configuration
Parameters
vlanvlanid
(Optional)Displayinformationonlyaboutthespecifiedinterface.
tunneltunnelid
loopbackloopid
Defaults
Ifnointerfaceisspecified,informationaboutallIPv6interfacesisdisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
UsethiscommandtodisplaytheusabilitystatusofIPv6interfaces.
IfanIPv6prefixisconfiguredonaninterface,thefollowinginformationalsodisplays:
TheIPv6prefixandlength
Theconfiguredpreferredlifetimevalue
Theconfiguredvalidlifetimevalue
Thestatusoftheonlinkflag,eitherenabledordisabled
Thestatusoftheautonomousaddressconfigurationflag(autoconfig),eitherenabledor
disabled.
Examples
ThisexampledisplaysinformationaboutIPv6interfaceVLAN7.
C3(su)->router>show ipv6 interface vlan 7
Vlan
Vlan
IPv6
IPv6
7 Administrative Mode
7 IPv6 Routing Operational Mode
is
Prefix is
Enabled
Enabled
Enabled
FE80::211:88FF:FE55:4A7F/128
3FFE:501:FFFF:101:211:88FF:FE55:4A7F/64
3FFD::211:88FF:FE55:4A7F/64
Routing Mode
Enabled
Interface Maximum Transmit Unit
1500
Router Duplicate Address Detection Transmits
1
Router Advertisement NS Interval
0
Router Lifetime Interval
1800
Router Advertisement Reachable Time
0
Router Advertisement Interval
600
Router Advertisement Managed Config Flag
Enabled
Router Advertisement Other Config Flag
Enabled
Router Advertisement Suppress Flag
Disabled
ThisexampledisplaysinformationaboutIPv6interfacetunnel1.
C3(su)->router>show ipv6 interface tunnel 1
Tunnel 1 Administrative Mode
Tunnel 1 IPv6 Routing Operational Mode
Mode for IPv6 Tunnel
Enabled
Disabled
IPv6OVER4
22-23
192.168.1.2
192.168.8.1
Enabled
1480
1
0
1800
0
600
Disabled
Disabled
Disabled
Syntax
show ipv6 neighbors
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
UsethiscommandtodisplaythecontentsoftheNeighborCache.
Example
Thisexampledisplaystheneighborsinthecache.
C3(su)->router>show ipv6 neighbors
IPv6 Address
Interface
-------------------------------------FE80::200:FF:FE00:A0A0
Vlan 6
FE80::2D0:B7FF:FE2C:7697
Vlan 6
FE80::2D0:B7FF:FE2C:7698
Vlan 6
FE80::2D0:B7FF:FE2C:7699
Vlan 6
FE80::2D0:B7FF:FE2C:769E
Vlan 6
FE80::2D0:B7FF:FE2C:76AA
Vlan 6
FE80::2D0:B7FF:FE2C:76AB
Vlan 6
FE80::2D0:B7FF:FE2C:76AC
22-24
IPv6 Configuration
MAC Address
Neighbor Last
isRtr State
Updated
1095
1096
1155
1461
1540
1553
1566
Vlan 6
FE80::2D0:B7FF:FE2C:76B4
Vlan 6
1903
Table 221providesanexplanationofthecommandoutput.
Table 22-1
Output Field
What It Displays...
IPv6 Address
Interface
MAC Address
isRtr
Neighbor State
Last Updated
The system uptime when the information for the neighbor was last
updated.
Syntax
show ipv6 route [{ipv6-addr [route-type] | {{ipv6-prefix/prefix-length | interface
interface} [route-type] | route-type | all]
Parameters
ipv6addr
SpecifiesaspecificIPv6addressforwhichthebestmatchingroute
shouldbedisplayed.
ipv6prefix/prefixlength TheIPv6networkprefixoftheroutetodisplay,andtheprefixlength.
TheprefixmustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
Theprefixlengthisadecimalnumberindicatingthenumberofhigh
ordercontiguousbitsoftheaddressthatcomprisethenetworkportion
oftheaddress.
interfaceinterface
Specifiesthattherouteswithnexthopsonthisinterfaceshouldbe
displayed.Interfacecanbeoftheform:
vlanvlanid
tunneltunnelid
loopbackloopid
routetype
Specifiestheroutetypeasoneofthefollowing:
connected
static
ospf
all
Specifiesthatallroutesshouldbedisplayed.
22-25
Defaults
Ifnoparametersareentered,informationaboutallactiveIPv6routesisdisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Routeruserexecution:C3(su)>router>
Usage
UsethiscommandtodisplayIPv6routingtableinformationforactiveroutes.
Example
ThisexampledisplaysallactiveIPv6routes.
C3(su)->router>show ipv6 route
IPv6 Routing Table - 5 entries
Codes: C - connected, S - static
O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF Ext 1, OE2 - OSPF Ext 2
ON1 - OSPF NSSA Ext Type 1, ON2 - OSPF NSSA Ext Type 2
S
C
C
C
S
::/0 [1/0]
via FE80::2D0:B7FF:FE2C:7694,
Vlan 6
3FFE:501:FFFF:100::/64 [0/0]
via ::,
Vlan 6
3FFE:501:FFFF:101::/64 [0/0]
via ::,
Vlan 7
3FFE:501:FFFF:108::/64 [0/0]
via ::,
Vlan 6
3FFE:501:FFFF:109::/64 [1/0]
via 3FFE:501:FFFF:100:200:FF:FE00:A1A1,
via FE80::200:FF:FE00:A1A1,
Vlan 6
Vlan 6
Table 222providesanexplanationofthecommandoutput.
Table 22-2
22-26
Output Field
What It Displays...
Codes:
Key for the routing protocol codes that might appear in the Codes
column of the routing table output.
Codes column
The code for the routing protocol that created this routing entry.
IPv6 prefix/prefix-length
The IPv6 prefix and prefix length of the destination IPv6 network
corresponding to this route.
[ Preference / Metric ]
Tag
via Next-hop
Interface
IPv6 Configuration
Syntax
show ipv6 route preference
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Routeruserexecution:C3(su)>router>
Usage
Lowernumbershaveagreaterpreference.Aroutewithapreferenceof255cannotbeusedto
forwardtraffic.
Thedefaultpreferencevalueforstaticroutescanbesetwiththeipv6routedistancecommand.
Thedistanceforaspecificstaticroutecanbesetwiththeipv6routecommand.
Example
Thefollowingexampleshowstheoutputofthiscommand.
C3(su)->router#show ipv6 route preferences
Local
Static
OSPF Intra
OSPF Inter
OSPF Ext T1
OSPF Ext T2
OSPF NSSA T1
OSPF NSSA T2
0
1
8
10
13
150
14
151
Table 223providesanexplanationofthecommandoutput.
Table 22-3
Output Field
What It Displays...
Local
Static
OSPF Intra
OSPF Inter
OSPF Ext T1
22-27
Table 22-3
Output Field
What It Displays...
OSPF Est T2
OSPF NSSA T1
OSPF NSS! T2
Syntax
show ipv6 route summary [all]
Parameters
all
(Optional)Displaythecountsummaryforallroutes,includingbestand
nonbestroutes.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Routeruserexecution:C3(su)>router>
Usage
Usethecommandwithoutparameterstodisplaythecountsummaryforonlythebestroutes.Use
alltodisplaythecountsummaryforallroutes,includingbestandnonbestroutes.
Example
Thisexampleillustratesthesummaryinformationdisplayedbythiscommand.
C3(su)->router>show ipv6 route summary all
IPv6 Routing Table Summary - 6 entries
Connected Routes
Static Routes
OSPF Routes
Intra Area Routes
Inter Area Routes
External Type-1 Routes
External Type-2 Routes
Total routes
3
3
0
0
0
0
0
6
Number of Prefixes:
/0: 1, /64: 5
Table 224providesanexplanationofthecommandoutput.
22-28
IPv6 Configuration
Table 22-4
Output Field
What It Displays...
Connected Routes
Static Routes
OSPF Routes
Number of Prefixes
Total Routes
Syntax
show ipv6 traffic [interface]
Parameters
interface
(Optional)Specifiestheinterfaceforwhichtrafficinformationshouldbe
displayed.Interfacecanbeoftheform:
vlanvlanid
tunneltunnelid
loopbackloopid
Defaults
Ifnointerfaceisspecified,informationabouttrafficonallinterfacesisdisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
Specifyalogical,loopback,ortunnelinterfacetoviewinformationabouttrafficonaspecific
interface.Ifyoudonotspecifyaninterface,thecommanddisplaysinformationabouttrafficonall
interfaces.
Example
Thefollowingexampledisplaystheoutputofthiscommand.
C3(su)->router>show ipv6 traffic
IPv6 STATISTICS
Total Datagrams Received..................................
Received Datagrams Locally Delivered......................
Received Datagrams Discarded Due To Header Errors.........
Received Datagrams Discarded Due To MTU...................
Received Datagrams Discarded Due To No Route..............
Received Datagrams With Unknown Protocol..................
Received Datagrams Discarded Due To Invalid Address.......
Received Datagrams Discarded Due To Truncated Data........
Received Datagrams Discarded Other........................
116
116
0
0
0
0
0
0
0
22-29
0
0
0
0
876
0
0
0
0
17
547
ICMPv6 STATISTICS
Total ICMPv6 Messages Received............................
ICMPv6 Messages With Errors Received......................
ICMPv6 Destination Unreachable Messages Received..........
ICMPv6 Messages Prohibited Administratively Received......
ICMPv6 Time Exceeded Messages Received....................
ICMPv6 Parameter Problem Messages Received................
ICMPv6 Packet Too Big Messages Received...................
ICMPv6 Echo Request Messages Received.....................
ICMPv6 Echo Reply Messages Received.......................
ICMPv6 Router Solicit Messages Received...................
ICMPv6 Router Advertisement Messages Received.............
ICMPv6 Neighbor Solicit Messages Received.................
ICMPv6 Neighbor Advertisement Messages Received...........
ICMPv6 Redirect Messages Received.........................
ICMPv6 Group Membership Query Messages Received...........
ICMPv6 Group Membership Response Messages Received........
ICMPv6 Group Membership Reduction Messages Received.......
Total ICMPv6 Messages Transmitted.........................
ICMPv6 Messages Not Transmitted Due To Error..............
ICMPv6 Destination Unreachable Messages Transmitted.......
ICMPv6 Messages Prohibited Administratively Transmitted...
ICMPv6 Time Exceeded Messages Transmitted.................
ICMPv6 Parameter Problem Messages Transmitted.............
ICMPv6 Packet Too Big Messages Transmitted................
ICMPv6 Echo Request Messages Transmitted..................
ICMPv6 Echo Reply Messages Transmitted....................
ICMPv6 Router Solicit Messages Transmitted................
ICMPv6 Router Advertisement Messages Transmitted..........
ICMPv6 Neighbor Solicit Messages Transmitted..............
ICMPv6 Neighbor Advertisement Messages Transmitted........
ICMPv6 Redirect Messages Transmitted......................
ICMPv6 Group Membership Query Messages Transmitted........
ICMPv6 Group Membership Response Messages Transmitted.....
ICMPv6 Group Membership Reduction Messages Transmitted....
ICMPv6 Duplicate Address Detects..........................
116
4
0
0
0
0
0
52
0
0
5
31
28
0
0
0
0
876
0
0
0
0
0
0
157
52
0
7
625
27
0
0
8
0
0
Table 225providesanexplanationofthecommandoutput.
Table 22-5
22-30
Output Field
What It Displays...
Total number of datagrams successfully delivered to IPv6 userprotocols (including ICMP). This counter increments at the
interface to which these datagrams were addressed, which might
not necessarily be the input interface for some of the datagrams.
IPv6 Configuration
Table 22-5
Output Field
What It Displays...
Datagrams Forwarded
22-31
Table 22-5
22-32
Output Field
What It Displays...
Fragments Created
IPv6 Configuration
Table 22-5
Output Field
What It Displays...
Number of ICMP messages which this interface did not send due
to problems discovered within ICMP such as a lack of buffers. This
value should not include errors discovered outside the ICMP layer
such as the inability of IPv6 to route the resultant datagram. In
some implementations there may be no types of error which
contribute to this counter's value.
22-33
Table 22-5
Output Field
What It Displays...
Syntax
clear ipv6 statistics [interface]
Parameters
interface
(Optional)Specifiestheinterfaceforstatisticsshouldbecleared.
Interfacecanbeoftheform:
vlanvlanid
tunneltunnelid
loopbackloopid
Defaults
Ifnointerfaceisspecified,statisticsarecleared(resetto0)forallinterfaces.
Mode
RouterprivilegedexecutionC3(su)>router#
Usage
IPv6statisticsaredisplayedwiththeshowipv6trafficcommand.Ifnointerfaceisspecified,the
countersforallIPv6trafficstatisticsareresettozerowhenthiscommandisexecuted.
Example
ThisexampleclearsthestatisticsforVLAN6.
C3(su)->router# clear ipv6 statistics vlan 6
22-34
IPv6 Configuration
23
IPv6 Proxy Routing
ThischapterdescribesthecommandsusedtoenableIPv6proxyroutingandthesuggested
proceduretoconfigureamixedC2andC3stacktouseIPv6proxyrouting.
For information about...
Refer to page...
Overview
23-1
23-2
Commands
23-3
Overview
IPv6proxyroutingallowsamixedC2/C3stacktosupportsomeIPv6routingfunctionality.When
IPv6proxyroutingisenabled,alltheswitchesinthestackcansupportIPv6unicastroutingand
IPv6tunneling.YoucanconfigureportbasedandVLANbasedIPv6routinginterfacesonanyC2
orC3stackunit.ThereisnochangeinexistingIPv4routingcapabilities.
Sincethisisafunctionthatexistsonlyinamixedstack,itisimplementedonlyintheC2firmware,
release5.01andlater.ForIPv6proxyroutingtoexistinthestack,aC3unitmustrunasthe
managerofthestack.Tofacilitatethis,thestackmanagerpreferenceofC3unitsshouldbesettoa
highervaluethanC2units.IfaC3unitisaddedtoanallC2stack,youmustmovethemanagerto
aC3unittousethisfeature.
MultipleC3unitscanexistinthemixedstack.AlltheC3unitsinthemixedstackwill
independentlyperformhardwareIPv6routing/tunneling.ThemanagerC3unitwilltransparently
dothehardwareIPv6routing/tunnelingforalltheC2units.
WhenIPv6proxyroutingisenabled,theC2beingconfiguredforrouting/tunneling(calledthe
proxyclient)isconfiguredtoredirecttheroutedIPV6/Tunnelingpacketstooneofthestacking
portsoftheC3stackmanager(calledtheproxyserver).TheC2isonlyconfigurediftheproxy
featureisalreadyenabledonthestack.ItshouldbenotedthatonlyIPv6packetswitha
destinationMACoftherouterMACofthesystemareredirectedtotheproxyserver.
Ontheproxyserver,allincomingpacketstothestackingportswithadestinationofoneofthe
stackingportswillbeprocessedthroughL2andL3switchinglogic.Ifthedestinationportisnot
oneofthestackingports(notanIPv6packet),thentheincomingpacketisforwardedbasedon
headerinformation.
Thisfeatureisdisabledbydefault.
InordertousetheOSPF,PIMSM,DVMRP,orVRRPprotocols,youmusthavepurchasedand
installedtheC2advancedroutinglicense.
23-1
Limitations
Proxyroutingwilluseuptotwomasksinthefastforwardingprocessorassociatedwitheach
portinvolvedinroutingofIPv6packets.Thiswillrequirerestrictionsontheuseofpolicy
whenproxyroutingisenabled.
AllIPv6packetsingressingoregressingaC2portmustbesentoverthestacktotheC3stack
master.LimitedstackbandwidthandtheamountofIPv6trafficmustbecarefullyconsidered
whenconfiguringmultipleC2portsforIPv6routing.
IfthestackmastermovesfromaC3unittoaC2unitinthestack,proxyroutingwillnolonger
beavailable.Toensurethatproxyroutingcontinuestooperateintheeventofafailover,C3
unitsmustbeconfiguredtobepreferredwhenanewmasteriselected.
SetthemanagementpriorityoftheC3switchestobehigherthanthatoftheC2switches.For
example,ifyourC3switchesareunits7and8,andyouwanttheunit7C3switchtoalways
becomethemanagerandtheunit8C3switchtobethebackupmanager:
C2(su)->set switch 7 priority 15
C2(su)->set switch 8 priority 13
Usetheshowswitchunitcommandtodisplayswitchpriority(AdminManagementPreference).
C2(su)->show switch 7
Switch
Management Status
Management Switch
Unassigned
15
Switch Type
C3G124-48
C3G124-48
C3G124-48
Switch Status
OK
Switch Family
XGS3
Switch Description
23-2
05.02.00.0031
05.02.00.0031
05.01.06.0006
Up Time
Commands
Commands
For information about...
Refer to page...
ipv6 proxy-routing
23-3
23-3
ipv6 proxy-routing
UsethiscommandtoenableordisableIPv6proxyroutingonamixedC2/C3stack.
Syntax
ipv6 proxy-routing
no ipv6 proxy-routing
Parameters
None.
Defaults
IPv6proxyroutingisdisabledbydefault.
Mode
Routerglobalconfiguration:C2(su)>router(Config)#
Usage
IPv6proxyroutingisdisabledbydefault.ItmustbeenabledwiththiscommandbeforetheC2
switchesinthestackwillstartredirectingroutedIPv6/tunnelingpacketstotheC3proxyserver.
UsesthenoformofthiscommandtodisableIPv6proxyrouting.
Example
ThisexampleenablesIPv6proxyrouting.
c2(su)->router
c2(su)->router>enable
c2(su)->router#config
Enter configuration commands:
c2(su)->router(Config)#ipv6 proxy-routing
Syntax
show ipv6 proxy-routing
Parameters
None.
SecureStack C3 Configuration Guide
23-3
Defaults
None.
Mode
Anyroutingmode.
Example
ThisexampleshowstheoutputofthiscommandwhenIPv6proxyroutingisdisabled.
c2(su)->router(Config)#show ipv6 proxy-routing
IPv6 Proxy Routing Mode................................... Disable
23-4
24
DHCPv6 Configuration
* IPv6 Routing License Required *
IPv6 routing must be enabled with a license key in order to use this feature. If you have purchased an IPv6
routing license key, and have enabled routing on the device, you must activate your license as described in
the chapter entitled Activating Licensed Features in order to enable the DHCPv6 configuration command
set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales.
ThecommandsdescribedinthischapterperformconfigurationoftheDynamicHost
ConfigurationProtocolforIPv6(DHCPv6)ontheSecureStackC3.
For information about...
Refer to page...
24-2
24-6
24-10
24-13
Overview
DHCPisgenerallyusedbetweenclients(forexample,hosts)andservers(forexample,routers)for
thepurposeofassigningIPaddresses,gateways,andothernetworkingdefinitionssuchasDNS,
NTP,and/orSIPparameters.However,IPv6nativelyprovidesforautoconfigurationofIP
addressesthroughtheIPv6NeighborDiscoveryProtocol(NDP)andtheuseofRouter
Advertisementmessages.Thus,theroleofDHCPv6withinthenetworkisdifferentfromDHCPv4
inthatitislessrelieduponforIPaddressassignment.
DHCPv6serverandclientinteractionsaredescribedbyRFC3315.Therearemanysimilarities
betweenDHCPv6andDHCPv4interactionsandoptions,butthemessagesandoptiondefinitions
aresufficientlydifferent.ThereisnomigrationorinteroperabilityfromDHCPv4toDHCPv6.
DHCPv6incorporatesthenotionofthestatelessserver,whereDHCPv6isnotusedforIPaddress
assignmenttoaclient.Instead,itonlyprovidesothernetworkinginformationsuchasDNS,NTP,
and/orSIPinformation.ThestatelessserverbehaviorisdescribedbyRFC3736,whichsimply
containsdescriptionsoftheportionsofRFC3315thatarenecessaryforstatelessserverbehavior.
InorderforaroutertodriveaDHCPv6clienttoutilizestatelessDHCPv6,theotherstateful
configurationoptionmustbeconfiguredforneighbordiscoveryonthecorrespondingIPv6
routerinterface.ThisinturncausesDHCPv6clientstosendtheDHCPv6InformationRequest
messageinresponse.ADHCPv6serverthenrespondsbyprovidingonlynetworkingdefinitions
suchasDNSdomainnameandserverdefinitions,NTPserverdefinitions,and/orSIPdefinitions.
24-1
RFC3315alsodescribesDHCPv6RelayAgentinteractions,whichareverymuchlikeDHCPv4
RelayAgent.RFC3046describestheDHCPv6RelayAgentInformationOption,whichemploys
verysimilarcapabilitiesasthosedescribedbyDHCPv4RelayAgentOptioninRFC2132.
WiththelargeraddressspaceinherenttoIPv6,addresseswithinanetworkcanbeallocatedmore
effectivelyinahierarchicalfashion.DHCPv6introducesthenotionofprefixdelegationas
describedinRFC3633asawayforrouterstocentralizeanddelegateIPaddressassignment.
Default Conditions
ThefollowingtableliststhedefaultDHCPv6conditions.
Condition
Default Value
IPv6 DHCP
Disabled
32
2592000 seconds
604800 seconds
Commands
For information about...
ipv6 dhcp enable
24-2
24-3
24-4
24-4
Syntax
ipv6 dhcp enable
no ipv6 dhcp enable
24-2
Refer to page...
DHCPv6 Configuration
Parameters
None.
Defaults
Bydefault,DHCPv6isdisabled.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
UsethiscommandtoenableDHCPv6ontherouter.Usethenoformofthiscommandtodisable
DHCPv6afterithasbeenenabled.
Example
ThisexampleenablesDHCPv6.
C3(su)->router(Config)# ipv6 dhcp enable
Syntax
ipv6 dhcp relay-agent-info-opt option
Parameters
option
Thevalueofoptionmayrangefrom32to65535.Thedefaultvalueis32.
Defaults
ThedefaultvalueoftheDHCPv6RelayAgentInformationOptionis32.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
TheDHCPv6RelayAgentInformationOptionallowsforvarioussuboptionstobeattachedto
messagesthatarebeingrelayedbythelocalroutertoarelayserver.Therelayservermayinturn
usethisinformationindetermininganaddresstoassigntoaDHCPv6client.RefertoRFC3046for
moreinformation.
Example
ThisexamplesetstheRelayAgentInformationOptionvalueto82.
C3(su)->router(Config)# ipv6 dhcp relay-agent-info-opt 82
24-3
Syntax
ipv6 dhcp relay-agent-info-remote-id-subopt option
Parameters
option
Thevalueofoptionmayrangefrom1to65535.Thedefaultvalueis1.
Defaults
ThedefaultvalueoftheDHCPv6RelayAgentRemoteIDsuboptionis1.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
ThissuboptionmaybeaddedbyDHCPrelayagentswhichterminateswitchedorpermanent
circuitsandhavemechanismstoidentifytheremotehostendofthecircuit.RefertoRFC3046for
moreinformation.
Example
ThisexamplesetstheRelayAgentRemoteIDsuboptionvalueto2.
C3(su)->router(Config)# ipv6 dhcp relay-agent-info-remote-id-subopt 2
Syntax
ipv6 dhcp pool pool-name
no ipv6 dhcp pool pool-name
Parameters
poolname
Specifiesthenameofthepooltobeconfigured.Poolnamesmustbeless
than31alphanumericcharacters.
Defaults
None.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
24-4
DHCPv6 Configuration
Usage
DHCPv6poolsareusedtospecifyinformationfortheDHCPv6servertodistributetoDHCPv6
clients.ThesepoolsaresharedbetweenmultipleinterfacesoverwhichDHCPv6server
capabilitiesareconfigured.
Afterexecutingthiscommandandenteringpoolconfigurationmode,youcanreturntoglobal
configurationmodebyexecutingtheexitcommand.Poolconfigurationcommandsaredescribed
inthesectionAddressPoolConfigurationCommandsonpage 246.
Usethenoformofthiscommandtoremoveaspecifiedpool.
Example
ThisexampleentersDHCPpoolconfigurationmodetoconfigurethepoolnamedPoolA.
C3(su)->router(Config)# ipv6 dhcp pool PoolA
C3(su)->router(Config-dhcp6s-pool)#
24-5
Commands
For information about...
Refer to page...
domain-name
24-6
dns-server
24-7
prefix-delegation
24-7
exit
24-8
domain-name
ThiscommandsetstheDNSdomainnamewhichisprovidedtoDHCPv6clientsbytheDHCPv6
server.
Syntax
domain-name name
no domain-name name
Parameters
name
SpecifiestheDNSdomainnameforthepoolbeingconfigured.The
namecanconsistofnomorethan31alphanumericcharacters.
Defaults
None.
Mode
RouterDHCPv6poolconfigurationmode:C3(su)>router(Configdhcp6spool)#
Usage
ADNSdomainnameisconfiguredforstatelessserversupport.ADHCPv6poolcanhaveupto8
domainnamesconfiguredforit.
ThenoformofthiscommandwillremovethedomainnamefromtheDHCPv6poolbeing
configured.
Example
Thisexamplespecifiesthedomainnameenterasys.comforthepoolnamedPoolA.
C3(su)->router(Config)# ipv6 dhcp pool PoolA
C3(su)->router(Config-dhcp6s-pool)# domain-name enterasys.com
24-6
DHCPv6 Configuration
dns-server
dns-server
ThiscommandsetstheIPv6DNSserveraddresswhichisprovidedtoDHCPv6clientsbythe
DHCPv6server.
Syntax
dns-server server-address
no dns-server server-address
Parameters
serveraddress
TheIPv6addressoftheDNSserver.
ThisparametermustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
Defaults
None.
Mode
RouterDHCPv6poolconfigurationmode:C3(su)>router(Configdhcp6spool)#
Usage
ADNSserveraddressisconfiguredforstatelessserversupport.ADHCPv6poolcanhaveupto8
DNSserveraddressesconfiguredforit.
ThenoformofthiscommandwillremovetheDHCPv6serveraddressfromtheDHCPv6pool
beingconfigured.
Example
ThisexampleconfiguresaDNSserveraddressforthepoolnamedPoolA.
C3(su)->router(Config)# ipv6 dhcp pool PoolA
C3(su)->router(Config-dhcp6s-pool)# dns-server 2001:0db8:1234:5678::A
prefix-delegation
Thiscommandconfiguresanumericprefixtobedelegatedtoaspecifiedprefixdelegationclient.
Syntax
prefix-delegation prefix/prefix-length DUID [name hostname] [valid-lifetime {secs
| infinite}] [preferred-lifetime {secs | infinite}]
no prefix-delegation prefix/prefix-length DUID
24-7
exit
Parameters
prefix/prefixlength
ThisprefixmustbeintheformdocumentedinRFC4291,withthe
addressspecifiedinhexadecimalusing16bitvaluesbetweencolons.
Thevalueofprefixlengthisadecimalnumberindicatingthenumberof
highordercontiguousbitsoftheaddressthatcomprisetheprefix.
DUID
TheDHCPUniqueIdentifier(DUID)oftheprefixdelegationclient,as
describedinRFC3315.
namehostname
(Optional)Thenameoftheprefixdelegationclient,consistingofupto
31alphanumericcharacters.Thisnameisusedforloggingand/or
tracingonly.
validlifetimesecs|
infinite
(Optional)Thevalidlifetimeoftheprefix,specifiedassecondsoras
infinite.Thevalueofsecscanrangefrom0to4294967295.
preferredlifetime
secs|infinite
(Optional)Thepreferredlifetimeoftheprefix,specifiedassecondsoras
infinite.Thevalueofsecscanrangefrom0to4294967295.
Defaults
Defaultvalueofvalidlifetimeofprefix:604,800
Defaultvalueofpreferredlifetimeofprefix:2,592,000
Mode
RouterDHCPv6poolconfigurationmode:C3(su)>router(Configdhcp6spool)#
Usage
UsethiscommandtomanuallyconfigureanIPv6addressprefixtobedelegatedtoaspecific
client,identifiedbytheirDHCPuniqueidentifier.RefertoRFC3633,IPv6PrefixOptionsfor
DynamicHostConfigurationProtocol(DHCP)version6,formoreinformationaboutprefix
delegation.
Usethenoformofthiscommandtoremoveaconfiguredprefix.
Example
Thisexampleconfiguresaprefixtobedelegatedtotheprefixdelegationclientidentifiedbythe
DUID00:02:00:00:00:11:0A:C0:89:D3:03:00:09:AA.Thedefaultlifetimevaluesareused.
C3(su)->router(Config)# ipv6 dhcp pool PoolA
C3(su)->router(Config-dhcp6s-pool)# prefix-delegation 2001:0db8:10::/48
00:02:00:00:00:11:0A:C0:89:D3:03:00:09:AA
exit
ThiscommandexitsfromDHCPv5poolconfigurationmodeandreturnstoglobalconfiguration
mode.
Syntax
exit
Parameters
None.
24-8
DHCPv6 Configuration
exit
Defaults
None.
Mode
RouterDHCPv6poolconfigurationmode:C3(su)>router(Configdhcp6spool)#
Example
ThisexampleillustrateshowtoexitDHCPv6poolconfigurationmode.
C3(su)->router(Config-dhcp6s-pool)# exit
C3(su)->router(Config)#
24-9
Commands
For information about...
Refer to page...
24-10
24-11
Syntax
ipv6 dhcp server pool-name [rapid-commit} [preference pref]
no ipv6 dhcp server pool-name
Parameters
poolname
Specifiesthepoolcontainingstatelessand/orprefixdelegation
parametersthatshouldbeusedbytheDHCPv6server.Referto
AddressPoolConfigurationCommandsonpage 246forthe
commandstoconfigureanaddresspool.
rapidcommit
(Optional)SpecifythattheservershouldusetheRapidCommitoption
thatallowsforanabbreviatedexchangebetweenDHCPv6clientand
server.RefertoRFC3315formoreinformation.
preferencepref
(Optional)SpecifiesthevalueoftheserversPreferenceoption.This
value,whichcanrangefrom0to4,294,967,295,isusedbyclientsto
determinepreferenceamongmultipleDHCPv6servers.
Defaults
Bydefault,DHCPv6functionalityisdisabled.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
UsethiscommandtoconfigureDHCPv6serverparameterswhenaninterfacewillactasa
DHCPv6server.AddresspoolsareconfiguredusingthecommandsdescribedinsectionAddress
PoolConfigurationCommandsonpage 246.
AninterfacecanbeconfiguredaseitheraDHCPv6serveroraDHCPv6relayagent,butnotboth.
UsethenoformofthiscommandtoremoveDHCPv6serverfunctionalityfromaninterface.
24-10
DHCPv6 Configuration
Example
ThisexampleconfiguresroutinginterfaceVLAN7tobeaDHCPv6server,usingtheaddresspool
namedPoolA.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 dhcp server PoolA
Syntax
ipv6 dhcp relay {destination dest-addr interface intf | interface intf} [remote-id
{duid-ifid | user-defined-string}]
no ipv6 dhcp relay {destination dest-addr interface intf | interface intf}
Parameters
destinationdestaddr
SpecifiestheIPv6addressofaDHCPv6relayserver.ThisIPv6address
canbeaglobaladdress,amulticastaddress,oralinklocaladdress.
Iftheaddressisamulticastorlinklocaladdress,thenyoumustspecify
theinterfacetobeusedtocontacttherelayserverwiththeinterface
parameter.
interfaceintf
Specifiestheinterfacetobeusedtocontacttherelayserver.The
interfaceisidentifiedbyporttype.unitnumber.portnumber.For
example,ge.3.1.
Ifdestinationdestaddrisnotspecified,thenaninterfacemustbe
specifiedandtheDHCPV6ALLAGENTSmulticastaddress(FF02::1:2)
isusedtorelayDHCPv6messagestotherelayserver.
remoteid{duidifid| (Optional)SpecifiesthattheRelayAgentInformationOption
userdefinedstring}
RemoteIDsuboptionistobeaddedtorelayedmessages.
SpecifyingduidifidcausestheremoteIDtobederivedfromtherelay
agentsDUIDandtherelayinterfacenumber.Alternatively,youcan
specifytheremoteIDasauserdefinedstringofalphanumeric
characters.RefertoRFC3046andRFC4649formoreinformationabout
theRemoteIDoption.
Defaults
Ifremoteidisnotspecified,theRelayAgentInformationOptionRemoteIDsuboptionisnot
addedtorelayedmessages.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
UsethiscommandtoconfigurearoutinginterfaceasaDHCPv6relayagent.
AninterfacecanbeconfiguredaseitheraDHCPv6serveroraDHCPv6relayagent,butnotboth.
UsethenoformofthiscommandtoremoveDHCPv6relayagentfunctionalityfromaninterface.
24-11
Examples
ThisexampleconfiguresinterfaceVLAN8asaDHCPv6relayagentthatrelaysDHCPv6
messagestotheDHCPv6serverattheglobaladdress2001:0db8:1234:5555::122:10.
C3(su)->router(Config)# interface vlan 8
C3(su)->router(Config-if(Vlan 8))# ipv6 dhcp relay destination
2001:0db8:1234:5555::122:10/64
ThisexampleconfiguresinterfaceVLAN8asaDHCPv6relayagentbyconfiguringtheinterface
throughwhichtherelayagentrelaysmessagesusingtheDHCPV6ALLAGENTSmulticast
address.
C3(su)->router(Config)# interface vlan 8
C3(su)->router(Config-if(Vlan 8))# ipv6 dhcp relay interface ge.3.1
24-12
DHCPv6 Configuration
Commands
For information about...
Refer to page...
24-13
24-14
24-16
24-17
24-18
24-18
Syntax
show ipv6 dhcp
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleillustratestheoutputofthiscommandwhenDHCPv6isenabledontheswitch.
C3(su)->router# show ipv6 dhcp
DHCPv6 is enabled
Server DUID: 00:01:00:06:90:83:57:c7:00:11:88:56:5d:58
24-13
Syntax
show ipv6 dhcp vlan vlan-id [statistics]
Parameters
vlanvlanid
SpecifiestheIDoftheroutinginterfaceforwhichtodisplayDHCPv6
information.
statistics
(Optional)SpecifiesthatDHCPv6statisticsforthespecifiedinterface
shouldbedisplayed.
Defaults
Ifstatisticsisnotspecified,configurationinformationabouttheinterfaceisdisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
WhenyoudisplayDHCPv6configurationinformation,theinformationdisplayedisdifferent
dependingonwhethertheinterfacehasbeenconfiguredasaDHCPv6serverorrelayagent.
Examples
ThisexampledisplaysDHCPv6configurationinformationaboutVLAN80,whichwasconfigured
asaDHCPv6server.
C3(su)->router# show ipv6 dhcp interface vlan 80
IPv6 Interface
Vlan 80
Mode
Server
Pool Name
newpool
Server Preference
5
Option Flags
Rapid Commit
ThisexampledisplaysDHCPv6configurationinformationaboutVLAN10,whichwasconfigured
asarelayagent.TheoutputfieldsaredescribedinTable 241onpage 2415.
C3(su)->router# show ipv6 dhcp interface vlan 10
IPv6 Interface
Vlan 10
Mode
Relay
Relay Address
5006:4567::100:1
Relay Interface Number
Relay Remote ID
Option Flags
Table 241providesanexplanationofthecommandoutput.
24-14
DHCPv6 Configuration
Table 24-1
Output...
What it displays...
IPv6 Interface
Mode
Pool Name
Server Preference
Option Flags
Relay Address
Relay Remote ID
Option Flags
ThisexampledisplaystheDHCPv6statisticsforVLAN80.
C3(su)->router# show ipv6 dhcp interface vlan 80 statistics
DHCPv6 Interface Vlan 80 Statistics
-----------------------------------DHCPv6 Solicit Packets Received
DHCPv6 Request Packets Received
DHCPv6 Confirm Packets Received
DHCPv6 Renew Packets Received
DHCPv6 Rebind Packets Received
DHCPv6 Release Packets Received
DHCPv6 Decline Packets Received
DHCPv6 Inform Packets Received
DHCPv6 Relay-forward Packets Received
DHCPv6 Relay-reply Packets Received
DHCPv6 Malformed Packets Received
Received DHCPv6 Packets Discarded
Total DHCPv6 Packets Received
DHCPv6 Advertisement Packets Transmitted
DHCPv6 Reply Packets Transmitted
DHCPv6 Reconfig Packets Transmitted
DHCPv6 Relay-reply Packets Transmitted
DHCPv6 Relay-forward Packets Transmitted
Total DHCPv6 Packets Transmitted
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
Table 242providesanexplanationofthecommandoutput.
24-15
Syntax
show ipv6 dhcp statistics
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
Thisexampledisplaystheoutputofthiscommand.
C3(su)->router# show ipv6 dhcp statistics
DHCPv6 Interface Global Statistics
-----------------------------------DHCPv6 Solicit Packets Received
DHCPv6 Request Packets Received
DHCPv6 Confirm Packets Received
DHCPv6 Renew Packets Received
DHCPv6 Rebind Packets Received
DHCPv6 Release Packets Received
DHCPv6 Decline Packets Received
DHCPv6 Inform Packets Received
DHCPv6 Relay-forward Packets Received
DHCPv6 Relay-reply Packets Received
DHCPv6 Malformed Packets Received
Received DHCPv6 Packets Discarded
Total DHCPv6 Packets Received
DHCPv6 Advertisement Packets Transmitted
DHCPv6 Reply Packets Transmitted
DHCPv6 Reconfig Packets Transmitted
DHCPv6 Relay-reply Packets Transmitted
DHCPv6 Relay-forward Packets Transmitted
Total DHCPv6 Packets Transmitted
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
Table 242providesanexplanationofthecommandoutput.
Table 24-2
24-16
Output...
What it displays...
DHCPv6 Configuration
Table 24-2
Output...
What it displays...
Syntax
clear ipv6 dhcp statistics [vlan vlan-id]
Parameters
vlanvlanid
(Optional)SpecifiestheinterfaceforwhichtoclearDHCPv6statistics.
Defaults
Ifnointerfaceisspecified,IPv6DHCPstatisticsforallinterfacesarecleared.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleclearsDHCPv6statisticsforVLAN80.
C3(su)->router# clear ipv6 dhcp statistics vlan 80
24-17
Syntax
show ipv6 dhcp pool pool-name
Parameters
poolname
Thenameoftheconfiguredaddresspoolforwhichtodisplay
information.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
Theinformationdisplayedbythiscommanddiffers,dependingontheconfigurationparameters
ofthepool.
Examples
ThisexampledisplaystheoutputforPoolAthatwasnotconfiguredforprefixdelegation.
C3(su)->router# show ipv6 dhcp pool PoolA
DHCPv6 Pool: PoolA
DNS Server: 2001:db8:1234:5678::A
Domain Name: enterasys.com
ThisexampledisplaystheoutputforPoolBthatwasconfiguredforprefixdelegation.
C3(su)->router# show ipv6 dhcp pool PoolB
DHCPv6 Pool: PoolB
Client DUID: 00:02:00:00:00:11:0A:C0:89:D3:03:00:09:AA
Host:
Prefix/Prefix Length: 2001:db8:10::/48
Preferred Lifetime: 2592000
Valid Lifetime: 604800
DNS Server:
Domain Name:
Syntax
show ipv6 dhcp binding [ipv6-addr]
24-18
DHCPv6 Configuration
Parameters
ipv6addr
(Optional)SpecifiestheIPv6addressoftheDHCPprefixdelegation
clientforwhichtodisplaybindinginformation.
Defaults
IfnoIPv6addressisspecified,allbindingsaredisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampledisplaysallbindingsfortheclientwiththeIPv6addressFE80::111:FCF1:DEA5:10.
C3(su)->router# show ipv6 dhcp binding FE80::111:FCF1:DEA5:10
24-19
24-20
DHCPv6 Configuration
25
OSPFv3 Configuration
* IPv6 Routing License Required *
IPv6 routing must be enabled with a license key in order to use this feature. If you have purchased an IPv6
routing license key, and have enabled routing on the device, you must activate your license as described in
the chapter entitled Activating Licensed Features in order to enable the OSPFv3 protocol configuration
command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales.
ThecommandsinthischapterperformconfigurationoftheOSPFv3routingprotocolonthe
SecureStackC3.ForinformationaboutgeneralIPv6configuration,refertoChapter 22,IPv6
Configuration.ForinformationaboutmanagingIPv6hostfunctionalityattheswitchlevel,refer
toChapter 21,IPv6Management.
For information about...
Refer to page...
25-3
25-10
25-21
25-29
Overview
OSPFv3istheOpenShortestPathFirstroutingprotocolforIPv6.ItissimilartoOSPFv2inits
conceptofalinkstatedatabase,intra/interareaandASexternalroutesandvirtuallinks.OSPFv3
alsodiffersfromOSPFv2inanumberofrespects:
Peeringisdonevialinklocaladdresses.
Theprotocolislinkratherthannetworkcentric.
AddressingsemanticshavebeenmovedtoleafLSAs,whicheventuallywillallowitsusefor
bothIPv4andIPv6.
TwonewLSAshavebeenintroduced:thelinkLSAandtheintraareaLSA.
Pointtopointlinksaresupportedinordertoenableoperationovertunnels.OSPFv3views
IPv6overIPv4tunnelsasapointtopointinterfacewithalinklocaladdressandpossibly,aglobal
unicastaddress.OSPFv3usesthereportedMTUfortunnelinterfaces.
OSPFv3supportsECMProutes.OSPFv3includesNSSAandASexternalLSAoverflowlimit
support.RFC1583compatibilitydoesnotapplytoOSPFv3.NoOSPFv3authenticationmethods
aresupportedatthistime.
LSAformatsarechanged,andthetype3and4summaryLSAsarerenamedinterareaprefix
andinterarearouterLSAs.AlsonotethatOSPFv3LSAidentifierscontainnoaddressing
25-1
Overview
semantics.LSAscopeisgeneralizedtolink,area,andASscope.OSPFv3specifiestheprocessing
ofunsupportedLSAs.UnsupportedLSAsaremaintainedinthedatabaseandfloodedaccording
toscope.InOSPFv3,routerswith100ormoreinterfacesgeneratemorethanonerouterLSA.A
newlinkLSAhasbeencreated.AddressesinLSAsarespecifiedas[prefix,prefixlength].
AreaIDandRouterIDremain32bitidentifiers.OSPFv3identifiesNeighborsbyrouterIDinstead
oftheinterfaceaddressusedinOSPFv2.
NotethatbothOSPFv3andOSPFv2canbeenabledandrunontheSecureStackC3.
Default Conditions
ThefollowingtableliststhedefaultOSPFv3conditions.
25-2
Condition
Default Value
IPv6 OSPF
Disabled
10
40 seconds
10 seconds
Enabled
Broadcast
Enabled
40
10
Default-information originate
Metric unspecified
Type 2
Distance OSPF
Intra 8
Inter 10
Type-1 13
Type-2 50
Enabled
Exit-overflow-interval
External-lsdb-limit
-1
Maximum-paths
Redistribute
Metric unspecified
Type 2
Tag 0
Trapflags
Enabled
OSPFv3 Configuration
Command
For information about...
Refer to page...
ipv6 router id
25-3
25-4
default-information originate
25-4
default-metric
25-5
distance ospf
25-5
exit-overflow-interval
25-6
external-lsdb-limit
25-7
maximum-paths
25-8
redistribute
25-8
ipv6 router id
Thiscommandconfiguresa32bitinteger,enteredin32bitdottedquadnotation,usedto
uniquelyidentifythisOSPFv3router.
Syntax
ipv6 router id ip-address
Parameters
ipaddress
SpecifiestheIDoftheOSPFv3router,in32bitdottedquadnotation.
Defaults
None.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
UsethiscommandtoconfiguretheOSPFv3routerID.
Example
ThisexampleillustratesconfiguringtheOSPFv3routerIDas2.2.2.2.
C3(su)->router(Config)# ipv6 router id 2.2.2.2
SecureStack C3 Configuration Guide
25-3
Syntax
ipv6 router ospf
Parameters
None.
Defaults
None.
Mode
Routerglobalconfiguration:C3(su)>router(Config)#
Usage
UsethiscommandtoenterOSPFv3configurationmodesoyoucanconfigureglobalOSPFv3
parameters.
Example
ThisexampleillustratesenteringrouterOSPFv3configurationmode.
C3(su)->router(Config)# ipv6 router ospf
C3(su)->router(Config-router)#
default-information originate
Thiscommandisusedtocontroltheadvertisementofdefaultroutes.
Syntax
default-information originate [always] [metric value] [metric-type type]
no default-information originate [metric] [metric-type]
Parameters
always
(Optional)Alwaysadvertisesthedefaultrouteinformation.
metricvalue
(Optional)Specifiesthemetricofthedefaultroute.Themetricvaluecan
rangefrom0to16777214.
metrictypetype
(Optional)Specifiesthemetrictypeofthedefaultroute.Themetrictype
canbe1,whichspecifiestype1externalroute,or2,whichspecifiestype
2externalroute.
Defaults
Adefaultexternalrouteisnotgenerated.
Thedefaultmetricisunspecified.
Thedefaulttypeistype2.
25-4
OSPFv3 Configuration
default-metric
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
UsethiscommandtogenerateadefaultexternalrouteintoanOSPFv3routingdomain.Usetheno
formofthiscommandtostopthegenerationofadefaultexternalroute.
Example
Thisexamplespecifiesametricof100forthedefaultrouteredistributedintotheOSPFv3routing
domain,andanexternalmetrictypeof1.
C3(su)->router(Config-router)# default-information originate metric 100
metric-type 1
default-metric
ThiscommandsetsadefaultmetricforroutesredistributedfromanotherprotocolintoOSPFv3.
Syntax
default-metric metric
no default-metric
Parameters
metric
Thevalueofmetriccanrangefrom1to16777214.
Defaults
Nodefaultmetricisconfigured.
Mode
RouterOSPFv3configuration:C3(su)->router(Config-router)#
Usage
Usethiscommandtocausethesamemetricvaluetobeusedforallredistributedroutes.
Usethenoformofthiscommandtoremoveaconfigureddefaultmetric.
Example
Thisexampleconfiguresametricof100tobeusedforallredistributedroutes.
C3(su)->router(Config-router)# default-metric 100
distance ospf
ThiscommandsetstheroutepreferencevalueofOSPFv3.
Syntax
distance ospf {intra | inter | type1 | type2} preference
no distance ospf {intra | inter | type1 | type2}
25-5
exit-overflow-interval
Parameters
intra
Specifiesthepreferenceforintraarearoutes(allrouteswithinanarea)
inter
Specifiesthepreferenceforinterarearoutes(allroutesbetweenareas)
type1
SpecifiesthepreferenceforType1externalroutes(routeslearnedby
redistributionfromotherroutingdomains)
type2
SpecifiesthepreferenceforType2externalroutes(routeslearnedby
redistributionfromotherroutingdomains)
preference
Thepreferencerangeisfrom1to255.
Defaults
Thedefaultpreferencevaluesare:
Intraarea=8
Interarea=10
Type1=13
Type2=50
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Lowerroutepreferencevaluesarepreferredwhendeterminingthebestroute.TheOSPFv3
specification(RFC2328)requiresthatpreferencesmustbegiventotherouteslearnedviaOSPFv3
inthefollowingorder:intraarea<interarea<Type1<Type2.
Aroutewithapreferenceof255cannotbeusedtoforwardtraffic.
Usethenoformofthiscommandtoresetthepreferencevaluesbacktothedefaults.
Example
Thefollowingexamplesettheintraareapreferenceto5.
C3(su)->router(Config-router)# distance ospf intra 5
exit-overflow-interval
ThiscommandconfigurestheexitoverflowintervalforOSPFv3.
Syntax
exit-overflow-interval seconds
no exit-overflow-interval
Parameters
seconds
Specifiestherangeforseconds,whichisfrom0to2147483647.
Defaults
Thedefaultintervalvalueis0.
25-6
OSPFv3 Configuration
external-lsdb-limit
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
TheexitoverflowintervalisthenumberofsecondsafterenteringOverflowstatethatarouterwill
waitbeforeattemptingtoleavetheOverflowState.Thisallowstheroutertoagainoriginate
nondefaultASexternalLSAs.Whensetto0,therouterwillnotleaveOverflowStateuntil
restarted.
Thenoformofthiscommandresetstheintervaltothedefaultof0.
Example
Thisexamplesetstheexitoverflowintervalto10seconds.
C3(su)->router(Config-router)# exit-overflow-interval 10
external-lsdb-limit
ThiscommandconfigurestheexternalLSDBlimitforOSPFv3.
Syntax
external-lsdb-limit limit
no external-lsdb-limit
Parameters
limit
Specifiesthelimit,whichcanrangefrom1to2147483647.Avalueof1
meansthatthereisnolimit.
Defaults
Thedefaultvalueis1.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
WhenthenumberofnondefaultASexternalLSAsinarouterslinkstatedatabasereachesthe
externalLSDBlimit,therouterentersoverflowstate.Therouterneverholdsmorethanthe
externalLSDBlimitnondefaultASexternalLSAsinitdatabase.TheexternalLSDBlimitMUST
besetidenticallyinallroutersattachedtotheOSPFv3backboneand/oranyregularOSPFv3area.
Thenoformofthiscommandresetsthelimittothedefaultvalueof1,meaningnolimit.
Example
ThisexamplesetstheexternalLSDBlimitto1000.
C3(su)->router(Config-router)# external-lsdb-limit 1000
25-7
maximum-paths
maximum-paths
ThiscommandsetsthenumberofpathsthatOSPFv3canreportforagivendestination.
Syntax
maximum-paths maxpaths
no maximum-paths
Parameters
maxpaths
Specifiesthevalueformaxpaths,whichcanrangefrom1to4.
Defaults
Thedefaultvalueis4.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Usethenoformofthiscommandtoresetthemaximumnumberofpathstothedefaultvalueof4.
Example
Thisexamplesetsthemaximumnumberofpathsforagivendestinationto3.
C3(su)->router(Config-router)# maximum-paths 3
redistribute
ThiscommandconfigurestheOSPFv3protocoltoallowredistributionofroutesfromthespecified
sourceprotocol/routers.
Syntax
redistribute {connected | static} [metric value] [metric-type type] [tag tag]
no redistribute {connected | static} [metric] [metric-type] [tag]
Parameters
connected|static
Specifiesthesourceprotocoltoredistribute.
metricvalue
(Optional)Specifiestherouteredistributionmetric.Themetricvaluecan
rangefrom0to16777214.
metrictypetype
(Optional)Specifiestherouteredistributionmetrictype.Themetrictype
canbe1,whichspecifiestype1externalroute,or2,whichspecifiestype
2externalroute.
tagtag
(Optional)Specifiesarouteredistributiontag.Thevalueoftagcan
rangefrom0to4294967295.
Defaults
Thedefaultvaluesare:
25-8
OSPFv3 Configuration
redistribute
Metric=unspecified
Metrictype=Type2
Tag=0
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
ThenoformofthiscommandconfigurestheOSPFv3protocoltoprohibitredistributionofroutes
fromthespecifiedsourceprotocol/routers.
Example
Thisexampleconfiguresrouteredistributionofstaticroutesandappliesametricof10
C3(su)->router(Config-router)# redistribute static metric 10
25-9
Commands
For information about...
Refer to page...
area default-cost
25-10
area nssa
25-11
25-12
25-12
25-13
25-14
25-14
area range
25-15
area stub
25-16
25-17
area virtual-link
25-17
25-18
25-19
25-19
25-20
area default-cost
Thiscommandconfiguresthedefaultcostforthesummarydefaultroutegeneratedbythearea
borderrouterintothestuborNSSAarea.
Syntax
area areaid default-cost cost
no area areaid default-cost
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
cost
Specifiesacost,whichcanrangebetween1and16777215.
Defaults
None.
25-10
OSPFv3 Configuration
area nssa
Mode
RouterOSPFv3configuration:C3(su)->router(Config-router)#
Usage
UsethiscommandtosetthecostvalueforthedefaultroutethatissentintoastubareaorNSSA
byanAreaBorderRouter(ABR).Thenoformofthiscommandremovesthecostvaluefromthe
summaryroutethatissentintothestubarea.
Example
Thisexamplesetsthedefaultroutecostto50forarea20.
C3(su)->router(Config-router)# area 20 default-cost 50
area nssa
Thiscommandconfiguresthespecifiedareatofunctionasanotsostubbyarea(NSSA).
Syntax
area areaid nssa
no area areaid nssa
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
AnNSSAallowssomeexternalroutesrepresentedbyexternalLinkStateAdvertisements(LSAs)
tobeimportedintoit.Thisisincontrasttoastubareathatdoesnotallowanyexternalroutes.
ExternalroutesthatarenotimportedintoanNSSAcanberepresentedbymeansofadefault
route.ThisconfigurationisusedwhenanOSPFv3internetworkisconnectedtomultiplenon
OSPFroutingdomains.
ThenoformofthiscommandchangestheNSSAbacktoaplainarea.
Example
Thisexampleshowshowtoconfigurearea20asanNSSA.
C3(su)->router(Config-router)# area 20 nssa
25-11
Syntax
area areaid nssa default-info-originate [metric] [comparable | non-comparable]
no area areaid nssa default-info-originate
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
metric
(Optional)Specifiesthemetricofthedefaultroute,intherangeof1to
16777214.
comparable|
noncomparable
(Optional)Specifiesthemetrictype:
comparablenssaexternal1
noncomparablenssaexternal2
Defaults
Defaultmetricvalueis10.
Mode
RouterOSPFv3configuration:C3(su)->router(Config-router)#
Usage
Usethiscommandtoallowadefaultroutetobeadvertisedwithinthearea.Thisoptionshouldbe
configuredonlyonareaborderrouters(ABRs).
Usethenoformofthiscommandtopreventadefaultroutetobeadvertisedwithinthearea.
Example
ThisexampleconfiguresNSSAarea20toadvertiseadefaultroute.
C3(su)->router(Config-router)# area 20 nssa default-info-originate
Syntax
area areaid no-redistribute
no area areaid no-redistribute
Parameters
areaid
25-12
OSPFv3 Configuration
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
RouterOSPFv3configuration:C3(su)->router(Config-router)#
Usage
UsethiscommandtopreventredistributionoflearnedexternalroutestotheNSSAbythisarea
borderrouter(ABR).Usethenoformofthiscommandtoenableredistributionoflearnedexternal
routestotheNSSA.
Example
ThisexampleconfigurestheroutertonotredistributelearnedexternalroutesintoNSSA20.
C3(su)->router(Config-router)# area 20 no-redistribute
Syntax
area areaid nssa no-summary
no area areaid nssa no-summary
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
UsethiscommandtopreventtheadvertisingofsummaryroutesintothespecifiedNSSAbythis
router.UsethenoformofthiscommandtoenableadvertisingofsummaryroutesintotheNSSA.
Example
ThisexampletheroutertonotadvertisesummaryroutesintoNSSA20.
C3(su)->router(Config-router)# area 20 nssa no-summary
25-13
Syntax
area areaid nssa translator-role {always | candidate}
no area areaid nssa translator-role
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
always
Specifiesthattherouterwillalwaysassumetheroleofthetranslatorthe
instantisbecomesaborderrouter.
candidate
Specifiesthattherouterwillparticipateinthetranslatorelection
processwhenitbecomesaborderrouter.
Defaults
Bydefault,thetranslatorroleisdisabled.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
TheNSSATranslatorRolespecifieswhetherornotanNSSArouterwillunconditionallytranslate
Type7LSAstoType5LSAswhenactingasanNSSAborderrouter.
Whenthealwaysparameterisspecifiedwiththiscommand,therouterwillalwaystranslateType
7LSAs,regardlessofthetranslatorstateofotherNSSAborderrouters.Whenthecandidate
parameterisspecified,theNSSArouterwillparticipateinthetranslatorelectionprocess
describedinRFC3101,TheOSPFNotSoStubbyArea(NSSA)Option.
Usethenoformofthiscommandtoreturntheconfiguredtranslatorroletothedefaultof
disabled.
Example
Thisexampleconfigurestheroutertoalwaysassumethetranslatorrolewhenitbecomesanarea
borderrouterforNSSA20.
C3(su)->router(Config-router)# area 20 nssa translator-role always
Syntax
area areaid translator-stab-intv interval
no area areaid translator-stab-intv
25-14
OSPFv3 Configuration
area range
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
interval
Specifiesthestabilityintervalinseconds.Thevalueofintervalcanrange
from0to3600seconds.
Defaults
Thedefaultintervalis40seconds.
Mode
RouterOSPFv3configuration:C3(su)->router(Config-router)#
Usage
Thestabilityintervalistheperiodoftimethatanelectedtranslatorcontinuestoperformitsduties
afteritdeterminesthatitstranslatorstatushasbeendeposedbyanotherrouter.
Example
Thisexamplesetsthetranslatorstabilityintervalto60secondsforNSSA20.
C3(su)->router(Config-router)# area 20 nssa translator-stab-intv 60
area range
ThiscommandcreatesanaddressrangeforthespecifiedNSSA.
Syntax
area areaid range ipv6-prefix/prefix-length {summarylink | nssaexternallink}
[advertise | not-advertise]
no area areaid range ipv6-prefix/prefix-length
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
ipv6prefix/prefixlength SpecifiesIPv6prefixandthelengthoftheIPv6prefixfortheaddress
range.Theprefixmustbespecifiedinhexadecimalusing16bitvalues
betweencolons.
Thevalueofprefixlengthisadecimalnumberindicatingthenumberof
highordercontiguousbitsthatcomprisetheprefix.
summarylink
SpecifiesthatroutesummarizationshouldbebasedonsummaryLSAs.
nssaexternallink
SpecifiesthatroutesummarizationshouldbebasedonexternalLSAs
Type7.
advertise|
notadvertise
(Optional)Specifieswhetherornottheroutesshouldbeadvertised.If
neitherparameterisspecifies,thedefaultisadvertise.
Defaults
Areaaddressrangesarenotconfiguredbydefault.
25-15
area stub
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Addressrangescontroltheadvertisementofroutesacrossareaboundaries.Routinginformation
issummarized,oraggregated,atareaboundaries.Externaltothearea,atmostasinglerouteis
advertised(viaaninterareaprefixLSA)foreachaddressrange.Arouteisadvertisedifandonly
iftheaddressrangesstatusissettoadvertise.Thedefaultconditionistoadvertise.
ForABRsconfiguredforNSSA,routesummarization/aggregationcanbeimplementedbasedon
LSAtypeeithersummaryLSAs(specifiedwiththesummarylinkparameter),orNSSAexternal
LSAsType7(specifiedwiththenssaexternallinkparameter).
Youcanconfiguremultipleaddressrangeswiththiscommand.
Usethenoformofthiscommandtoremoveaconfiguredaddressrange.
Example
Thisexampleconfiguresanaddressrangetobeconsolidatedandadvertisedbasedonsummary
LSAs.
C3(su)->router(Config-router)# area 20 range 3FFe:501::/32 summarylink
area stub
ThiscommandcreatesastubareaforthespecifiedareaID.
Syntax
area areaid stub
no area areaid stub
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
AstubareaischaracterizedbythefactthatASexternalLSAsarenotpropagatedintothearea.
RemovingASexternalLSAsandsummaryLSAscansignificantlyreducethelinkstatedatabaseof
routerswithinthestubarea.
Usethenoformofthecommandtodeleteastubarea.
25-16
OSPFv3 Configuration
Example
ThisexamplecreatesastubareawiththeIDof30.
C3(su)->router(Config-router)# area 30 stub
Syntax
area areaid stub no-summary
no area areaid stub no-summary
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
UsethenoformofthiscommandtosetthesummaryLSAimportmodetothedefaultforthe
specifiedstubarea.
Example
TheexampledisablestheimportofsummaryLSAsintostubarea30.
C3(su)->router(Config-router)# area 30 stub no-summary
area virtual-link
ThiscommandcreatestheOSPFv3virtualinterfaceforthespecifiedareaandneighbor.
Syntax
area areaid virtual-link neighborid
no area areaid virtual-link neighborid
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
neighborid
SpecifiesthevirtuallinkneighborbymeansofitsrouterID.Therouter
IDmustbeenteredin32bitdottedquadnotation.
25-17
Defaults
None.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
ThevirtuallinkneighborisidentifiedbyitsrouterID.Usethenoformofthiscommandtodelete
theconfiguredOSPFv3virtualinterfaceidentifiedbyareaandneighbor.
Example
Thisexamplecreatesavirtualinterfaceforarea20andtheneighborwithrouterID2.2.2.2.
C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2
Syntax
area areaid virtual-link neighborid dead-interval seconds
no area areaid virtual-link neighborid dead-interval
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
neighborid
SpecifiesthevirtuallinkneighborbymeansofitsrouterID.Therouter
IDmustbeenteredin32bitdottedquadnotation.
seconds
Specifiesthevalueofthedeadintervalinseconds.Therangeisfrom1
to65535seconds.
Defaults
Thedefaultdeadintervalis40seconds.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Usethenoformofthiscommandtoreturnaconfiguredvaluetothedefaultof40seconds.
Example
Thisexampleconfiguresadeadintervalof60secondsforthespecifiedvirtualinterface.
C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 dead-interval 60
25-18
OSPFv3 Configuration
Syntax
area areaid virtual-link neighborid hello-interval seconds
no area areaid virtual-link neighborid hello-interval
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
neighborid
SpecifiesthevirtuallinkneighborbymeansofitsrouterID.Therouter
IDmustbeenteredin32bitdottedquadnotation.
seconds
Specifiesthevalueofthehellointervalinseconds.Therangeisfrom1
to65535seconds.
Defaults
Thedefaulthellointervalis10seconds.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Usethenoformofthiscommandtoreturnaconfiguredvaluetothedefaultvalueof10seconds.
Example
Thisexampleconfiguresahellointervalof30secondsforthespecifiedOSPFv3virtualinterface.
C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 hello-interval 30
Syntax
area areaid virtual-link neighborid retransmit-interval seconds
no area areaid virtual-link neighborid retransmit-interval
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
neighborid
SpecifiesthevirtuallinkneighborbymeansofitsrouterID.Therouter
IDmustbeenteredin32bitdottedquadnotation.
seconds
Specifiesthevalueoftheretransmitintervalinseconds.Therangeis
from1to3600seconds.
25-19
Defaults
Thedefaultretransmitintervalis5seconds.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Usethenoformofthiscommandtoreturnaconfiguredvaluetothedefaultvalueof5seconds.
Example
Thisexamplesetstheretransmitintervalto10secondsforthespecifiedOSPFv3virtualinterface.
C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 retransmit-interval
10
Syntax
area areaid virtual-link neighborid transmit-delay seconds
no area areaid virtual-link neighborid transmit-delay
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
neighborid
SpecifiesthevirtuallinkneighborbymeansofitsrouterID.Therouter
IDmustbeenteredin32bitdottedquadnotation.
seconds
Specifiesthevalueofthetransmitdelayinseconds.Therangeisfrom1
to3600seconds.
Defaults
Thedefaulttransmitdelayis1second.
Mode
RouterOSPFv3configuration:C3(su)>router(Configrouter)#
Usage
Usethenoformofthiscommandtoresetthetransmitdelaytothedefaultof1second.
Example
Thisexamplesetsthetransmitdelayto2secondsforthespecifiedOSPFv3virtualinterface.
C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 transmit-delay 2
25-20
OSPFv3 Configuration
Commands
For information about...
Refer to page...
25-21
25-22
25-22
25-23
25-24
25-24
25-25
25-26
25-26
25-27
Syntax
ipv6 ospf enable
no ipv6 ospf enable
Parameters
None.
Defaults
OSPFv3isdisabledbydefault.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
UsethiscommandtoenableOSPFv3onarouterVLANinterfaceoronaloopbackinterface.Use
thenoformofthiscommandtodisableOSPFv3onaninterface.
Note: In order for OSPFv3 to run on an interface, IPv6 must be explicitly enabled on the interface
using the ipv6 enable command.
25-21
Example
ThisexampleentersrouterinterfaceconfigurationmodeforVLAN7andthenenablesOSPFv3on
theinterface.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf enable
Syntax
ipv6 ospf areaid areaid
no ipv6 ospf areaid areaid
Parameters
areaid
SpecifiestheareaIDineither32bitdottedquadformatorasadecimal
numberbetween0and4294967295.
Defaults
None.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
TheareaIDuniquelyidentifiestheareatowhichtheinterfaceconnects.AssigninganareaID
whichdoesnotexistonaninterfacecausestheareatobecreatedwithdefaultvalues.
Usethenoformofthiscommandtoremoveanareafromtheinterface.
Examples
ThisexampleassignsVLAN7toarea20,expressedindottedquadformat.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf areaid 0.0.0.20
ThisexampleassignsVLAN7toarea20,expressedasadecimalnumber.
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf areaid 20
Syntax
ipv6 ospf cost cost
no ipv6 ospf cost cost
25-22
OSPFv3 Configuration
Parameters
cost
Specifiesthecostofsendingapacketonthisinterface.Thevaluecan
rangefrom1to65535.
Defaults
Thedefaultcostis10.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Usethiscommandtoexplicitlyspecifythecostofsendingapacketontheinterfacebeing
configuredforOSPFv3.Usethenoformofthiscommandtoreturnthecosttothedefaultvalueof
10.
Example
ThisexampleconfiguresthecostforrouterinterfaceVLAN7to100.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf cost 100
Syntax
ipv6 ospf dead-interval seconds
no ipv6 ospf dead-interval seconds
Parameters
seconds
SpecifiestheOSPFv3deadintervalinseconds.Thevaluecanrange
from1to2147483647seconds.
Defaults
Thedefaultdeadintervalvalueis40seconds.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
TheOSPFv3deadintervalisthelengthoftimeinsecondsthataroutersHellopacketshavenot
beenseenbeforeitsneighborroutersdeclarethattherouterisdown.Thevalueforthedead
intervalmustbethesameforallroutersattachedtoacommonnetwork,andshouldbesome
multipleofthehellointerval.
Usethenoformofthiscommandtoreturnthedeadintervaltothedefaultvalueof40seconds.
25-23
Example
ThisexamplesetsthedeadintervalforrouterinterfaceVLAN7to60seconds.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf dead-interval 60
Syntax
ipv6 ospf hello-interval seconds
no ipv6 ospf hello-interval seconds
Parameters
seconds
SpecifiestheOSPFv3hellointervalinseconds.Thevaluecanrange
from1to65535seconds.
Defaults
Thedefaulthellointervalis10seconds.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
UsethiscommandtospecifytheintervalbetweenhellopacketsthatOSPFv3sendsonthe
interfacebeingconfigured.Theshorterthehellointerval,thefastertopologicalchangeswillbe
detected,butmoreroutingtrafficwillensue.Thehellointervalmustbethesameforallrouters
attachedtoacommonnetwork.
Usethenoformofthiscommandtoreturnthehellointervaltothedefaultvalueof10seconds.
Example
ThisexamplesetsthehellointervalforrouterinterfaceVLAN7to20seconds.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf hello-interval 20
Syntax
ipv6 ospf mtu-ignore
no ipv6 ospf mtu-ignore
Parameters
None.
25-24
OSPFv3 Configuration
Defaults
Bydefault,MTUmismatchdetectionisenabled.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
OSPFDatabaseDescriptionpacketsspecifythesizeofthelargestIPpacketthatcanbesent
withoutfragmentationontheinterface.WhenarouterreceivesaDatabaseDescriptionpacket,it
examinestheMTUadvertisedbytheneighbor.Bydefault,iftheMTUislargerthantheroutercan
accept,theDatabaseDescriptionpacketisrejectedandtheOSPFadjacencyisnotestablished.
UsethiscommandtopreventtheOSPFv3routerprocessfromcheckingwhetherneighborsare
usingthesamemaximumtransmissionunit(MTU)onacommoninterfacewhenexchanging
DatabaseDescriptionpackets.
UsethenoformofthiscommandtoenableMTUmismatchdetection.
Example
ThisexampledisablesMTUmismatchdetectiononrouterinterfaceVLAN7.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf mtu-ignore
Syntax
ipv6 ospf network {broadcast | point-to-point}
no ipv6 ospf network {broadcast | point-to-point}
Parameters
broadcast
Setsthenetworktypetobroadcast.
pointtopoint
Setsthenetworktypetopointtopoint.
Defaults
Defaultnetworktypeisbroadcast.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Normally,thenetworktypeisdeterminedfromthephysicalIPnetworktype.Bydefault,all
EthernetnetworksareOSPFv3typebroadcast.Similarly,tunnelinterfacesdefaulttopointto
point.WhenanEthernetportisusedasasinglelargebandwidthIPnetworkbetweentworouters,
thenetworktypecanbepointtopointsincethereareonlytworouters.Usingpointtopointas
thenetworktypeeliminatestheoverheadoftheOSPFv3designatedrouterelection.Itisnormally
notusefultosetatunneltoOSPFv3networktypebroadcast.
25-25
Usethenoformofthiscommandtosetthenetworktypetothedefault.
Example
ThisexamplesetsthenetworktypetopointtopointforrouterinterfaceVLAN7.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf network point-to-point
Syntax
ipv6 ospf priority priority
no ipv6 ospf priority
Parameters
priority
Specifiesthepriorityvalue,whichcanrangefrom0to255.
Defaults
Defaultpriorityvalueis1.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Whentworoutersonthesamenetworkattempttobecomethedesignatedrouter,theonewiththe
higherrouterprioritytakesprecedence.Ifthereisatie,therouterwiththehigherrouterIDtakes
precedence.Arouterwitharouterprioritysettozeroisineligibletobecomethedesignatedrouter
orbackupdesignatedrouter.
Usethenoformofthiscommandtoreturnpriorityvaluetothedefaultof1.
Example
ThisexamplesetsthepriorityforrouterinterfaceVLAN7to5.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf priority 5
Syntax
ipv6 ospf retransmit-interval seconds
no ipv6 ospf retransmit-interval
25-26
OSPFv3 Configuration
Parameters
seconds
Specifiestheretransmitintervalvalue,whichcanrangefrom0to3600
seconds.
Defaults
Defaultvalueis4seconds.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Theretransmitintervalisthenumberofsecondsbetweenlinkstateadvertisement
retransmissionsforadjacenciesbelongingtothisrouterinterface.Thisvalueisalsousedwhen
retransmittingdatabasedescriptionandlinkstaterequestpackets.
Usethenoformofthiscommandtoresettheretransmitintervaltothedefaultvalueof4seconds.
Example
Thisexamplesetstheretransmitintervalto10secondsforrouterinterfaceVLAN7.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf retransmit-interval 10
Syntax
ipv6 ospf transmit-delay seconds
no ipv6 ospf transmit-delay
Parameters
seconds
Specifiesthetransmitdelay,whichcanrangefrom1to3600seconds.
Defaults
Defaultvalueis1second.
Mode
Routerinterfaceconfiguration:C3(su)>router(Configif(Vlan1))#
Usage
Thetransmitdelay,specifiedinseconds,setstheestimatednumberofsecondsittakestotransmit
alinkstateupdatepacketoverthisinterface.
Usethenoformofthiscommandtoreturnthetransmitdelaytothedefaultvalueof1seconds.
25-27
Example
Thisexamplesetsthetransmitdelayvalueto4secondsforrouterinterfaceVLAN7.
C3(su)->router(Config)# interface vlan 7
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf transmit-delay 4
25-28
OSPFv3 Configuration
Commands
For information about...
Refer to page...
25-29
25-31
25-32
25-33
25-34
25-38
25-40
25-42
25-44
25-45
25-46
Syntax
show ipv6 ospf
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleshowshowtodisplayOSPFv3routerinformation.
C3(su)->router# show ipv6 ospf
Router ID
OSPF Admin Mode
ASBR Mode
2.2.2.2
Enable
Enable
25-29
ABR Status
Exit Overflow Interval
External LSA Count
External LSA Checksum
New LSAs Originated
LSAs Received
External LSDB Limit
Default Metric
Maximum Paths
Default Route Advertise
Always
Metric
Metric Type
Enable
0
0
0
89
177
No Limit
Not Configured
4
Disabled
FALSE
External Type 2
Table 251providesanexplanationofthecommandoutput.
Note: Some of the information in Table 25-1 displays only if you enable OSPFv3 and configure
certain features.
Table 25-1
25-30
Output Field
What It Displays...
Router ID
ASBR Mode
ABR Status
LSAs Received
Default Metric
Maximum Paths
The maximum number of paths that OSPF can report for a given
destination.
OSPFv3 Configuration
Table 25-1
Output Field
What It Displays...
Always
Metric
The metric for the advertised default routes. If the metric is not
configured, this field is blank.
Metric Type
Syntax
show ipv6 ospf area areaid
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleshowshowtodisplayOSPFv3informationforarea20.
C3(su)->router>show ipv6 ospf area 20
AreaID
External Routing
Spf Runs
Area Border Router Count
Area LSA Count
Area LSA Checksum
Stub Mode
0.0.0.20
Import NSSAs
7
0
5
188094
Disable
Output Field
What It Displays...
AreaID
External Routing
Spf Runs
25-31
Table 25-2
Output Field
What It Displays...
Stub Mode
Metric value of the stub area. This field displays only if the area is
a configured as a stub area.
Syntax
show ipv6 ospf abr
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleshowshowtodisplayOSPFv3areaborderrouterinformation.
C3(su)->router# show ipv6 ospf abr
Type
Router Id
Cost
Area ID
Next Hop
Next Hop
Intf
----- -------------- ---- ------------ -------------------------------- -------INTRA 82.15.0.1
10
0.0.0.10
FE80::200:2DFF:FEE6:FB6B
Vlan 48
Table 253providesanexplanationofthecommandoutput.
Table 25-3
Output Field
What It Displays...
Type
25-32
Router ID
Cost
Area ID
OSPFv3 Configuration
Table 25-3
Output Field
What It Displays...
Syntax
show ipv6 ospf asbr
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleshowshowtodisplayOSPFv3ASborderrouterroutes.
C3(su)->router# show ipv6 ospf asbr
Type
Router Id
Cost
Area ID
Next Hop
Next Hop
Intf
----- -------------- ---- ------------ -------------------------------- -------INTER 1.11.1.1
5
0.0.0.20
FE80::100:1111:FEE6:FB7A
Vlan 35
Table 254providesanexplanationofthecommandoutput.
Table 25-4
Output Field
What It Displays...
Type
Router ID
Cost
Area ID
Next Hop
25-33
Syntax
show ipv6 ospf [areaid] database [{external | inter-area {prefix | router} | link |
network | nssa-external | prefix | router | unknown {area | as | link}}]
[lsid] [{adv-router [rtrid] | self-originate | database-summary}]
Parameters
areaid
(Optional)Displaydatabaseinformationaboutaspecificarea.Enterthe
areaIDinIPaddressformat(dottedquad)orasadecimalvalue.
external
(Optional)DisplayexternalLSAs.
interarea
(Optional)DisplayinterareaLSAs.
prefix
(Optional)DisplayintraareaPrefixLSAs.
router
(Optional)DisplayrouterLSAs.
link
(Optional)DisplaylinkLSAs.
network
(Optional)DisplaynetworkLSAs.
nssaexternal
(Optional)DisplayNSSAexternalLSAs.
unknown
{area|as|link}
(Optional)Displayunknownarea,unknownAS,orunknownlink
LSAs.
lsid
(Optional)SpecifiesthelinkstateID.
advrouter[rtrid]
(Optional)DisplaytheLSAsthatarerestrictedbytheadvertisingrouter.
Optionally,specifytherouterbyitsrouterID(rtrid),enteredasa32bit
dottedquadvalue.
selforiginate
(Optional)DisplayLSAsthatareselforiginated.
databasesummary
(Optional)DisplaysthenumberofeachtypeofLSAinthedatabaseand
thetotalnumberofLSAsinthedatabase.
Defaults
Ifnoparametersareentered,LSAheadersforallareasaredisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
Ifyouexecutethiscommandwithoutanyparameters,LSAheadersforallareasaredisplayed.Use
theareaidparametertodisplaydatabaseinformationforaspecificarea.Theotheroptional
parameterscanbeusedtospecifyaparticulartypeoflinkstateadvertisementtodisplay.
Examples
ThisexampledisplaystheoutputwhenanareaIDisspecified.
C3(su)->router#show ipv6 ospf 10 database
Inter Network States (Area 0.0.0.10)
25-34
OSPFv3 Configuration
Adv Router
Link Id
Age
Sequence Csum Options Rtr Opt
--------------- --------------- ----- -------- ---- ------- ------2.2.2.2
1 153
80000026 A8F2
Intra Prefix
Adv Router
Link Id
Age
Sequence Csum Options Rtr Opt
--------------- --------------- ----- -------- ---- ------- ------2.2.2.2
0 506
80000027 DD00
AS External States
Adv Router
Link Id
Age
Sequence Csum Options Rtr Opt
--------------- --------------- ----- -------- ---- ------- ------2.2.2.2
1 342
8000002C 0C20
Thisexampleshowspartialoutputofthiscommandwhennoparametersarespecified.
C3(su)->router>show ipv6 ospf database
router links States (Area 0.0.0.0)
Adv Router
Link Id
--------------- --------------2.2.2.2
0
3.3.3.3
0
Age
Sequence Csum Options Rtr Opt
----- -------- ---- ------- ------1288
80000273 32A9 V6E--R- ---EB
1098
80000251 7D11 V6E--RD -----
Age
Sequence Csum Options Rtr Opt
----- -------- ---- ------- ------1098
800001DA 0F95 V6E--RD
1288
80000213 DFC0 V6E--R-
Thisexampleillustratestheoutputofthiscommandusingtheadvrouterparameter.
C3(su)->router>show ipv6 ospf database external adv-router
AS External States
LS Age: 930
LS Type: AS-External-LSA
LS Id: 1
Advertising Router: 2.2.2.2
LS Seq Number: 0x80000006
Checksum: 0x3e4c
Length: 36
Options:(E-Bit)
25-35
Metric Type: 2
Metric:20
IPv6 Prefix: 2301::/64 (None)
Table 255providesanexplanationofthecommandoutput.
Table 25-5
Output Field
What It Displays...
Link Id
Advertising Router
LS Age
LS Type
LS Seq Number
Checksum
Lenght
Options
Option bits in LSA header. Refer to section A.2 in RFC 2740 for
more information. Possible values are:
V6 indicates status of V6 bit. If this bit is clear, the router/link
should be excluded from IPv6 routing calculations.
E indicates status of E-bit. This bit describes the way ASexternal-LSAs are flooded.
M indicates the status of MC-bit. This bit describes whether IP
multicast datagrams are forwarded.
N indicates the status of N-bit. This bit describes the handling of
Type-7 LSAs.
R indicates the status of R-bit. This bit (the `Router' bit)
indicates whether the originator is an active router.
D indicates the status of DC-bit. This bit describes the router's
handling of demand circuits.
Metric Type
Metric
IPv6 Prefix
ThisexampleshowshowtodisplayOSPFdatabasesummaryinformation.
C3(su)->router#show ipv6 ospf database database-summary
OSPF Router with ID (2.2.2.2)
OSPFv3 Configuration
2
1
1
0
0
2
Intra-area Prefix
Link Unknown
Area Unknown
AS Unknown
AS Unknown
Self Originated Type-7
Subtotal
2
0
0
0
0
0
8
2
1
51
0
0
2
2
0
0
0
0
0
58
4
2
52
0
0
4
4
0
0
0
0
0
66
Table 256providesanexplanationofthedatabasesummarycommandoutput.
Table 25-6
Output Field
What It Displays...
Router
Network
Inter-area Prefix
Inter-area Router
Type-7 Ext
Link
Intra-area Prefix
25-37
Table 25-6
Output Field
What It Displays...
Link Unknown
Area Unknown
AS Unknown
Type-5 Ext
Self-Originated Type-5
Total
Syntax
show ipv6 ospf interface {vlan vlanid | tunnel tunnelid | loopback loopid}
Parameters
vlanvlanid
SpecifiestheVLANinterfacetodisplayinformationabout.
tunneltunnelid
Specifiesthetunnelinterfacetodisplayinformationabout.
loopbackloopid
Specifiestheloopbackinterfacetodisplayinformationabout.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Examples
ThisexampledisplaysinformationaboutOSPFv3routinginterfaceVLAN80.
C3(su)->router>show ipv6 ospf interface vlan 80
IPv6 Address
FE80::211:88FF:FE56:5D8F
ifIndex
430
OSPF Admin Mode
Enable
OSPF Area ID
0.0.0.20
Router Priority
1
Retransmit Interval
5
Hello Interval
10
Dead Interval
40
LSA Ack Interval
1
Iftransit Delay Interval
1
25-38
OSPFv3 Configuration
Authentication Type
Metric Cost
OSPF Mtu-ignore
OSPF Interface Type
State
Designated Router
Backup Designated Router
Number of Link Events
None
10 (computed)
Disable
broadcast
designated-router
2.2.2.2
0.0.0.0
2
Table 257providesanexplanationofthecommandoutput.
Table 25-7
Output Field
What It Displays...
IPv6 Address
ifIndex
OSPF Area ID
Router Priority
Retransmit Interval
Hello Interval
Dead Interval
Authentication Type
25-39
Table 25-7
Output Field
What It Displays...
Metric Cost
The priority of the path. Low costs have a higher priority than high
costs.
OSPF MTU-ignore
Broadcast LANs, such as Ethernet and IEEE 802.5, take the value
broadcast. Tunnel interfaces take the value point-to-point.
State
The OSPF Interface States are: down, loopback, waiting, point-topoint, designated router, and backup designated router.
Designated Router
Syntax
show ipv6 ospf interface stats vlan vlanid
Parameters
vlanvlanid
SpecifiestheVLANinterfaceforwhichtodisplaystatistics.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampleshowshowtodisplaystatisticsforVLAN80.
C3(su)->router>show ipv6 ospf interface stats vlan 80
OSPFv3 Area ID
0.0.0.20
Spf Runs
7
Area Border Router Count
0
AS Border Router Count
0
Area LSA Count
5
IPv6 Address
FE80::211:88FF:FE56:5D8F/128
OSPF Interface Events
2
Virtual Events
0
Neighbor Events
0
External LSA Count
1
LSAs Received
1903
Originate New LSAs
4198
Sent Packets
1053
25-40
OSPFv3 Configuration
Received Packets
Discards
Bad Version
Virtual Link Not Found
Area Mismatch
Invalid Destination Address
No Neighbor at Source Address
Invalid OSPF Packet Type
Packet Type
-------------------Hello
Database Description
LS Request
LS Update
LS Acknowledgement
0
0
0
0
0
0
0
0
Sent
---------1053
0
0
0
0
Received
---------0
0
0
0
0
Table 258providesanexplanationofthecommandoutput.
Table 25-8
Output Field
What It Displays...
OSPFv3 Area ID
Spf Runs
Is the number of times that the intra-area route table has been
calculated using this area's link-state database.
The total number of area border routers reachable within this area.
IPv6 Address
Virtual Events
Neighbor Events
LSAs Received
Sent Packets
Received Packets
Discards
Bad Version
Area Mismatch
25-41
Table 25-8
Output Field
What It Displays...
Syntax
show ipv6 ospf neighbor [interface {vlan vlanid | tunnel tunnelid}] [neighborid]
Parameters
interface
(Optional)Restrictstheoutputdisplaytoaspecificinterface.
vlanvlanid
SpecifytheVLANinterfacetodisplayinformationabout.
tunneltunnelid
Specifythetunnelinterfacetodisplay
neighborid
(Optional)SpecifytheneighborbyitsrouterID,specifiedin32bit
dottedquadformat.
Defaults
Whennoparametersarespecified,informationaboutallneighborsisdisplayed.
Mode
Routerprivilegedexecution:C3(su)>router#
Usage
IfyoudonotspecifyaneighborrouterID,theoutputdisplayssummaryinformationinatable.If
youspecifyaninterfaceortunnel,onlytheinformationforthatinterfaceortunneldisplays.
WhenyouspecifyaneighborbyrouterID,detailedinformationabouttheneighbordisplays.
TheinformationisdisplayedonlyifOSPFv3isenabledandtheinterfacehasaneighbor.
Examples
Thisexampleillustratesthesummaryinformationdisplayedwhennoneighborisspecified.
C3(su)->router#show ipv6 ospf neighbor
Router ID
---------------3.3.3.3
6.6.6.6
Priority
-------1
1
Intf
ID
----3
456
Interface
State
----------Vlan 36
Tunnel 0
---------------Full/DR
Full/PtP
Table 259providesanexplanationofthecommandoutput.
25-42
OSPFv3 Configuration
Dead
Time
---32
31
Table 25-9
Output Field
What It Displays...
Router ID
Priority
Intf ID
Interface
State
Dead Time
Thisexampledisplaystheoutputofthiscommandwhenaneighborisspecified.
C3(su)->router#show ipv6 ospf neighbor 8.8.8.8
Interface
Area Id
Options
Router Priority
Dead timer due in (secs)
State
Events
Retransmission Queue Length
Vlan 45
0.0.0.30
0x2
128
33
Full/DR
6
0
Table 2510providesanexplanationofthecommandoutput.
25-43
Table 25-10
Output Field
What It Displays...
Interface
Area ID
Options
Router Priority
State
Events
Syntax
show ipv6 ospf range areaid
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
Thisexampledisplaysrangeinformationforarea20.
C3(su)->router#show ipv6 ospf range 20
Area ID
IPv6 Prefix/Prefix Length
Lsdb Type
Advertisement
--------------- ------------------------- --------------- ------------0.0.0.20
3345:1234::/64
Summary Link
Enabled
Table 2511providesanexplanationofthecommandoutput.
25-44
OSPFv3 Configuration
Table 25-11
Output Field
What It Displays...
Area ID
Lsdb Type
Advertisement
Syntax
show ipv6 ospf stub table
Parameters
None.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisexampledisplaystheOSPFv3stubtableinformation.
C3(su)->router# show ipv6 ospf stub table
AreaId
TypeofService Metric Val Import SummaryLSA
---------------- ------------- ---------- ----------------0.0.0.20
Normal
1
Enable
Table 2512providesanexplanationofthecommandoutput.
Table 25-12
Output Field
What It Displays...
Area ID
Type of Service
Type of service associated with the stub metric. For this release,
Normal TOS is the only supported type.
Metric Val
25-45
Syntax
show ipv6 ospf virtual-link areaid neighborid
Parameters
areaid
SpecifiestheareaIDinIPaddressformat(dottedquad)orasadecimal
value.
neighborid
SpecifiestheneighborbyitsrouterID,specifiedin32bitdottedquad
format.
Defaults
None.
Mode
Routerprivilegedexecution:C3(su)>router#
Example
ThisinformationdisplaysvirtuallinkinformationforareaID10andtheneighborwithrouterID
of3.3.3.3.
C3(su)->router(Config)#show ipv6 ospf virtual-link 10 3.3.3.3
Area ID
10
Neighbor IP Address
3.3.3.3
Hello Interval
10
Dead Interval
40
Iftransit Delay Interval
1
Retransmit Interval
5
State
DOWN
Metric
0
Neighbor State
DOWN
Table 2513providesanexplanationofthecommandoutput.
Table 25-13
25-46
Output Field
What It Displays...
Area ID
Neighbor Router ID
Hello Interval
Dead Interval
Retransmit Interval
State
The OSPFv3 Interface States are: down, loopback, waiting, pointto-point, designated router, and backup designated router. This is
the state of the OSPFv3 interface.
OSPFv3 Configuration
Table 25-13
Output Field
What It Displays...
Metric
Neighbor State
25-47
25-48
OSPFv3 Configuration
26
Authentication and Authorization
Configuration
Thischapterdescribesthefollowingauthenticationandauthorizationcommandsandhowtouse
them.ForinformationaboutusingtheTACACS+authenticationmethodformanagement,see
Chapter 27,TACACS+Configuration.
For information about...
Refer to page...
26-1
26-4
Configuring RADIUS
26-6
26-15
26-25
26-37
26-48
26-49
26-52
26-57
26-68
26-80
26-82
LoginuseraccountsandpasswordsusedtologintotheCLIviaaTelnetconnectionorlocal
COMportconnection.Fordetails,refertoSettingUserAccountsandPasswordson
page 32.
HostAccessControlAuthentication(HACA)authenticatesuseraccessofTelnet
management,consolelocalmanagementandWebViewviaacentralRADIUSClient/Serveror
26-1
TACACS+application.WhenRADIUSorTACACS+isenabled,thisessentiallyoverrideslogin
useraccounts.WhenHACAisactiveperavalidRADIUSorTACACS+configuration,theuser
namesandpasswordsusedtoaccesstheswitchviaTelnet,SSH,WebView,andCOMports
willbevalidatedagainsttheconfiguredRADIUSserver.OnlyinthecaseofaRADIUS
timeoutwillthosecredentialsbecomparedagainstcredentialslocallyconfiguredonthe
switch.Fordetails,refertoConfiguringRADIUSonpage 266.
SNMPuserorcommunitynamesallowsaccesstotheSecureStackC3switchviaanetwork
SNMPmanagementapplication.Toaccesstheswitch,youmustenteranSNMPuseror
communitynamestring.Thelevelofmanagementaccessisdependentontheassociated
accesspolicy.Fordetails,refertoChapter 8.
802.1XPortBasedNetworkAccessControlusingEAPOL(ExtensibleAuthenticationProtocol)
providesamechanismviaaRADIUSserverforadministratorstosecurelyauthenticateand
grantappropriateaccesstoenduserdevicescommunicatingwithSecureStackC3ports.For
detailsonusingCLIcommandstoconfigure802.1X,refertoConfiguring802.1X
Authenticationonpage 2615.
Note: To configure EAP pass-through, which allows client authentication packets to be forwarded
through the switch to an upstream device, 802.1X authentication must be globally disabled with the
set dot1x command.
MACAuthenticationprovidesamechanismforadministratorstosecurelyauthenticate
sourceMACaddressesandgrantappropriateaccesstoenduserdevicescommunicatingwith
SecureStackC3ports.Fordetails,refertoConfiguringMACAuthenticationonpage 2625.
MultipleAuthenticationMethodsallowsuserstoauthenticateusingmultiplemethodsof
authenticationonthesameport.Fordetails,refertoConfiguringMultipleAuthentication
Methodsonpage 2637.
MultiUserAuthenticationallowsmultipleusersanddevicesonthesameportto
authenticateusinganysupportedauthenticationmethod.Eachuserordevicecanbemapped
tothesameordifferentrolesusingEnterasyspolicyforaccesscontrol,VLANauthorization,
trafficratelimiting,andqualityofservice.Thisisthemostflexibleandpreferredmethodto
useforVoIP(PCdaisychainedtoaphone).Fordetails,refertoAboutMultiUser
Authenticationonpage 2637.RefertoAppendix A,PolicyandAuthenticationCapacities,
foralistingofthenumberofusersperportsupportedbytheSecureStackC3.
User+IPPhone(Legacyfeature)TheUser+IPPhoneauthenticationfeatureprovides
legacysupportforauthenticationandauthorizationoftwodevices,specificallyaPCcascaded
withaVLANtaggingIPphone,onasingleportontheswitch.TheIPphonemust
authenticateusingMACor802.1Xauthentication,buttheusermayauthenticatebyany
method.ThisfeatureallowsboththeusersPCandIPphonetosimultaneouslyauthenticate
onasingleportandeachreceiveauniquelevelofnetworkaccess.Fordetails,referto
ConfiguringUser+IPPhoneAuthenticationonpage 2648.
Note: User + IP Phone authentication is a legacy feature that should only be used if you have
already implemented User + IP Phone in your network with switches that do not support true
multi-user authentication.
26-2
RFC3580tunnelattributesprovideamechanismtocontainan802.1X,MAC,orPWA
authenticatedusertoaVLANregardlessofthePVID.Thisfeaturedynamicallyassignsa
VLANbasedontheRFC3580tunnelattributesreturnedintheRADIUSacceptmessage.Refer
toConfiguringVLANAuthorization(RFC3580)onpage 2649.
ConfiguringPolicyMaptableResponseallowsyoutodefinehowthesystemshouldhandle
allowinganauthenticateduserontoaportbasedonthecontentsoftheRADIUSserver
AccessAcceptreply.Therearethreepossibleresponsesettings:tunnelmode,policymode,or
bothtunnelandpolicy,alsoknownashybridauthenticationmode.RefertoConfiguring
PolicyMaptableResponseonpage 2652.
MACLockinglocksaporttooneormoreMACaddresses,preventingtheuseof
unauthorizeddevicesandMACspoofingontheportFordetails,refertoConfiguringMAC
Lockingonpage 2657.
PortWebAuthentication(PWA)passesalllogininformationfromtheendstationtoa
RADIUSserverforauthenticationbeforeallowingausertoaccessthenetwork.PWAisan
alternativeto802.1XandMACauthentication.Fordetails,refertoConfiguringPortWeb
Authentication(PWA)onpage 2668.
SecureShell(SSH)providessecureTelnet.Fordetails,refertoConfiguringSecureShell
(SSH)onpage 2680.
IPAccessLists(ACLs)permitsordeniesaccesstoroutinginterfacesbasedonprotocoland
inboundand/oroutboundIPaddressrestrictionsconfiguredinaccesslists.Fordetails,referto
ConfiguringAccessListsonpage 2682.
TACACS+(TerminalAccessControllerAccessControlSystemPlus) asecurityprotocol
developedbyCiscoSystemsthatcanbeusedasanalternativetothestandardRADIUS
securityprotocol(RFC2865).TACACS+runsoverTCPandencryptsthebodyofeachpacket.
RefertoChapter 27,TACACS+Configuration,forinformationaboutthecommandsusedto
configureTACACS+.
Tospecifythepolicyprofiletoassigntotheauthenticatinguser(networkaccess
authentication):
Enterasys:version=1:policy=string
wherestringspecifiesthepolicyprofilename.Policyprofilenamesarecasesensitive.
Tospecifyamanagementlevel(managementaccessauthentication):
Enterasys:version=1:mgmt=level
wherelevelindicatesthemanagementlevel,eitherro,rw,orsu.
Tospecifybothmanagementlevelandpolicyprofile:
Enterasys:version=1:mgmt=level:policy=string
26-3
Theundecoratedformatissimplyastringthatspecifiesapolicyprofilename.Theundecorated
formatcannotbeusedformanagementaccessauthentication.
DecoratedFilterIDsareprocessedfirstbytheswitch.IfnodecoratedFilterIDsarefound,then
undecoratedFilterIDsareprocessed.IfmultipleFilterIDsarefoundthatcontainconflicting
values,aSyslogmessageisgenerated.
Commands
Thecommandsusedtoconfiguretheauthenticationloginmethodarelistedbelow.
For information about...
Refer to page...
26-4
26-4
26-5
Syntax
show authentication login
Parameters
None.
Defaults
None.
Mode
Switchcommand,ReadOnly.
Example
Thisexampleshowshowtodisplaythecurrentauthenticationloginmethod.
C3(rw)->show authentication login
Current authentication login is any
26-4
Syntax
set authentication login {any | local | radius | tacacs}
Parameters
any
Specifiesthattheauthenticationprotocolwillbeselectedusingthe
followingprecedenceorder:
TACACS+
RADIUS
Local
local
Specifiesthatthelocalnetworkpasswordsettingswillbeusedfor
authenticationlogin.
radius
SpecifiesthatRADIUSwillbeusedforauthenticationlogin.
tacacs
SpecifiesthatTACACS+willbeusedforauthenticationlogin.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Example
Thisexampleshowshowtosettheauthenticationloginmethodtousethelocalpasswordsettings:
C3(rw)->set authentication login local
Syntax
clear authentication login
Parameters
None.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Example
Thisexampleshowshowtoresettheauthenticationloginmethod.
C3(rw)->clear authentication login
26-5
Configuring RADIUS
Configuring RADIUS
Purpose
Toperformthefollowing:
ReviewtheRADIUSclient/serverconfigurationontheswitch.
EnableordisabletheRADIUSclient.
Setlocalandremoteloginoptions.
Setprimaryandsecondaryserverparameters,includingIPaddress,timeoutperiod,
authenticationrealm,andnumberofuserloginattemptsallowed.
ResetRADIUSserversettingstodefaultvalues.
ConfigureaRADIUSaccountingserver.
ConfiguretheinterfaceusedforthesourceIPaddressoftheRADIUSapplicationwhen
generatingRADIUSpackets.
Commands
For information about...
Refer to page...
show radius
26-6
set radius
26-7
clear radius
26-9
26-10
26-10
26-11
26-12
26-12
26-13
show radius
UsethiscommandtodisplaythecurrentRADIUSclient/serverconfiguration.
Syntax
show radius [status | retries | timeout | server [index | all]]
Parameters
26-6
status
(Optional)DisplaystheRADIUSserversenablestatus.
retries
(Optional)DisplaysthenumberofretryattemptsbeforetheRADIUSserver
timesout.
timeout
(Optional)Displaysthemaximumamountoftime(inseconds)toestablish
contactwiththeRADIUSserverbeforeretryattemptsbegin.
set radius
server
(Optional)DisplaysRADIUSserverconfigurationinformation.
index|all
Forusewiththeserverparametertoshowserverconfigurationforall
serversoraspecificRADIUSserverasdefinedbyanindex.
Defaults
Ifnoparametersarespecified,allRADIUSconfigurationinformationwillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayRADIUSconfigurationinformation:
C3(rw)->show radius
RADIUS status:
Enabled
RADIUS retries:
3
RADIUS timeout:
20 seconds
RADIUS Server
IP Address
----------------------10
172.16.20.10
Auth-Port
--------1812
Realm-Type
----------------management-access
Table 261providesanexplanationofthecommandoutput.
Table 26-1
Output Field
What It Displays...
RADIUS status
RADIUS retries
Number of retry attempts before the RADIUS server times out. The default value of 3
can be reset using the set radius command as described in set radius on
page 26-7.
RADIUS timeout
Maximum amount of time (in seconds) to establish contact with the RADIUS server
before retry attempts begin. The default value of 20 can be reset using the set
radius command as described in set radius on page 26-7.
RADIUS Server
Realm-Type
Realm defines who has to go through the RADIUS server for authentication.
Management-access: This means that anyone trying to access the switch (Telnet,
SSH, Local Management) has to authenticate through the RADIUS server.
Network-access: This means that all the users have to authenticate to a RADIUS
server before they are allowed access to the network.
Any-access: Means that both Management-access and Network-access have
been enabled.
set radius
Usethiscommandtoenable,disable,orconfigureRADIUSauthentication.
Syntax
set radius {enable | disable} | {retries number-of-retries} | {timeout timeout} |
{server index ip-address port [secret-value] [realm {management-access | any |
network-access}} | {realm {management-access | any | network-access} {index| all}}
26-7
set radius
Parameters
enable|disable
EnablesordisablestheRADIUSclient.
retriesnumberof
retries
SpecifiesthenumberofretryattemptsbeforetheRADIUSservertimesout.
Validvaluesarefrom0to10.Defaultis3.
timeouttimeout
Specifiesthemaximumamountoftime(inseconds)toestablishcontact
withtheRADIUSserverbeforeretryattemptsbegin.Validvaluesarefrom1
to30.Defaultis20seconds.
serverindex
ip_addressport
Specifiestheindexnumber,IPaddressandtheUDPauthenticationportfor
theRADIUSserver.
secretvalue
(Optional)Specifiesanencryptionkeytobeusedforauthentication
betweentheRADIUSclientandserver.
realm
management
access|any|
networkaccess
RealmallowsyoutodefinewhohastogothroughtheRADIUSserverfor
authentication.
managementaccess:Thismeansthatanyonetryingtoaccesstheswitch
(Telnet,SSH,LocalManagement)hastoauthenticatethroughthe
RADIUSserver.
networkaccess:Thismeansthatalltheusershavetoauthenticatetoa
RADIUSserverbeforetheyareallowedaccesstothenetwork.
any:Meansthatbothmanagementaccessandnetworkaccesshave
beenenabled.
Note: If the management-access or any access realm has been configured, the
local admin account is disabled for access to the switch using the console, Telnet,
or Local Management. Only the network-access realm allows access to the local
admin account.
index|all
Appliestherealmsettingtoaspecificserverortoallservers.
Defaults
Ifsecretvalueisnotspecified,nonewillbeapplied.
Ifrealmisnotspecified,theanyaccessrealmwillbeused.
Mode
Switchcommand,readwrite.
Usage
TheSecureStackC3deviceallowsupto10RADIUSserverstobeconfigured,withuptotwo
serversactiveatanygiventime.
TheRADIUSclientcanonlybeenabledontheswitchonceaRADIUSserverisonline,anditsIP
address(es)hasbeenconfiguredwiththesamepasswordtheRADIUSclientwilluse.
Examples
ThisexampleshowshowtoenabletheRADIUSclientforauthenticatingwithRADIUSserver1at
IPaddress192.168.6.203,UDPauthenticationport1812,andanauthenticationpasswordof
pwsecret.Aspreviouslynoted,theserversecretpasswordenteredheremustmatchthat
alreadyconfiguredastheReadWrite(rw)passwordontheRADIUSserver:
C3(su)->set radius server 1 192.168.6.203 1812 pwsecret
26-8
clear radius
ThisexampleshowshowtosettheRADIUStimeoutto5seconds:
C3(su)->set radius timeout 5
ThisexampleshowshowtosetRADIUSretriesto10:
C3(su)->set radius retries 10
Thisexampleshowshowtoforceanymanagementaccesstotheswitch(Telnet,web,SSH)to
authenticatethroughaRADIUSserver.Theallparameterattheendofthecommandmeansthat
anyofthedefinedRADIUSserverscanbeusedforthisAuthentication.
C3(rw)->set radius realm management-access all
clear radius
UsethiscommandtoclearRADIUSserversettings.
Syntax
clear radius [retries] | [timeout] | [server {index | all | realm {index | all}}]
Parameters
retries
ResetsthemaximumnumberofattemptsausercancontacttheRADIUS
serverbeforetimingoutto3.
timeout
ResetsthemaximumamountoftimetoestablishcontactwiththeRADIUS
serverbeforetimingoutto20seconds.
server
Deletesserversettings.
index|all
Forusewiththeserverparametertocleartheserverconfigurationforall
serversoraspecificRADIUSserverasdefinedbyanindex.
realm
ResetstherealmsettingforallserversoraspecificRADIUSserveras
definedbyanindex.
Mode
Switchcommand,readwrite.
Defaults
None.
Examples
ThisexampleshowshowtoclearallsettingsonallRADIUSservers:
C3(su)->clear radius server all
ThisexampleshowshowtoresettheRADIUStimeouttothedefaultvalueof20seconds:
C3(su)->clear radius timeout
26-9
Syntax
show radius accounting [server] | [counter ip-address] | [retries] | [timeout]
Parameters
server
(Optional)DisplaysoneorallRADIUSaccountingserverconfigurations.
counteripaddress
(Optional)DisplayscountersforaRADIUSaccountingserver.
retries
(Optional)Displaysthemaximumnumberofattemptstocontactthe
RADIUSaccountingserverbeforetimingout.
timeout
(Optional)Displaysthemaximumamountoftimebeforetimingout.
Mode
Switchcommand,readonly.
Defaults
Ifnoparametersarespecified,allRADIUSaccountingconfigurationinformationwillbe
displayed.
Example
ThisexampleshowshowtodisplayRADIUSaccountingconfigurationinformation.Inthiscase,
RADIUSaccountingisnotcurrentlyenabledandglobaldefaultsettingshavenotbeenchanged.
Oneserverhasbeenconfigured.
FordetailsonenablingandconfiguringRADIUSaccounting,refertosetradiusaccountingon
page 2610:
C3(ro)->show radius accounting
RADIUS accounting status:
Disabled
RADIUS Acct Server IP Address Acct-Port Retries Timeout Status
------------------ ---------- --------- ------- ------- -----1
172.16.2.10 1856
3
20
Disabled
Syntax
set radius accounting {[enable | disable] [retries retries] [timeout timeout]
[server ip_address port [server-secret]
Parameters
26-10
enable|disable
EnablesordisablestheRADIUSaccountingclient.
retriesretries
SetsthemaximumnumberofattemptstocontactaspecifiedRADIUS
accountingserverbeforetimingout.Validretryvaluesare010.
timeouttimeout
Setsthemaximumamountoftime(inseconds)toestablishcontactwitha
specifiedRADIUSaccountingserverbeforetimingout.Validtimeout
valuesare130.
serverip_address
portserversecret
Specifiestheaccountingservers:
IPaddress
UDPauthenticationport(065535)
serversecret(ReadWritepasswordtoaccessthisaccountingserver.
Devicewillpromptforthisentryuponcreatingaserverinstance,as
shownintheexamplebelow.)
Mode
Switchcommand,readwrite.
Defaults
None.
Examples
ThisexampleshowshowtoenabletheRADIUSaccountingclientforauthenticatingwiththe
accountingserveratIPaddress10.2.4.12,UDPauthenticationport1800.Aspreviouslynoted,the
serversecretpasswordenteredheremustmatchthatalreadyconfiguredastheReadWrite(rw)
passwordontheRADIUSaccountingserver:
C3(su)->set radius accounting server 10.2.4.12 1800
Enter secret:
Re-enter secret:
ThisexampleshowshowtosettheRADIUSaccountingtimeoutto30seconds:
C3(su)->set radius accounting timeout 30
ThisexampleshowshowtosetRADIUSaccountingretriesto10:
C3(su)->set radius accounting retries 10
Syntax
clear radius accounting {server ip-address | retries | timeout | counter}
Parameters
serveripaddress
Clearstheconfigurationononeormoreaccountingservers.
retries
Resetstheretriestothedefaultvalueof3.
timeout
Resetsthetimeoutto5seconds.
counter
Clearscounters.
Mode
Switchcommand,readwrite.
26-11
Defaults
None.
Example
ThisexampleshowshowtoresettheRADIUSaccountingtimeoutto5seconds.
C3(su)->clear radius accounting timeout
Syntax
show radius interface
Parameters
None.
Defaults
None.
Mode
Switchmode,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.Inthiscase,theIPaddressassignedto
loopbackinterface1willbeusedasthesourceIPaddressoftheRADIUSapplication.
C3(rw)->show radius interface
loopback 1
192.168.10.1
Syntax
set radius interface {loopback loop-ID | vlan vlan-ID}
Parameters
loopbackloopID
Specifiestheloopbackinterfacetobeused.ThevalueofloopIDcan
rangefrom0to7.
vlanvlanID
SpecifiestheVLANinterfacetobeused.ThevalueofvlanIDcanrange
from1to4093.
Defaults
None.
26-12
Mode
Switchcommand,readwrite.
Usage
ThiscommandallowsyoutoconfigurethesourceIPaddressusedforthesourceIPaddressofthe
RADIUSapplicationwhengeneratingRADIUSpackets.Anyofthemanagementinterfaces,
includingVLANroutinginterfaces,canbeconfiguredasthesourceIPaddressusedinpackets
generatedbytheRADIUSapplication.
AninterfacemusthaveanIPaddressassignedtoitbeforeitcanbesetbythiscommand.
Ifnointerfaceisspecified,thentheIPaddressoftheHostinterface,ifconfigured,willbeusedfor
boththesourceIPaddressandNASIP.IfnointerfaceisspecifiedandnoHostaddressis
configured,thesourceIPaddresswillbetheaddressoftheroutedinterfaceonwhichthepacket
egresses.Ifloopback0hasbeenconfigured,theNASIPwillbesettotheIPaddressofloopback0.
Otherwise,theNASIPwillbezero.
Example
ThisexampleconfiguresanIPaddressonVLANinterface100andthensetsthatinterfaceasthe
RADIUSapplicationsourceIPaddress.
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
C3(rw)->router(Config-if(Vlan 100))#exit
C3(rw)->router(Config)#exit
C3(rw)->router#exit
C3(rw)->router>exit
C3(rw)->set radius interface vlan 100
192.168.10.1
Syntax
clear radius interface
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
26-13
Example
ThiscommandreturnstheinterfaceusedforthesourceIPaddressoftheRADIUSapplication
backtothedefaultoftheHostinterface.
C3(rw)->show radius interface
vlan 100
192.168.10.1
26-14
Commands
For information about...
Refer to page...
show dot1x
26-15
26-17
set dot1x
26-18
26-19
26-20
show eapol
26-21
set eapol
26-23
clear eapol
26-23
show dot1x
Usethiscommandtodisplay802.1Xstatus,diagnostics,statistics,andreauthenticationor
initializationcontrolinformationforoneormoreports.
Syntax
show dot1x [auth-diag] [auth-stats] [port [init | reauth]] [port-string]
Parameters
authdiag
(Optional)Displaysauthenticationdiagnosticsinformation.
authstats
(Optional)Displaysauthenticationstatistics.
portinit|reauth
(Optional)Displaysthestatusofportinitializationandreauthentication
controlfortheport.
portstring
(Optional)Displaysinformationforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifnoparametersarespecified,802.1Xstatuswillbedisplayed.
26-15
show dot1x
Ifportstringisnotspecified,informationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Examples
Thisexampleshowshowtodisplay802.1Xstatus:
C3(su)->show dot1x
DOT1X is disabled.
Thisexampleshowshowtodisplayauthenticationdiagnosticsinformationforge.1.1:
C3(su)->show dot1x auth-diag ge.1.1
Port : 1
Auth-Diag
Enter Connecting:
EAP Logoffs While Connecting:
Enter Authenticating:
Success While Authenticating
Timeouts While Authenticating:
Fails While Authenticating:
ReAuths While Authenticating:
EAP Starts While Authenticating:
EAP logoff While Authenticating:
Backend Responses:
Backend Access Challenges:
Backend Others Requests To Supp:
Backend NonNak Responses From:
Backend Auth Successes:
Backend Auth Fails:
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
Thisexampleshowshowtodisplayauthenticationstatisticsforge.1.1:
C3(su)->show dot1x auth-stats
Port: 1
Auth-Stats
EAPOL Frames Rx:
EAPOL Frames Tx:
EAPOL Start Frames Rx:
EAPOL Logoff Frames Rx:
EAPOL RespId Frames Rx:
EAPOL Resp Frames Rx:
EAPOL Req Frames Tx:
EAP Length Error Frames Rx:
Last EAPOL Frame Version:
Last EAPOL Frame Source:
ge.1.1
0
0
0
0
0
0
0
0
0
00:00:00:00:00:00
Thisexampleshowshowtodisplaythestatusofportreauthenticationcontrolforge.1.1through
ge.1.6:
C3(su)->show dot1x port reauth ge.1.1-6
Port 1: Port reauthenticate:
FALSE
Port 2: Port reauthenticate:
FALSE
Port 3: Port reauthenticate:
FALSE
Port 4: Port reauthenticate:
FALSE
Port 5: Port reauthenticate:
FALSE
Port 6: Port reauthenticate:
FALSE
26-16
Syntax
show dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod]
[reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod]
[port-string]
Parameters
authcontrolled
portcontrol
(Optional)DisplaysthecurrentvalueofthecontrolledPortcontrol
parameterfortheport.
maxreq
(Optional)Displaysthevaluesetformaximumrequestscurrentlyinuseby
thebackendauthenticationstatemachine.
quietperiod
(Optional)Displaysthevaluesetforquietperiodcurrentlyinusebythe
authenticatorPAEstatemachine.
reauthenabled
(Optional)Displaysthestateofreauthenticationcontrolusedbythe
ReauthenticationTimerstatemachine.
reauthperiod
(Optional)Displaysthevalue,inseconds,setforthereauthentication
periodusedbythereauthenticationtimerstatemachine.
servertimeout
(Optional)Displaystheservertimeoutvalue,inseconds,currentlyinuse
bythebackendauthenticationstatemachine.
supptimeout
(Optional)Displaystheauthenticationsupplicanttimeoutvalue,in
seconds,currentlyinusebythebackendauthenticationstatemachine.
txperiod
(Optional)Displaysthetransmissionperiodvalue,inseconds,currentlyin
usebytheauthenticatorPAEstatemachine.
portstring
(Optional)Limitsthedisplayofdesiredinformationinformationtospecific
port(s).Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
Defaults
Ifnoparametersarespecified,all802.1Xsettingswillbedisplayed.
Ifportstringisnotspecified,informationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Examples
ThisexampleshowshowtodisplaytheEAPOLportcontrolmodeforge.1.1:
C3(su)->show dot1x auth-config authcontrolled-portcontrol ge.1.1
Port 1: Auth controlled port control:
Auto
Thisexampleshowshowtodisplaythe802.1Xquietperiodsettingsforge.1.1:
C3(su)->show dot1x auth-config quietperiod ge.1.1
Port 1: Quiet period:
30
Thisexampleshowshowtodisplayall802.1Xauthenticationconfigurationsettingsforge.1.1:
C3(ro)->show dot1x auth-config ge.1.1
26-17
set dot1x
Port : 1
Auth-Config
PAE state:
Backend auth state:
Admin controlled directions:
Oper controlled directions:
Auth controlled port status:
Auth controlled port control:
Quiet period:
Transmission period:
Supplicant timeout:
Server timeout:
Maximum requests:
Reauthentication period:
Reauthentication control:
Initialize
Initialize
Both
Both
Authorized
Auto
60
30
30
30
2
3600
Disabled
set dot1x
Usethiscommandtoenableordisable802.1Xauthentication,toreauthenticateoneormoreaccess
entities,ortoreinitializeoneormoresupplicants.
Syntax
set dot1x {enable | disable | port {init | reauth} {true | false} [port-string]}
Parameters
enable|disable
Enablesordisables802.1X.
port
Enableordisable802.1Xreauthenticationorinitializationcontrolononeor
moreports.
init|reauth
Configureinitializationorreauthenticationcontrol.
true|false
Enable(true)ordisable(false)reinitialization/reauthentication.
portstring
(Optional)Specifiestheport(s)toreinitializeorreauthenticate.
Defaults
Ifnoportsarespecified,thereinitializationorreauthenticationsettingwillbeappliedtoallports.
Mode
Switchcommand,readwrite.
Usage
Disabling802.1Xauthenticationglobally,bynotenteringaspecificportstringvalue,willenable
theEAPpassthroughfeature.EAPpassthroughallowsclientauthenticationpacketstobe
forwardedunmodifiedthroughtheswitchtoanupstreamdevice.
Examples
Thisexampleshowshowtoenable802.1X:
C3(su)->set dot1x enable
Thisexampleshowshowtoreinitializege.1.2:
C3(rw)->set dot1x port init true ge.1.2
26-18
Syntax
set dot1x auth-config {[authcontrolled-portcontrol {auto | forced-auth |
forced-unauth}] [maxreq value] [quietperiod value] [reauthenabled {false | true}]
[reauthperiod value] [servertimeout timeout] [supptimeout timeout] [txperiod
value]} [port-string]
Parameters
authcontrolled
portcontrol
auto|forcedauth|
forcedunauth
Specifiesthe802.1Xportcontrolmode.
autoSetportcontrolmodetoautocontrolledportcontrol.This
isthedefaultvalue.
forcedauthSetportcontrolmodetoForcedAuthorized
controlledportcontrol.
forcedunauthSetportcontrolmodetoForcedUnauthorized
controlledportcontrol.
maxreqvalue
Specifiesthemaximumnumberofauthenticationrequestsallowed
bythebackendauthenticationstatemachine.Validvaluesare110.
Defaultvalueis2.
quietperiodvalue
Specifiesthetime(inseconds)followingafailedauthentication
beforeanotherattemptcanbemadebytheauthenticatorPAEstate
machine.Validvaluesare065535.Defaultvalueis60seconds.
reauthenabledfalse|
true
Enables(true)ordisables(false)reauthenticationcontrolofthe
reauthenticationtimerstatemachine.Defaultvalueisfalse.
reauthperiodvalue
Specifiesthetimelapse(inseconds)betweenattemptsbythe
reauthenticationtimerstatemachinetoreauthenticateaport.Valid
valuesare065535.Defaultvalueis3600seconds.
servertimeouttimeout
Specifiesatimeoutperiod(inseconds)fortheauthenticationserver,
usedbythebackendauthenticationstatemachine.Validvaluesare1
300.Defaultvalueis30seconds.
supptimeouttimeout
Specifiesatimeoutperiod(inseconds)fortheauthentication
supplicantusedbythebackendauthenticationstatemachine.Valid
valuesare1300.Defaultvalueis30seconds.
txperiodvalue
Specifiestheperiod(inseconds)whichpassesbetweenauthenticator
PAEstatemachineEAPtransmissions.Validvaluesare065535.
Defaultvalueis30seconds.
portstring
(Optional)Limitstheconfigurationofdesiredsettingstospecified
port(s).Foradetaileddescriptionofpossibleportstringvalues,refer
toPortStringSyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,authenticationparameterswillbesetonallports.
Mode
Switchcommand,readwrite.
26-19
Examples
Thisexampleshowshowtoenablereauthenticationcontrolonportsge.1.13:
C3(su)->set dot1x auth-config reauthenabled true ge.1.1-3
Thisexampleshowshowtosetthe802.1Xquietperiodto120secondsonportsge.1.13:
C3(su)->set dot1x auth-config quietperiod 120 ge.1.1-3
Syntax
clear dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod]
[reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod] [portstring]
Parameters
authcontrolled
portcontrol
(Optional)Resetsthe802.1Xportcontrolmodetoauto.
maxreq
(Optional)Resetsthemaximumrequestsvalueto2.
quietperiod
(Optional)Resetsthequietperiodvalueto60seconds.
reauthenabled
(Optional)Resetsthereauthenticationcontrolstatetodisabled(false).
reauthperiod
(Optional)Resetsthereauthenticationperiodvalueto3600seconds.
servertimeout
(Optional)Resetstheservertimeoutvalueto30seconds.
supptimeout
(Optional)Resetstheauthenticationsupplicanttimeoutvalueto30
seconds.
txperiod
(Optional)Resetsthetransmissionperiodvalueto30seconds.
portstring
(Optional)Resetssettingsonspecificport(s).Foradetaileddescriptionof
possibleportstringvalues,refertoPortStringSyntaxUsedintheCLIon
page 71.
Defaults
Ifnoparametersarespecified,allauthenticationparameterswillbereset.
Ifportstringisnotspecified,parameterswillbesetonallports.
Mode
Switchcommand,readwrite.
Examples
Thisexampleshowshowtoresetthe802.1Xportcontrolmodetoautoonallports:
C3(su)->clear dot1x auth-config authcontrolled-portcontrol
Thisexampleshowshowtoresetreauthenticationcontroltodisabledonportsge.1.13:
C3(su)->clear dot1x auth-config reauthenabled ge.1.1-3
26-20
show eapol
Thisexampleshowshowtoresetthe802.1Xquietperiodto60secondsonportsge.1.13:
C3(su)->clear dot1x auth-config quietperiod ge.1.1-3
show eapol
UsethiscommandtodisplayEAPOLstatusorsettingsforoneormoreports.
Syntax
show eapol [port-string]
Parameters
portstring
(Optional)DisplaysEAPOLstatusforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,onlyEAPOLenablestatuswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayEAPOLstatusforportsge.1.13:
C3(su)->show eapol ge.1.1-3
EAPOL is disabled.
Port
-------ge.1.1
ge.1.2
ge.1.3
Authentication State
-------------------Initialize
Initialize
Initialize
Authentication Mode
-------------------Auto
Auto
Auto
Table 262providesanexplanationofthecommandoutput.Fordetailsonusingtheseteapol
commandtoenabletheprotocolandassignanauthenticationmode,refertoseteapolon
page 2623.
26-21
show eapol
Table 26-2
Output Field
What It Displays...
Port
Authentication State
Current EAPOL authentication state for each port. Possible internal states for the
authenticator (switch) are:
initialize: A port is in the initialize state when:
authentication is disabled,
authentication is enabled and the port is linked. (In this case very
little time is spent in this state, it immediately transitions to the
connecting state, via disconnected.
disconnected: The port passes through this state on its way to connected
whenever the port is reinitialized, via link state change, reauthentication failure, or
management intervention.
connecting: While in this state, the authenticator sends request/ID messages to
the end user.
authenticating: The port enters this state from connecting after receiving a
response/ID from the end user. It remains in this state until the entire
authentication exchange between the end user and the authentication server
completes.
authenticated: The port enters this state from authenticating state after the
exchange completes with a favorable result. It remains in this state until linkdown,
logoff, or until a reauthentication begins.
aborting: The port enters this state from authenticating when any event occurs
that interrupts the login exchange.
held: After any login failure the port remains in this state for the number of
seconds equal to quietPeriod (can be set using MIB).
forceAuth: Management is allowing normal, unsecured switching on this port.
forceUnauth: Management is preventing any frames from being forwarded to or
from this port.
Authentication Mode Mode enabling network access for each port. Modes include:
Auto: Frames are forwarded according to the authentication state of each port.
Forced Authorized Mode: Meant to disable authentication on a port. It is
intended for ports that support ISLs and devices that cannot authenticate, such
as printers and file servers. If a default policy is applied to the port via the policy
profile MIB, then frames are forwarded according to the configuration set by that
policy, otherwise frames are forwarded according to the current configuration for
that port. Authentication using 802.1X is not possible on a port in this mode.
Forced Unauthorized Mode: All frames received on the port are discarded by a
filter. Authentication using 802.1X is not possible on a port in this mode.
26-22
set eapol
set eapol
UsethiscommandtoenableordisableEAPOLportbaseduserauthenticationwiththeRADIUS
serverandtosettheauthenticationmodeforoneormoreports.
Syntax
set eapol [enable | disable] [auth-mode {auto | forced-auth | forced-unauth}
port-string
Parameters
enable|disable
EnablesordisablesEAPOL.
authmode
Specifiestheauthenticationmodeas:
auto|
forcedauth|
forcedunauth
autoAutoauthorizationmode.Thisisthedefaultmodeandwill
forwardframesaccordingtotheauthenticationstateoftheport.For
detailsonthismode,refertoTable 262.
forcedauthForcedauthorizedmode,whichdisablesauthentication
ontheport.
forcedunauthForcedunauthorizedmode,whichfiltersanddiscards
allframesreceivedontheport.
portstring
Specifiestheport(s)onwhichtosetEAPOLparameters.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtoenableEAPOL:
C3(su)->set eapol enable
ThisexampleshowshowtoenableEAPOLwithforcedauthorizedmodeonportge.1.1:
C3(su)->set eapol auth-mode forced-auth ge.1.1
clear eapol
UsethiscommandtogloballycleartheEAPOLauthenticationmode,ortoclearsettingsforoneor
moreports.
Syntax
clear eapol [auth-mode] [port-string]
26-23
clear eapol
Parameters
authmode
(Optional)GloballyclearstheEAPOLauthenticationmode.
portstring
Specifiestheport(s)onwhichtoclearEAPOLparameters.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifauthmodeisnotspecified,allEAPOLsettingswillbecleared.
Ifportstringisnotspecified,settingswillbeclearedforallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheEAPOLauthenticationmodeforportge.1.3:
C3(su)->clear eapol auth-mode ge.1.3
26-24
Commands
For information about...
Refer to page...
show macauthentication
26-25
26-27
set macauthentication
26-28
26-28
26-29
26-29
26-30
26-30
26-31
26-31
26-32
26-32
26-33
26-33
26-34
26-35
26-35
show macauthentication
UsethiscommandtodisplayMACauthenticationinformationforoneormoreports.
Syntax
show macauthentication [port-string]
26-25
show macauthentication
Parameters
portstring
(Optional)DisplaysMACauthenticationinformationforspecificport(s).
Foradetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,MACauthenticationinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayMACauthenticationinformationforge.2.1through8:
C3(su)->show macauthentication ge.2.1-8
MAC authentication:
- enabled
MAC user password:
- NOPASSWORD
Port username significant bits - 48
Port
------ge.2.1
ge.2.2
ge.2.3
ge.2.4
ge.2.5
ge.2.6
ge.2.7
ge.2.8
Port
State
-------disabled
disabled
disabled
disabled
disabled
disabled
disabled
disabled
Reauth
Period
---------3600
3600
3600
3600
3600
3600
3600
3600
Auth
Allowed
-------1
1
1
1
1
1
1
1
Auth
Allocated
--------1
1
1
1
1
1
1
1
Reauthentications
----------------disabled
disabled
disabled
disabled
disabled
disabled
disabled
disabled
Table 263providesanexplanationofthecommandoutput.
Table 26-3
26-26
Output Field
What It Displays...
MAC authentication
Whether MAC authentication is globally enabled or disabled. Set using the set
macauthentication command as described in set macauthentication on
page 26-28.
User password associated with MAC authentication on the device. Set using the set
macauthentication password command as described in set macauthentication
password on page 26-28.
Port username
significant bits
Number of significant bits in the MAC addresses to be used starting with the left-most
bit of the vendor portion of the MAC address. The significant portion of the MAC
address is sent as a user-name credential when the primary attempt to authenticate
the full MAC address fails. Any other failure to authenticate the full address, (i.e.,
authentication server timeout) causes the next attempt to start once again with a full
MAC authentication. Default value of 48 can be changed with the set
macauthentication significant-bits command.
Port
Port State
Table 26-3
Output Field
What It Displays...
Reauth Period
Reauthentication period for this port. Default value of 30 can be changed using the
set macauthentication reauthperiod command (page 26-33).
Auth Allowed
Auth Allocated
Reauthentications
Whether or not reauthentication is enabled or disabled on this port. Set using the set
macauthentication reauthentication command (page 26-32).
Syntax
show macauthentication session
Parameters
None.
Defaults
Ifportstringisnotspecified,MACsessioninformationwillbedisplayedforallMAC
authenticationports.
Mode
Switchcommand,readonly.
Usage
ChangingtheReauthPeriodwiththesetmacauthenticationreauthperiodcommanddoesnot
affectcurrentsessions.Newsessionsdisplaythecorrectperiod.
Example
ThisexampleshowshowtodisplayMACsessioninformation:
C3(su)->show macauthentication session
Port
MAC Address
Duration
Reauth Period
--------------------- ---------- ------------ge.1.2
00:60:97:b5:4c:07 0,00:52:31 3600
Reauthentications
----------------disabled
Table 264providesanexplanationofthecommandoutput.
Table 26-4
Output Field
What It Displays...
Port
MAC Address
Duration
26-27
set macauthentication
Table 26-4
Output Field
What It Displays...
Reauth Period
Reauthentication period for this port, set using the set macauthentication
reauthperiod command described in set macauthentication reauthperiod on
page 26-33.
Reauthentications
Whether or not reauthentication is enabled or disabled on this port. Set using the set
macauthentication reauthentication command described in set
macauthentication reauthentication on page 26-32.
set macauthentication
UsethiscommandtogloballyenableordisableMACauthentication.
Syntax
set macauthentication {enable | disable}
Parameters
enable|disable
GloballyenablesordisablesMACauthentication.
Mode
Switchcommand,readwrite.
Defaults
None.
Example
ThisexampleshowshowtogloballyenableMACauthentication:
C3(su)->set macauthentication enable
Syntax
set macauthentication password password
Parameters
password
SpecifiesatextstringMACauthenticationpassword.
Defaults
None.
Mode
Switchcommand,readwrite.
26-28
Example
ThisexampleshowshowtosettheMACauthenticationpasswordtomacauth:
C3(su)->set macauthentication password macauth
Syntax
clear macauthentication password
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtocleartheMACauthenticationpassword:
C3(su)->clear macauthentication password
Syntax
set macauthentication port {enable | disable} port-string
Parameters
enable|disable
EnablesordisablesMACauthentication.
portstring
Specifiesport(s)onwhichtoenableordisableMACauthentication.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
26-29
Usage
Enablingport(s)forMACauthenticationrequiresgloballyenablingMACauthenticationonthe
switchasdescribedinsetmacauthenticationonpage 2628,andthenenablingitonaportby
portbasis.Bydefault,MACauthenticationisgloballydisabledanddisabledonallports.
Example
ThisexampleshowshowtoenableMACauthenticationonge.2.1though5:
C3(su)->set macauthentication port enable ge.2.1-5
Syntax
set macauthentication portinitialize port-string
Parameters
portstring
SpecifiestheMACauthenticationport(s)toreinitialize.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoforcege.2.1through5toinitialize:
C3(su)->set macauthentication portinitialize ge.2.1-5
Syntax
set macauthentication portquietperiod time port-string
Parameters
26-30
time
Periodinsecondstowaitafterafailedauthentication.Bydefault,thisis30
seconds.
portstring
Specifiestheportsforwhichthequitperiodistobeapplied.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsport1towait5secondsafterafailedauthenticationattemptbeforeanew
attemptcanbemade:
C3(su)->set macauthentication portquietperiod 5 ge.1.1
Syntax
clear macauthentication portquietperiod [port-string]
Parameters
portstring
(Optional)Specifiestheportsforwhichthequietperiodistobereset.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifaportstringisnotspecifiedthenallportswillbesettothedefaultportquietperiod.
Mode
Switchcommand,readwrite.
Example
Thisexampleresetsthedefaultquietperiodonport1:
C3(su)->clear macauthentication portquietperiod ge.1.1
Syntax
set macauthentication macinitialize mac-addr
Parameters
macaddr
SpecifiestheMACaddressofthesessiontoreinitialize.
26-31
Mode
Switchcommand,readwrite.
Defaults
None.
Example
ThisexampleshowshowtoforcetheMACauthenticationsessionforaddress006097b54c07
toreinitialize:
C3(su)->set macauthentication macinitialize 00-60-97-b5-4c-07
Syntax
set macauthentication reauthentication {enable | disable} port-string
Parameters
enable|disable
EnablesordisablesMACreauthentication.
portstring
Specifiesport(s)onwhichtoenableordisableMACreauthentication.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenableMACreauthenticationonge.4.1though5:
C3(su)->set macauthentication reauthentication enable ge.4.1-5
Syntax
set macauthentication portreauthenticate port-string
26-32
Parameters
portstring
SpecifiesMACauthenticationport(s)tobereauthenticated.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoforcege.2.1though5toreauthenticate:
C3(su)->set macauthentication portreauthentication ge.2.1-5
Syntax
set macauthentication macreauthenticate mac-addr
Parameters
macaddr
SpecifiestheMACaddressofthesessiontoreauthenticate.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoforcetheMACauthenticationsessionforaddress006097b54c07
toreauthenticate:
C3(su)->set macauthentication macreauthenticate 00-60-97-b5-4c-07
Syntax
set macauthentication reauthperiod time port-string
26-33
Parameters
time
Specifiesthenumberofsecondsbetweenreauthenticationattempts.Valid
valuesare14294967295.
portstring
Specifiestheport(s)onwhichtosettheMACreauthenticationperiod.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ChangingtheReauthPeriodwiththesetmacauthenticationreauthperiodcommanddoesnot
affectcurrentsessions.Newsessionswillusethecorrectperiod.
Example
ThisexampleshowshowtosettheMACreauthenticationperiodto7200seconds(2hours)on
ge.2.1through5:
C3(su)->set macauthentication reauthperiod 7200 ge.2.1-5
Syntax
clear macauthentication reauthperiod [port-string]
Parameters
portstring
(Optional)ClearstheMACreauthenticationperiodonspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,thereauthenticationperiodwillbeclearedonallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtogloballycleartheMACreauthenticationperiod:
C3(su)->clear macauthentication reauthperiod
26-34
Syntax
set macauthentication significant-bits number
Parameters
number
Specifiesthenumberofsignificantbitstobeusedforauthentication.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThiscommandallowsyoutospecifyamasktoapplytoMACaddresseswhenauthenticating
usersthroughaRADIUSserver.Themostcommonuseofsignificantbitmasksisfor
authenticationofallMACaddressesforaspecificvendor.
OnswitchesusingMACauthentication,theMACaddressofauserattemptingtologinissentto
theRADIUSserverastheusername.Ifaccessisdenied,andifasignificantbitmaskhasbeen
configured(otherthan48)withthiscommand,theswitchwillapplythemaskandresendthe
maskedaddresstotheRADIUSserver.Forexample,ifauserwithMACaddressof0016CF12
3456isdeniedaccess,anda32bitmaskhasbeenconfigured,theswitchwillapplythemaskand
resendaMACaddressof0016CF120000totheRADIUSserver.
Touseasignificantbitsmaskforauthenticationofdevicesbyaparticularvendor,specifya24bit
mask,tomaskouteverythingexceptthevendorportionoftheMACaddress.
Example
ThisexamplesetstheMACauthenticationsignificantbitsmaskto24.
C3(su)->set macauthentication significant-bits 24
Syntax
clear macauthentication significant-bits
Parameters
None.
Defaults
None.
26-35
Mode
Switchcommand,readwrite.
Example
ThisexampleresetstheMACauthenticationsignificantbitsto48.
C3(su)->clear macauthentication significant-bits
26-36
Commands
For information about...
Refer to page...
show multiauth
26-38
26-39
26-39
26-40
26-40
26-41
26-41
26-37
show multiauth
Refer to page...
26-42
26-43
26-43
26-44
26-45
26-46
26-46
26-47
26-48
show multiauth
Usethiscommandtodisplaymultipleauthenticationsystemconfiguration.
Syntax
show multiauth
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaymultipleauthenticationsystemconfiguration:
C3(rw)->show multiauth
Multiple authentication system configuration
------------------------------------------------Supported types
: dot1x, pwa, mac
Maximum number of users
: 768
Current number of users
: 2
System mode
: multi
Default precedence
: dot1x, pwa, mac
Admin precedence
: dot1x, pwa, mac
Operational precedence
: dot1x, pwa, mac
26-38
Syntax
set multiauth mode {multi | strict}
Parameters
multi
Allowsthesystemtousemultipleauthenticatorssimultaneously(802.1x,
PWA,andMACAuthentication)onaport.Thisisthedefaultmode.
strict
Usermustauthenticateusing802.1xauthenticationbeforenormaltraffic
(anythingotherthanauthenticationtraffic)canbeforwarded.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
MultiauthmultimoderequiresthatMAC,PWA,and802.1Xauthenticationbeenabledglobally,
andconfiguredappropriatelyonthedesiredportsaccordingtotheircorrespondingcommand
setsdescribedinthischapter.RefertoConfiguring802.1XAuthenticationonpage 2615and
ConfiguringMACAuthenticationonpage 2625andConfiguringPortWebAuthentication
(PWA)onpage 2668.
Example
Thisexampleshowshowtoenablesimultaneousmultipleauthentications:
C3(rw)->set multiauth mode multi
Syntax
clear multiauth mode
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
26-39
Example
Thisexampleshowshowtoclearthesystemauthenticationmode:
C3(rw)->clear multiauth mode
Syntax
set multiauth precedence {[dot1x] [mac] [pwa]}
Parameters
dot1x
Setsprecedencefor802.1Xauthentication.
mac
SetsprecedenceforMACauthentication.
pwa
Setsprecedenceforportwebauthentication
Defaults
Defaultprecedenceorderisdot1x,pwa,mac.
Mode
Switchcommand,readwrite.
Usage
Whenauserissuccessfullyauthenticatedbymorethanonemethodatthesametime,the
precedenceoftheauthenticationmethodswilldeterminewhichRADIUSreturnedfilterIDwillbe
processedandresultinanappliedtrafficpolicyprofile.
Example
ThisexampleshowshowtosetprecedenceforMACauthentication:
C3(rw)->set multiauth precedence mac dot1x
Syntax
clear multiauth precedence
Parameters
None.
Defaults
None.
26-40
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoclearthemultipleauthenticationprecedence:
C3(rw)->clear multiauth precedence
Syntax
show multiauth port [port-string]
Parameters
portstring
(Optional)Displaysmultipleauthenticationinformationforspecificport(s).
Defaults
Ifportstringisnotspecified,multipleauthenticationinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaymultipleauthenticationinformationforportsge.3.14.The
numberofMaxusersshownbythiscommandvariesdependingontheplatform.
C3(rw)->show multiauth port ge.3.1-4
Port
Mode
Max
users
------------ ------------ ---------ge.3.1
auth-opt
n
ge.3.2
auth-opt
n
ge.3.3
auth-opt
n
ge.3.4
auth-opt
n
Allowed
users
---------1
1
1
1
Current
users
---------0
0
0
0
Syntax
set multiauth port mode {auth-opt | auth-reqd | force-auth | force-unauth} |
numusers numusers port-string
26-41
Parameters
mode
authopt|
authreqd|
forceauth|
forceunauth
Specifiestheport(s)multipleauthenticationmodeas:
authoptAuthenticationoptional(nonstrictbehavior).Ifauser
doesnotattempttoauthenticateusing802.1x,orif802.1x
authenticationfails,theportwillallowtraffictobeforwarded
accordingtothedefineddefaultVLAN.
authreqdAuthenticationisrequired.
forceauthAuthenticationconsidered.
forceunauthAuthenticationdisabled.
numusers
numusers
Specifiesthenumberofusersallowedauthenticationonport(s).Valid
valuesdependonyourspecificplatform.RefertoAppendix A,Policyand
AuthenticationCapacitiesforinformationaboutmultiusercapacities.
portstring
Specifiestheport(s)onwhichtosetmultipleauthenticationproperties.
Defaults
Defaultvalueforthenumberofusersallowedtoauthenticateonaportis1.
Mode
Switchcommand,readwrite.
Examples
Thisexampleshowshowtosettheportmultipleauthenticationmodetorequiredonge.3.14:
C3(rw)->set multiauth port mode auth-reqd ge.3.14
Thisexampleshowshowtosetthenumberofusersallowedtoauthenticateonportge.3.14to2:
C3(rw)->set multiauth port numusers 2 ge.3.14
Syntax
clear multiauth port {mode | numusers} port-string
Parameters
mode
Clearsthespecifiedportsmultipleauthenticationmode.
numusers
Clearsthevaluesetforthenumberofusersallowedauthenticationonthe
specifiedport.
portstring
Specifiestheportorportsonwhichtoclearmultipleauthentication
properties.
Defaults
None.
26-42
Mode
Switchcommand,readwrite.
Examples
Thisexampleshowshowtocleartheportmultipleauthenticationmodeonportge.3.14:
C3(rw)->clear multiauth port mode ge.3.14
Thisexampleshowshowtoclearthenumberofusersonportge.3.14:
C3(rw)->clear multiauth port numusers ge.3.14
Syntax
show multiauth station [mac address] [port port-string]
Parameters
macaddress
(Optional)Displaysmultipleauthenticationstationentriesforaspecific
MACaddress.
portportstring
(Optional)Displaysmultipleauthenticationstationentriesforoneormore
ports.
Mode
Switchcommand,readonly.
Defaults
Ifnooptionsarespecified,multipleauthenticationstationentrieswillbedisplayedforallMAC
addressesandports.
Example
Thisexampleshowshowtodisplaymultipleauthenticationstationentries.Inthiscase,twoend
userMACaddressesareshown:
C3(rw)->show
Port
-----------ge.1.20
ge.2.16
multiauth station
Address type Address
------------ -----------------------mac
00-10-a4-9e-24-87
mac
00-b0-d0-e5-0c-d0
Syntax
show multiauth session [all] [agent {dot1x | mac | pwa}] [mac address]
[port port-string]
26-43
Parameters
all
(Optional)Displaysinformationaboutallsessions,includingthosewith
terminatedstatus.
agentdot1x|mac|
pwa
(Optional)Displays802.1X,orMAC,orportwebauthenticationsession
information.
macaddress
(Optional)Displaysmultipleauthenticationsessionentriesforspecific
MACaddress(es).
portportstring
(Optional)Displaysmultipleauthenticationsessionentriesforthe
specifiedportorports.
Defaults
Ifnooptionsarespecified,multipleauthenticationsessionentrieswillbedisplayedforall
sessions,authenticationtypes,MACaddresses,andports.
Mode
Switchcommand,readonly.
Example
Thisexampleshowshowtodisplaymultipleauthenticationsessioninformationforportge.1.1.
C3(su)->show multiauth session port ge.1.1
__________________________________________
Port
| ge.1.1
Station address
Auth status
| success
Last attempt
Agent type
| dot1x
Session applied
Server type
| radius
VLAN-Tunnel-Attr
Policy index
| 0
Policy name
Session timeout | 0
Session duration
Idle timeout
| 5
Idle time
Termination time | Not Terminated
|
|
|
|
|
|
|
00-01-03-86-0A-87
FRI MAY 18 11:16:36 2007
true
none
Administrator
0,00:00:25
0,00:00:00
Syntax
show multiauth idle-timeout
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
26-44
Example
Thisexampleshowshowtodisplaytimeoutvaluesforanidlesessionforallauthenticationtypes.
C3(su)->show multiauth idle-timeout
Authentication type Timeout (sec)
------------------- ------------dot1x
0
pwa
0
mac
0
Syntax
set multiauth idle-timeout [dot1x | mac | pwa] timeout
Parameters
dot1x
(Optional)SpecifiestheIEEE802.1Xportbasednetworkaccesscontrol
authenticationmethodforwhichtosetthetimeoutvalue.
mac
(Optional)SpecifiestheEnterasysMACauthenticationmethodfor
whichtosetthetimeoutvalue.
pwa
(Optional)SpecifiestheEnterasysPortWebAuthenticationmethodfor
whichtosetthetimeoutvalue.
timeout
Specifiesthetimeoutvalueinseconds.Thevaluecanrangefrom0to
65535.Avalueof0meansthatnoidletimeoutwillbeappliedunlessan
idletimeoutvalueisprovidedbytheauthenticatingserver.
Defaults
Ifnoauthenticationmethodisspecified,theidletimeoutvalueissetforallauthentication
methods.
Mode
Switchmode,readwrite.
Usage
Ifyousetanidletimeoutvalue,aMACuserwhoseMACaddresshasagedoutoftheforwarding
databasewillbeunauthenticatedifnotraffichasbeenseenfromthataddressforthespecifiedidle
timeoutperiod.
Avalueofzeroindicatesthatnoidletimeoutwillbeappliedunlessanidletimeoutvalueis
providedbytheauthenticatingserver.Forexample,ifasessionisauthenticatedbyaRADIUS
server,thatservermayencodeaIdleTimeoutAttributeinitsauthenticationresponse.
Example
Thisexamplesetstheidletimeoutvalueforallauthenticationmethodsto300seconds.
C3(su)->set multiauth idle-timeout 300
26-45
Syntax
clear multiauth idle-timeout [dot1x | mac | pwa]
Parameters
dot1x
(Optional)SpecifiestheIEEE802.1Xportbasednetworkaccesscontrol
authenticationmethodforwhichtoresetthetimeoutvaluetoits
default.
mac
(Optional)SpecifiestheEnterasysMACauthenticationmethodfor
whichtoresetthetimeoutvaluetoitsdefault.
pwa
(Optional)SpecifiestheEnterasysPortWebAuthenticationmethodfor
whichtoresetthetimeoutvaluetoitsdefault.
Defaults
Ifnoauthenticationmethodisspecified,theidletimeoutvalueisresettoitsdefaultvalueof0for
allauthenticationmethods.
Mode
Switchmode,readwrite.
Example
Thisexampleresetstheidletimeoutvalueforallauthenticationmethodsto0seconds.
C3(su)->clear multiauth idle-timeout
Syntax
show multiauth session-timeout
Parameters
None.
Defaults
None.
Mode
Switchmode,readonly.
26-46
Example
Thisexampledisplaysthesessiontimeoutvaluesforallauthenticationmethods.
C3(su)->show multiauth session-timeout
Authentication type Timeout (sec)
------------------- ------------dot1x
0
pwa
0
mac
0
Syntax
set multiauth session-timeout [dot1x | mac | pwa] timeout
Parameters
dot1x
(Optional)SpecifiestheIEEE802.1Xportbasednetworkaccesscontrol
authenticationmethodforwhichtosetthesessiontimeoutvalue.
mac
(Optional)SpecifiestheEnterasysMACauthenticationmethodfor
whichtosetthesessiontimeoutvalue.
pwa
(Optional)SpecifiestheEnterasysPortWebAuthenticationmethodfor
whichtosetthesessiontimeoutvalue.
timeout
Specifiesthetimeoutvalueinseconds.Thevaluecanrangefrom0to
65535.Avalueof0meansthatnosessiontimeoutwillbeappliedunless
asessiontimeoutvalueisprovidedbytheauthenticatingserver.
Defaults
Ifnoauthenticationmethodisspecified,thesessiontimeoutvalueissetforallauthentication
methods.
Mode
Switchmode,readwrite.
Usage
Avalueofzeromaybesupersededbyasessiontimeoutvalueprovidedbytheauthenticating
server.Forexample,ifasessionisauthenticatedbyaRADIUSserver,thatservermayencodea
SessionTimeoutAttributeinitsauthenticationresponse.
Example
ThisexamplesetsthesessiontimeoutvaluefortheIEEE802.1Xauthenticationmethodto300
seconds.
C3(su)->set multiauth session-timeout dot1x 300
26-47
Syntax
clear multiauth session-timeout [dot1x | mac | pwa]
Parameters
dot1x
(Optional)SpecifiestheIEEE802.1Xportbasednetworkaccesscontrol
authenticationmethodforwhichtoresetthetimeoutvaluetoits
default.
mac
(Optional)SpecifiestheEnterasysMACauthenticationmethodfor
whichtoresetthetimeoutvaluetoitsdefault.
pwa
(Optional)SpecifiestheEnterasysPortWebAuthenticationmethodfor
whichtoresetthetimeoutvaluetoitsdefault.
Defaults
Ifnoauthenticationmethodisspecified,thesessiontimeoutvalueisresettoitsdefaultvalueof0
forallauthenticationmethods.
Mode
Switchmode,readwrite.
Example
ThisexampleresetsthesessiontimeoutvaluefortheIEEE802.1Xauthenticationmethodto0
seconds.
C3(su)->clear multiauth session-timeout dot1x
26-48
Thesecondpolicyrole,fortheuser,caneitherbestaticallyconfiguredwiththedefaultpolicyrole
ontheportordynamicallyassignedthroughauthenticationtothenetwork(usingaRADIUS
FilterID).Whenthedefaultpolicyroleisassignedonaport,theVLANsetastheportsPVIDis
mappedtothedefaultpolicyrole.Whenapolicyroleisdynamicallyappliedtoauserastheresult
ofasuccessfullyauthenticatedsession,theauthenticatedVLANismappedtothepolicyroleset
intheFilterIDreturnedfromtheRADIUSserver.TheauthenticatedVLANmayeitherbethe
PVIDoftheport,ifthePVIDOverrideforthepolicyprofileisdisabled,ortheVLANspecifiedin
thePVIDOverrideifthePVIDOverrideisenabled.
TunnelTypeVLAN(13)
TunnelMediumType802
TunnelPrivateGroupIDVLANID
InordertoauthenticateRFC3580users,policymaptableresponsemustbesettotunnelas
describedinConfiguringPolicyMaptableResponseonpage 2652.
Note: A policy license, if applicable, is not required to deploy RFC 3580 dynamic VLAN
assignment.
Commands
For information about...
Refer to page...
set vlanauthorization
26-50
26-50
clear vlanauthorization
26-51
show vlanauthorization
26-51
26-49
set vlanauthorization
set vlanauthorization
EnableordisabletheuseoftheRADIUSVLANtunnelattributetoputaportintoaparticular
VLANbasedontheresultofauthentication.
Syntax
set vlanauthorization {enable | disable} [port-string]
Parameters
enable|disable
Enablesordisablesvlanauthorization/tunnelattributes.
portstring
(Optional)SpecifieswhichportstoenableordisabletheuseofVLAN
tunnelattributes/authorization.Foradetaileddescriptionofpossibleport
stringvalues,refertoPortStringSyntaxUsedintheCLIonpage 71.
Defaults
VLANauthenticationisdisabledbydefault.
Mode
Switchcommand,readwrite.
Examples
ThisexampleshowshowtoenableVLANauthenticationforallGigabitEthernetports:
C3(rw)-> set vlanauthorization enable ge.*.*
ThisexampleshowshowtodisableVLANauthenticationforallGigabitEthernetportsonswitch
unit/module 3:
C3(rw)-> set vlanauthorization disable ge.3.*
Syntax
set vlanauthorization egress {none | tagged | untagged} port-string
Parameters
26-50
none
Specifiesthatnoegressmanipulationwillbemade.
tagged
Specifiesthattheauthenticatingportwillbeaddedtothecurrenttagged
egressfortheVLANIDreturned.
untagged
Specifiesthattheauthenticatingportwillbeaddedtothecurrent
untaggedegressfortheVLANIDreturned(default).
portstring
Specifiesthattheportorlistofports.towhichthiscommandwillapply.
Foradetaileddescriptionofpossibleportstringvalues,refertoPort
StringSyntaxUsedintheCLIonpage 71.
clear vlanauthorization
Defaults
Bydefault,administrativeegressissettountagged.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenabletheinsertionoftheRADIUSassignedVLANtoan802.1qtag
foralloutboundframesforports10through15onunit/modulenumber3.
C3(rw)->set vlanauthorization egress tagged ge.3.10-15
clear vlanauthorization
Usethiscommandtoreturnport(s)tothedefaultconfigurationofVLANauthorizationdisabled,
egressuntagged.
Syntax
clear vlanauthorization [port-string]
Parameters
portstring
(Optional)Specifieswhichportsaretoberestoredtodefault
configuration.Ifnoportstringisentered,theactionwillbeaglobal
setting.Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
Defaults
Ifnoportstringisentered,allportsawillberesettodefaultconfigurationwithVLAN
authorizationdisabledandegressframesuntagged.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowhowtoclearVLANauthorizationforallportsonslots3,4,and5:
C3(rw)->clear vlanauthorization ge.3-5.*
show vlanauthorization
DisplaystheVLANauthenticationstatusandconfigurationinformationforthespecifiedports.
Syntax
show vlanauthorization [port-string]
26-51
Parameters
portstring
(Optional)DisplaysVLANauthenticationstatusforthespecifiedports.If
noportstringisentered,thentheglobalstatusofthesettingisdisplayed.
Foradetaileddescriptionofpossibleportstringvalues,refertoPort
StringSyntaxUsedintheCLIonpage 71.
Defaults
Ifnoportstringisentered,thestatusforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThiscommandshowshowtodisplayVLANauthorizationstatusforge.1.1:
C3(su)->show vlanauthorization ge.1.1
Vlan Authorization: - enabled
port
status
administrative
operational
egress
egress
------- -------- -----------------------ge.1.1
enabled
untagged
authenticated
vlan id
mac address
----------------- -------
Table 265providesanexplanationofcommandoutput.Fordetailsonenablingandassigning
protocolandegressattributes,refertosetvlanauthorizationonpage 2650andset
vlanauthorizationegressonpage 2650.
Table 26-5
Output Field
What It Displays...
port
Port identification
status
administrative
egress
operational egress
authenticated mac
address
If authentication has succeeded, displays the MAC address assigned for egress.
vlan id
26-52
Whenthemaptableresponseissettopolicymode,thesystemwillusetheFilterIDattributesin
theRADIUSreplytoapplyapolicytotheauthenticatinguserandwillignoreanytunnel
attributesintheRADIUSreply.Onthisplatform,whenpolicymodeisconfigured,noVLANto
policymappingwilloccur.
Whenthemaptableresponseissettoboth,orhybridauthenticationmode,bothFilterID
attributes(dynamicpolicyassignment)andtunnelattributes(dynamicVLANassignment)sentin
RADIUSserverAccessAcceptrepliesareusedtodeterminehowtheswitchshouldhandle
authenticatingusers.Onthisplatform,whenhybridauthenticationmodeisconfigured,VLANto
policymappingcanoccur,asdescribedbelowinWhenPolicyMaptableResponseisBothon
page 2653.
UsinghybridauthenticationmodeeliminatesthedependencyonhavingtoassignVLANs
throughpolicyrolesVLANscanbeassignedbymeansofthetunnelattributeswhilepolicy
rolescanbeassignedbymeansoftheFilterIDattributes.Alternatively,VLANtopolicymapping
canbeusedtomappoliciestousersusingtheVLANspecifiedbythetunnelattributes,without
havingtoconfigureFilterIDattributesontheRADIUSserver.Thisseparationgives
administratorsmoreflexibilityinsegmentingtheirnetworksbeyondtheplatformshardware
policyrolelimits.
RefertoRADIUSFilterIDAttributeandDynamicPolicyProfileAssignmentonpage 263for
moreinformationaboutFilterIDattributesandConfiguringVLANAuthorization(RFC3580)
onpage 2649formoreinformationabouttunnelattributes.
Operational Description
When Policy Maptable Response is Both
HybridauthenticationmodeusesbothFilterIDattributesandtunnelattributes.Toenablehybrid
authenticationmode,usethesetpolicymaptablecommandandsettheresponseparameterto
both.Whenconfiguredtousebothsetsofattributes:
IfboththeFilterIDandtunnelattributesarepresentintheRADIUSreply,thenthepolicy
profilespecifiedbytheFilterIDisappliedtotheauthenticatinguser,andifVLAN
authorizationisenabledgloballyandontheauthenticatingusersport,theVLANspecifiedby
thetunnelattributesisappliedtotheauthenticatinguser.
IfVLANauthorizationisnotenabled,theVLANspecifiedbythepolicyprofileisapplied.See
ConfiguringVLANAuthorization(RFC3580)onpage 2649forinformationaboutenabling
VLANauthorizationgloballyandonspecificports.
IftheFilterIDattributesarepresentbutthetunnelattributesarenotpresent,thepolicy
profilespecifiedbytheFilterIDisapplied,alongwiththeVLANspecifiedbythepolicy
profile.
IfthetunnelattributesarepresentbuttheFilterIDattributesarenotpresentorareinvalid,
andifVLANauthorizationisenabledgloballyandontheauthenticatingusersport,thenthe
switchwillchecktheVLANtopolicymappingtable(configuredwiththesetpolicy
maptablecommand):
IfanentrymappingthereceivedVLANIDtoavalidpolicyprofileisfound,thenthat
policyprofile,alongwiththeVLANspecifiedbythepolicyprofile,willbeappliedtothe
authenticatinguser.
Ifnomatchingmappingtableentryisfound,theVLANspecifiedbythetunnelattributes
willbeappliedtotheauthenticatinguser.
IftheVLANtopolicymappingtableisinvalid,thenthe
etsysPolicyRFC3580MapInvalidMappingMIBisincrementedandtheVLANspecifiedby
thetunnelattributeswillbeappliedtotheauthenticatinguser.
SecureStack C3 Configuration Guide
26-53
IfVLANauthorizationisnotenabled,thetunnelattributesareignored.
IftheFilterIDattributesarepresent,thespecifiedpolicyprofilewillbeappliedtothe
authenticatinguser.IfnoFilterIDattributesarepresent,orifthepolicyIDisunknownor
invalid,thedefaultpolicy(ifitexists)willbeapplied.
Ifthetunnelattributesarepresent,theyareignored.NoVLANtopolicymappingwilloccur.
Onswitchesthatsupportpolicy,thedefaultmaptableresponsemodeispolicy.Onswitchesthat
donotsupportpolicy,thedefaultmaptableresponsemodeistunnel.
Ifthetunnelattributesarepresent,thespecifiedVLANwillbeappliedtotheauthenticating
user.NoVLANtopolicymappingwilloccur.
Ifthetunnelattributesarenotpresent,thedefaultpolicyVLANwillbeappliedifitexists.
Otherwise,theportVLANwillbeapplied.
IftheFilterIDattributesarepresent,theyareignored.
IfVLANauthorizationisnotenabled,theuserwillbeallowedontotheportwiththedefault
policy,ifitexists.Ifnodefaultpolicyexists,theportVLANwillbeapplied.
Onswitchesthatsupportpolicy,thedefaultmaptableresponsemodeispolicy.Onswitchesthat
donotsupportpolicy,thedefaultmaptableresponsemodeistunnel.
Commands
For information about...
Refer to page...
26-54
26-55
26-56
Syntax
show policy maptable [vlan-list]
Parameters
vlanlist
26-54
(Optional)SpecifiestheVLANorlistofVLANsforwhichtodisplaythe
VLANtopolicysettings.
Defaults
IfnoVLANlistisspecified,allentriesintheVLANtopolicymappingtablearedisplayed.
Mode
Switchcommand,readonly.
Usage
Thiscommanddisplaysboththepolicymaptableresponsesetting,andtheentriesintheVLAN
topolicymappingtableforoneormultipleVLANs.RefertoOperationalDescriptionon
page 2653forinformationabouthowtheVLANtopolicymappingtableisused.
Example
ThisexampleshowshowtodisplaythepolicymaptableresponseandalltheentriesintheVLAN
topolicymappingtable.Inthisexample,hybridauthenticationmodeisenabled(becausethe
policymaptableresponseisboth).
C3(rw)->show policy maptable
Policy map response
: both
Policy map last change : 1 days 00:23:57
VLAN ID
144
160
Policy Profile
4
7
(Students)
(Faculty)
Syntax
set policy maptable {vlan-list policy-index | response {both | policy | tunnel}}
Parameters
vlanlistpolicyindex
SpecifiesanentryintheVLANtopolicymappingtable,whichrelatesa
policyprofilewithaVLANIDorrangeofIDs.vlanlistcanrangefrom1
to4093.policyindexcanrangefrom1to1023.
response
Indicatesthatthiscommandisconfiguringthepolicymaptable
response.
both
SetsthemaptableresponsetolookatboththeFilterIDandtunnel
attributesinaRADIUSAccessAcceptreplytodeterminehowto
handleanauthenticatinguser.Thisisequivalenttoenablinghybrid
authenticationmode.
policy
Setsthemaptableresponsetopolicymode.Thesystemwilllookatonly
theFilterIDattributesinaRADIUSAccessAcceptreplytodetermine
howtohandleanauthenticatinguser.
tunnel
Setsthemaptableresponsetotunnelmode.Thesystemwilllookat
onlythetunnelattributesinaRADIUSAccessAcceptreplyto
determinehowtohandleanauthenticatinguser.
26-55
Defaults
Nomappingtableentriesareconfigured.
Thedefaultpolicymaptableresponsesettingispolicymode.
Mode
Switchcommand,readwrite.
Usage
ThiscommandcanbeusedtocreateentriesintheVLANtopolicymappingtableandalsotoset
theswitchsmaptableresponse.RefertoOperationalDescriptiononpage 2653formore
informationabouttheswitchsoperationsforallmaptableresponseparameters.
WhenyouareusingVLANauthorizationfordynamicVLANassignment,youshouldsetthe
policymaptableresponsetotunnel.SeeConfiguringVLANAuthorization(RFC3580)on
page 2649.
Examples
Thisexampleshowshowtosetthepolicymaptableresponsetoboth,orhybridauthentication
mode:
C3(rw)->set policy maptable response both
ThisexampleshowshowtoconfigureapolicymappingentrythatwillmapVLAN144topolicy
profile4.
C3(rw)->set policy maptable 144 4
Syntax
clear policy maptable {vlan-list | response}
Parameters
vlanlist
ClearsthepolicyprofilemappingforthespecifiedVLANIDorrangeof
VLANs.
response
Resetsthemaptableresponsetopolicy.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThiscommandcanbeusedtoremoveanentryintheVLANtopolicymappingtableortochange
themaptableresponsebacktothedefaultvalueofpolicymode.
26-56
Example
ThisexampleremovestheentryinthemappingtableforVLAN144.
C3(rw)->show policy maptable
Policy map response
: both
Policy map last change : 1 days 17:23:57
VLAN ID
144
160
Policy Profile
4
7
(Students)
(Faculty)
Policy Profile
7
(Faculty)
Alinkdownevent
WhenMAClockingisdisabledonaport
WhenaMACisagedoutoftheforwardingdatabasewhenFirstArrivalagingisenabled
Whenproperlyconfigured,MAClockingisanexcellentsecuritytoolasitpreventsMACspoofing
onconfiguredports.AlsoifaMACweretobesecuredbysomethinglikeDragonDynamic
IntrusionDetection,MAClockingwouldmakeitmoredifficultforahackertosendpacketsinto
thenetworkbecausethehackerwouldhavetochangetheirMACaddressandmovetoanother
port.Inthemeantimethesystemadministratorwouldbereceivingamaclocktrapnotification.
Purpose
Toreview,disable,enable,andconfigureMAClocking.
26-57
show maclock
Commands
For information about...
Refer to page...
show maclock
26-58
26-59
26-60
26-61
set maclock
26-61
clear maclock
26-62
26-63
26-63
26-64
26-65
26-65
26-66
26-66
26-67
show maclock
UsethiscommandtodisplaythestatusofMAClockingononeormoreports.
Syntax
show maclock [port-string]
Parameters
portstring
(Optional)DisplaysMAClockingstatusforspecifiedport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,MAClockingstatuswillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayMAClockinginformationforge.1.1.
C3(su)->show maclock ge.1.1
MAC locking is globally enabled
Port
Number
26-58
Port
Status
Trap
Status
Aging
Status
Max Static
Allocated
Max FirstArrival
Allocated
Last Violating
MAC Address
------ge.1.1
Table 266providesanexplanationofthecommandoutput.
Table 26-6
Output Field
What It Displays...
Port Number
Port Status
Whether MAC locking is enabled or disabled on the port. MAC locking is globally
disabled by default. For details on enabling MAC locking on the switch and on one or
more ports, refer to set maclock enable on page 26-60 and set maclock on
page 26-61.
Trap Status
Whether MAC lock trap messaging is enabled or disabled on the port. For details
on setting this status, refer to set maclock trap on page 26-67.
Aging Status
The maximum static MAC addresses allowed locked to the port. For details on
setting this value, refer to set maclock static on page 26-63.
Max FirstArrival
Allocated
The maximum end station MAC addresses allowed locked to the port. For details on
setting this value, refer to set maclock firstarrival on page 26-64.
Most recent MAC address(es) violating the maximum static and first arrival value(s)
set for the port.
Syntax
show maclock stations [firstarrival | static] [port-string]
Parameters
firstarrival
(Optional)DisplaysMAClockinginformationaboutendstationsfirst
connectedtoMAClockedports.
static
(Optional)DisplaysMAClockinginformationaboutstatic(management
defined)endstationsconnectedtoMAClockedports.
portstring
(Optional)Displaysendstationinformationforspecifiedport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifnoparametersarespecified,MAClockinginformationwillbedisplayedforallendstations.
Mode
Switchcommand,readonly.
26-59
Example
ThisexampleshowshowtodisplayMAClockinginformationfortheendstationsconnectedtoall
GigabitEthernetportsinunit/module2:
C3(su)->show maclock stations ge.2.*
Port Number MAC Address
Status
------------ -----------------------------ge.2.1
00:a0:c9:39:5c:b4
active
ge.2.7
00:a0:c9:39:1f:11
active
State
-------------first arrival
static
Aging
----true
false
Table 267providesanexplanationofthecommandoutput.
Table 26-7
Output Field
What It Displays...
Port Number
MAC address
Status
State
Whether the end station locked to the port is a first arrival or static connection.
Aging
When true, FirstArrival MACs that have aged out of the forwarding database will be
removed for the associated port lock.
Note: MAC locking needs to be enabled globally and on appropriate ports for it to function.
Syntax
setmaclockenable[portstring]
Parameters
portstring
(Optional)EnablesMAClockingonspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,MAClockingwillbeenabledglobally.
Mode
Switchcommand,readwrite.
Usage
Whenenabledandconfigured,MAClockingdefineswhichMACaddresses,aswellashowmany
MACaddressesarepermittedtousespecificport(s).
26-60
MAClockingisdisabledbydefaultatdevicestartup.ConfiguringoneormoreportsforMAC
lockingrequiresgloballyenablingitonthedeviceandthenenablingitonthedesiredports.
Example
ThisexampleshowshowtoenableMAClockingonge.2.3:
C3(su)->set maclock enable ge.2.3
Syntax
set maclock disable [port-string]
Parameters
portstring
(Optional)DisablesMAClockingonspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,MAClockingwillbedisabledgloballyontheswitch.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodisableMAClockingonge.2.3:
C3(su)->set maclock disable ge.2.3
set maclock
UsethiscommandtocreateastaticMACaddresstoportlocking,andtoenableordisableMAC
lockingforthespecifiedMACaddressandport.
Syntax
set maclock mac-address port-string {create | enable | disable}
Parameters
macaddress
SpecifiestheMACaddressforwhichMAClockingwillbecreated,
enabledordisabled.
portstring
Specifiestheportonwhichtocreate,enableordisableMAClockingfor
thespecifiedMAC.Foradetaileddescriptionofpossibleportstring
values,refertoPortStringSyntaxUsedintheCLIonpage 71.
26-61
clear maclock
create
EstablishesaMAClockingassociationbetweenthespecifiedMAC
addressandport.CreateautomaticallyenablesMAClockingbetweenthe
specifiedMACaddressandport.
enable|disable
EnablesordisablesMAClockingbetweenthespecifiedMACaddressand
port.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ConfiguringaportforMAClockingrequiresgloballyenablingitontheswitchfirstusingtheset
maclockenablecommandasdescribedinsetmaclockenableonpage 2660.
StaticMAClockingauseronmultipleportsisnotsupported.
StaticallyMAClockedaddresseswilldisplayintheshowmacoutput(asdescribedonpage1422)
asaddresstypeotherandwillnotremovethemonlinkdown.
Example
ThisexampleshowshowtocreateaMAClockingassociationbetweenMACaddress0e03efd8
4455andportge.3.2:
C3(rw)->set maclock 0e-03-ef-d8-44-55 ge.3.2 create
clear maclock
UsethiscommandtoremoveastaticMACaddresstoportlockingentry.
Syntax
clear maclock mac-address port-string
Parameters
macaddress
SpecifiestheMACaddressthatwillberemovedfromthelistofstatic
MACsallowedtocommunicateontheport.
portstring
SpecifiestheportonwhichtocleartheMACaddress.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
26-62
Usage
TheMACaddressthatisclearedwillnolongerbeabletocommunicateontheportunlessthefirst
arrivallimithasbeensettoavaluegreaterthan0andthislimithasnotyetbeenmet.
Forexample,ifuserBsMACisremovedfromthestaticMACaddresslistandthefirstarrival
limithasbeensetto0,thenuserBwillnotbeabletocommunicateontheport.IfuserAsMACis
removedfromthestaticMACaddresslistandthefirstarrivallimithasbeensetto10,butonlyhas
7entries,userAwillbecomethe8thentryandallowedtocommunicateontheport.
Example
ThisexampleshowshowtoremoveaMACfromthelistofstaticMACsallowedtocommunicate
onportge.3.2:
C3(rw)->clear maclock 0e-03-ef-d8-44-55 ge.3.2
Syntax
set maclock static port-string value
Parameters
portstring
SpecifiestheportonwhichtosetthemaximumnumberofstaticMACs
allowed.Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
value
SpecifiesthemaximumnumberofstaticMACaddressesallowedper
port.Validvaluesare0to20.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthemaximumnumberofallowablestaticMACsto2onge.3.1:
C3(rw)->set maclock static ge.3.1 2
Syntax
clear maclock static port-string
26-63
Parameters
portstring
SpecifiestheportonwhichtoresetnumberofstaticMACaddresses
allowed.Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetthenumberofallowablestaticMACsonge.2.3:
C3(rw)->clear maclock static ge.2.3
Syntax
set maclock firstarrival port-string value
Parameters
portstring
SpecifiestheportonwhichtolimitMAClocking.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
value
SpecifiesthenumberoffirstarrivalendstationMACaddressestobe
allowedconnectionstotheport.Validvaluesare0to600.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Themaclockfirstarrivalcountresetswhenthelinkgoesdown.Thisfeatureisbeneficialifyou
haveroamingusersthefirstarrivalcountwillbereseteverytimeausermovestoanotherport,
butwillstillprotectagainstconnectingmultipledevicesonasingleportandwillprotectagainst
MACaddressspoofing.
Note: Setting a ports first arrival limit to 0 does not deny the first MAC address learned on the port
from passing traffic.
26-64
Example
ThisexampleshowshowtorestrictMAClockingto6MACaddressesonge.2.3:
C3(su)->set maclock firstarrival ge.2.3 6
Syntax
clear maclock firstarrival port-string
Parameters
portstring
Specifiestheportonwhichtoresetthefirstarrivalvalue.Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetMACfirstarrivalsonge.2.3:
C3(su)->clear maclock firstarrival ge.2.3
Syntax
set maclock agefirstarrival port-string {enable | disable}
Parameters
portstring
Specifiestheport(s)onwhichtoenableordisablefirstarrivalaging.For
adetaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
enable|disable
Enableordisablefirstarrivalaging.Bydefault,firstarrivalagingis
disabled.
Defaults
None.
26-65
Mode
Switchmode,readwrite.
Example
Thisexampleenablesfirstarrivalagingonportge.1.1.
C3(su)-> set maclock agefirstarrival ge.1.1 enable
Syntax
clear maclock agefirstarrival port-string
Parameters
portstring
Specifiestheport(s)onwhichtodisablefirstarrivalaging.Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
None.
Mode
Switchmode,readwrite.
Example
Thisexampledisablesfirstarrivalagingonportge.1.1.
C3(su)-> clear maclock agefirstarrival ge.1.1 enable
Syntax
set maclock move port-string
Parameters
portstring
SpecifiestheportonwhichMACwillbemovedfromfirstarrivalMACs
tostaticentries.Foradetaileddescriptionofpossibleportstringvalues,
refertoPortStringSyntaxUsedintheCLIonpage 71.
Defaults
None.
26-66
Mode
Switchcommand,readwrite.
Usage
IftherearemorefirstarrivalMACsthantheallowedmaximumstaticMACs,thenonlythelatest
firstarrivalMACswillbemovedtostaticentries.Forexample,ifyousetthemaximumnumberof
staticMACsto2withthesetmaclockstaticcommand,andthenexecutedthesetmaclockmove
command,eventhoughtherewerefiveMACsinthefirstarrivaltable,onlythetwomostrecent
MACentrieswouldbemovedtostaticentries.
Example
ThisexampleshowshowtomoveallcurrentfirstarrivalMACstostaticentriesonportsge.3.140:
C3(rw)->set maclock move ge.3.1-40
Syntax
set maclock trap port-string {enable | disable}
Parameters
portstring
SpecifiestheportonwhichMAClocktrapmessagingwillbeenabledor
disabled.Foradetaileddescriptionofpossibleportstringvalues,referto
PortStringSyntaxUsedintheCLIonpage 71.
enable|disable
EnablesordisablesMAClocktrapmessaging.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Whenenabled,thisfeatureauthorizestheswitchtosendanSNMPtrapmessageifanendstation
isconnectedthatexceedsthemaximumvaluesconfiguredusingthesetmaclockfirstarrivaland
setmaclockstaticcommands.ViolatingMACaddressesaredroppedfromthedevices(orstacks)
filteringdatabase.
Example
ThisexampleshowshowtoenableMAClocktrapmessagingonge.2.3:
C3(su)->set maclock trap ge.2.3 enable
26-67
Purpose
Toreview,enable,disable,andconfigurePortWebAuthentication(PWA).
Commands
For information about...
26-68
Refer to page...
show pwa
26-69
set pwa
26-70
26-71
26-71
26-72
26-72
26-73
26-73
26-74
26-74
26-75
26-75
26-76
26-76
26-77
26-77
26-78
26-79
show pwa
show pwa
Usethiscommandtodisplayportwebauthenticationinformationforoneormoreports.
Syntax
show pwa [port-string]
Parameters
portstring
(Optional)DisplaysPWAinformationforspecificport(s).
Defaults
Ifportstringisnotspecified,PWAinformationwillbedisplayedforallports.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayPWAinformationforge.2.1:
C3(su)->show pwa ge.2.1
PWA Status
PWA IP Address
PWA Protocol
PWA Enhanced Mode
PWA Logo
PWA Guest Networking Status
PWA Guest Name
PWA Redirect Time
Port
Mode
-------- ---------------ge.2.1
disabled
enabled
192.168.62.99
PAP
N/A
enabled
disabled
guest
N/A
AuthStatus
-------------disconnected
QuietPeriod
----------60
MaxReq
--------16
Table 268providesanexplanationofthecommandoutput.
Table 26-8
Output Field
What It Displays...
PWA Status
PWA IP Address
IP address of the end station from which PWA will prevent network access until the
user is authenticated. Set using the set pwa ipaddress command as described in
set pwa ipaddress on page 26-73.
PWA Protocol
Whether PWA protocol is CHAP or PAP. Default setting of PAP can be changed
using the set pwa protocol command as described in set pwa protocol on
page 26-73.
PWA Enhanced
Mode
Whether PWA enhanced mode is enabled or disabled. Default state of disabled can
be changed using the set pwa enhancedmode command as described in set pwa
enhancedmode on page 26-79.
26-69
set pwa
Table 26-8
Output Field
What It Displays...
PWA Logo
Whether the Enterasys logo will be displayed or hidden at user login. Default state of
enabled (displayed) can be changed using the set pwa displaylogo command as
described in set pwa displaylogo on page 26-72.
PWA Guest
Networking Status
Guest user name for PWA enhanced mode networking. Default value of guest can
be changed using the set pwa guestname command as described in set pwa
guestname on page 26-74.
PWA Guest
Password
Guest users password. Default value of an empty string can be changed using the
set pwa guestpassword command as described in set pwa guestpassword on
page 26-75.
Time in seconds after login success before the user is redirected to the PWA home
page.
Port
Mode
Auth Status
Quiet Period
Amount of time a port will be in the held state after a user unsuccessfully attempts to
log on to the network. Default value of 60 can be changed using the set pwa
quietperiod command as described in set pwa quietperiod on page 26-76.
MaxReq
Maximum number of log on attempts allowed before transitioning the port to a held
state. Default value of 2 can be changed using the set pwa maxrequests command
as described in set pwa maxrequest on page 26-77.
set pwa
Usethiscommandtoenableordisableportwebauthentication.
Syntax
set pwa {enable | disable}
Parameters
enable|disable
Enablesordisablesportwebauthentication.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoenableportwebauthentication:
C3(su)->set pwa enable
26-70
Syntax
show pwa banner
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaythePWAloginbanner:
C3(su)->show pwa banner
Welcome to Enterasys Networks
Syntax
set pwa banner string
Parameters
string
SpecifiesthePWAloginbanner.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthePWAloginbannertoWelcometoEnterasys Networks:
C3(su)->set pwa banner Welcome to Enterasys Networks
26-71
Syntax
clear pwa banner
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoresetthePWAloginbannertoablankstring
C3(su)->clear pwa banner
Syntax
set pwa displaylogo {display | hide}
Parameters
display|hide
DisplaysorhidestheEnterasys NetworkslogowhenthePWAwebsite
displays.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtohidetheEnterasys Networkslogo:
C3(su)->set pwa displaylogo hide
26-72
Syntax
set pwa ipaddress ip-address
Parameters
ipaddress
SpecifiesagloballyuniqueIPaddress.Thissamevaluemustbe
configuredintoeveryauthenticatingswitchinthedomain.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetaPWAIPaddressof1.2.3.4:
C3(su)->set pwa ipaddress 1.2.3.4
Syntax
set pwa protocol {chap | pap}
Parameters
chap|pap
SetsthePWAprotocolto:
CHAP(PPPChallengeHandshakeProtocol)encryptstheusername
andpasswordbetweentheendstationandtheswitchport.
PAP(PasswordAuthenticationProtocoldoesnotprovideany
encryptionbetweentheendstationtheswitchport.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetathePWAprotocoltoCHAP:
C3(su)->set pwa protocol chap
26-73
Syntax
set pwa guestname name
Parameters
name
Specifiesaguestusername.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthePWAguestusernametoguestuser:
C3(su)->set pwa guestname guestuser
Syntax
clear pwa guestname
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoclearthePWAguestusername
C3(su)->clear pwa guestname
26-74
Syntax
set pwa guestpassword
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
PWAwillusethispasswordandtheguestusernametograntnetworkaccesstoguestswithout
establishedloginnamesandpasswords.
Example
ThisexampleshowshowtosetthePWAguestuserpasswordname:
C3(su)->set pwa guestpassword
Guest Password: *********
Retype Guest Password: *********
Syntax
set pwa gueststatus {authnone | authradius | disable}
Parameters
authnone
Enablesguestnetworkingwithnoauthenticationmethod.
authradius
EnablesguestnetworkingwithRADIUSauthentication.Uponsuccessful
authenticationfromRADIUS,PWAwillapplythepolicyreturnedfrom
RADIUStothePWAport.
disable
Disablesguestnetworking.
Defaults
None.
Mode
Switchcommand,readwrite.
26-75
Usage
PWAwilluseaguestpasswordandguestusernametograntnetworkaccesswithdefaultpolicy
privilegestouserswithoutestablishedloginnamesandpasswords.
Example
ThisexampleshowshowtoenablePWAguestnetworkingwithRADIUSauthentication:
C3(su)->set pwa guestnetworking authradius
Syntax
set pwa initialize [port-string]
Parameters
portstring
(Optional)Initializesspecificport(s).Foradetaileddescriptionofpossible
portstringvalues,refertoPortStringSyntaxUsedintheCLIon
page 71.
Defaults
Ifportstringisnotspecified,allportswillbeinitialized.
Mode
Switchcommand,readwrite.
Example
Thisexampleshowshowtoinitializeportsge.1.57:
C3(su)->set pwa initialize ge.1.5-7
Syntax
set pwa quietperiod time [port-string]
Parameters
26-76
time
Specifiesquiettimeinseconds.
portstring
(Optional)Setsthequietperiodforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,quietperiodwillbesetforallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthePWAquietperiodto30secondsforportsge.1.57:
C3(su)->set pwa quietperiod 30 ge.1.5-7
Syntax
set pwa maxrequests requests [port-string]
Parameters
maxrequests
Specifiesthemaximumnumberoflogonattempts.
portstring
(Optional)Setsthemaximumrequestsforspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,maximumrequestswillbesetforallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtosetthePWAmaximumrequeststo3forallports:
C3(su)->set pwa maxrequests 3
Syntax
set pwa portcontrol {enable | disable} [port-string]
26-77
Parameters
enable|disable
EnablesordisablesPWAonspecifiedports.
portstring
(Optional)Setsthecontrolmodeonspecificport(s).Foradetailed
descriptionofpossibleportstringvalues,refertoPortStringSyntaxUsed
intheCLIonpage 71.
Defaults
Ifportstringisnotspecified,PWAwillenabledonallports.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenablePWAonports122:
C3(su)->set pwa portcontrol enable ge.1.1-22
Syntax
show pwa session [port-string]
Parameters
portstring
(Optional)DisplaysPWAsessioninformationforspecificport(s).Fora
detaileddescriptionofpossibleportstringvalues,refertoPortString
SyntaxUsedintheCLIonpage 71.
Defaults
Ifportstringisnotspecified,sessioninformationforallportswillbedisplayed.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplayPWAsessioninformation:
C3(su)->show pwa session
Port
MAC
-------- ----------------ge.2.19 00-c0-4f-20-05-4b
ge.2.19 00-c0-4f-24-51-70
ge.2.19 00-00-f8-78-9c-a7
26-78
IP
--------------172.50.15.121
172.50.15.120
172.50.15.61
User
------------pwachap10
pwachap1
pwachap11
Duration
-----------0,14:46:55
0,15:43:30
0,14:47:58
Status
--------active
active
active
Syntax
set pwa enhancedmode {enable | disable}
Parameters
enable|disable
EnablesordisablesPWAenhancedmode.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoenablePWAenhancedmode:
C3(su)->set pwa enhancedmode enable
26-79
Commands
For information about...
Refer to page...
26-80
set ssh
26-80
26-81
Syntax
show ssh status
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
ThisexampleshowshowtodisplaySSHstatusontheswitch:
C3(su)->show ssh status
SSH Server status: Disabled
set ssh
Usethiscommandtoenable,disableorreinitializeSSHserverontheswitch.Bydefault,theSSH
serverisdisabled.
Syntax
set ssh {enable | disable | reinitialize}
26-80
Parameters
enable|disable
EnablesordisablesSSH,orreinitializestheSSHserver.
reinitialize
ReinitializestheSSHserver.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtodisableSSH:
C3(su)->set ssh disable
Syntax
set ssh hostkey reinitialize
Parameters
reinitialize
Reinitializestheserverhostauthenticationkeys.
Defaults
None
Mode
Switchcommand,readwrite.
Example
ThisexampleshowshowtoregenerateSSHkeys:
C3(su)->set ssh hostkey reinitialize
26-81
Purpose
Toreviewandconfiguresecurityaccesscontrollists(ACLs),whichpermitordenyaccessto
routinginterfacesbasedonprotocolandIPaddressrestrictions.
Commands
For information about...
Refer to page...
show access-lists
26-82
access-list (standard)
26-83
access-list (extended)
26-84
ip access-group
26-86
show access-lists
UsethiscommandtodisplayconfiguredIPaccesslistswhenoperatinginroutermode.
Syntax
showaccesslists[number]
Parameters
accesslist
number
(Optional)Displaysaccesslistinformationforaspecificaccesslistnumber.
Validvaluesarebetween1and199.
Defaults
Ifnumberisnotspecified,theentiretableofaccesslistswillbedisplayed.
Mode
Anyroutermode.
Example
ThisexampleshowshowtodisplayIPaccesslistnumber145.Thisisanextendedaccesslist,
whichpermitsordeniesICMP,UDPandIPframesbasedonrestrictionsconfiguredwithoneof
theaccesslistcommands.Fordetailsonconfiguringstandardaccesslists,refertoaccesslist
(standard)onpage 2683.Fordetailsonconfiguringextendedaccesslists,refertoaccesslist
(extended)onpage 2684.
26-82
access-list (standard)
access-list (standard)
UsethiscommandtodefineastandardIPaccesslistbynumberwhenoperatinginroutermode.
Thenoformofthiscommandremovesthedefinedaccesslistorentry.
Syntax
To create an ACL entry:
access-list access-list-number {deny | permit} source [source-wildcard]
no access-list access-list-number [entryno [entryno]]
Parameters
accesslistnumber
[entryno[entryno]]
Specifiesastandardaccesslistnumber.Validvaluesarefrom1to99.
Whenusingthenoaccesslistcommand,youcandeleteawholeaccesslist,
oronlyspecificentriesinthelistwiththeoptionalentrynoparameter.
Specifyarangeofentriesbyenteringthestartandendentrynumbers.
deny|permit
Deniesorpermitsaccessifspecifiedconditionsaremet.
source
Specifiesthenetworkorhostfromwhichthepacketwillbesent.Valid
optionsforexpressingsourceare:
sourcewildcard
IPaddressorrangeofaddresses(A.B.C.D)
anyAnysourcehost
hostsourceIPaddressofasinglesourcehost
(Optional)Specifiesthebitstoignoreinthesourceaddress.
26-83
access-list (extended)
insert|replace
entryno
(Optional)InsertsthisnewentrybeforeaspecifiedentryinanexistingACL,
orreplacesaspecifiedentrywiththisnewentry.
movedestination
source1source2
(Optional)Movesasequenceofaccesslistentriesbeforeanotherentry.
Destinationisthenumberoftheexistingentrybeforewhichthisnewentry
willbemoved.Source1isasingleentrynumberorthefirstentrynumberin
therangetobemoved.Source2(optional)isthelastentrynumberinthe
rangetobemoved.Ifsource2isnotspecified,onlythesource1entrywillbe
moved.
Defaults
Ifinsert,replaceormovearenotspecified,thenewentrywillbeappendedtotheaccesslist.
Ifsource2isnotspecifiedwithmove,onlyoneentrywillbemoved.
Mode
Globalconfiguration:C3(su)>router(Config)#
Usage
ValidaccesslistnumbersforstandardACLsare1to99.ForextendedACLs,validvaluesare100
to199.
Accesslistsareappliedtointerfacesbyusingthe ipaccessgroupcommand(page2686).
Allaccesslistshaveanimplicitdenyanyanystatmentastheirlastentry.
Examples
Thisexampleshowshowtocreateaccesslist1withthreeentriesthatallowaccesstoonlythose
hostsonthethreespecifiednetworks.Thewildcardbitsapplytothehostportionsofthenetwork
addresses.Anyhostwithasourceaddressthatdoesnotmatchtheaccesslistentrieswillbe
rejected:
C3(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255
C3(su)->router(Config)#access-list 1 permit 128.88.0.0 0.0.255.255
C3(su)->router(Config)#access-list 1 permit 36.0.0.0 0.255.255.255
Thisexamplemovesentry16tothebeginningofACL22:
C3(su)->router(Config)#access-list 22 move 1 16
access-list (extended)
UsethiscommandtodefineanextendedIPaccesslistbynumberwhenoperatinginroutermode.
Thenoformofthiscommandremovesthedefinedaccesslistorentry:
Syntax
To create an extended ACL entry:
access-list access-list-number {deny | permit} protocol source [source-wildcard]
[eq port] destination [destination-wildcard] [eq port]
no access-list access-list-number [entryno [entryno]]
26-84
access-list (extended)
Parameters
accesslistnumber
[entryno[entryno]]
Specifiesanextendedaccesslistnumber.Validvaluesarefrom100to199.
deny|permit
Deniesorpermitsaccessifspecifiedconditionsaremet.
protocol
SpecifiesanIPprotocolforwhichtodenyorpermitaccess.Validvalues
andtheircorrespondingprotocolsare:
source
Whenusingthenoaccesslistcommand,youcandeleteawholeaccesslist,
oronlyspecificentriesinthelistwiththeoptionalentrynoparameter.
Specifyarangeofentriesbyenteringthestartandendentrynumbers.
ipAnyInternetprotocol
udpUserDatagramProtocol
tcpTransmissionControlProtocol
icmpInternetControlMessageProtocol
Specifiesthenetworkorhostfromwhichthepacketwillbesent.Valid
optionsforexpressingsourceare:
IPaddressorrangeofaddresses(A.B.C.D)
anyAnysourcehost
hostsourceIPaddressofasinglesourcehost
sourcewildcard
(Optional)Specifiesthebitstoignoreinthesourceaddress.
eqport
(Optional)AppliesaccessrulestoTCPorUDPsourceand/ordestination
portnumbersequaltothespecifiedportnumber.
Portnumberscanrangefrom0to65535.
Note: This parameter is not available when you specify the icmp protocol.
destination
Specifiesthenetworkorhosttowhichthepacketwillbesent.Validoptions
forexpressingdestinationare:
IPaddress(A.B.C.D)
anyAnydestinationhost
hostsourceIPaddressofasingledestinationhost
destinationwildcard (Optional)Specifiesthebitstoignoreinthedestinationaddress.
insert|replace
entryno
(Optional)Insertsthisnewentrybeforeaspecifiedentryinanexisting
ACL,orreplacesaspecifiedentrywiththisnewentry.
movedestination
source1source2
(Optional)Movesasequenceofaccesslistentriesbeforeanotherentry.
Destinationisthenumberoftheexistingentrybeforewhichthisnewentry
willbemoved.Source1isasingleentrynumberorthefirstentrynumberin
therangetobemoved.Source2(optional)isthelastentrynumberinthe
rangetobemoved.Ifsource2isnotspecified,onlythesource1entrywillbe
moved.
Defaults
Ifinsert,replace,ormovearenotspecified,thenewentrywillbeappendedtotheaccesslist.
Ifsource2isnotspecifiedwithmove,onlyoneentrywillbemoved.
SecureStack C3 Configuration Guide
26-85
ip access-group
Ifeqportisnotspecified,TCP/UDPportsarenotusedforfiltering.Onlytheprotocol,source,and
destinationareusedforapplyingtherule.
Mode
Globalconfiguration:C3(su)>router(Config)#
Usage
Accesslistsareappliedtointerfacesbyusingtheipaccessgroupcommandasdescribedinip
accessgrouponpage 2686.
ValidaccesslistnumbersforextendedACLsare100to199.ForstandardACLs,validvaluesare1
to99.
Allaccesslistshaveanimplicitdenyanyanystatmentastheirlastentry.
Examples
Thisexampleshowshowtodefineaccesslist145todenyICMPtransmissionsfromanysource
andforanydestination:
C3(su)->router(Config)#access-list 145 deny ICMP any any
Thisexampleappendstoaccesslist145apermitstatementthatallowsthehostwithIPaddress
88.255.255.254todoanSSHremotelogintoanydestinationonTCPport22.
C3(su)->router(Config)#access-list 145 permit tcp host 88.255.255.254 any eq 22
Thisexampleappendstoaccesslist145apermitstatementthatallowsSNMPcontroltraffic(from
UDPport161)tobesentfromIPaddresseswithintherangedefinedby88.255.128.00.0.127.255
toanydestination.
C3(su)->router(Config)#access-list 145 permit udp 88.255.128.0 0.0.127.255 eq 161
any
ip access-group
Usethiscommandtoapplyaccessrestrictionstoinboundframesonaninterfacewhenoperating
inroutermode.Thenoformofthiscommandremovesthespecifiedaccesslist.
Syntax
ip access-group access-list-number in
no ip access-group access-list-number in
Parameters
accesslistnumber
Specifiesthenumberoftheaccesslisttobeappliedtotheaccesslist.This
isadecimalnumberfrom1to199.
in
Filtersinboundframes.
Defaults
None.
Mode
Interfaceconfiguration:C3(su)>router(Configif(Vlan<vlan_id>))#
26-86
ip access-group
Usage
ACLsmustbeappliedperroutinginterface.Anaccesslistcanbeappliedtoinboundtrafficonly.
AccesslistscannowbeappliedtoroutedVLANswhichincorporateLAGs.
Example
Thisexampleshowshowtoapplyaccesslist1forallinboundframesontheVLAN1interface.
Throughthedefinitionofaccesslist1,onlyframeswithasourceaddressonthe192.5.34.0/24
networkwillberouted.AlltheframeswithothersourceaddressesreceivedontheVLAN1
interfacearedropped:
C3(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255
C3(su)->router(Config)#interface vlan 1
C3(su)->router(Config-if(Vlan 1))#ip access-group 1 in
26-87
ip access-group
26-88
27
TACACS+ Configuration
ThischapterprovidesinformationaboutthecommandsusedtoconfigureandmonitorTACACS+
(TerminalAccessControllerAccessControlSystemPlus).
TACACS+isasecurityprotcolthatprovidesservicesforsecureauthentication,CLIcommand
authorization,andCLIauditingforadministrativeaccess.Itcanbeusedasanalternativetothe
standardRADIUSsecurityprotocol(RFC2865).TACACS+runsoverTCPandencryptsthebody
ofeachmanagementpacket.
BasedonthenowobsoleteTACACSprotocol(definedinRFC1492),TACACS+isdefinedinan
unpublishedandexpiredInternetDraftdraftgranttacacs02.txt,TheTACACS+Protocol
Version1.78,January,1997.
FordetailedinformationaboutusingTACACS+inyournetwork,refertotheEnterasysFeature
GuideTACACS+ConfigurationlocatedontheEnterasyswebsite:
http://www.enterasys.com/support/manuals/f.html#M
For information about...
Refer to page...
show tacacs
27-2
set tacacs
27-3
27-3
27-4
27-5
27-6
27-7
27-8
27-9
27-9
27-10
27-10
27-11
27-11
27-12
27-1
TACACS+ Configuration
show tacacs
show tacacs
UsethiscommandtodisplaythecurrentTACACS+configurationinformationandstatus.
Syntax
show tacacs [state]
Parameters
state
(Optional)DisplaysonlytheTACACS+clientstatus.
Defaults
Ifstateisnotspecified,allTACACS+configurationinformationwillbedisplayed.
Mode
Switchcommand,ReadOnly.
Example
ThisexampleshowshowtodisplayallTACACSconfigurationinformation.
C3(ro)->show tacacs
TACACS+ status:Disabled
TACACS+ session accounting state:disable
TACACS+ command authorization state:disable
TACACS+ command auccounting state:disable
TACACS+ single connect state:Disabled
TACACS+ service: exec
TACACS+ session authorization A-V pairs:
access-level
attribute
value
read-only
priv-lvl
read-write
priv-lvl
super-user
priv-lvl
15
TACACS+ Server
IP address
Port
Timeout
--------------
----------
------
-------
192.168.10.1
49
10
Table 271providesanexplanationofthecommandoutput.
Table 27-1
27-2
Output...
What it displays...
TACACS+ status
TACACS+ command
authorization state
set tacacs
TACACS+ Configuration
Table 27-1
Output...
What it displays...
TACACS+ service
The name of the service that is requested by the TACACS+ client for
session authorization. exec is the default service name.
Displays the attribute value pairs that are mapped to the read-only,
read-write, and super-user access privilege levels for the service
requested for session authorization.
The attribute names and values shown in the example above are the
default values.
TACACS+ Server
set tacacs
UsethiscommandtoenableordisabletheTACACS+client.
Syntax
set tacacs {enable | disable}
Parameters
enable|disable
EnablesordisablestheTACACSclient.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Usage
TheTACACS+clientcanbeenabledontheswitchanytime,withorwithoutaTACACS+server
online.IftheTACACS+serverisofflineandTACACS+isenabled,theloginauthenticationis
switchedtoRADIUSorlocal,ifenabled.
Examples
ThisexampleshowshowtoenabletheTACACS+client.
C3(rw)->set tacacs enable
Syntax
show tacacs server {index | all}
27-3
TACACS+ Configuration
Parameters
index
DisplaytheconfigurationoftheTACACS+serveridentifiedbyindex.
Thevalueofindexcanrangefrom1to2,147,483,647.
all
DisplaytheconfigurationforallconfiguredTACACS+servers.
Defaults
None.
Mode
Switchcommand,ReadOnly.
Example
ThisexampledisplaysconfigurationinformationforTACACS+server1.
C3(ro)->show tacacs server 1
TACACS+ Server
IP address
Port
Timeout
--------------
----------
------
-------
192.168.10.1
49
10
Syntax
set tacacs server {all | index} timeout seconds
set tacacs server index address port secret
Parameters
all
SpecifythetimeoutvalueforallconfiguredTACACS+servers.
index
ConfiguretheTACACS+serveridentifiedbyindex.Thevalueofindex
canrangefrom1to2,147,483,647.
timeoutseconds
Setthetimeoutvalueforthespecifiedserver(s)inseconds.Thevalueof
secondscanrangefrom1to180seconds.
Thedefaulttimeoutvalueis10seconds.
address
SpecifytheIPaddressoftheTACACS+server.
port
SpecifytheTCPportfortheTACACS+server.Thevalueofportcan
rangefrom0to65535,buttypically,port49isspecified.
secret
Specifythesecret(sharedpassword)fortheTACACS+server.
Defaults
NoTACACS+serversareconfiguredbydefault.
WhenyoudoconfigureaTACACS+server,thedefaulttimeoutvalueis10seconds.
27-4
TACACS+ Configuration
Mode
Switchcommand,ReadWrite.
Usage
Upto5TACACS+serverscanbeconfigured,withtheindexvalueof1havingthehighestpriority.
Ifyouwanttochangethedefaulttimeoutvalueforaspecificserverorallservers,youmustenter
thecommandusingthetimeoutparameter.
Whenatleastonebackupserverhasbeenconfiguredandtheswitchlosescontactwiththe
primaryserver,theswitchwillcontactthenextserverinpriority.Iftheswitchwastryingto
authenticateauserwhentheconnectionwaslost,orifthedefaultloginaccess(readonly
permissions)hadbeenreceived,theswitchwilltrytoauthenticateagain.
Ifauserhadalreadybeenauthenticatedandauthorized,thenthebackupserveriscontacted
withoutrequiringanyauthentication.Thebackupserverwilljustauthorizeoraccountforthe
packetscominginforthatuser.SinceataskIDisassociatedwitheachaccountingsession,ifthere
isafailovertoabackupserver,theaccountinginformationwillstillbeassociatedwiththecorrect
sessionusingthetaskID.
Whenafailovertoabackupserveroccurs,syslogmessagesaregeneratedcontainingthereason
forthefailure.
Example
ThisexampleconfiguresTACACS+server1.Then,thedefaulttimeoutvalueof10secondsis
changedto20seconds.
C3(rw)->set tacacs server 1 192.168.10.10 49 mysecret
C3(rw)->set tacacs server 1 timeout 20
Syntax
clear tacacs server {all | index} [timeout]
Parameters
all
SpecifiesthatallconfiguredTACACS+serversshouldbeaffected.
index
SpecifiesoneTACACS+servertobeaffected.
timeout
(Optional)Returnthetimeoutvaluetoitsdefaultvalueof10seconds.
Defaults
Iftimeoutisnotspecified,theaffectedTACACS+serverswillberemoved.
Mode
Switchcommand,ReadWrite.
27-5
TACACS+ Configuration
Examples
ThisexampleremovesTACACS+server1.
C3(rw)->clear tacacs server 1
Thisexampleresetsthetimeoutvaluetoitsdefaultvalueof10secondsforallconfigured
TACACS+servers.
C3(rw)->clear tacacs server all timeout
Syntax
show tacacs session {authorization | accounting}
Parameters
authorization
Displayclientsessionauthorizationsettings.
accounting
Displayclientsessionaccountingsettings.
Defaults
None.
Mode
Switchcommand,ReadOnly.
Examples
Thisexampleshowshowtodisplayclientsessionauthorizationinformation:
C3(ro)->show tacacs session authorization
TACACS+ service: exec
TACACS+ session authorization A-V pairs:
access-level
attribute
value
read-only
priv-lvl
read-write
priv-lvl
super-user
priv-lvl
15
Thisexampleshowshowtodisplayclientsessionaccountingstate.
C3(ro)->show tacacs session accounting
TACACS+ session accounting state:
27-6
enabled
TACACS+ Configuration
Syntax
set tacacs session accounting {enable | disable}
set tacacs session authorization {service name | read-only attribute value |
read-write attribute value | super-user attribute value}
Parameters
accounting
SpecifiesthatTACACS+sessionaccountingisbeingconfigured.
enable|disable
EnablesordisablesTACACS+sessionaccounting.
authorization
SpecifiesthatTACACS+sessionauthorizationisbeingconfigured.
servicename
SpecifiesthenameoftheservicethattheTACACS+clientwillrequest
fromtheTACACS+server.Thenamespecifiedheremustmatchthe
nameofaserviceconfiguredontheserver.Thedefaultservicenameis
exec.
readonlyattribute
value
Specifiesthatthereadonlyaccessprivilegelevelshouldbematchedto
aprivilegelevelconfiguredontheTACACS+serverbymeansofan
attributevaluepairspecifiedbyattributeandvalue.
Bydefault,attributeisprivlvlandvalueis0.
readwriteattribute
value
Specifiesthatthereadwriteaccessprivilegelevelshouldbematchedto
aprivilegelevelconfiguredontheTACACS+serverbymeansofan
attributevaluepairspecifiedbyattributeandvalue.
Bydefault,attributeisprivlvlandvalueis1.
superuserattribute
value
Specifiesthatthesuperuseraccessprivilegelevelshouldbematchedto
aprivilegelevelconfiguredontheTACACS+serverbymeansofan
attributevaluepairspecifiedbyattributeandvalue.
Bydefault,attributeisprivlvlandvalueis15.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Usage
Whensessionaccountingisenabled,theTACACS+serverwilllogaccountinginformation,suchas
startandstoptimes,IPaddressoftheclient,andsoforth,foreachauthorizedclientsession.
WhentheTACACS+clientisenabledontheswitch(withthesettacacsenablecommand),the
sessionauthorizationparametersconfiguredwiththiscommandaresentbytheclienttothe
TACACS+serverwhenasessionisinitiatedontheswitch.Theparametervaluesmustmatcha
serviceandaccesslevelattributevaluepairsconfiguredontheserverforthesessiontobe
authorized.Iftheparametervaluesdonotmatch,thesessionwillnotbeallowed.
27-7
TACACS+ Configuration
Theservicenameandattributevaluepairscanbeanycharacterstring,andaredeterminedby
yourTACACS+serverconfiguration.
SinceataskIDisassociatedwitheachaccountingsession,ifthereisafailovertoabackupserver,
theaccountinginformationwillstillbeassociatedwiththecorrectsessionusingthetaskID.
Examples
ThisexampleconfigurestheservicerequestedbytheTACACS+clientastheservicenamebasic.
C3(rw)->set tacacs session authorization service basic
Thisexamplemapsthereadwriteaccessprivilegeleveltoanattributenamedprivlvlwiththe
valueof5configuredontheTACACS+server.
C3(rw)->set tacacs session authorization read-write priv-lvl 5
ThisexampleenablesTACACS+sessionaccounting.
C3(rw)->set tacacs session accounting enable
Syntax
clear tacacs session authorization {[service]|[read-only]|[read-write] |
[super-user]}
Parameters
authorization
ClearstheTACACS+sessionauthorizationparameters.
service
ClearstheTACACS+sessionauthorizationservicenametothedefault
valueofexec.
readonly
ClearstheTACACS+sessionauthorizationreadonlyattributevalue
pairtotheirdefaultvaluesofprivlvland0.
readwrite
ClearstheTACACS+sessionauthorizationreadwriteattributevalue
pairtotheirdefaultvaluesofprivlvland1.
superuser
ClearstheTACACS+sessionauthorizationsuperuserattributevalue
pairtotheirdefaultvaluesofprivlvland15.
Defaults
Atleastoneofthesessionauthorizationparametersmustbespecified.
Mode
Switchcommand,ReadWrite.
Examples
Thisexampleshowshowtoreturntheservicenametothedefaultofexec.
C3(rw)->clear tacacs session authorization service
Thisexampleshowshowtoreturnallthesessionauthorizationparameterstotheirdefaultvalues.
C3(rw)->clear tacacs session authorization service read-only read-write superuser
27-8
TACACS+ Configuration
Syntax
show tacacs command {accounting | authorization}
Parameters
accounting
DisplaythestatusofTACACS+accountingonapercommandbasis.
authorization
DisplaythestatusofTACACS+authorizationonapercommandbasis.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Example
ThisexampleshowshowtodisplaythestateoftheTACACS+clientscommandauthorization.
C3(rw)->show tacacs command authorization
TACACS+ command authorization state:
enabled
Syntax
set tacacs command {accounting | authorization} {enable | disable}
Parameters
accounting|
authorization
SpecifieseitherTACACS+accountingorauthorizationtobeenabledor
disabled.
enable|disable
Enableordisableaccountingorauthorizationonapercommandbasis.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Usage
InorderforpercommandaccountingorauthorizationbyaTACACS+servertotakeplace,the
commandmustbeexecutedwithinanauthorizedsession.
27-9
TACACS+ Configuration
Whenpercommandaccountingisenabled,theTACACS+serverwilllogaccountinginformation,
suchasstartandstoptimes,IPaddressoftheclient,andsoforth,foreachcommandexecuted
duringthesession.
Whenpercommandauthorizationisenabled,theTACACS+serverwillcheckwhethereach
commandispermittedforthatauthorizedsessionandreturnasuccessorfail.Iftheauthorization
fails,thecommandisnotexecuted.
Example
ThisexampleshowshowtoenableTACACS+authorizationonacommandbasis.
C3(rw)->set tacacs command authorization enable
Syntax
show tacacs singleconnect
Parameters
None.
Defaults
None.
Mode
Switchcommand,ReadWrite.
Example
ThisexampleshowshowtodisplaythestateoftheTACACS+clientsabilitytosendmultiple
requestsoverasingleconnection.
C3(rw)->show tacacs singleconnect
TACACS+ single-connect state:
enabled
Syntax
set tacacs singleconnect {enable | disable}
Parameters
enable|disable
27-10
EnableordisabletheabilitytosendmultiplerequestsoverasingleTCP
connection.
TACACS+ Configuration
Defaults
None.
Mode
Switchcommand,ReadWrite.
Examples
Thisexampleshowshowtodisablesendingmultiplerequestsoverasingleconnection.
C3(rw)->set tacacs singleconnect disable
Syntax
show tacacs interface
Parameters
None.
Defaults
None.
Mode
Switchmode,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.Inthiscase,theIPaddressassignedto
loopbackinterface1willbeusedasthesourceIPaddressoftheTACACS+packetsgeneratedby
theswitch.
C3(rw)->show tacacs interface
loopback 1
192.168.10.1
Syntax
set tacacs interface {loopback loop-ID | vlan vlan-ID}
Parameters
loopbackloopID
Specifiestheloopbackinterfacetobeused.ThevalueofloopIDcan
rangefrom0to7.
27-11
TACACS+ Configuration
vlanvlanID
SpecifiestheVLANinterfacetobeused.ThevalueofvlanIDcanrange
from1to4093.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThiscommandallowsyoutoconfigurethesourceIPaddressusedbytheTACACS+application
ontheswitchwhengeneratingpacketsformanagementpurposes.Anyofthemanagement
interfaces,includingVLANroutinginterfaces,canbeconfiguredasthesourceIPaddressusedin
packetsgeneratedbytheTACACS+client.
AninterfacemusthaveanIPaddressassignedtoitbeforeitcanbesetbythiscommand.
Ifnointerfaceisspecified,thentheIPaddressoftheHostinterfacewillbeused.
Ifanonloopbackinterfaceisconfiguredwiththiscommand,applicationpacketegressis
restrictedtothatinterfaceiftheservercanbereachedfromthatinterface.Otherwise,thepackets
aretransmittedoverthefirstavailableroute.Packetsfromtheapplicationserverarereceivedon
theconfiguredinterface.
Ifaloopbackinterfaceisconfigured,andtherearemultiplepathstotheapplicationserver,the
outgoinginterface(gateway)isdeterminedbasedonthebestroutelookup.Packetsfromthe
applicationserverarethenreceivedonthesendinginterface.Ifrouteredundancyisrequired,
therefore,aloopbackinterfaceshouldbeconfigured.
Example
ThisexampleconfiguresanIPaddressonVLANinterface100andthensetsthatinterfaceasthe
TACACS+clientsourceIPaddress.
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
C3(rw)->router(Config-if(Vlan 100))#exit
C3(rw)->router(Config)#exit
C3(rw)->router#exit
C3(rw)->router>exit
C3(rw)->set tacacs interface vlan 100
192.168.10.1
Syntax
clear tacacs interface
Parameters
27-12
TACACS+ Configuration
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThiscommandreturnstheinterfaceusedforthesourceIPaddressoftheTACACS+clientbackto
thedefaultoftheHostinterface.
C3(rw)->show tacacs interface
vlan 100
192.168.10.1
27-13
TACACS+ Configuration
27-14
28
sFlow Configuration
ThischapterprovidesinformationaboutthecommandsusedtoconfigureandmonitorthesFlow
system.
For information about...
Refer to page...
Overview
28-1
Commands
28-4
Overview
sFlowisamethodformonitoringhighspeedswitchedandroutednetworks.sFlowtechnologyis
builtintonetworkequipmentandgivesvisibilityintonetworkactivity,enablingeffective
managementandcontrolofnetworkresources.
AnsFlowsolutionconsistsofansFlowAgent,embeddedinthenetworkdevicesuchasaswitch
orrouter,andansFlowCollector.ThesFlowAgentusessamplingtechnologytocapturetraffic
statisticsfromthedeviceitismonitoringandimmediatelyforwardsthesampledtrafficstatistics
toansFlowCollectorforanalysisinsFlowdatagrams.
ThesFlowAgentusestwoformsofsamplingstatisticalpacketbasedsamplingofswitchedor
routedPacketFlows,andtimebasedsamplingofcounters.
Version5ofsFlowisdescribedindetailinthedocumententitledsFlowVersion5availablefrom
sFlow.org(http://www.sflow.org).
sFlowmakesitpossibletomonitorportsofaswitch,withnoimpactonthedistributed
switchingperformance.(SeeUsageNotesonpage 283formoreinformation.)
sFlowrequiresverylittlememoryorCPUusage.Samplesarenotaggregatedintoaflow
tableontheswitchtheyareforwardedimmediatelyoverthenetworktothesFlow
Collector.
Thesystemistoleranttopacketlossinthenetwork.(Thestatisticalmodelmeanslossis
equivalenttoaslightchangeinthesamplingrate.)
ThesFlowCollectorcanreceivedatafrommultipleswitches,providingarealtime
synchronizedviewofthewholenetwork.
ThesFlowCollectorcananalyzetrafficpatternsforwhateverprotocolsarefoundinthe
packetheaders(forexample,TCP/IP,IPX,Ethernet,AppleTalk).Thereisnoneedforthelayer
2switchtodecodeandunderstandallprotocols.
28-1
sFlow Configuration
Overview
Definitions
ThefollowingtabledescribessomeofthemainsFlowtermsandconcepts.
Table 28-1
sFlow Definitions
Term
Definition
Data Source
Packet Flow
Sampling Rate
Sampling Interval
sFlow Instance
sFlow Agent
sFlow Collector
sFlow Datagram
Sampling Mechanisms
TwoformsofsamplingareperformedbythesFlowAgent:statisticalpacketbasedsamplingof
switchedorroutedpacketflows,andtimebasedsamplingofcounters.
28-2
Overview
sFlow Configuration
Whenapacketarrivesonaninterface,theNetworkDevicemakesafilteringdecisionto
determinewhetherthepacketshouldbedropped.
2.
Ifthepacketisnotfiltered(dropped),adestinationinterfaceisassignedbytheswitching/
routingfunction.
3.
Atthispoint,adecisionismadeonwhetherornottosamplethepacket.Themechanism
involvesacounterthatisdecrementedwitheachpacket.Whenthecounterreacheszeroa
sampleistaken.
4.
Whenasampleistaken,thecounterindicatinghowmanypacketstoskipbeforetakingthe
nextsampleisreset.Thevalueofthecounterissettoarandomintegerwherethesequenceof
randomintegersusedovertimeistheSamplingRate.
PacketflowsamplingresultsinthegenerationofPacketFlowRecords.APacketFlowRecord
containsinformationabouttheattributesofapacketflow,including:
Informationonthepacketitselfapacketheader,packetlength,andpacketencapsulation.
Informationaboutthepaththepackettookthroughthedevice,includinginformationrelating
totheselectionoftheforwardingpath.
Counter Sampling
Theprimaryobjectiveofthecountersamplingisto,inanefficientway,periodicallyexport
countersassociatedwithDataSources.AmaximumsamplingintervalisassignedtoeachsFlow
InstanceassociatedwithaDataSource.
Countersamplingisaccomplishedasfollows:
1.
ThesFlowAgentkeepalistofcountersourcesbeingsampled.
2.
WhenaPacketFlowSampleisgenerated,thesFlowAgentexaminesthelistofcounter
sourcesandaddscounterstothesampledatagram,leastrecentlysampledfirst.
Countersareonlyaddedtothedatagramifthesourcesarewithinashortperiod,5seconds
say,offailingtomeettherequiredsamplinginterval.
3.
Periodically,sayeverysecond,thesFlowAgentexaminesthelistofcountersourcesandsends
anycountersthatneedtobesenttomeetthesamplingintervalrequirement.
ThesetofcountersisafixedsetdefinedinSection5ofthedocumententitledsFlowVersion5
availablefromsFlow.org(http://www.sflow.org).
Usage Notes
Althoughtheswitchhardwarehasthecapabilitytosamplepacketsonanyport,toensurethat
CPUutilitizationisnotcompromised,thenumberofsFlowsamplersthatcanbeconfiguredper
switchorstackofswitchesislimitedtoamaximumof32.Thereisnolimitationonthenumberof
pollersthatcanbeconfigured.
Undercertaincircumstances,theswitchwilldroppacketsamplesthatthesFlowimplementation
isnotabletocountandthereforecannotcorrectlyreportsample_poolanddropsfieldsofflow
samplessenttothesFlowCollector.Underheavyload,thissamplelosscouldbesignificantand
couldthereforeaffecttheaccuracyofthesamplinganalysis.
28-3
sFlow Configuration
Commands
sFlowisdisabledbydefaultonSecureStackandGSeriesdevices.
Example Configuration
ThegeneralprocedureforconfiguringsFlowincludes:
1.
ConfigureyoursFlowCollectorinformationtobeusedbythesFlowAgentontheswitch.Up
toeightCollectorscanbeconfigured.TheinformationisstoredinthesFlowReceiverTable.
2.
EnableandconfiguresFlowpacketflowsamplinginstancesoneachport.
3.
EnableandconfiguresFlowcountersamplingpollerinstancesoneachport.
ThefollowingisanexampleofthecommandsusedtoconfiguresFlow:
# configure sFlow Collector 1
# accept defaults for datagram size and port
set sflow receiver 1 owner enterasys timeout 180000
set sflow receiver 1 ip 192.168.16.91
#
#configure packet sampling instances on ports 1 through 12
#assign to sFlow Collector 1
set sflow port ge.1.1-12 sampler 1
set sflow port ge.1.1-12 sampler maxheadersize 256
set sflow port ge.1.1-12 sampler rate 2048
#
#configure counter poller instances on ports 1 through 12
#assign to sFlow Collector 1
set sflow port ge.1.1-12 poller 1
set sflow port ge.1.1-12 poller interval 20
Commands
For information about...
28-4
Refer to page...
28-5
28-7
28-7
28-8
28-9
28-9
28-10
28-11
28-12
28-12
28-13
28-14
sFlow Configuration
Refer to page...
28-14
28-15
28-16
28-17
Syntax
show sflow receivers [index]
Parameters
index
(Optional)SpecifiesaspecificCollectortodisplayinformationabout.
Defaults
ThecontentsofthesFlowReceiversTableisdisplayed.
Mode
Switchcommand,readonly.
Usage
ExecutingthiscommandwithoutspecifyinganindexintothesFlowReceiversTabledisplays
informationaboutalltheCollectorsconfiguredontheswitch.
IfyouspecifyanindividualCollectorbyitsindexnumber,additionalinformationisdisplayedfor
thatCollector.
Examples
ThisexampledisplaysthesFlowReceiversTable.
C3(su)->show sflow receivers
Receiver Owner
Index
Time out
String
IP Address
Size
ets1
17766
1400
6343
10.1.2.117
1400
6343
0.0.0.0
1400
6343
0.0.0.0
1400
6343
0.0.0.0
1400
6343
0.0.0.0
1400
6343
0.0.0.0
1400
6343
0.0.0.0
1400
6343
0.0.0.0
28-5
sFlow Configuration
ThisexampledisplaysinformationabouttheCollectorwithindex1.
C3(su)->show sflow receivers 1
Receiver Index
Owner String
ets1
Time out
17758
IP Address:
10.1.2.117
Address Type
IPv4
Port
6343
Datagram Version
1400
Thefollowingtabledescribestheoutputfields.
Table 28-2
28-6
Output...
What it displays...
Receiver Index
Owner String
Time Out
IP Address
Address Type
Port
Datagram Version
sFlow Configuration
Syntax
set sflow receiver index owner owner-string timeout timeout
Parameters
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
beingconfigured.Theindexcanrangefrom1to8.
ownerownerstring
Theidentitystringofthereceiver/Collectorbeingconfigured.
Thestringcanbeupto127charactersinlength.
timeouttimeout
Thetime,inseconds,remainingbeforethereceiver/Collectorbeing
configuredandallassociatedsamplersandpollersexpire.
Thevaluecanrangefrom0to4294967295seconds.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
InorderforansFlowCollectortobeassignedtoreceivesampledatagramsfromthesFlowAgent
ontheswitch,anentryforthatCollectormustbeconfiguredintheswitchssFlowReceiversTable.
Anentrymustcontainanowneridentitystring,anonzerotimeoutvalue,andtheIPaddressof
theCollector.ConfiguretheIPaddresswiththesetsflowreceiveripcommand.
Anentrywithoutanowneridentitystringisconsideredunclaimedandcannotbeassignedasa
receivertosamplerorpollerinstances.
Oncethetimersetbythiscommandexpires,thereceiver/Collectorandallthesamplersand
pollersassociatedwiththisCollectorexpireandareremovedfromtheswitchsconfiguration.In
ordertostartsendingsampledatatotheCollectoragain,theCollectormustbereconfiguredwith
anewtimeoutvalueandsamplersandpollersmustbeconfiguredagain.Therefore,youshould
considersettingthetimeoutvaluetothelargestvaluethatisreasonableforyourenvironment.
Example
Thisexampleconfiguresanentryforindex1inthesFlowReceiversTable.
C3(su)->set sflow receiver 1 owner ets1 timeout 180000
Syntax
set sflow receiver index ip ipaddr
SecureStack C3 Configuration Guide
28-7
sFlow Configuration
Parameters
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
beingconfigured.Theindexcanrangefrom1to8.
ipipaddr
TheIPaddressofthereceiver/Collectorbeingconfigured.AnIP
addressof0.0.0.0meansthatnosampledatagramswillbesenttothe
Collector.
Defaults
ThedefaultIPaddressis0.0.0.0.
Mode
Switchcommand,readwrite.
Usage
InorderforansFlowCollectortobeassignedtoreceivesampledatagramsfromthesFlowAgent
ontheswitch,anentryforthatCollectormustbeconfiguredintheswitchssFlowReceiversTable.
Anentrymustcontainanowneridentitystring,anonzerotimeoutvalue,andtheIPaddressof
theCollector.Configuretheowneridentitystringandtimeoutvaluewiththesetsflowreceiver
ownercommand.
SampledatagramswillnotbesenttoaCollectorwhoseentryinthesFlowReceiversTablehasan
IPaddressof0.0.0.0.
Example
ThisexampleconfiguresanIPaddressof10.10.10.10toindexentry1.
C3(su)->set sflow receiver 1 ip 10.10.10.10
Syntax
set sflow receiver index maxdatagram bytes
Parameters
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
beingconfigured.Theindexcanrangefrom1to8.
maxdatagrambytes
Specifiesthemaximumnumberofdatabytesthatcanbesentinasingle
sampledatagram.Thissizeshouldbesettoavoidfragmentationofthe
sFlowdatagrams.
Thevalueofbytescanrangefrom200to9116.Thedefaultis1400.
Defaults
Defaultmaximumdatagramsizeis1400bytes.
28-8
sFlow Configuration
Mode
Switchcommand,readwrite.
Example
Thisexamplesetsthemaximumdatagramsizeto2800bytesforindexentry1.
C3(su)->set sflow receiver 1 maxdatagram 2800
Syntax
set sflow receiver index port port
Parameters
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
beingconfigured.Theindexcanrangefrom1to8.
portport
SpecifiestheUDPportonthereceiver/Collectortowhichthesample
datagramsshouldbesent.Bydefault,theportis6343.
Defaults
Thedefaultportvalueis6343.
Mode
Switchcommand,readwrite.
Example
ThisexamplechangesthesFlowreceiverportontheCollectorto1234.
C3(su)->set sflow receiver 1 port 1234
Syntax
clear sflow receiver index [ip | maxdatagram | owner [timeout] | port]
Parameters
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
beingconfigured.Theindexcanrangefrom1to8.
ip
(Optional)CleartheIPaddressto0.0.0.0.Sampledatagramsarenotsent
toCollectorswithanIPaddressof0.0.0.0.
maxdatagram
(Optional)Returnthemaximumdatagramsizeto1400bytes.
28-9
sFlow Configuration
owner
(Optional)Cleartheowneridentitystring.EntriesinthesFlowReceiver
Tablewithoutanidentitystringareconsideredunclaimed.
timeout
(Optional)Clearthetimeoutvalueofthespecifiedentry.
portport
(Optional)CleartheUDPportonthereceiver/Collectortowhichthe
sampledatagramsshouldbesent.Thevalueisresettothedefaultof
6343.
Defaults
Ifnooptionalparametersarespecified,theentireentryiscleared.
Mode
Switchcommand,readwrite.
Usage
YoucancleartheIPaddress,maximumdatagramsize,orUDPportwithoutdeletinganentry
fromthesFlowReceiversTable.Ifyoucleartheownerortimeout,theentireentryiscleared.Ifyou
enteronlyanentryindexandnoneoftheoptionalparameters,theentireentryiscleared.
Onceanentryiscleared,allpollersandsamplersassociatedwiththatreceiverarealsoremoved
fromtheswitchconfiguration.
Example
Thisexamplereturnsthemaximumdatagramsizetothedefaultof1400bytesfortheCollector
withindex1.
C3(su)->clear sflow receiver 1 maxdatagram
Syntax
set sflow port port-string poller {index | interval seconds}
Parameters
portstring
Specifiestheportorports(datasources)onwhichthepollerinstanceis
beingconfigured.
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
withwhichthepollerinstanceisassociated.Theindexcanrangefrom1
to8.
intervalseconds
Specifiesthepollinginterval,whichcanrangefrom0to86400seconds.
Avalueof0disablescountersampling.
Defaults
Thedefaultintervalvalueis0seconds,whichdisablescountersampling.
Mode
Switchcommand,readwrite.
28-10
sFlow Configuration
Usage
Apollerinstanceperformscountersamplingonthedatasourcetowhichitisconfigured.Referto
SamplingMechanismsonpage 282formoreinformation.
Youmustfirstassociateareceiver/CollectorinthesFlowReceiversTablewiththepollerinstance,
beforeconfiguringthepollinginterval.
WhenareceivertimesoutorisclearedfromthesFlowReceiversTable,allpollerandsampler
instancesassociatedwiththatreceiverarealsoclearedfromtheswitchsconfiguration.
Example
Thefollowingexampleconfigurespollerinstancesonportsge.1.1throughge.1.8andassociates
themwithreceiver1.Then,apollingintervalof240secondsisconfigured.
C3(su)->set sflow port ge.1.1-8 poller 1
C3(su)->set sflow port ge.1.1-8 poller interval 240
Syntax
show sflow pollers
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.
C3(su)->show sflow pollers
Poller
Data Source
-----------
Receiver
Index
-------
Poller
Interval
-------
ge.1.1
240
ge.1.2
240
ge.1.3
240
ge.1.4
240
ge.1.5
240
ge.1.6
240
ge.1.7
240
ge.1.8
240
28-11
sFlow Configuration
Syntax
clear sflow port port-string poller [interval]
Parameters
portstring
Specifiestheportorportsonwhichthepollerinstanceisbeingcleared.
interval
(Optional)Specifiesthatthepollingintervalshouldbeclearedto0.A
valueof0disablescountersampling.
Defaults
Ifintervalisnotspecified,thepollerinstanceiscleared.
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesthepollerinstanceonportge.1.1.
C3(su)->clear sflow port ge.1.1 poller
Syntax
set sflow port port-string sampler {index | maxheadersize bytes | rate rate}
Parameters
portstring
Specifiestheportorports(datasources)onwhichthesamplerinstance
isbeingconfigured.
index
IndexnumberinthesFlowReceiversTableforthereceiver/Collector
withwhichthesamplerinstanceisassociated.Theindexcanrangefrom
1to8.
maxheadersizebytes
Specifiesthemaximumnumberofbytesthatshouldbecopiedfromthe
samplerpacket.Thevaluecanrangefrom20to256bytes.Thedefaultis
128bytes.
raterate
Specifiesthestatisticalsamplingrateforsamplingfromthisdata
source.Thevalueofratespecifiesthenumberofincomingpacketsfrom
whichonepacketwillbesampled.Forexample,iftherateis1024,one
packetwillbesampledfromevery1024ingressingpacketsonthisdata
source.
Theratecanrangefrom1024to65536.Avalueof0disablessampling.
Thedefaultvalueis0.
28-12
sFlow Configuration
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
Asamplerinstanceperformspacketflowsamplingonthedatasourcetowhichitisconfigured.
RefertoSamplingMechanismsonpage 282formoreinformation.
Youmustfirstassociateareceiver/CollectorinthesFlowReceiversTablewiththesampler
instance,beforeconfiguringthesamplingrateormaximumnumberofbytescopiedfromsampled
packets.
WhenareceivertimesoutorisclearedfromthesFlowReceiversTable,allpollerandsampler
instancesassociatedwiththatreceiverarealsoclearedfromtheswitchsconfiguration.
Amaximumof32samplerinstancescanbeconfiguredperswitchorstackofswitches.
Example
Thefollowingexampleconfiguressamplerinstancesonportsge.1.1throughge.1.8andassociates
themwithreceiver1.Then,asamplingrateof1024isconfigured.Thedefaultmaxheadersizeof
128bytesisused.
C3(su)->set sflow port ge.1.1-8 sampler 1
C3(su)->set sflow port ge.1.1-8 sampler rate 1024
Syntax
show sflow samplers
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.
C3(su)->show sflow samplers
Sampler
Data Source
-----------
Receiver
Index
-------
Packet
Sampling Rate
-------------
Max Header
Size
----------
ge.1.1
1024
128
28-13
sFlow Configuration
ge.1.2
1024
128
ge.1.3
1024
128
ge.1.4
1024
128
ge.1.5
1024
128
ge.1.6
1024
128
ge.1.7
1024
128
ge.1.8
1024
128
Syntax
clear sflow port port-string sampler [maxheadersize | rate]
Parameters
portstring
Specifiestheportorportsonwhichthesamplerinstanceisbeing
cleared.
maxheadersize
(Optional)Specifiesthatthemaximumheadersizeshouldbeclearedto
thedefaultvalueof128bytes.
rate
(Optional)Specifiesthatthesamplingrateshouldbeclearedtothe
defaultvalueof0,whichdisablessamplingbytheinstance.
Defaults
Ifneitheroptionalparameterisspecified,thesamplerinstanceiscleared.
Mode
Switchcommand,readwrite.
Example
Thisexampleremovesthesamplerinstanceonportge.1.1.
C3(su)->clear sflow port ge.1.1 sampler
Syntax
set sflow interface {loopback loop-ID | vlan vlan-ID}
Parameters
loopbackloopID
28-14
Specifiestheloopbackinterfacetobeused.ThevalueofloopIDcan
rangefrom0to7.
sFlow Configuration
vlanvlanID
SpecifiestheVLANinterfacetobeused.ThevalueofvlanIDcanrange
from1to4093.
Defaults
None.
Mode
Switchcommand,readwrite.
Usage
ThiscommandallowsyoutoconfigurethemanagementinterfaceusedbythesFlowAgentwhen
sendingsamplingdatagramstothesFlowCollector.Anyoftheinterfaces,includingVLAN
routinginterfaces,canbeconfiguredasthemanagementinterface.
AninterfacemusthaveanIPaddressassignedtoitbeforeitcanbesetbythiscommand.
Ifnointerfaceisspecified,thentheHostVLANwillbeusedasthemanagementinterface.
Ifanonloopbackinterfaceisconfiguredwiththiscommand,applicationpacketegressis
restrictedtothatinterfaceiftheservercanbereachedfromthatinterface.Otherwise,thepackets
aretransmittedoverthefirstavailableroute.Packetsfromtheapplicationserverarereceivedon
theconfiguredinterface.
Ifaloopbackinterfaceisconfigured,andtherearemultiplepathstotheapplicationserver,the
outgoinginterface(gateway)isdeterminedbasedonthebestroutelookup.Packetsfromthe
applicationserverarethenreceivedonthesendinginterface.Ifrouteredundancyisrequired,
therefore,aloopbackinterfaceshouldbeconfigured.
Example
ThisexampleconfiguresanIPaddressonVLANinterface100andthensetsthatinterfaceasthe
managementinterfaceforthesFlowAgent.
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
C3(rw)->router(Config-if(Vlan 100))#exit
C3(rw)->router(Config)#exit
C3(rw)->router#exit
C3(rw)->router>exit
C3(rw)->set sflow interface vlan 100
192.168.10.1
Syntax
show sflow interface
Parameters
28-15
sFlow Configuration
None.
Defaults
None.
Mode
Switchmode,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.Inthiscase,theIPaddressassignedto
loopbackinterface1willbeusedasthesourceIPaddressofthesFlowAgent.
C3(rw)->show sflow interface
loopback 1
192.168.10.1
Syntax
clear sflow interface
Parameters
None.
Defaults
None.
Mode
Switchcommand,readwrite.
Example
ThiscommandreturnsthemanagmentinterfaceusedbythesFlowAgentbacktothedefaultof
theHostVLAN.
C3(rw)->show sflow interface
vlan 100
192.168.10.1
28-16
sFlow Configuration
Syntax
show sflow agent
Parameters
None.
Defaults
None.
Mode
Switchcommand,readonly.
Example
Thisexampledisplaystheoutputofthiscommand.
C3(rw)->show sflow agent
sFlow Version
IP Address
1.3;Broadcom Corp.;06.03.00.0001T
192.168.1.6
28-17
sFlow Configuration
28-18
A
Policy and Authentication Capacities
ThisappendixliststhepolicyandauthenticationcapacitiesoftheSecureStackC3asofthedate
thisdocumentwaspublished.PleaserefertotheReleaseNotesforyourfirmwareversionforthe
latestcapacityinformation.
Policy Capacities
RefertotheConfiguringPolicyFeatureGuideforanindepthdiscussionofPolicy
configuration.ThisFeatureGuideislocatedontheEnterasysNetworkswebsite:
http://www.enterasys.com/support/manuals/
Table A-1
Policy Capacities
Feature
Capacity
15
768
128
128
512
100
No limit
Yes
No
No
Yes
Yes
cos/drop/fwd
ip protocol1
cos/drop/fwd
cos/drop/fwd
ip tos1
cos/drop/fwd
cos/drop/fwd
A-1
Table A-1
Authentication Capacities
Feature
Capacity
udp dest port/udp source port
icmp
type1
cos/drop/fwd
No
Authentication Capacities
RefertotheConfiguringUserAuthenticationFeatureGuideforanindepthdiscussionof
authenticationconfiguration.ThisFeatureGuideislocatedontheEnterasysNetworkswebsite:
http://www.enterasys.com/support/manuals/
Table A-2
Authentication Capacities
Authentication Feature
Capacity
Supported
MAC-based authentication
Supported
Supported
tunnel mode
User + IP phone
(Configured with a policy admin rule)
Multiauth numusers set to 2
A-2
Supported
Index
Numerics
802.1D 9-1
802.1p 11-17, 12-1
802.1Q 10-1
802.1s 9-2
802.1w 9-1
802.1x 26-7, 26-23
A
Access Groups 26-86
Access Lists 26-83 to 26-84
Addresses
MAC, adding entries to routing
table 19-5
setting the router ID address 20-12
Advertised Ability 7-16
AES encryption protocol 8-10
Alias
node 14-40
Area Border Routers (ABRs) 20-21
ARP
dynamic inspection 17-15
entries, adding in routing
mode 19-13
proxy, enabling 19-14
timeout 19-15
Authentication
EAPOL 26-23
MAC 26-25
MD5 20-20
OSPF
MD5 20-20
simple password 20-19
Port web 26-68
RADIUS server 26-7, 26-10
SSH 26-81
Auto-negotiation 7-16
starting 1-6
Command History Buffer 14-14, 14-15
Command Line Interface. See also CLI
Configuration
clearing switch parameters 3-51
modes for router operation 18-2
Configuration Files
copying 3-45
deleting 3-46
displaying 3-43
executing 3-44
show running config 3-46
show running-config 19-6
Contexts (SNMP) 8-3
Copying Configuration or Image
Files 3-45
CoS
flood control 11-19
rate limiting 11-17
Cost
area default 20-23
OSPF 20-15, 20-23
Spanning Tree port 9-40
Defaults
CLI behavior, described 1-8
factory installed 1-2
DES encryption protocol 8-10
DHCP server, configuring 16-1
DHCP snooping
basic configuration 17-3
database 17-2
overview 17-1
DHCP/BOOTP Relay 16-1
DHCPv6
about 24-1
configuring 24-1
DVMRP 20-33
Dynamic ARP inspection
basic configuration 17-18
overview 17-15
Dynamic policy profile
assignment 26-3
F
Flood control, via CoS 11-19
Flow Control 7-22
Forbidden VLAN port 10-14
G
Getting help xxxvii
GVRP
enabling and disabling 10-23
purpose of 10-20
timer 10-24
H
Hardware
show system 3-14, 3-26
Hello Packets 20-18
Help
keyword lookups 1-8
Host VLAN 10-18
hostprotect, configuring 3-56
hybrid authentication, about 26-52
I
ICMP 14-16
IGMP 13-1
enabling and disabling 13-2, 13-10
Image File
copying 3-45
downloading 3-32
Ingress Filtering 10-8, 10-11
Interface Configuration Mode 19-3
Interface(s)
configuring OSPF parameters 20-11
configuring settings for IP 19-1
loopback, configuring 22-10
RIP passive 20-8
RIP receive 20-9
RIP send 20-4
tunnel, configuring 19-8, 22-10
IP
access lists 26-83 to 26-84
address, setting for a routing
interface 19-5
routes, adding in router mode 19-21
routes, managing in switch
mode 14-19
IPv6
about 22-1
addresses, configuring 22-10
addresses, setting 21-3
configuration defaults 22-2
default router, setting 21-5
DHCPv6, configuring 24-1
displaying information 22-22
gateway, setting 21-5
general configuration
commands 22-3
interface configuration
commands 22-10
management 21-1
Neighbor Discovery Protocol
Index -1
about 22-1
configuring 22-14
displaying cache 21-6
OSPFv3, configuring 25-1
IPv6 proxy routing 23-1
IRDP 20-37
J
Jumbo Frame Support 7-14
K
Keyword Lookups 1-8
L
License key
advanced routing 20-1
licenses
license key field descriptions 4-1
procedure for stack environment 4-1
Line Editing Commands 1-10
Link Layer Discovery Protocol (LLDP)
configuring 6-13
Link State Advertisements
displaying 20-27
retransmit interval 20-17
transmit delay 20-17
LLDP
configuring 6-13
LLDP-MED
configuring 6-14
Lockout
set system 3-7
Logging 14-1
Login
administratively configured 1-7
default 1-7
setting accounts 3-2
via Telnet 1-7
Loopback interfaces,
configuring 22-10
M
MAC Addresses
displaying 14-22
MAC Authentication 26-25
MAC Locking 26-57
maximum static entries 26-63
static 26-63
Management VLAN 10-2
maptable response 26-52
MD5 Authentication 20-20
motd 3-25
Multicast 20-49
Multicast Filtering 13-1, 13-2
Multiple Spanning Tree Protocol
(MSTP) 9-2
N
Name
setting for a VLAN 10-6
setting for the system 3-27
Neighbor Discovery Protocol
Index - 2
configuring 22-14
Neighbors
OSPF 20-30
Network Management
addresses and routes 14-19
monitoring switch events and
status 14-14
Networks
OSPF 20-14
Node Alias 14-40
NSSA Areas 20-23
NVRAM
clearing 3-51
O
OSPF
Area Border Routers (ABRs) 20-21
areas, defining NSSAs 20-23
areas, defining range 20-21
areas, defining stub 20-22
configuration mode, enabling 20-13
configuration tasks 20-11
cost 20-15, 20-23
hello packet intervals 20-18
information,
displaying 20-26 to 20-31
link state advertisements 20-27
neighbors 20-30
networks 20-14
priority 20-15
redistribute 20-25
retransmit interval 20-17
timers 20-16
transmit delay 20-17
virtual links 20-24, 20-31
OSPFv3
about 25-1
area configuration commands 25-10
configuration defaults 25-2
configuring 25-1
displaying information 25-29
global configuration commands 25-3
interface configuration
commands 25-21
P
Password
aging 3-6
history 3-6, 3-7
set new 3-5
setting the login 3-5
PIM-SM 20-49
Ping 14-16, 19-21
Policy Management
assigning ports 11-15
classifying to a VLAN or Class of
Service 11-7, 11-11
dynamic assignment of profiles 26-3
profiles 11-2, 11-17
policy maptable response,
about 26-52
R
RADIUS 26-6
realm 26-8
RADIUS Filter-ID 26-3
attribute formats 26-3
RADIUS server 26-7, 26-10
Rapid Spanning Tree Protocol
(RSTP) 9-1
Rate limiting, via CoS 11-17
Redistribute 20-9, 20-25
Related Manuals xxxv
remote port mirroring
configuring 7-40
Reset 3-50
RFC 3580 26-49
RIP
CIDR 20-7
configuration mode, enabling 20-2
configuration tasks 20-2
passive interface 20-8
redistribute 20-9
Router Mode(s)
enabling 18-2
Routing Interfaces
configuring 19-3
Routing Protocol Configuration
DVMRP 20-33
IRDP 20-37
OSPF 20-11
OSPFv3 25-1
RIP 20-2
VRRP 20-42
S
Scrolling Screens 1-9
Secure Shell (SSH) 26-80
enabling 26-80
regenerating new keys 26-81
Security
methods, overview of 26-1
Serial Port
downloading upgrades via 3-32
sFlow configuration 28-1
show system utilization cpu 3-15
SNMP
access rights 8-15
accessing in router mode 8-3
enabling on the switch 8-18
encryption protocols 8-10
MIB views 8-19
notification parameters 8-29
notify filters 8-29
security models and levels 8-2
statistics 8-3
target addresses 8-26
target parameters 8-23
trap configuration example 8-37
users, groups and communities 8-8
SNTP 14-29
Spanning Tree 9-2
backup root 9-21, 9-22
bridge parameters 9-3
features 9-2
port parameters 9-34
Rapid Spanning Tree Protocol
(RSTP) 9-1
Split Horizon 20-7
SSL WebView 3-54
stacks
installing units 2-2
operation 2-1
virtual switch configuration 2-3
Stub Areas 20-22
Syslog 14-1
System Information
displaying basic 3-13
setting basic 3-9
T
TACACS+ configuration 27-1
Technical Support xxxvii
Telnet
disconnecting 14-17
U
User Accounts
default 1-7
setting 3-2
V
Version
RIP receive 20-5
RIP send 20-4
Version Information 3-26
Virtual Links 20-24, 20-31
virtual switch, configuring 2-3
VLANs
assigning ingress filtering 10-11
assigning port VLAN IDs 10-8
authentication 26-49, 26-51
classifying to 11-7, 11-11
creating static 10-5
dynamic egress 10-17
egress lists 10-13, 26-50
enabling GVRP 10-20
forbidden ports 10-14
host, setting 10-18
ingress filtering 10-8
naming 10-6
RADIUS 26-49
secure management, creating 10-2
VRRP
configuration mode, enabling 20-42
creating a session 20-43
enabling on an interface 20-47
priority 20-45
virtual router address 20-44
W
WebView 1-2, 3-52
WebView SSL 3-54
Index -3
Index - 4