You are on page 1of 470

SecureStack A2

Stackable Switches

Configuration Guide
Firmware Version 1.04.xx

P/N 9034155-06

Notice
Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and  its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such  changes have been made. The hardware, firmware, or software described in this document is subject to change without notice. IN NO EVENT SHALL ENTERASYS NETWORKS BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR  CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF  OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE INFORMATION CONTAINED IN THEM, EVEN IF ENTERASYS  NETWORKS HAS BEEN ADVISED OF, KNEW OF, OR SHOULD HAVE KNOWN OF, THE POSSIBILITY OF SUCH  DAMAGES. Enterasys Networks, Inc. 50 Minuteman Road Andover, MA 01810 © 2007 Enterasys Networks, Inc. All rights reserved. Part Number: 9034155‐06 June 2007 ENTERASYS, ENTERASYS NETWORKS, ENTERASYS NETSIGHT, WEBVIEW, ENTERASYS SECURESWITCH, and any  logos associated therewith, are trademarks or registered trademarks of Enterasys Networks, Inc. in the United States and other  countries. All other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies. Documentation URL: http://www.enterasys.com/support/manuals Documentacion URL: http://www.enterasys.com/support/manuals Dokumentation im Internet: http://www.enterasys.com/support/manuals

Version:

Information in this guide refers to SecureStack A2 firmware version 1.04.xx

i

ENTERASYS NETWORKS, INC. FIRMWARE LICENSE AGREEMENT
BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT, CAREFULLY READ THIS LICENSE AGREEMENT.
This document is an agreement (“Agreement”) between the end user (“You”) and Enterasys Networks, Inc., on behalf of itself  and its Affiliates (as hereinafter defined) (“Enterasys”) that sets forth Your rights and obligations with respect to the Enterasys  software program/firmware (including any accompanying documentation, hardware or media) (“Program”) in the package  and prevails over any additional, conflicting or inconsistent terms and conditions appearing on any purchase order or other  document submitted by You. “Affiliate” means any person, partnership, corporation, limited liability company, other form of  enterprise that directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common  control with the party specified. This Agreement constitutes the entire understanding between the parties, with respect to the  subject matter of this Agreement. The Program may be contained in firmware, chips or other media. BY INSTALLING OR OTHERWISE USING THE PROGRAM, YOU REPRESENT THAT YOU ARE AUTHORIZED TO ACCEPT  THESE TERMS ON BEHALF OF THE END USER (IF THE END USER IS AN ENTITY ON WHOSE BEHALF YOU ARE  AUTHORIZED TO ACT, “YOU” AND “YOUR” SHALL BE DEEMED TO REFER TO SUCH ENTITY) AND THAT YOU  AGREE THAT YOU ARE BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES, AMONG OTHER  PROVISIONS, THE LICENSE, THE DISCLAIMER OF WARRANTY AND THE LIMITATION OF LIABILITY. IF YOU DO NOT  AGREE TO THE TERMS OF THIS AGREEMENT OR ARE NOT AUTHORIZED TO ENTER INTO THIS AGREEMENT,  ENTERASYS IS UNWILLING TO LICENSE THE PROGRAM TO YOU AND YOU AGREE TO RETURN THE UNOPENED  PRODUCT TO ENTERASYS OR YOUR DEALER, IF ANY, WITHIN TEN (10) DAYS FOLLOWING THE DATE OF RECEIPT  FOR A FULL REFUND. IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT ENTERASYS NETWORKS, LEGAL  DEPARTMENT AT (978) 684‐1000. You and Enterasys agree as follows: 1. LICENSE. You have the non‐exclusive and non‐transferable right to use only the one (1) copy of the Program provided in  this package subject to the terms and conditions of this Agreement. 2. RESTRICTIONS. Except as otherwise authorized in writing by Enterasys, You may not, nor may You permit any third  party to: (a) Reverse engineer, decompile, disassemble or modify the Program, in whole or in part, including for reasons of error  correction or interoperability, except to the extent expressly permitted by applicable law and to the extent the parties  shall not be permitted by that applicable law, such rights are expressly excluded. Information necessary to achieve  interoperability or correct errors is available from Enterasys upon request and upon payment of Enterasys’ applicable  fee. (b) Incorporate the Program in whole or in part, in any other product or create derivative works based on the Program, in  whole or in part. (c) Publish, disclose, copy reproduce or transmit the Program, in whole or in part. (d) Assign, sell, license, sublicense, rent, lease, encumber by way of security interest, pledge or otherwise transfer the  Program, in whole or in part. (e) Remove any copyright, trademark, proprietary rights, disclaimer or warning notice included on or embedded in any  part of the Program. 3. APPLICABLE LAW. This Agreement shall be interpreted and governed under the laws and in the state and federal courts  of the Commonwealth of Massachusetts without regard to its conflicts of laws provisions. You accept the personal jurisdiction  and venue of the Commonwealth of Massachusetts courts. None of the 1980 United Nations Convention on the Limitation Period  in the International Sale of Goods, and the Uniform Computer Information Transactions Act shall apply to this Agreement. 4. EXPORT RESTRICTIONS. You understand that Enterasys and its Affiliates are subject to regulation by agencies of the  U.S. Government, including the U.S. Department of Commerce, which prohibit export or diversion of certain technical products  to certain countries, unless a license to export the product is obtained from the U.S. Government or an exception from obtaining  such license may be relied upon by the exporting party. If the Program is exported from the United States pursuant to the License Exception CIV under the U.S. Export  Administration Regulations, You agree that You are a civil end user of the Program and agree that You will use the Program for  civil end uses only and not for military purposes. If the Program is exported from the United States pursuant to the License Exception TSR under the U.S. Export  Administration Regulations, in addition to the restriction on transfer set forth in Section 1 or 2 of this Agreement, You agree not  to (i) reexport or release the Program, the source code for the Program or technology to a national of a country in Country  Groups D:1 or E:2 (Albania, Armenia, Azerbaijan, Belarus, Cambodia, Cuba, Georgia, Iraq, Kazakhstan, Laos, Libya, Macau, 

ii

Moldova, Mongolia, North Korea, the People’s Republic of China, Russia, Tajikistan, Turkmenistan, Ukraine, Uzbekistan,  Vietnam, or such other countries as may be designated by the United States Government), (ii) export to Country Groups D:1 or  E:2 (as defined herein) the direct product of the Program or the technology, if such foreign produced direct product is subject to  national security controls as identified on the U.S. Commerce Control List, or (iii) if the direct product of the technology is a  complete plant or any major component of a plant, export to Country Groups D:1 or E:2 the direct product of the plant or a  major component thereof, if such foreign produced direct product is subject to national security controls as identified on the  U.S. Commerce Control List or is subject to State Department controls under the U.S. Munitions List. 5. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed Program (i) was developed solely at private  expense; (ii) contains “restricted computer software” submitted with restricted rights in accordance with section 52.227‐19 (a)  through (d) of the Commercial Computer Software‐Restricted Rights Clause and its successors, and (iii) in all respects is  proprietary data belonging to Enterasys and/or its suppliers. For Department of Defense units, the Program is considered  commercial computer software in accordance with DFARS section 227.7202‐3 and its successors, and use, duplication, or  disclosure by the U.S. Government is subject to restrictions set forth herein. 6. DISCLAIMER OF WARRANTY. EXCEPT FOR THOSE WARRANTIES EXPRESSLY PROVIDED TO YOU IN WRITING  BY ENTERASYS, ENTERASYS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT  LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR  PURPOSE, TITLE AND NON‐INFRINGEMENT WITH RESPECT TO THE PROGRAM.  IF IMPLIED WARRANTIES MAY NOT  BE DISCLAIMED BY APPLICABLE LAW, THEN ANY IMPLIED  WARRANTIES ARE LIMITED IN DURATION TO THIRTY  (30) DAYS AFTER DELIVERY OF THE PROGRAM TO YOU. 7. LIMITATION OF LIABILITY. IN NO EVENT SHALL ENTERASYS OR ITS SUPPLIERS BE LIABLE FOR ANY  DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS, PROFITS,  BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR  RELIANCE DAMAGES, OR OTHER LOSS) ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM, EVEN IF  ENTERASYS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.  THIS FOREGOING LIMITATION SHALL  APPLY REGARDLESS OF THE CAUSE OF ACTION UNDER WHICH DAMAGES ARE SOUGHT. THE CUMULATIVE LIABILITY OF ENTERASYS TO YOU FOR ALL CLAIMS RELATING TO THE PROGRAM, IN  CONTRACT, TORT OR OTHERWISE, SHALL NOT EXCEED THE TOTAL AMOUNT OF FEES PAID TO ENTERASYS BY  YOU FOR THE RIGHTS GRANTED HEREIN. 8. AUDIT RIGHTS. You hereby acknowledge that the intellectual property rights associated with the Program are of critical  value to Enterasys, and, accordingly, You hereby agree to maintain complete books, records and accounts showing (i) license  fees due and paid, and (ii) the use, copying and deployment of the Program. You also grant to Enterasys and its authorized  representatives, upon reasonable notice, the right to audit and examine during Your normal business hours, Your books, records,  accounts and hardware devices upon which the Program may be deployed to verify compliance with this Agreement, including  the verification of the license fees due and paid Enterasys and the use, copying and deployment of the Program. Enterasys’ right  of examination shall be exercised reasonably, in good faith and in a manner calculated to not unreasonably interfere with Your  business. In the event such audit discovers non‐compliance with this Agreement, including copies of the Program made, used  or deployed in breach of this Agreement, You shall promptly pay to Enterasys the appropriate license fees. Enterasys reserves  the right, to be exercised in its sole discretion and without prior notice, to terminate this license, effective immediately, for failure  to comply with this Agreement. Upon any such termination, You shall immediately cease all use of the Program and shall return  to Enterasys the Program and all copies of the Program. 9. OWNERSHIP. This is a license agreement and not an agreement for sale. You acknowledge and agree that the Program  constitutes trade secrets and/or copyrighted material of Enterasys and/or its suppliers. You agree to implement reasonable  security measures to protect such trade secrets and copyrighted material. All right, title and interest in and to the Program shall  remain with Enterasys and/or its suppliers. All rights not specifically granted to You shall be reserved to Enterasys. 10. ENFORCEMENT. You acknowledge and agree that any breach of Sections 2, 4, or 9 of this Agreement by You may cause  Enterasys irreparable damage for which recovery of money damages would be inadequate, and that Enterasys may be entitled  to seek timely injunctive relief to protect Enterasys’ rights under this Agreement in addition to any and all remedies available at  law. 11. ASSIGNMENT. You may not assign, transfer or sublicense this Agreement or any of Your rights or obligations under this  Agreement, except that You may assign this Agreement to any person or entity which acquires substantially all of Your stock  assets. Enterasys may assign this Agreement in its sole discretion. This Agreement shall be binding upon and inure to the benefit  of the parties, their legal representatives, permitted transferees, successors and assigns as permitted by this Agreement. Any  attempted assignment, transfer or sublicense in violation of the terms of this Agreement shall be void and a breach of this  Agreement. 12. WAIVER. A waiver by Enterasys of a breach of any of the terms and conditions of this Agreement must be in writing and  will not be construed as a waiver of any subsequent breach of such term or condition. Enterasys’ failure to enforce a term upon  Your breach of such term shall not be construed as a waiver of Your breach or prevent enforcement on any other occasion.

iii

13. SEVERABILITY. In the event any provision of this Agreement is found to be invalid, illegal or unenforceable, the validity,  legality and enforceability of any of the remaining provisions shall not in any way be affected or impaired thereby, and that  provision shall be reformed, construed and enforced to the maximum extent permissible. Any such invalidity, illegality, or  unenforceability in any jurisdiction shall not invalidate or render illegal or unenforceable such provision in any other  jurisdiction. 14. TERMINATION. Enterasys may terminate this Agreement immediately upon Your breach of any of the terms and  conditions of this Agreement. Upon any such termination, You shall immediately cease all use of the Program and shall return  to Enterasys the Program and all copies of the Program.

iv

Contents
About This Guide
Using This Guide ........................................................................................................................................... xxiii Structure of This Guide .................................................................................................................................. xxiii Related Documents ....................................................................................................................................... xxiv Conventions Used in This Guide .................................................................................................................... xxv Getting Help ................................................................................................................................................... xxvi

Chapter 1: Introduction
SecureStack A2 CLI Overview ....................................................................................................................... 1-1 Switch Management Methods ........................................................................................................................ 1-2 Factory Default Settings ................................................................................................................................. 1-2 Using the Command Line Interface ................................................................................................................ 1-5 Starting a CLI Session ............................................................................................................................. 1-5 Logging In ................................................................................................................................................ 1-6 Navigating the Command Line Interface .................................................................................................. 1-6

Chapter 2: Configuring Switches in a Stack
About SecureStack A2 Switch Operation in a Stack ...................................................................................... 2-1 Installing a New Stackable System of Up to Eight Units ................................................................................ 2-2 Installing Previously-Configured Systems in a Stack ..................................................................................... 2-3 Adding a New Unit to an Existing Stack ......................................................................................................... 2-3 Creating a Virtual Switch Configuration .......................................................................................................... 2-4 Considerations About Using Clear Config in a Stack ..................................................................................... 2-5 Configuring Standalone A2 Stack Ports ......................................................................................................... 2-5 Stacking Configuration and Management Commands ................................................................................... 2-6 Purpose .................................................................................................................................................... 2-6 Commands ............................................................................................................................................... 2-6 show switch ........................................................................................................................................ 2-7 show switch switchtype ...................................................................................................................... 2-8 show switch stack-ports...................................................................................................................... 2-9 set switch stack-port ........................................................................................................................... 2-9 set switch .......................................................................................................................................... 2-11 set switch copy-fw ............................................................................................................................ 2-11 set switch description ....................................................................................................................... 2-12 set switch movemanagement ........................................................................................................... 2-12 set switch member............................................................................................................................ 2-13 clear switch member......................................................................................................................... 2-14

Chapter 3: Basic Configuration
Setting User Accounts and Passwords .......................................................................................................... 3-2 Purpose .................................................................................................................................................... 3-2 Commands ............................................................................................................................................... 3-2 show system login .............................................................................................................................. 3-2 set system login .................................................................................................................................. 3-3 clear system login ............................................................................................................................... 3-4 set password ...................................................................................................................................... 3-4 set system password length ............................................................................................................... 3-5 set system password aging ................................................................................................................3-6 set system password history .............................................................................................................. 3-6 show system lockout .......................................................................................................................... 3-7

v

set system lockout .............................................................................................................................. 3-8 Setting Basic Switch Properties ...................................................................................................................... 3-9 Purpose .................................................................................................................................................... 3-9 Commands ............................................................................................................................................... 3-9 show ip address................................................................................................................................ 3-10 set ip address ................................................................................................................................... 3-10 clear ip address ................................................................................................................................ 3-11 show ip protocol................................................................................................................................ 3-11 set ip protocol ................................................................................................................................... 3-12 show system..................................................................................................................................... 3-12 show system hardware..................................................................................................................... 3-13 show system utilization..................................................................................................................... 3-14 set system enhancedbuffermode ..................................................................................................... 3-15 show time ......................................................................................................................................... 3-16 set time ............................................................................................................................................. 3-16 show summertime ............................................................................................................................ 3-17 set summertime ................................................................................................................................ 3-17 set summertime date ........................................................................................................................ 3-18 set summertime recurring ................................................................................................................. 3-18 clear summertime ............................................................................................................................. 3-19 set prompt......................................................................................................................................... 3-20 show banner motd ............................................................................................................................ 3-20 set banner motd................................................................................................................................ 3-21 clear banner motd............................................................................................................................. 3-21 show version..................................................................................................................................... 3-22 set system name .............................................................................................................................. 3-23 set system location ........................................................................................................................... 3-23 set system contact............................................................................................................................ 3-24 set width ........................................................................................................................................... 3-24 set length .......................................................................................................................................... 3-25 show logout ...................................................................................................................................... 3-25 set logout ......................................................................................................................................... 3-26 show console .................................................................................................................................... 3-26 set console baud .............................................................................................................................. 3-27 Configuring Power over Ethernet (PoE) ....................................................................................................... 3-28 Purpose .................................................................................................................................................. 3-28 Commands ............................................................................................................................................. 3-28 show inlinepower .............................................................................................................................. 3-29 set inlinepower threshold.................................................................................................................. 3-29 set inlinepower trap .......................................................................................................................... 3-30 show port inlinepower ....................................................................................................................... 3-30 set port inlinepower .......................................................................................................................... 3-31 Downloading a New Firmware Image ........................................................................................................... 3-32 Downloading from a TFTP Server .......................................................................................................... 3-32 Downloading via the Serial Port ............................................................................................................. 3-32 Reviewing and Selecting a Boot Firmware Image ........................................................................................ 3-35 Purpose .................................................................................................................................................. 3-35 Commands ............................................................................................................................................. 3-35 show boot system ............................................................................................................................. 3-35 set boot system ................................................................................................................................ 3-36 Starting and Configuring Telnet .................................................................................................................... 3-37 Purpose .................................................................................................................................................. 3-37 Commands ............................................................................................................................................. 3-37 show telnet ....................................................................................................................................... 3-37 set telnet ........................................................................................................................................... 3-38 telnet................................................................................................................................................. 3-38
vi

Managing Switch Configuration and Files .................................................................................................... 3-39 Configuration Persistence Mode ............................................................................................................ 3-39 Purpose .................................................................................................................................................. 3-39 Commands ............................................................................................................................................. 3-39 show snmp persistmode ................................................................................................................... 3-40 set snmp persistmode ...................................................................................................................... 3-40 save config ....................................................................................................................................... 3-41 dir...................................................................................................................................................... 3-41 show file............................................................................................................................................ 3-42 show config....................................................................................................................................... 3-43 configure ........................................................................................................................................... 3-44 copy .................................................................................................................................................. 3-45 delete................................................................................................................................................ 3-45 show tftp settings.............................................................................................................................. 3-46 set tftp timeout .................................................................................................................................. 3-46 clear tftp timeout ............................................................................................................................... 3-47 set tftp retry....................................................................................................................................... 3-47 clear tftp retry.................................................................................................................................... 3-48 Configuring CDP ........................................................................................................................................... 3-49 Purpose .................................................................................................................................................. 3-49 Commands ............................................................................................................................................. 3-49 show cdp .......................................................................................................................................... 3-49 set cdp state ..................................................................................................................................... 3-51 set cdp auth ...................................................................................................................................... 3-51 set cdp interval ................................................................................................................................. 3-52 set cdp hold-time .............................................................................................................................. 3-53 clear cdp ........................................................................................................................................... 3-53 show neighbors ................................................................................................................................ 3-54 Clearing and Closing the CLI ........................................................................................................................ 3-55 Purpose .................................................................................................................................................. 3-55 Commands ............................................................................................................................................. 3-55 cls (clear screen) .............................................................................................................................. 3-55 exit .................................................................................................................................................... 3-56 Resetting the Switch ..................................................................................................................................... 3-57 Purpose .................................................................................................................................................. 3-57 Commands ............................................................................................................................................. 3-57 reset.................................................................................................................................................. 3-57 clear config ....................................................................................................................................... 3-58 Using and Configuring WebView .................................................................................................................. 3-59 Purpose .................................................................................................................................................. 3-59 Commands ............................................................................................................................................. 3-59 show webview .................................................................................................................................. 3-59 set webview ...................................................................................................................................... 3-60 show ssl............................................................................................................................................ 3-60 set ssl ............................................................................................................................................... 3-61

Chapter 4: Port Configuration
Port Configuration Summary .......................................................................................................................... 4-1 A2H124-24 and A2H124-24P Switch Ports ............................................................................................. 4-1 A2H124-48 and A2H124-48P Switch Ports ............................................................................................. 4-2 A2H124-24FX Switch Ports ..................................................................................................................... 4-2 A2H254-16 Switch Ports .......................................................................................................................... 4-2 Port String Syntax Used in the CLI .......................................................................................................... 4-2 Reviewing Port Status .................................................................................................................................... 4-4 Purpose .................................................................................................................................................... 4-4

vii

.................................. 4-7 Purpose ................................................................................................................................................................................................................................................................................ 4-16 set port advertise ............................................................................................. 4-21 Configuring Broadcast Suppression ................................................................................................................................................. 4-16 show port advertise .............................................................................. 4-15 Purpose ................................................................................................................................................................................................. 4-10 show port speed ......................................................................................................................................... 4-8 show port alias......................................................................................................................................................................................................................................................................... 4-17 clear port advertise ............................................................................................................ 4-10 Commands .............................................. 4-9 Setting Speed and Duplex Mode . 4-22 Commands .......................................................................................................................................................................................................................................................................................................................................................................................................................................... 4-26 set port mirroring ....................................................................................................................................................................................... 4-25 show port mirroring.......................................................................................................................................................................................................... 4-13 Commands ........................................................................................................................................ 4-10 Purpose ............................................................................................................................................................................................ 4-11 show port duplex .................... 4-15 Commands .............................................................................................................................................. 4-8 set port enable.......................................................................................................................................................................................................................................................................................................... 4-15 show port negotiation .............................................................................. 4-7 Commands ............... 4-12 Enabling / Disabling Jumbo Frame Support ......... 4-25 Commands ... 4-14 Setting Auto-Negotiation and Advertised Ability .............................................................................................................. 4-10 set port speed... 4-14 clear port jumbo ................................................................................................ 4-26 clear port mirroring ....................................................................................................... 4-15 set port negotiation .................................................................................. 4-9 set port alias ........ 4-19 show flowcontrol .................................................................................. 4-20 Setting Port Link Traps ................................................................................................................................................................................... 4-22 show port broadcast .................................................................. 4-22 set port broadcast.............................................................................................................................................................................................................................................................................................. 4-25 Purpose .................................................................... 4-7 set port disable ................................. 4-22 Purpose ......................................................................................................................................................................................................... 4-19 Commands ................................................................................................................................................................................................................................................................................ 4-13 Purpose ........................................................................................................................................................................................................................................................ 4-13 set port jumbo.............................. 4-25 Mirroring Features ...................................................................................................................................... 4-19 set flowcontrol.............................. 4-18 Setting Flow Control .............................................................................................................................. 4-21 set port trap ............................................................................................................................... 4-21 Purpose .................................................... 4-6 Disabling / Enabling and Naming Ports ................................................................... 4-19 Purpose ..................................... 4-24 Port Mirroring ............................................................................................................................................................... 4-21 Commands ........................................................................................................................................................ 4-23 clear port broadcast........................................... 4-11 set port duplex ........................... 4-5 show port counters ....................................................................................................................................................................................................................................................................................................................................................................................................................... 4-21 show port trap.............................................................................. 4-4 show port ............................................................................................................................................Commands ... 4-13 show port jumbo ............................................................................................................................................................................................... 4-27 viii ....................................................................................................................................... 4-4 show port status ..............................................................................................................................................................................................................................................................................................................................................................

................................................................................................. 5-4 show snmp engineid........................................................................................................................................................................................................................................................................................................................... 4-44 set port protected name........................................... 5-8 show snmp user ............................................... 4-31 set lacp .......................................................................................... 5-9 set snmp user ............................................................................................. 5-1 SNMPv3 ........................................... 4-29 Commands ...................................................................... and Communities ...................................................................... 4-36 clear lacp singleportlag.............................................................................................................................................................................. 4-46 Chapter 5: SNMP Configuration SNMP Configuration Summary ............ Groups.............................................................................................. 5-8 Purpose .............................. 4-29 SecureStack A2 Usage Considerations ....................................................... 4-43 clear port protected................................................................................................... 4-37 set port lacp ............................................................................................................................... 5-4 show snmp counters......................... 5-5 Configuring SNMP Users.................................................................................. 4-35 set lacp singleportlag. 4-33 set lacp aadminkey......................... 5-11 show snmp group ............................................. 4-45 show port protected name ................................................................................ 4-30 show lacp.................................. 5-16 show snmp access ...................................................................................................................................................................................... 4-28 LACP Operation ............................................................................................................... 4-33 clear lacp ........................... 5-16 Commands ..................................... 5-2 Using SNMP Contexts to Access Specific MIBs .................................................................................................................................... 5-14 clear snmp community...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 4-39 clear port lacp ...................................................................................................................................................................................................... 5-13 show snmp community ................................................................................................................................................................................................................................... 5-13 set snmp community..................................................................................................................................................................... 4-32 set lacp asyspri................................................................................................................ 4-42 Commands ................................................................................................................................................................................................................................................................................................................................................................................................................... 4-28 LACP Terminology .......................................... 5-12 clear snmp group .......................................................................................................................................................................................................................................................... 5-4 Purpose .............................................. 5-2 About SNMP Security Models and Levels .................................................................... 4-37 show port lacp ............................................................................................................................. 5-4 Commands ..................................................................................... 5-3 Reviewing SNMP Statistics ................................................................................................ 4-41 Configuring Protected Ports ..................................................................Link Aggregation Control Protocol (LACP) ...................................... 4-43 show port protected ........................................................................ 4-45 clear port protected name.................................................. 4-42 Protected Port Operation .............................................................................................................................................. 4-42 set port protected........................................................................................................................................................ 5-15 Configuring SNMP Access Rights ........................................................................................................................................................................................................................................................................................................................................ 5-11 set snmp group ............................................................................................................................................................................................................................................ 5-8 Commands .... 5-16 ix ....................................................................................................................................................................................................................................................................................................................... 4-35 clear lacp static ............................................................................................................................ 4-34 set lacp static............................................................................................ 5-16 Purpose ................................................................... 5-1 SNMPv1 and SNMPv2c ....................................... 5-3 Configuration Considerations .................................................................................... 5-10 clear snmp user ...................................................................................................................................................................................................................

.................................................. 6-9 show spantree bridgeprioritymode ............................................................................... 5-27 clear snmp targetparams........................................................................................................................................................................................................................................................................................................ 6-10 clear spantree bridgeprioritymode ....................................................... 6-1 Overview: Single....................................................................................................................................................................... 6-8 show spantree bpdu-forwarding .......................................... 5-38 set snmp notifyprofile.................................................................................................................................................................................................. 5-41 Example .......................................................................................... 5-39 clear snmp notifyprofile.....................set snmp access............................. 5-30 clear snmp targetaddr.............................................................................................................................................. 6-8 clear spantree version ......................................................................................... 5-36 show snmp notifyfilter ... 6-10 set spantree bridgeprioritymode ....................................................................................................................................... 5-25 set snmp targetparams........................ 5-35 clear snmp notify ............................................................ 5-34 set snmp notify ............. 5-19 Configuring SNMP MIB Views ................................................................................................................................................................................................................. and Multiple Spanning Tree Protocols .......................................................................................................... 5-33 About SNMP Notify Filters ................................................................................................................... 5-29 show snmp targetaddr ............................... 6-5 set spantree.... 5-18 clear snmp access......................................................... 5-38 show snmp notifyprofile ....................................................................................................................................................................................................................... 5-22 set snmp view.................................................................................................................................................................................................................................................................................................................... 5-24 Configuring SNMP Target Parameters ......................................................................................................... 5-25 show snmp targetparams ...... 5-31 Configuring SNMP Notification Parameters .......................................................................................... 6-7 set spantree version .......................................................................... 5-25 Purpose ..................................................... 6-2 Configuring Spanning Tree Bridge Parameters .................................................................................... 5-37 clear snmp notifyfilter.............................................. 5-23 clear snmp view............................................................................................................................................... Rapid................................................................................................................................................... 6-1 Spanning Tree Features ............................................................................................................................................................................................ 5-33 Purpose ......................................................................................................................................................................................................................................................................................................................................................................................................................................... 5-41 Chapter 6: Spanning Tree Configuration Spanning Tree Configuration Summary ................................... 6-7 show spantree version........................................................................................................................................................................................................................................................................................................................................ 5-20 show snmp view ................................................. 5-40 Creating a Basic SNMP Trap Configuration ...................................................................... 5-36 set snmp notifyfilter.......................... 5-29 set snmp targetaddr.................................................... 6-11 show spantree mstilist ........... 6-3 Commands ........................................... 6-9 set spantree bpdu-forwarding................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................. 5-25 Commands .................................................................................................... 5-29 Purpose ...................................................................................................... 6-3 show spantree stats.......................................................................................................................... 5-29 Commands ............................................................................... 6-3 Purpose .................................................................................................................................................................................................... 5-20 show snmp context.................................................................... 5-20 Purpose ......................................................................................................................................... 5-33 Commands ............................................. 6-11 x .................................................... 5-28 Configuring SNMP Target Addresses .......................................................................................................................... 5-20 Commands ............... 5-33 show snmp notify .............................................................................................................................................................................................................................................................................

.......................................................................................................................... 6-23 clear spantree tctrapsuppress .. 6-17 clear spantree priority ...................................................................................................................................................... 6-38 set spantree adminedge ................................................................................. 6-17 set spantree hello .............................................................................. 6-36 set spantree adminpathcost .............................................................................. 6-26 set spantree spanguardtimeout .................................................................................................. 6-31 clear spantree legacypathcost ........................................... 6-12 show spantree mstmap .................................................... 6-39 xi ................. 6-28 show spantree spanguardtrapenable ............................................................. 6-21 set spantree backuproot ..................... 6-20 clear spantree fwddelay............................................................................................................................................................................... 6-22 set spantree tctrapsuppress ........................................................................................................................................................................................................................................................................................................................................................................................................ 6-24 show spantree spanguard ............................................................................................................................................................. 6-38 clear spantree adminedge ................... 6-16 set spantree priority ...... 6-35 show spantree adminpathcost ................... 6-35 clear spantree portpri........................................................................................................................................................ 6-21 clear spantree backuproot ............................................................................... 6-32 Commands ................................... 6-22 show spantree tctrapsuppress...... 6-15 set spantree mstcfgid ......................................................... 6-33 show spantree portadmin ............................................................................................................................................................................................................................................................................................................. 6-14 show spantree vlanlist ............................................ 6-29 set spantree spanguardtrapenable .............................................................................................................................................................................................................................................................................................................................................................. 6-14 show spantree mstcfgid .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 6-37 show spantree adminedge ......................................................................................................................................................................................................................... 6-34 set spantree portpri...... 6-20 show spantree backuproot ................................................................................................... 6-16 clear spantree mstcfgid .................................................................................... 6-26 show spantree spanguardtimeout .......................................................... 6-30 show spantree legacypathcost ............................................................................................................................................................................................................................... 6-33 clear spantree portadmin......................................................................... 6-31 Configuring Spanning Tree Port Parameters ........................................................................................ 6-34 show spantree portpri ......................................... 6-19 set spantree fwddelay.................................................................................................................................................................................................................................................... 6-13 clear spantree mstmap ........................................................................................................................................................... 6-29 clear spantree spanguardtrapenable ............................................................................................................................................................................................................................... 6-28 clear / set spantree spanguardlock....................................... 6-25 set spantree spanguard ................................................................................................................................................... 6-19 clear spantree maxage .......................... 6-37 clear spantree adminpathcost ................................................................................ 6-27 show spantree spanguardlock ........................................................................................................................................set spantree msti .............. 6-27 clear spantree spanguardtimeout ........ 6-32 Purpose ...... 6-18 set spantree maxage ................................................................................................................................................................... 6-32 set spantree portadmin.................................................................................................................................................................. 6-18 clear spantree hello ............................................................................................................................................................................... 6-13 set spantree mstmap .............................................. 6-24 set spantree protomigration ........................................................................................................................................... 6-30 set spantree legacypathcost.......... 6-12 clear spantree msti .................................................................... 6-25 clear spantree spanguard ..................................................................................................................................................................................

........................................ 7-18 set vlan dynamicegress .......................... 7-22 Enabling/Disabling GVRP (GARP VLAN Registration Protocol) .................................................................................. 7-1 Port String Syntax Used in the CLI ...................................................................................................................................................................................Chapter 7: 802.................................................. 7-24 Commands ........................................................................ 7-10 show port ingress filter...................................................................................................................................................................................................................................................................................... 7-9 clear port vlan ........................ 7-24 show gvrp ................................................................................................................................................................................................... 7-6 clear vlan name ........................................................................................ 7-15 set vlan forbidden ......................................................................... 7-8 Purpose .............................................................................................................................................................................. 7-25 show garp timer ................................................................ 7-7 Assigning Port VLAN IDs (PVIDs) and Ingress Filtering ....................................................................................................................................................................................................... 7-3 show vlan............................................................................................................................................................................... 7-27 set garp timer.............................................................................................. 7-23 Purpose ........................................... 7-6 clear vlan ......................................................................................................................................................................................... 7-5 Purpose ................................................... 7-21 clear host vlan ............................ 7-17 show vlan dynamicegress ................................... 7-14 show port egress ............................................................................................................................................... 7-5 Commands .............................................................................................................................................................. 7-14 Purpose ........ 7-15 set vlan egress ........ 7-8 show port vlan .................................. 7-11 show port discard ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ 7-19 Setting the Host VLAN .................................................................................................................................. 7-8 set port vlan .................... 7-20 show host vlan..............................................1Q VLAN Configuration VLAN Configuration Summary ............. 7-8 Commands ........................... 7-28 xii ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 7-20 Commands ........................................................................................................................................................................................................................................................ 7-13 Configuring the VLAN Egress List ............ 7-10 set port ingress filter ............................................................................................................................................................................ 7-1 Viewing VLANs ......................................................................................................................................................................................................... 7-12 set port discard .......................................................................................... 7-20 Purpose .......................................................................................................................................................................................................................................................................................................................................... 7-25 set gvrp............................................. 7-5 set vlan name ................................................................................................................................................................................................. 7-23 About GARP VLAN Registration Protocol (GVRP) .......................................................................................................... 7-5 set vlan .......................................................................................................................................................... 7-20 set host vlan .................................................................................................................................................. 7-14 Commands ......................................................... 7-27 clear gvrp ................................................................................. 7-3 Creating and Naming Static VLANs ...................................................................................................................................................... 7-1 Creating a Secure Management VLAN ........................................................................................................................................................................... 7-3 Purpose ............................................. 7-16 clear vlan egress .................................... 7-3 Commands ...................................................................................................

.............................................................. 9-4 Configuring Priority to Transmit Queue Mapping ................ 9-8 show port txq ........ 8-19 Chapter 9: Port Priority and Rate Limiting Configuration Port Priority Configuration Summary ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 9-8 Commands ............................................................................................................................ 8-6 set diffserv class rename ................................................................................................................................................................................................................................................................................................................ 8-10 show diffserv policy ..................................................... 9-2 Purpose .................................................................... 9-5 Commands ........................................................................ 9-5 show port priority-queue ........................................................................................................................................................................................................... 8-17 Commands .................................. 8-3 show diffserv class ................................................ 8-2 Purpose ..... 8-17 show diffserv service stats..................................................................................... 8-2 Command ............................................................. 9-5 Purpose ........................ 8-9 Configuring Diffserv Policies and Assigning Classes ...................................................................................................................................................................................................................................................................................................................................................................................... 9-5 set port priority-queue............................................................................................................. 9-12 Purpose ........................................................................................ 9-8 set port txq................................................................................................. 8-5 set diffserv class match ...................................................... 8-2 set diffserv adminmode ................................................................................................................................................................................................................................................................................. 8-10 Purpose ........................................................................................................................................................................................................................................................................................... 8-14 set diffserv policy police action conform ................................................................................................................... 8-3 Commands .......................................................................................................................................................................................................................................................................................................................................................................................... 9-1 Configuring Port Priority ........................................ 9-2 show port priority ....................... 8-16 Assigning Policies to Service Ports ..................... 8-14 set diffserv policy police action nonconform ............................................................................................................................................... 8-12 set diffserv policy class............. 8-15 set diffserv policy rename ................................................................................................................................................................... 9-10 Configuring Port Traffic Rate Limiting ......................................................................................................................................... 9-7 Configuring Quality of Service (QoS) ................................................... 9-2 Commands . 8-18 set diffserv service........................................... 8-17 Purpose ................................................................................................................ 8-13 set diffserv policy police style simple ................. 9-8 Purpose .......................................................................................................................................................................................................................... 8-10 Commands ...................................................................................... 8-11 set diffserv policy delete ......................................................... 8-3 Purpose ................................................................................................................................................................................................................................... 8-4 set class create................................................................................................................................................................... 9-12 xiii ......................................Chapter 8: Differentiated Services Configuration Globally Enabling or Disabling Diffserv ................................................................................................................................................................................................................................................................................................... 8-11 set diffserv policy create ............................. 8-12 set diffserv policy mark ............................................................................................................................ 9-6 clear port priority-queue........................ 9-2 set port priority................................................................................................................................................................................................................................................................. 9-3 clear port priority.......................................................................................... 8-3 show diffserv info ........................ 9-9 clear port txq.............................................................................................................................................................. 8-4 set diffserv class delete ... 8-17 show diffserv service info ......................................................................................................................................................................................................................................................................... 8-2 Creating Diffserv Classes and Matching Conditions ................................................................................................

........................................................................................................... 10-5 set igmpsnooping mcrtrexpiretime................................................................................................................................................................................................................................................................. 11-3 clear logging server ...................................................... 10-10 Chapter 11: Logging and Network Management Configuring System Logging ....... 10-3 set igmpsnooping adminmode............... 10-4 set igmpsnooping groupmembershipinterval ................................................................................................................................................... 11-13 set history .............................................................................................................................................................................................................................. 11-15 Managing Switch Network Addresses and Routes ..Commands .............................................. 9-14 clear port ratelimit .......................................................... 11-11 Monitoring Network Events and Status ................................................................. 10-2 Purpose ................................................................................................................................................................................................................................................................................................................................................................................. 10-6 set igmpsnooping add-static ....................................................................................... 11-10 show logging buffer ............................................ 11-15 disconnect ...................................................................................................................................... 9-15 Chapter 10: IGMP Configuration IGMP Overview ........................................................... 10-2 show igmpsnooping ............................................................................................................................................................................ 10-3 set igmpsnooping interfacemode............................................................................................................................................... 11-9 set logging local...................................................................................................................................................................................................................................................................................................................... 11-8 clear logging application ............ 11-17 set arp.......................... 11-7 set logging application ................ 10-5 set igmpsnooping maxresponse .......................................................................................................................................................... 11-17 Purpose .................................................................................................................................................................................................................................................................. 11-12 Purpose .................................................................................................................................................................. 10-2 Commands ...................................................................... 11-5 clear logging default ........................................................ 10-7 show igmpsnooping static ............................................................................................................................................................................................................................................................................................................................................... 11-10 clear logging local.. 10-8 show igmpsnooping mfdb ......................................................................................................................................................................................................................... 11-1 Purpose ............................. 10-1 About Multicasting ............................................................................................................................................... 9-12 show port ratelimit ........................................................................................................................ 11-2 set logging server ................................................................................................................................................................................ 11-4 set logging default ...................................................................... 11-12 Commands ................................................................................................................ 9-12 set port ratelimit ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 11-18 xiv ...................................................................... 11-12 show history......... 11-1 show logging server..................................................................................................... 11-13 ping.................... 11-9 show logging local ....... 11-6 show logging application ...................... 11-4 show logging default.................................................................................................................................................................................................................................................................................................................................................. 10-9 clear igmpsnooping .. 11-14 show users ............................... 11-1 Commands ................................................................................................................................................................................................................................................................................................................................... 10-1 About IP Multicast Group Management .......................................................................................................................................................................................................................................................................................................................................................... 11-12 history ................................................ 10-1 Configuring IGMP at Layer 2 ..................................... 11-17 show arp ................................................................................... 10-7 set igmpsnooping remove-static ...................... 11-17 Commands ....................................................

........................... 11-31 show nodealias config ........................................................................................ 11-28 set sntp poll-retry ..................................................................... 11-24 Purpose ......................... 11-32 clear nodealias config ................................................................................................................................................................................................................................................................... 12-15 Commands ...................................................................................................................................................................................................................................................... 12-10 Purpose ............................................................................................................................................................................................................................................................................................................................................................................. 11-31 set nodealias .......................................................................................... 12-10 Commands ............................................................................ 12-15 Purpose ............................................................................................................................................. 11-18 traceroute .......................................................................................... 12-7 set rmon history ........................ 12-3 show rmon stats ..................................................................................................................................................... 11-24 set sntp client................. 12-17 clear rmon event............................................................................................................................................................................................................... 12-7 show rmon history .................................................. 11-29 clear sntp poll-retry .................. 11-19 show mac .................................................................................................................................. 11-24 show sntp ............................................................................................................ 12-9 Alarm Group Commands ........................................................................................ 12-15 set rmon event properties ........................................................................... 12-14 Event Group Commands ........................................................................................................................... 11-23 Configuring Simple Network Time Protocol (SNTP) .....................................................................................................................................................................................................................................................................................................................................................................................clear arp..................................................................................................................................... 12-3 set rmon stats ............................... 12-11 set rmon alarm status .. 12-18 xv .................................................................................................................................................................................................................................................................................................................................................... 11-29 set sntp poll-timeout ...................................... 12-15 show rmon event ............. 11-22 set mac agetime . 12-8 clear rmon history ............. 12-13 clear rmon alarm.................................................................................................................................................................................................................................................................................. 11-31 Commands ......................................................................................................................................................................................................................................................................................................................................... 12-5 clear rmon stats .......................................................... 11-24 Commands . 11-26 clear sntp client................................................................................................................................................................................................................... 12-3 Commands .......................................................................................................................... 12-6 History Group Commands .................................................................................... 11-30 clear sntp poll-timeout .................. 12-10 set rmon alarm properties.......................................... 12-7 Commands .................................................................... 11-31 Purpose ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 11-30 Configuring Node Aliases ............................................... 11-26 set sntp server ................................................................................................................................................................................................................................................................................ 12-1 Statistics Group Commands ............................................................................................................................. 11-22 clear mac agetime ................................................................................................................................................................................................................................................................................................................................................................................................................. 12-10 show rmon alarm .............................. 11-28 clear sntp poll-interval........................................................... 12-16 set rmon event status ................................................................................................................................................. 12-7 Purpose ............................................ 11-27 set sntp poll-interval................................................................................................................................................................................................................................................................................................................................................................................................................................. 11-27 clear sntp server ....... 12-3 Purpose ............................................................................................ 11-33 Chapter 12: Configuring RMON RMON Monitoring Group Functions ............. 11-20 show mac agetime.......

.................................. 12-24 set rmon capture................................................. 13-3 Purpose ..................................................................................................................... 13-4 show dhcp conflict ................................................................................................................................................................................................................................................................................................................................................................................................................................................ 13-11 Purpose .................................................................................................................................................................................................................................................................................................... 12-25 clear rmon capture............................................................... 12-19 set rmon channel ................................................................................................................................................................................ 12-26 Chapter 13: Configuring DHCP Server DHCP Overview ................................................................ 13-6 clear dhcp exclude................................................................................................................................................................................................................................................ 13-17 clear dhcp pool client-identifier .................................................................................................................................................................................................................................................. 13-16 clear dhcp pool host .................................................................. 13-9 show dhcp server statistics................................................................................................................................................... 13-10 Configuring IP Address Pools ................................................................................................................................................................................................................................................................................................................................. 12-24 Purpose ........................................................... 13-7 clear dhcp ping ....................................................................................................................... 13-1 DHCP Server .................................................................................................................................................. 13-14 clear dhcp pool network......................................................... 13-1 Configuring a DHCP Server ...................................13-19 set dhcp pool bootfile....................................................... 13-3 Commands ........................................................................................................ 13-4 set dhcp conflict logging ....................................................................................................................................................................................................................................................................... 12-19 show rmon channel ................................................................................................................................................................................................................. 13-2 Configuring General DHCP Server Parameters ..................................................................................................................................................................................................................................... 12-22 clear rmon filter ............................... 12-23 Packet Capture Commands ....................................................................................................... 13-11 Manual Pool Configuration Considerations .................................................................. 13-14 set dhcp pool hardware-address .................................. 12-20 clear rmon channel ................................................................................................................................................................................................................................................................................................................................................................................................................. 13-7 set dhcp ping ............... 13-21 clear dhcp pool next-server ................................................................................................................................................................................................................................................................................................................................................................................................................................................... 13-3 set dhcp bootp .................................................................................... 13-18 set dhcp pool client-name...................................... 13-11 set dhcp pool ................................................ 13-5 clear dhcp conflict....................................................................................................... 13-20 set dhcp pool next-server ................................................................................................................................................................................................ 13-5 set dhcp exclude....13-21 xvi .......................................................................................................... 13-8 clear dhcp binding ................ 13-8 show dhcp binding........................................................................... 12-21 show rmon filter ............................................................................................................................................. 13-13 clear dhcp pool .......................................... 13-11 Commands .............................................................. 12-21 set rmon filter ....................................................................... 13-16 set dhcp pool host ............................................... 13-19 clear dhcp pool client-name......................................................... 13-17 set dhcp pool client-identifier ...............................................................................................Filter Group Commands .................................................... 12-24 Commands ................ 13-9 clear dhcp server statistics ................................................. 13-15 clear dhcp pool hardware-address ............................... 13-13 set dhcp pool network................................................................................................................................. 12-24 show rmon capture ............ 13-3 set dhcp ...................................................................... 12-19 Commands ............................................................................................................................................................................................................................................... 13-20 clear dhcp pool bootfile...............................................................................

.................................... 14-27 set macauthentication portinitialize................... 14-8 set radius accounting................................................................................................................................. 14-27 set macauthentication portquietperiod........................................................................... 14-29 set macauthentication portreauthenticate....................................................................................................................... 14-11 Commands ................................................................................................................................................................................................... 13-22 set dhcp pool default-router ..........................................................................................................................................................................................set dhcp pool lease................................................. 14-22 Purpose ................ 14-7 show radius accounting ............................................................................................................................................................................................................................................................. 14-26 clear macauthentication password ......................... 14-3 Commands ............................................................................................................................................................................................ 14-13 set dot1x .. 14-3 Purpose .............................................................. 14-24 set macauthentication........... 13-25 clear dhcp pool domain-name ............... 14-17 show eapol ........................................... 14-5 clear radius .................................................................................................................................................................................................................................................................................................... 14-15 set dot1x auth-config .................................................................................................................................................................................................................................................................................................................................................................................... 14-20 clear eapol ................................. 13-28 set dhcp pool option ........................................................................ 13-25 set dhcp pool domain-name ........................................ 14-11 show dot1x ......................................................................... 14-23 show macauthentication session ............................................................................................................................. 14-25 set macauthentication password ........................................ 14-29 set macauthentication reauthentication ............................................................................................................................. 14-30 set macauthentication reauthperiod ...................................................................................... 13-28 clear dhcp pool option ............................................................................................ 13-24 clear dhcp pool dns-server .................................... 14-18 set eapol ....................... 14-10 Configuring 802................................................................................................................................................................14-30 set macauthentication macreauthenticate ................. 13-26 set dhcp pool netbios-name-server .......................................................................................................................................... 14-22 Commands .................... 14-3 show radius ............................................................................................................................................ 14-28 clear macauthentication portquietperiod................................................................................................................................................................................................................ 14-26 set macauthentication port ............. 14-12 show dot1x auth-config.................................................................................................................................................................................................................................................................................. 13-26 clear dhcp pool netbios-name-server ............................................................................. 14-16 clear dot1x auth-config ............................................ 13-29 show dhcp pool configuration ................................................................................................... 14-28 set macauthentication macinitialize ................................................................................................................................................................................................................................................................ 14-22 show macauthentication ..... 13-30 Chapter 14: Security Configuration Overview of Security Methods ...............................................................................................1X Authentication ........................................................................................................................................................ 13-22 clear dhcp pool lease......................................................................................................................................................................... 13-24 set dhcp pool dns-server ............................................................................................................... 14-1 Configuring RADIUS ............................................................................................................................................................................................................................13-23 clear dhcp pool default-router............................... 14-9 clear radius accounting............................14-31 xvii ........................................................................................................................................................................................................................................................................................................................ 13-27 set dhcp pool netbios-node-type ................................... 14-11 Purpose ............................... 14-21 Configuring MAC Authentication .......................................................................................................................................................................................................................................................................................................................................................................... 13-27 clear dhcp pool netbios-node-type ..................................................................................................................................... 14-4 set radius ...........................................................................................................................

......................................................................... 14-35 set multiauth mode .............................................. 14-34 Commands ................ 14-54 Configuring Secure Shell (SSH) ................................................................................................................................................ 14-36 clear multiauth mode ................................................................................................................................................................................................................................................................................................................................................................................. 14-47 set maclock enable..................................................................................................................... 14-51 clear maclock static .............................................. 14-37 clear multiauth precedence ........................................................................................................................clear macauthentication reauthperiod . 14-58 set access-list (create rules) ................................ 14-41 set vlanauthorization....................................................................................... 14-53 set maclock trap ........ 14-42 set vlanauthorization egress ............................................................................................................................................................................. 14-62 Index xviii .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................. 14-57 Commands .......................................... 14-40 Configuring VLAN Authorization (RFC 3580) ...................................................................................................... 14-32 set macauthentication significant-bits ............................ 14-45 show maclock .................................................................................. 14-61 clear access-list .............. 14-56 Configuring Layer 2 Access Control Lists ............................ 14-33 Configuring Multiple Authentication Methods ........................................................................ 14-34 About Multiple Authentication Types ..................................................................................................................................................................................... 14-59 set access-list (ports)......14-37 show multiauth port ...................................................... 14-50 set maclock static ..................................................... 14-60 show access-list ports ........................................................................................................... 14-41 Purpose ................................................................................................................................................................................................................... 14-42 clear vlanauthorization................................................................................................................................................................................................. 14-45 Commands ..................... 14-34 show multiauth................................................ 14-49 clear maclock........................................................................................................................... 14-53 set maclock move ........................................................................................................... 14-36 set multiauth precedence ........................................................ 14-38 set multiauth port ................................................................................................................................................................................................................................................................................................................................................................................................................. 14-45 Purpose ....................................... 14-39 show multiauth station ......................................................................................................................................................................................................................... 14-52 clear maclock firstarrival ......................................................................................................................... 14-60 show access-list ...................................................................................................................... 14-32 clear macauthentication significant-bits ........................................................................................................................................................................................................................................................................... 14-41 Commands ............................ 14-43 show vlanauthorization ............................................................................................................................................................................. 14-44 Configuring MAC Locking ..................................................... 14-56 set ssh hostkey.......................................................................................................................... 14-48 set maclock disable ................................................... 14-51 set maclock firstarrival ...... 14-55 Purpose ........................................................................................................................................... 14-39 clear multiauth port .................................................................................................... 14-55 show ssh status .................. 14-58 set access-list (create list) .................................................................................................................................................................................................................................................................................. 14-49 set maclock................................................................................................................................................................................................................................................................ 14-55 Commands ............................................................................................................................................................ 14-46 show maclock stations............................................................ 14-55 set ssh ...............................

............................................................................................................................................................................................................................. 5-2 show snmp engineid Output Details .......................................................... 4-7 LACP Terms and Definitions ................................................................................................................................................................ 14-44 show maclock Output Details ............................................................ 5-41 show spantree Output Details ................................................................................................................................................................................................................................................................................... 5-17 show snmp view Output Details ..................................................................... 14-19 show macauthentication Output Details ............................................................ 14-23 show macauthentication session Output Details ............................................. 9-13 show logging server Output Details........ 1-7 Performing a Keyword Lookup ........ 6-6 Command Set for Creating a Secure Management VLAN ......... 11-21 show sntp Output Details............................... 14-4 show eapol Output Details.............................................. 12-16 show radius Output Details................................................................................. 11-8 show arp Output Details ....................................................................................................................................................................................................................................................................................... 1-2 Basic Line Editing Commands.............................................................. 12-4 show rmon alarm Output Details ............................................................................................................................................................................................... 1-8 Abbreviating a Command ............................... 14-47 xix ................................................................................................................................................................................................ 8-7 show port ratelimit Output Details....................................... 4-5 show port counters Output Details ................................................................................................................. 12-1 show rmon stats Output Details........................................................................................................................................................................ 11-7 Mnemonic Values for Logging Applications.................................................................................................................................................................... 14-46 show maclock stations Output Details................................................................................................................................................................................ 1-9 show system lockout Output Details............................................................ 4-29 show lacp Output Details..... 7-2 show vlan Output Details........................................................................... 11-32 RMON Monitoring Group Functions and Commands ......................................................................................................... 1-7 Performing a Partial Keyword Lookup ............................................................... 11-25 show nodealias config Output Details .................................. 12-11 show rmon event Output Details .................................................................. 7-24 Tables 1-1 1-2 3-1 3-2 3-3 3-4 4-1 4-2 4-3 4-4 5-1 5-2 5-3 5-4 5-5 5-6 5-7 5-8 5-9 5-10 5-11 6-1 7-1 7-2 7-3 8-1 9-1 11-1 11-2 11-3 11-4 11-5 11-6 11-7 12-1 12-2 12-3 12-4 14-1 14-2 14-3 14-4 14-5 14-6 14-7 Default Settings for Basic Switch Operation .............................................. 3-13 show version Output Details ........................................................................................................................................................................................................................................................................................................................................................................................................ 4-31 SNMP Security Levels.................................................................................................................................................... 11-2 show logging application Output Details......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 3-22 show cdp Output Details......................................................................................................................................... 5-21 show snmp targetparams Output Details .......................................................Figures 1-1 1-2 1-3 1-4 1-5 1-6 7-1 SecureStack A2 Startup Screen ............ 5-12 show snmp access Output Details .... 5-10 show snmp group Output Details . 3-50 show port status Output Details................................................................................ 7-26 Valid IP DSCP Numeric and Keyword Values ....................... 1-5 Sample CLI Defaults Description................................................................................................................................................................................................................................................................................................................................................................................................................................................ 1-8 Example of VLAN Propagation via GVRP ......................... 11-18 show mac Output Details................................................... 5-34 Basic SNMP Trap Configuration.............................................................................................. 3-7 show system Output Details ...................................................................... 14-25 show vlanauthorization Output Details ............ 5-4 show snmp counters Output Details ..................................................................................................................... 5-30 show snmp notify Output Details ...... 5-26 show snmp targetaddr Output Details .. 7-4 show gvrp configuration Output Details ................... 5-6 show snmp user Output Details.. 1-7 Scrolling Screen Output...................................................

................14-8 ACL Rule Precedence .......................................................... 14-57 xx ...........................................

 how to manage configuration files. Introduction. Configure security protocols. Chapter 5. how  to set the login password. Refer to the Release Notes shipped with your device to determine which features are supported. port mirroring. MAC locking. Using This Guide A general working knowledge of basic network operations and an understanding of CLI  management applications is helpful before configuring the SecureStack device. how to configure WebView and Telnet. Chapter 4. how to download a  firmware image. Configuring Switches in a Stack. including port speed. and information about using the Command Line Interface (CLI). and how to exit the CLI. some features described in this document may not be supported. provides information about how to configure and  manage stacked switches. flow control. Chapter 2.  This manual describes how to do the following: • • • • • • Access the SecureStack CLI. Establish and manage priority classification.  Important Notice Depending on the firmware version used in your SecureStack device. Chapter 3. Port Configuration. an overview of the device’s factory  default settings. and MAC  authentication. Use CLI commands to perform network management and device configuration operations Establish and manage Virtual Local Area Networks (VLANs). access  rights. This manual explains  how to access the device’s Command Line Interface (CLI) and how to use it to configure  SecureStack A2 switch devices.About This Guide Welcome to the Enterasys Networks SecureStack A2 Configuration Guide. describes how to review and configure console port settings. Establish and manage static and dynamically‐assigned policy classifications. auto‐negotiation. SNMP Configuration. SSHv2. target addresses. an overview of local management requirements.1X and RADIUS.  duplex mode. provides how to set basic system properties. including 802. and notification parameters. and  how to enable or disable switch ports and configure switch port settings. describes how to configure SNMP users and user groups. Structure of This Guide The guide is organized as follows:  Chapter 1. SecureStack A2 Configuration Guide xxiii . provides an overview of the tasks that can be accomplished using the  CLI interface. Basic Configuration. link aggegation and broadcast  suppression.

 MAC authentication. display the current ports and port types associated with a VLAN and protocol. how to review and configure DHCP address pools. establish VLAN forwarding (egress) lists. create a  secure management VLAN. Configuring DHCP Server. and manage the  SecureStack device: • • • • Ethernet Technology Guide Cabling Guide SecureStack A2 Installation Guide(s) SecureStack Redundant Power System Installation Guide Documents listed above. and MAC  locking.enterasys. 802.  Chapter 13.Related Documents Chapter 6. describes how to configure 802. IGMP Configuration. Related Documents The following Enterasys Networks documents may help you to set up. describes how to review and configure DHCP server  parameters. and how to configure Layer 2 ACLs. and how to review and set Spanning Tree port parameters. describes how to display and configure  Diffserv settings. Logging and Network Management. describes how to configure Syslog. maximum aging time and forward  delay. Spanning Tree Configuration. route frames according to  VLAN ID. Secure Shell server. describes how to configure Internet Group Management  Protocol (IGMP) settings for multicast filtering. Differentiated Services Configuration. Chapter 11. and performance tuning  information and allows for interoperability between SNMP management stations and monitoring  agents. hello time.1Q VLAN Configuration. Chapter 9.  which provides comprehensive network fault diagnosis. control. how to configure RADIUS server. describes how to review and set Spanning Tree bridge  parameters for the device.  Chapter 8.  Chapter 7. describes how to create static VLANs.com/support/manuals/ xxiv About This Guide . how to monitor network events and status. describes how to use RMON (Remote Network Monitoring). Configuring RMON. and configure ports on the device as GVRP‐aware ports. planning. Security Configuration. and how to display DHCP server  information.1X authentication using  EAPOL. describes how to set the transmit  priority of each port and configure a rate limit for a given port and list of priorities. including bridge priority.and how to configure  SNTP and node aliases. Chapter 14. including port priority and path  costs. select the mode of  operation for each port. can be obtained from the World Wide Web in Adobe Acrobat Portable  Document Format (PDF) at the following web site: http://www. how to  manage general switch settings. Port Priority and Rate Limiting Configuration. Chapter 12. Chapter 10.

Achtung: Verweißt auf wichtige Informationen zum Schutz gegen Beschädigungen. The following icons are used in this guide: Note: Calls the reader’s attention to any item of information that may be of special importance. parameters or keyboard keys. Caution: Contains information essential to avoid damage to the equipment. Precaución: Contiene información esencial para prevenir dañar el equipo. Indicates a user-supplied value. Square brackets indicate an optional value. A vertical bar indicates a choice in values. A combination of square brackets with braces and vertical bars indicates a required choice of an optional value. either required or optional.Conventions Used in This Guide Conventions Used in This Guide The following conventions are used in the text of this document: Convention Bold font italic font Courier font Courier font in italics [] {} | [x | y | z] {x | y | z} [x {y | z} ] Description Indicates mandatory keywords. SecureStack A2 Configuration Guide xxv . Braces indicate required values. Braces with a vertical bar indicate a choice of a required value. Square brackets with a vertical bar indicate a choice of a value. One or more values may be required. Indicates complete document titles. Used for examples of information displayed on the screen.

S. Before calling Enterasys Networks. is this a recurring  problem?) Any previous Return Material Authorization (RMA) numbers xxvi About This Guide . type [C-SERIES] in the subject line.enterasys. To send comments or suggestions concerning this document to the Technical Publications Department: techpubs@enterasys. have you returned the switch before. layout. have the following information ready: • • • • • • • • Your Enterasys Networks service contract number  A description of the failure A description of any action(s) already taken to resolve the problem (for example. contact Enterasys Networks using one  of the following methods: World Wide Web http://www.com To expedite your message.enterasys.com/services/support 1-800-872-8440 (toll-free in U.Getting Help Getting Help For additional support related to this switch or document. and Canada) or 1-978-684-1000 Phone Internet mail For the Enterasys Networks Support toll-free number in your country: http://www.com Make sure to include the document Part Number in the email message. cable type) Network load and frame size at the time of trouble (if known) The switch history (for example.com/services/support/contact/ support@enterasys. changing  mode switches or rebooting the unit) The serial and revision numbers of all involved Enterasys Networks products in the network A description of your network environment (for example.

. Assign IP address and subnet mask. factory default settings. MAC locking.. SecureStack A2 Configuration Guide 1-1 . Establish and manage priority classification. Establish and manage Virtual Local Area Networks (VLANs).1X and RADIUS. Select a default gateway. an overview of ways to  manage the switch. an  overview of the tasks that may be accomplished using the CLI interface. and information about how to use the Command Line  Interface to configure the switch.1 Introduction This chapter provides an overview of the SecureStack A2’s unique features and functionality. SSHv2. Download a new firmware image. SecureStack A2 CLI Overview Switch Management Methods Factory Default Settings Using the Command Line Interface Refer to page . 1-1 1-2 1-2 1-5 SecureStack A2 CLI Overview Enterasys Networks’ SecureStack A2 CLI interface allows you to perform a variety of network  management tasks.. PWA. and  MAC authentication. including 802. Configure security protocols. including the following: • • • • • • • Use CLI commands to perform network management and switch configuration operations. For information about ..

 Enterasys Networks’ embedded web server application. 20 lines. set to auto for all ports.Switch Management Methods Switch Management Methods The SecureStack A2 switch can be managed using the following methods: • • • • • • Locally using a VT type terminal connected to the console port. Globally enabled. Set to 00-00-00-00-00-00-00-00 Set to 180 seconds. Remotely using an SNMP management station. Join timer set to 20 centiseconds. leaveall timer set to 1000 centiseconds. 1-2 Introduction . In‐band through a Telnet connection. Transmit frequency of CDP messages set to 60 seconds. Set to 60 seconds. Remotely using a VT type terminal connected through a modem. Baud rate: 9600 Data bits: 8 Flow control: disabled Stop bits: 1 Parity: none DHCP server Diffserv EAPOL EAPOL authentication mode GARP timer GVRP History buffer size Disabled. When enabled. Disabled.  Table 1-1 Feature CDP discovery protocol CDP authentication code CDP hold time CDP interval Cisco discovery protocol Cisco DP hold time Cisco DP interval timer Community name Console (serial) port required settings Default Settings for Basic Switch Operation Default Setting Auto enabled on all ports. In‐band using the Enterasys NetSight® management application. Public. leave timer set to 60 centiseconds. Table 1‐1  lists default settings for SecureStack A2 switch operation. Factory Default Settings The following tables list factory default settings available on the SecureStack A2 switch. Remotely using WebView™. Auto enabled on all ports. The Installation Guide for your SecureStack A2 device provides setup instructions for connecting a  terminal or modem to the switch. Disabled. Set to 180 seconds.

Set to an empty string for all default user accounts. Logging severity level set to 6 (significant conditions) for all applications. All ports are enabled to send link traps. query interval is set to 260 seconds and response time is set to 10 seconds. Set to 300 seconds. Disabled. Administrative state is on (auto). Disabled.0. which is set to full duplex. IEEE 802. default gateway set to 0. after 3 failed login attempts. Syslog port set to UDP port number 514. and 100BASE-FX.881 per second on all switch ports Port duplex mode Port enable/disable Port priority Port speed Port trap Power over Ethernet port admin state Priority classification Set to half duplex.1 authentication IGMP snooping IP mask and gateway IP routes Jumbo frame support Link aggregation control protocol (LACP) Link aggregation admin key Link aggregation flow regeneration Link aggregation system priority Link aggregation outport algorithm Lockout Logging MAC aging time MAC locking Passwords Password aging Password history Port auto-negotiation Port advertised ability Port broadcast suppression Enabled and set to limit broadcast packets to 14. Set to disable Read-Write and Read-Only users. Disabled.0. Set to 32768 for all ports. When enabled. No static routes configured.0.Factory Default Settings Table 1-1 Feature Default Settings for Basic Switch Operation (Continued) Default Setting Disabled. Disabled (globally and on all ports). Set to DIP-SIP.0. Enabled.0. Set to 0. which is set to 100 Mbps. Enabled on all ports. Set to 10 Mbps. Set to 32768 for all ports. Subnet mask set to 0. and to lockout the default admin (Super User) account for 15 minutes. except for 100BASE-FX and 1000BASE-X. SecureStack A2 Configuration Guide 1-3 . Enabled. No passwords are checked for duplication. except for 1000BASE-X. User must press ENTER at the password prompt to access CLI. Enabled on all ports. which is set to 1000 Mbps. Classification rules are automatically enabled when created.0. Maximum ability advertised on all ports.

Set to 2 seconds. If a Spanning Tree BDPU is not received on the port within a few seconds. All ports use a VLAN identifier of 1. CLI display set to 80 columns and 24 rows. Disabled (globally and on all ports). Enabled. Edge port administrative status begins with the value set to false initially after the device is powered up. Set to empty string. Set to mstp (Multiple Spanning Tree Protocol). RADIUS client RADIUS last resort action RADIUS retries RADIUS timeout Rate limiting SNMP SNTP Spanning Tree Spanning Tree edge port administrative status Spanning Tree edge port delay Spanning Tree forward delay Spanning Tree hello interval Spanning Tree ID (SID) Spanning Tree maximum aging time Spanning Tree port priority Spanning Tree priority Spanning Tree topology change trap suppression Spanning Tree version SSH System baud rate System contact System location System name Terminal Timeout User names VLAN dynamic egress VLAN ID Host VLAN 1-4 Introduction . All ports with bridge priority are set to 128 (medium priority). rw for Read-Write access. set to 20 seconds. Enabled. Disabled. Set to 20 seconds. the status setting changes to true. Set to 9600 baud. When the client is enabled. Disabled on all VLANs.Factory Default Settings Table 1-1 Feature Default Settings for Basic Switch Operation (Continued) Default Setting Disabled. Set to 0. When the client is enabled. Bridge priority is set to 32768. Set to 15 seconds. Globally enabled and enabled on all ports. Default host VLAN is 1. and admin for Super User access. Set to empty string. Disabled. Set to empty string. set to 3. Enabled. Login accounts set to ro for Read-Only access. When the client is enabled. Set to 5 minutes. set to Challenge.

enterasys. SecureStack A2 Configuration Guide 1-5 . Inc. For information about setting the switch’s IP address. SecureStack A2 Startup Screen Figure 1-1 Username:admin Password: Enterasys SecureStack A2 Command Line Interface Enterasys Networks. refer to “Starting and Configuring Telnet” on  page 3‐37. 2. Telnet to the switch’s IP address. follow the  steps listed in “Using a Default User Account” on page 1‐6. Phone: +1 978 684 1000 E-mail: support@enterasys. you can establish a Telnet session from any  TCP/IP based node on the network.com WWW: http://www. 2006 Chassis Serial Number: Chassis Firmware Revision: 041800249041 1.Using the Command Line Interface Using the Command Line Interface Starting a CLI Session Connecting Using the Console Port Connect a terminal to the local console port as described in your SecureStack A2 Installation Guide.  Enter login (user name) and password information in one of the following ways: – – If the switch’s default login and password settings have not been changed. The notice of authorization and the prompt displays as shown in Figure 1‐1. For information about configuring Telnet settings.  The startup screen. You can now start the Command Line  Interface (CLI) by  • • using a default user account.com (c) Copyright Enterasys Networks. MA 01810-1008 U.xx A2(su)-> Connecting Using Telnet Once the SecureStack A2 device has a valid IP address.S.A. or Enter an administratively‐configured user name  and password. 50 Minuteman Rd. or  using an administratively‐assigned user account as described in “Using an Administratively  Configured User Account” on page 1‐6. refer to  “set ip address” on page 3‐10. Figure 1‐1. To establish a Telnet session: 1. will display on the terminal. Inc. as described in “Using a Default User Account” on page 1‐6.04. Andover.

Using the Command Line Interface Refer to the instructions included with the Telnet application for information about establishing a  Telnet session. refer to “Setting User Accounts and Passwords” on page 3‐2. Leave this string blank and press ENTER. 2. 3. At the Password prompt. Administrators with Super User (su) access can use the set system login command (page 3-3) to create and change user accounts.  For information on changing these  default settings. ro for Read‐Only access. 1-6 Introduction . proceed as follows: 1. At the login prompt. At the login prompt.  CLI Command Defaults Descriptions Each command description in this guide includes a section entitled “Defaults” which contains  different information from the factory default settings on the switch described in Table 1‐1. proceed as follows: 1.  admin for Super User access. and the set password command to change any local account password. Logging In By default. The   section defines CLI behavior if the user enters a command without typing optional parameters  (indicated by square brackets [ ]). The notice of authorization and the prompt displays as shown in Figure 1‐1. Note: Users with Read-Write (rw) and Read-Only access can use the set password command (page 3-4) to change their own passwords. enter one of the following default user names: – – – 2. The switch information and prompt displays as  shown in Figure 1‐1. this section describes how the CLI  responds if the user opts to enter only the keywords of the command syntax. or if the default user  accounts have not been administratively changed. enter your password and press ENTER. Navigating the Command Line Interface Getting Help with CLI Syntax The SecureStack A2 switch allows you to display usage and syntax information for individual  commands by typing help or ? after the command. For commands with optional parameters. The default password is set to a blank string. For commands without optional parameters. The Password prompt displays. Figure 1‐2 provides  an example.  Press ENTER. Using an Administratively Configured User Account If the switch’s default user account settings have been changed. rw for Read‐Write access. enter your administratively‐assigned user name and press ENTER. rw for Read‐Write access. the defaults  section lists “None”. and admin for super‐user access to all modifiable  parameters. the SecureStack A2 switch is configured with three user login accounts—ro for  Read‐Only access. Using a Default User Account If this is the first time you are logging in to the SecureStack A2 switch.

Figure 1-3 Performing a Keyword Lookup A2(su)->show snmp ? community notify targetaddr targetparams SNMP SNMP SNMP SNMP v1/v2c notify target target community name configuration configuration address configuration parameters configuration Entering a question mark (?) without a space after a partial keyword will display a list of  commands that begin with the partial keyword. Users with Read‐ Write access will be able to modify all modifiable parameters in set and show commands. Figure 1‐4 shows how to use this function for all  commands beginning with co: Figure 1-4 Performing a Partial Keyword Lookup copy A2(rw)->co? configure A2(su)->co Note: At the end of the lookup display. status information for all ports will be displayed. In this case.  CLI Command Modes Each command description in this guide includes a section entitled “Mode” which states whether  the command is executable in Admin (Super User). Administrators or Super Users will be allowed all Read‐Write and  Read‐Only privileges. Entering  a space and a question mark (?) after any of these parameters (such as show snmp community)  will display additional parameters nested within the syntax. as well  as view Read‐Only commands. or Read‐Only mode.Using the Command Line Interface Figure 1-2 Sample CLI Defaults Description Syntax show port status [port-string] Defaults If port‐string is not specified. The SecureStack A2 switch  indicates which mode a user is logged in as by displaying one of the following prompts: • • • Admin: A2(su)‐> Read‐Write: A2(rw)‐> Read‐Only: A2(ro)‐> Performing Keyword Lookups Entering a space and a question mark (?) after a keyword will display all commands beginning  with the keyword. Users with  Read‐Only access will only be permitted to view Read‐Only (show) commands. four additional keywords are used by the show snmp command. Read‐Write. Figure 1‐3 shows how to perform a keyword lookup for the show snmp  command. SecureStack A2 Configuration Guide 1-7 . the system will repeat the command you entered without the ?. and will be able to modify local user accounts.

23 134. Figure 1-5 Scrolling Screen Output A2(su)->show mac MAC Address FID Port Type ---------------------------------------------------------00-00-1d-67-68-69 1 host Management 00-00-02-00-00-00 1 fe.73.3 Learned 00-00-02-00-00-02 1 fe.* UDP 0 0 10.80 *. The example in Figure 1‐5 shows how the show mac command indicates that output continues on  more than one screen. CLI  output requiring more than one screen will display --More-.89.10 Learned --More-- Abbreviating and Completing Commands The SecureStack A2 switch allows you to abbreviate CLI commands and keywords down to the  number of characters that will allow for a unique abbreviation.1.--------------------TCP 0 0 10.141.1.119.1030 134.1. Figure 1‐6 shows how to  abbreviate the show netstat command to sh net.23 *.192.13.1.13.6 Learned 00-00-02-00-00-05 1 fe. Figure 1-6 Abbreviating a Command A2(su)->sh net Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address ----.1.161 *.to indicate continuing screens.4724 TCP 0 0 *.21.2 Learned 00-00-02-00-00-01 1 fe.4 Learned 00-00-02-00-00-03 1 fe.141. To  display additional screen output: • • Press any key other than ENTER to advance the output one screen at a time.51246 TCP 0 275 10.1025 *.123 *.1.73.73.190.1.1.21.21.* State ------ESTABLISHED ESTABLISHED LISTEN LISTEN 1-8 Introduction .* UDP 0 0 *.-----.--------------------.* UDP 0 0 *.5 Learned 00-00-02-00-00-04 1 fe.* TCP 0 0 *.8 Learned 00-00-02-00-00-07 1 fe.141.Using the Command Line Interface Displaying Scrolling Screens If the CLI screen length has been set using the set length command as described on page 3‐25.113.7 Learned 00-00-02-00-00-06 1 fe.514 UDP 0 0 *.9 Learned 00-00-02-00-00-08 1 fe.13. Press ENTER to advance the output one line at a time.23 134.94.-----.1.

Complete word. Delete all characters after cursor.  Table 1-2 Basic Line Editing Commands Command Move cursor to beginning of line. Scroll to next command in command history (use the CLI history command to display the history). Key Sequence Ctrl+A Ctrl+B Ctrl+D Ctrl+E Ctrl+F Ctrl+H Ctrl+I or TAB Ctrl+K Ctrl+N Ctrl+P Ctr1+Q Ctr1+S Ctrl+T Ctrl+U or Ctrl+X Ctrl+W Ctrl+Y SecureStack A2 Configuration Guide 1-9 . Move cursor back one character. Delete character to left of cursor.Using the Command Line Interface Basic Line Editing Commands The CLI supports EMACs‐like line editing commands. Pause the CLI process (for scrolling). Move cursor forward one character. Scroll to previous command in command history. Resume the CLI process. Delete all characters before cursor. Table 1‐2 lists some commonly used  commands. Restore the most recently deleted item. Delete word to the left of cursor. Transpose characters. Move cursor to end of line. Delete a character.

Using the Command Line Interface 1-10 Introduction .

About SecureStack A2 Switch Operation in a Stack Installing a New Stackable System of Up to Eight Units Installing Previously-Configured Systems in a Stack Adding a New Unit to an Existing Stack Creating a Virtual Switch Configuration Considerations About Using Clear Config in a Stack Configuring Standalone A2 Stack Ports Stacking Configuration and Management Commands Refer to page . is powered down. For information about .  The console port on the manager switch remains active for out‐of‐band (local) switch  management.  you can start with a single unit and add more units as your network expands. but the console port on each member switch is deactivated. the switches behave and perform as a single switch product.2 Configuring Switches in a Stack This chapter provides information about configuring SecureStack A2 switches in a stack. a stack of units  performs as one large product.  Once installed in a stack.  The hierarchy of the switches that will assume the function of backup manager is also  determined in case the current manager malfunctions.. All other switches are established as members in the stack.. As such. Now each switch can be  configured locally using only the manager’s console port. This is known as the  manager switch. In all cases. or is disconnected  from the stack.. or inband using a remote device and  the CLI set of commands described in this section. This enables you to  set the IP address and system password using a single console port. These switches provide a management platform and uplink to a network  backbone for a stacked group of up to eight SecureStack A2 switches. SecureStack A2 Configuration Guide 2-1 • ..  the following occurs during initialization: • • • The switch that will manage the stack is automatically established. 2-1 2-2 2-3 2-3 2-4 2-5 2-5 2-6 About SecureStack A2 Switch Operation in a Stack The SecureStack A2 products are stackable switches that can be adapted and scaled to help meet  your network needs. When switches are installed and connected as described in the SecureStack A2 Installation Guides. and is managed as a single network entity. You can also mix  different products in the family in a single stack to provide a desired combination of port types  and functions to match the requirements of individual applications.

 When you enter the command with a  unit number. b. Then. this will ensure that unit IDs are ordered sequentially. the MGR LED of the specified switch will blink for 10 seconds. 5. The management election process uses the following precedence to assign a management  switch: a. Important The following procedures assume that all units have a clean configuration from manufacturing.  1. 2. Since unit IDs are assigned on a first-come. it will  initialize with the same unit ID.Installing a New Stackable System of Up to Eight Units Once a stack is created (more than one switch is interconnected). 3. When adding a new unit to an already running stack. c. The normal state  of this LED is off for member units and steady green for the manager unit. make all physical connections with the stack cables as described in the  SecureStack A2 Installation Guides. they are persistent and will be retained during a power cycle to any or all of the units. every time a board is power‐cycled. first‐served basis. Highest MAC Address Use the following recommended procedures when installing a new stackable system or adding a  new unit to an existing stack. individually power on each unit from top to  bottom. Once unit IDs are assigned. Before applying power. 2-2 Configuring Switches in a Stack . 4.  Unit IDs are saved against each module. d.  Once the desired master unit has been selected. Previously assigned / elected management unit Management assigned priority (values 1‐15) Hardware preference level 3. (Optional) If desired. reset the system using the reset command as  described in “reset” on page 3‐57. the following procedure occurs: 1.4. you can use the show switch unit command (“show  switch” on page 2‐7) to physically identify each unit.  Notes: Ensure that each switch is fully operational before applying power to the next switch.  After the stack has been configured. This is important for port‐specific information (for example:  ge. 2.  Once all of the stack cables have been connected. change the management unit using the set switch movemanagement  command as described in “set switch movemanagement” on page 2‐12. Installing a New Stackable System of Up to Eight Units Use the following procedure for installing a new stack of up to eight units out of the box. unit IDs are arbitrarily assigned on a first‐come.12 is the 12th Gigabit Ethernet port on Unit # 4). By default. it is also assumed that the new unit is using the same firmware image version as other units in the stack. first-served basis.

7. Clear any switches which are listed as “unassigned” using the clear switch member  command as described in “clear switch member” on page 2‐14. 2. you can use the show switch unit command (“show  switch” on page 2‐7) to physically confirm the identity of each unit. b. you must:  (1) Renumber the stack using the set switch renumber command as described in “set  switch” on page 2‐11. then (2) Clear the original unit number using the clear switch member command. and connect the stack cables. This  procedure assumes that the new unit being added has a clean configuration from manufacturing  and is running the same firmware image version as other units in the stack. 8. 6. If the new member displays as unit 2.  After the stack has been reconfigured. 2. Use one of the following methods to complete stack cable connections: – If the running stack uses a daisy chain topology.Installing Previously-Configured Systems in a Stack Installing Previously-Configured Systems in a Stack If member units in a stack have been previous members of a different stack. If the new member displays a different unit number. you may need to  configure the renumbering of the stack as follows: 1. SecureStack A2 Configuration Guide 2-3 . break the ring and make the stack cable  connections to the new unit to close the ring. Power up only the unit you wish to be manager. Power up the member of the stack you wish to become unit 2. 1. 3.  – 3. 5. Apply power to the new unit. you can proceed to repeat this step with the next  unit. make the stack cable connections from  the bottom of the stack to the new unit (that is. Repeat Step 6 until all members have been renumbered in the order you desire. and use the show switch  command as described in “show switch” on page 2‐7 to display stacking information.  Use the show switch command to redisplay stacking information. Stack the units in the method desired. Adding a New Unit to an Existing Stack Use the following procedure for installing a new unit to an existing stack configuration. STACK DOWN port from the bottom unit  of the running stack to the STACK UP port on the new unit).  Once the management unit is powered up. Ensure that power is off on the new unit being installed. If the running stack uses a ring stack topology. When you enter the  command with a unit number.  The normal state of this LED is off for member units and steady green for the manager unit. the COM session of the CLI will state that a new CPU was added. Once the second unit is fully  powered. the MGR LED of the specified switch will blink for 10 seconds. log into the CLI.  a. 4.

1) is then associated with VLAN 555. Use  the SID of the switch model.------------. determine the switch index (SID)  of the model of switch being configured.00. A2(su)->show switch switchtype SID --1 2 3 4 5 6 Switch Model ID -------------------------------A2H124-24P A2H124-24 A2H124-48 A2H124-48P A2H124-24FX A2H254-16 Mgmt Pref ---1 1 1 1 1 1 Code Version --------0xa08245 0xa08245 0xa08245 0xa08245 0xa08245 0xa08245 A2(su)->set switch member 2 4 A2(su)->show switch Management Preconfig Plugged-in Switch Switch Status Model ID Model ID Status -----. 2-4 Configuring Switches in a Stack .1 is set to 555 Code Version -------01. and the unit ID that you want to  assign to this switch member.1 A2(su)->set port vlan fe.22 00.”  To create a virtual switch configuration in a stack environment: 1. 4. Add the virtual switch to the stack using the set switch member command (page 2‐13).2.2. The  first port on that virtual switch (fe.Creating a Virtual Switch Configuration Creating a Virtual Switch Configuration You can create a configuration for a SecureStack A2 switch before adding the actual physical  device to a stack.-----------.2.03.  Using the output of the show switch switchtype command. This preconfiguration feature includes configuring protocols on the ports of the  “virtual switch.2. Display the types of switches supported in the stack. 3. You must clear the mismatch before the new device will properly join the stack.------------. The following example adds an A2H124‐48P model (SID is 4) to a stack as unit 2 of the stack.--------------------1 Mgmt Switch A2H124-48 A2H124-48 OK 2 Unassigned A2H124-48P Not Present A2(su)->set vlan create 555 A2(su)->clear vlan egress 1 fe. Proceed to configure the ports of the virtual switch as you would do for physically present  devices.1 555 untagged A2(su)->show port vlan fe. determined in the previous step. using the show switch switchtype  command (page 2‐8).1 fe. 2.00 Note: If you preconfigure a virtual switch and then add a physical switch of a different type to the stack as that unit number.2. any configured functionality that cannot be supported on the physical switch will cause a configuration mismatch status for that device and the ports of the new device will join detached.

Configuring Standalone A2 Stack Ports It is possible on a standalone A2 switch to configure the two stack ports as standard gigabit  Ethernet ports. SecureStack A2 Configuration Guide 2-5 . including stack unit  IDs and switch priority values. This command  WILL NOT clear stack parameters or the IP address and avoids the process of renumbering  the stack. The clear config all command WILL set the front panel uplink ports back to stack ports. Use clear ip address to remove the IP address of the stack. For more information.Considerations About Using Clear Config in a Stack Considerations About Using Clear Config in a Stack When using the clear config command (page 3‐58) to clear configuration parameters in a stack. When Uplink Ports are Configured as Ethernet Ports When using the clear config command (page 3‐58) to clear configuration parameters on a  standalone A2 switch with the uplink ports configured as standard Ethernet ports. Use clear license to remove an applied license from a switch. • • • Configuration parameters and stacking information can also be cleared on the master unit only  by selecting the “restore configuration to factory defaults” option from the boot menu on switch  startup. it is important  to remember the following: • • The clear config command WILL NOT set the front panel uplink ports back to stack ports. it  is important to remember the following: • Use clear config to clear config parameters without clearing stack unit IDs. This selection will leave stacking priorities on all other units. refer to the set switch stack‐port command described on  page 2‐9. Use clear config all when it is necessary to clear all config parameters. This command will not clear the IP address nor will it remove  an applied advanced feature license.

2-7 2-8 2-9 2-9 2-11 2-11 2-12 2-12 2-13 2-14 2-6 Configuring Switches in a Stack .  Commands For information about..Stacking Configuration and Management Commands Stacking Configuration and Management Commands Purpose To review. individually configure and manage switches in a SecureStack A2 stack.. show switch show switch switchtype show switch stack-ports set switch stack-port set switch set switch copy-fw set switch description set switch movemanagement set switch member clear switch member Refer to page...

Mode Switch command.xx SecureStack A2 Configuration Guide 2-7 .xx 01.04. The normal state of this LED is off for member units and steady  green for the manager unit.Model A2G124-24 01.xx 01. you can use this command to physically confirm the identity of  each unit.04.  Syntax show switch [status] [unit] Parameters status unit (Optional) Displays power and administrative status information for one  or more units in the stack.xx 01.04. When you enter the command with a unit number.xx 01. A2 -.04. Inc.xx 01.04. Examples This example shows how to display information about all switch units in the stack: A2(rw)->show switch Management Switch Status -----.04.show switch show switch Use this command to display information about one or more units in the stack.xx 01. Usage After a stack has been configured. the MGR LED of the specified  switch will blink for 10 seconds.-----------1 Mgmt Switch 2 Stack Member 3 Stack Member 4 Stack Member 5 Stack Member 6 Stack Member 7 Stack Member 8 Stack Member Preconfig Model ID ------------A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 Plugged-in Model ID ------------A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 A2G124-24 Switch Status --------------------OK OK OK OK OK OK OK OK Code Version -------01.xx This example shows how to display information about switch unit 1 in the stack: A2(ro)->show switch 1 Switch Management Status Hardware Management Preference Admin Management Preference Switch Type Preconfigured Model Identifier Plugged-in Model Identifier Switch Status Switch Description Detected Code Version 1 Management Switch Unassigned Unassigned A2G124-24 A2G124-24 A2G124-24 OK Enterasys Networks. status and other configuration information about all units will be displayed. read‐only. (Optional) Specifies the unit(s) for which information will display.04.xx 01. Defaults If not specified.04.04.

A2 -Model A2H124-24P 2-8 Configuring Switches in a Stack .Model A2G124-24 A2G124-24 Enterasys Networks. Inc.01. Inc.20 02.01. Mode Switch command. Inc. Syntax show switch switchtype [switchindex] Parameters switchindex Specifies the switch index (SID) of the switch type to display.show switch switchtype Detected Code in Flash Detected Code in Back Image Up Time 03. Examples This example shows how to display switch type information about all switches in the stack: A2(rw)->show switch switchtype SID --1 2 3 4 5 Switch Model ID -------------------------------A2H124-24P A2H124-24 A2H124-48 A2H124-48P A2H124-24FX Mgmt Pref ---1 1 1 1 1 Code Version --------0xa08245 0xa08245 0xa08245 0xa08245 0xa08245 This example shows how to display switch type information about SID1: A2(ro)->show switch switchtype 1 Switch Type Model Identifier Switch Description 0x56540002 A2H124-24P Enterasys Networks. Defaults None.Model A2G124-24 show switch switchtype Use this command to display information about supported switch types in the stack. A2 -. A2 -.37 0 days 6 hrs 37 mins 54 secs This example shows how to display status information for switch unit 1 in the stack: A2(ro)->show switch status 1 Switch Switch Status Admin State Power State Inserted Switch: Model Identifier Description Configured Switch: Model Identifier Description 1 Full A2G124-24 Enterasys Networks. read‐only.

---------.------------RX----------Data Error Data Error Stacking Rate Rate Total Rate Rate Total Switch Port (Mb/s) (Errors/s) Errors (Mb/s) (Errors/s) Errors -----.-----.-----.---------.---------.show switch stack-ports Management Preference Expected Code Version Supported Cards: Slot Card Index (CID) Model Identifier 1 0xa08245 0 10 A2H124-24P show switch stack-ports Use this command to display various data flow and error counters on stack ports. SecureStack A2 Configuration Guide 2-9 . Example This example shows how to display data and error information on stack ports: A2(ro)->show switch stack-ports ------------TX-------------. read‐only.-------1 Up 0 0 0 0 0 0 Down 0 0 0 0 0 0 set switch stack-port Use this command to configure the two front panel uplink ports as standard Gigabit Ethernet  ports or stack ports. Syntax show switch stack-ports [unit] Parameters unit Specifies the switch unit ID. Change the two front panel stack ports to Stacking mode.---------. Syntax set switch stack-port {ethernet | stack} Parameters ethernet stack Change the two front panel stack ports to Ethernet mode. Defaults None. Mode Switch command. an integer ranging from 1 to 8.

Example This example shows how to set the front panel stacking ports as Gigabit Ethernet ports. the front panel uplink ports are in stack mode.set switch stack-port Defaults By default. Mode Switch mode. Usage Use this command only on standalone (non‐stacked) A2 switches. Do not stack A2 switches with uplink ports that are in Ethernet mode. Using this command will cause a switch reset. read‐write. A2(su)->set switch stack-port ethernet This command will reset the entire system. Do you want to continue (y/n) [n]?y 2-10 Configuring Switches in a Stack .

Defaults None. read‐write. Syntax set switch copy-fw [destination-system unit] Parameters destination‐system  (Optional) Specifies the unit number of unit on which to copy the  unit management image file. to set a switch’s priority for becoming the management  switch if the previous management switch fails. or to change the switch unit ID for a switch in the  stack. Note: This number must be a previously unassigned unit ID number. Examples This example shows how to assign priority 3 to switch 5: A2(su)->set switch 5 priority 3 This example shows how to renumber switch 5 to switch 7: A2(su)->set switch 5 renumber 7 set switch copy-fw Use this command to replicate the code image file from the management switch to other  switch(es) in the stack. Specifies a new number for the unit. Defaults If destination‐system is not specified. Specifies a priority value for the unit. Value can range from 1 to 8. SecureStack A2 Configuration Guide 2-11 . Valid values are 1 to 15 with higher  values assigning higher priority. Mode Switch command.set switch set switch Use this command to assign a switch ID. the management image file will be replicated to all switches  in the stack. Syntax set switch {unit [priority value | renumber newunit]} Parameters unit priority value renumber newunit Specifies a unit number for the switch.

 read‐write. Example This example shows how to replicate the management image file to all switches in the stack: A2(su)->set switch copy-fw Are you sure you want to copy firmware? (y/n) y Code transfer completed successfully. Syntax set switch description unit description Parameters unit description Specifies a unit number for the switch. read‐write.set switch description Mode Switch command. Example This example shows how to assign the name “FirstUnit” to switch unit 1 in the stack: A2(su)->set switch description 1 FirstUnit set switch movemanagement Use this command to move management switch functionality from one switch to another. Defaults None. Mode Switch command. Specifies the unit number of the newly‐designated management switch. Defaults None. 2-12 Configuring Switches in a Stack . set switch description Use this command to assign a name to a switch in the stack. Specifies a text description for the unit. Syntax set switch movemanagement fromunit tounit Parameters fromunit tounit Specifies the unit number of the current management switch.

Syntax set switch member unit switch-id Parameters unit switch‐id Specifies a unit number for the switch. Specifies a switch ID (SID) for the switch. read‐write. This allows you to preconfigure a switch  before the physical device is actually added to the stack. Mode Switch command. SIDs can be displayed with the  show switch switchtype command. Usage Refer to “Creating a Virtual Switch Configuration” on page 2‐4 for more information about how to  add a virtual switch to a stack. read‐write. Example This example shows how to move management functionality from switch 1 to switch 2: A2(su)->set switch movemenagement 1 2 Moving stack management will unconfigure entire stack including all interfaces. Defaults None.set switch member Mode Switch command. Are you sure you want to move stack management? (y/n) y set switch member Use this command to add a virtual member to a stack. Example This example shows how to specify a switch as unit 1 with a switch ID of 1: A2(su)->set switch member 1 1 SecureStack A2 Configuration Guide 2-13 .

Mode Switch command. Syntax clear switch member unit Parameters unit Specifies the unit number of the switch.clear switch member clear switch member Use this command to remove a member entry from the stack.  Defaults None. read‐write. Example This example shows how to remove the switch 5 entry from the stack: A2(su)->clear switch member 5 2-14 Configuring Switches in a Stack .

3-2 3-9 3-28 3-32 3-35 3-37 3-39 3-49 3-55 3-57 3-59 SecureStack A2 Configuration Guide 3-1 . For information about ..  This chapter describes how to customize basic system settings to adapt to your work environment. Setting User Accounts and Passwords Setting Basic Switch Properties Configuring Power over Ethernet (PoE) Downloading a New Firmware Image Reviewing and Selecting a Boot Firmware Image Starting and Configuring Telnet Managing Switch Configuration and Files Configuring CDP Clearing and Closing the CLI Resetting the Switch Using and Configuring WebView Refer to page ...3 Basic Configuration At startup. the SecureStack A2 switch is configured with many defaults and standard features..

Setting User Accounts and Passwords Setting User Accounts and Passwords Purpose To change the switch’s default user login and password settings. Commands The commands used to configure user accounts and passwords are listed below. In this case. Example This example shows how to display login account information. and to add new user accounts  and passwords.... 3-2 3-3 3-4 3-4 3-5 3-6 3-6 3-7 3-8 show system login Use this command to display user login account information. switch defaults have  not been changed: A2(su)->show system login Password history size: 0 Password aging : disabled 3-2 Basic Configuration .. show system login set system login clear system login set password set system password length set system password aging set system password history show system lockout set system lockout Refer to page. For information about. super user. Mode Switch command. Defaults None. Syntax show system login Parameters None.

Example This example shows how to enable a new user account with the login name “netops” with super  user access privileges: A2(su)->set system login netops super-user enable SecureStack A2 Configuration Guide 3-3 . Configured with set system password aging (page 3-6). Password aging Username Access State set system login Use this command to create a new user login account.  Defaults None. Number of days user passwords will remain valid before aging out. Number of previously used user login passwords that will be checked for duplication when the set password command is executed. Mode Switch command. including the admin account. although a maximum of 16 characters is  recommended for proper viewing in the show system login display. Syntax set system login username {super-user | read-write | read-only} {enable | disable} Parameters username Specifies a login name for a new or existing user. which  cannot be deleted. Login user names. super‐user |  read‐write |  read‐only enable | disable Enables or disables the user account..  The SecureStack A2 switch supports up to 16 user accounts.set system login Username admin ro rw Access super-user read-only read-write State enabled enabled enabled Table 3‐1 provides an explanation of the command output.. Table 3-1 Output Password history size show system login Output Details What It Displays. read-write or read-only. Specifies the access privileges for this user. Configured with set system password history (page 3-6). This string can be a  maximum of 80 characters. super user. or to disable or enable an existing account. Access assigned to this user account: super-user. Whether this user account is enabled or disabled.

) Defaults None. Mode Switch command. Defaults None. rw for Read‐Write access. super user. read‐write.) Specifies a system default  or a user‐configured login account name. Syntax clear system login username Parameters username Specifies the login name of the account to be cleared.  admin for Super User access. super‐user. Switch command. Syntax set password [username] Parameters username (Only available to users with super‐user access. Mode Switch command. (This access level allows Read‐Write access  to all modifiable parameters. Example This example shows how to remove the “netops” user account: A2(su)->clear system login netops set password Use this command to change system default passwords or to set a new login password on the CLI. the SecureStack A2  switch provides the following account names: ro for Read‐Only access. including user accounts.clear system login clear system login Use this command to remove a local login user account. 3-4 Basic Configuration . Note: The default admin (su) account cannot be deleted. By default.

  Super Users (Admin) can change any password on the system. Defaults None. Examples This example shows how a super‐user would change the Read‐Write password from the system  default (blank string): A2(su)->set password rw Please enter new password: ******** Please re-enter new password: ******** Password changed. Syntax set system password length characters Parameters characters Specifies the minimum number of characters for a user account password.  Valid values are 0 to 40.set system password length Usage Read‐Write users can change their own passwords. Mode Switch command. Example This example shows how to set the minimum system password length to 8 characters: A2(su)->set system password length 8 SecureStack A2 Configuration Guide 3-5 . super user. A2(su)-> This example shows how a user with Read‐Write access would change his password: A2(su)->set password Please enter old password: ******** Please enter new password: ******** Please re-enter new password: ******** Password changed. A2(su)-> set system password length Use this command to set the minimum user login password length.

Syntax set system password history size Parameters size Specifies the number of passwords checked for duplication. super user.set system password aging set system password aging Use this command to set the number of days user passwords will remain valid before aging out. or  to disable user account password aging. super user. Defaults None. Syntax set system password aging {days | disable} Parameters days disable Specifies the number of days user passwords will remain valid before  aging out. Disables password aging. Mode Switch command. Example This example shows how to configure the system to check the last 10 passwords for duplication A2(su)->set system password history 10 3-6 Basic Configuration . This prevents duplicate passwords from being entered into the system  with the set password command. Example This example shows how to set the system password age time to 45 days: A2(su)->set system password aging 45 set system password history Use this command to set the number of previously used user login passwords that will be checked  for password duplication. Mode Switch command. Defaults None. Valid values  are 0 to 10. Valid values are 1 to 365.

Table 3‐1 provides an explanation of the command output. switch defaults have not  been changed: A2(su)->show system lockout Lockout attempts: 3 Lockout time: 15 minutes.show system lockout show system lockout Use this command to display settings for locking out users after failed attempts to log in to the  system. Defaults None. In this case.. Syntax show system lockout Parameters None. Mode Switch command. Table 3-1 Output Lockout attempts Lockout time show system lockout Output Details What It Displays. super user.. These settings are configured with the  set system lockout command (“set system lockout” on page 3‐8). Number of failed login attempts allowed before a read-write or read-only user’s account will be disabled. Example This example shows how to display user lockout settings. Number of minutes the default admin user account will be locked out after the maximum login attempts. SecureStack A2 Configuration Guide 3-7 .

 Once a user account is locked out. Syntax set system lockout {[attempts attempts] [time time]} Parameters attempts attempts time time Specifies the number of failed login attempts allowed before a read‐write  or read‐only user’s account will be disabled. Mode Switch command.set system lockout set system lockout Use this command to set the number of failed login attempts before locking out (disabling) a read‐ write or read‐only user account. Valid values are 1 to 10. Specifies the number of minutes the default admin user account will be  locked out after the maximum login attempts. Valid values are 0 to 60. Example This example shows how to set login attempts to 5 and lockout time to 30 minutes: A2(su)->set system lockout attempts 5 time 30 3-8 Basic Configuration . Defaults None. super user. and the number of minutes to lockout the default admin super  user account after maximum login attempts. it can only be re‐ enabled by a super user with the set system login command (page 3‐3).

. show ip address set ip address clear ip address show ip protocol set ip protocol show system show system hardware show system utilization set system enhancedbuffermode show time set time show summertime set summertime set summertime date set summertime recurring clear summertime set prompt show banner motd set banner motd clear banner motd show version set system name set system location set system contact set width set length show logout set logout Refer to page. Commands The commands used to set basic system information are listed below. 3-10 3-10 3-11 3-11 3-12 3-12 3-13 3-14 3-15 3-16 3-16 3-17 3-17 3-18 3-18 3-19 3-20 3-20 3-21 3-21 3-22 3-23 3-23 3-24 3-24 3-25 3-25 3-26 SecureStack A2 Configuration Guide 3-9 .Setting Basic Switch Properties Setting Basic Switch Properties Purpose To display and set the system IP address and other basic system (switch) properties. For information about....

Syntax show ip address Parameters None. Defaults None.42. (Optional) Sets the system’s default gateway (next‐hop device). Example This example shows how to display the system IP address and subnet mask: A2(su)->show ip address Name ---------------host Address ---------------10. ip‐mask will be set to the natural mask of the ip‐address and ip‐gateway will be set to  the ip‐address.13. subnet mask and default gateway.0.255.. show console set console baud Refer to page. Mode Switch command.20 Mask ---------------255. For SecureStack A2 systems.0 set ip address Use this command to set the system IP address. (Optional) Sets the system’s subnet mask.. mask ip‐mask gateway ip‐gateway Defaults If not specified.. 3-26 3-27 show ip address Use this command to display the system IP address and subnet mask.show ip address For information about. 3-10 Basic Configuration . read‐only. this is the  IP address of the management switch as described in “About SecureStack  A2 Switch Operation in a Stack” on page 2‐1. Syntax set ip address ip-address [mask ip-mask] [gateway ip-gateway] Parameters  ip‐address Sets the IP address for the system..

 read‐write.1. Defaults None.255. read‐only.128.1 mask 255. Syntax show ip protocol Parameters None.10.10. Example This example shows how to clear the system IP address: A2(rw)->clear ip address show ip protocol Use this command to display the method used to acquire a network IP address for switch  management.0 gateway 10.255.128. Example This example shows how to set the system IP address to 10. SecureStack A2 Configuration Guide 3-11 . Syntax clear ip address Parameters None.1 with a mask of 255.1. Mode Switch command.clear ip address Mode Switch command.1: A2(su)->set ip address 10.0.1.1 clear ip address Use this command to clear the system IP address.1. read‐write. Defaults None. Mode Switch command.10.0 and  a default gateway of 10.

 power and fan  tray status and uptime. Mode Switch command.set ip protocol Example This example shows how to display the method used to acquire a network IP address: A2(su)->show ip protocol System IP address acquisition method: dhcp set ip protocol Use this command to specify the protocol used to acquire a network IP address for switch  management. read‐only. Select DHCP as the protocol to use to acquire the system IP address. Mode Switch command. read‐write. Syntax set ip protocol {bootp | dhcp | none} Parameters bootp dhcp none Select BOOTP as the protocol to use to acquire the system IP address. Example This example shows how to set the method used to acquire a network IP address to DHCP. Defaults None. 3-12 Basic Configuration . Defaults None. Syntax show system Parameters None. A2(su)->set ip protocol dhcp show system Use this command to display system information. No protocol will be used to acquire the system IP address. including contact information.

show system hardware

Example
This example shows how to display system information:
A2(su)->show system System contact:John Smith System location:Bldg10 2nd floor East System name:10-2-A2 Switch 1 -------PS1-Status ---------Ok Fan1-Status ----------Ok Uptime d,h:m:s -------------2,19:57:39 Logout ------5 min

PS2-Status ---------Not Installed and/or Not Operating Fan2-Status ----------Ok

Table 3‐2 provides an explanation of the command output. Table 3-2
Output System contact System location System name PS1 and PS2-Status Fan Status Uptime d,h:m:s Logout

show system Output Details
What It Displays... Contact person for the system. Default of a blank string can be changed with the set system contact command (“set system contact” on page 3-24). Where the system is located. Default of a blank string can be changed with the set system location command (“set system location” on page 3-23). Name identifying the system. Default of a blank string can be changed with the set system name command (“set system name” on page 3-23). Operational status for power supply 1 and, if installed, power supply 2. Operational status of the fan trays. System uptime. Time an idle console or Telnet CLI session will remain connected before timing out. Default of 5 minutes can be changed with the set logout command (“set logout” on page 3-26).

show system hardware
Use this command to display the system’s hardware configuration.

Syntax
show system hardware

Parameters
None.

Defaults
None.
SecureStack A2 Configuration Guide 3-13

show system utilization

Mode
Switch command, read‐only.

Example
This example shows how to display the system’s hardware configuration. Please note that the  information you see displayed may differ from this example.
A2(su)->show system hardware SLOT HARDWARE INFORMATION -------------------Model: Serial Number: Vendor ID: Base MAC Address: Hardware Version: FirmWare Version: Boot Code Version:

A2G124-24 041800129041 0x0e10 00:01:F4:5F:1D:E0 BCM56504 REV 19 1.04.xx 01.00.17

show system utilization
Use this command to display detailed information about the processor running on the switch, or  the overall memory usage of the Flash and SDRAM storage devices on the unit, or the processes  running on the switch. Only the memory usage in the master unit of a stack is shown.

Syntax
show system utilization {cpu | storage | process}

Parameters
cpu storage process Display information about the processor running on the switch. Display information about the overall memory usage on the switch. Display information about the processes running on the switch.

Defaults
None.

Mode
Switch command, read‐only.

Examples
This example shows how to display the system’s CPU utilization:
A2(ro)->show system utilization cpu Total CPU Utilization: Switch CPU 5 sec 1 min 5 min ----------------------------------------------1 1 3% 1% 1%

This example shows how to display the system’s overall memory usage: 
A2(ro)->show system utilization storage

3-14

Basic Configuration

set system enhancedbuffermode

Storage Utilization: Type Description Size(Kb) Available (Kb) --------------------------------------------------------------RAM RAM device 262144 97173 Flash Images, Config, Other 31095 8094

This example shows how to display information about the processes running on the system. Only  partial output is shown.
A2(ro)->show system utilization process TID Name 5Sec 8d45148 captureTask 0.00% 8e264f8 poe_monitor 0.00% 8ea6d38 poe_read 0.80% 8eb7140 vlanDynEg 0.00% 8f0be10 tcdpSendTask 0.00% 8f1c0e8 tcdpTask 0.00% ... 1Min 0.00% 0.01% 0.22% 0.00% 0.00% 0.00% 5Min 0.00% 0.05% 0.20% 0.00% 0.00% 0.00%

set system enhancedbuffermode
Use this command to enable or disable enhanced buffer mode, which optimizes buffer  distribution for non‐stacking single CoS queue operation. Executing this command will reset the  switch, so the system prompts you to confirm whether you want to proceed.

Syntax
set system enhancedbuffermode {enable | disable}

Parameters
enable | disable Enables or disables enhanced buffer mode.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to enable enhanced buffer mode:
A2(su)->set system enhancedbuffermode enable Changes in the enhanced buffer mode will require reseting this unit. Are you sure you want to continue? (y/n)

SecureStack A2 Configuration Guide

3-15

show time

show time
Use this command to display the current time of day in the system clock.

Syntax
show time

Parameters
None.

Defaults
None.

Mode
Switch command, read‐only.

Example
This example shows how to display the current time. The output shows the day of the week,  month, day, and the time of day in hours, minutes, and seconds and the year:
A2(su)->show time THU SEP 05 09:21:57 2002

set time
Use this command to change the time of day on the system clock.

Syntax
set time [mm/dd/yyyy] [hh:mm:ss]

Parameters
[mm/dd/yyyy]  [hh:mm:ss] Sets the time in: month, day, year and/or  24‐hour format  At least one set of time parameters must be entered.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to set the system clock to 7:50 a.m:
A2(su)->set time 7:50:00

3-16

Basic Configuration

show summertime

show summertime
Use this command to display daylight savings time settings.

Syntax
show summertime

Parameters
None.

Defaults
None.

Mode
Switch command, read‐only.

Example
This example shows how to display daylight savings time settings:
A2(su)->show summertime Summertime is disabled and set to '' Start : SUN APR 04 02:00:00 2004 End : SUN OCT 31 02:00:00 2004 Offset: 60 minutes (1 hours 0 minutes) Recurring: yes, starting at 2:00 of the first Sunday of April and ending at 2:00 of the last Sunday of October

set summertime
Use this command to enable or disable the daylight savings time function.

Syntax
set summertime {enable | disable} [zone]

Parameters
enable | disable zone Enables or disables the daylight savings time function. (Optional) Applies a name to the daylight savings time settings.

Defaults
If a zone name is not specified, none will be applied.

Mode
Switch command, read‐only.

Example
This example shows how to enable daylight savings time function:
A2(su)->set summertime enable

SecureStack A2 Configuration Guide

3-17

set summertime date

set summertime date
Use this command to configure specific dates to start and stop daylight savings time. These  settings will be non‐recurring and will have to be reset annually.

Syntax
set summertime date start_month start_date start_year start_hr_min end_month end_date end_year end_hr_min [offset_minutes]

Parameters
start_month  start_date  start_year  start_hr_min end_month end_date end_year end_hr_min offset_minutes Specifies the month of the year to start daylight savings time. Specifies the day of the month to start daylight savings time.  Specifies the year to start daylight savings time. Specifies the time of day to start daylight savings time. Format is hh:mm. Specifies the month of the year to end daylight savings time. Specifies the day of the month to end daylight savings time.  Specifies the year to end daylight savings time. Specifies the time of day to end daylight savings time. Format is hh:mm. (Optional) Specifies the amount of time in minutes to offset daylight  savings time from the non‐daylight savings time system setting. Valid  values are 1 ‐ 1440.

Defaults
If an offset is not specified, none will be applied.

Mode
Switch command, read‐write.

Example
This example shows how to set a daylight savings time start date of April 4, 2004 at 2 a.m. and an  ending date of October 31, 2004 at 2 a.m. with an offset time of one hour:
A2(su)->set summertime date April 4 2004 02:00 October 31 2004 02:00 60

set summertime recurring
Use this command to configure recurring daylight savings time settings. These settings will start  and stop daylight savings time at the specified day of the month and hour each year and will not  have to be reset annually.

Syntax
set summertime recurring start_week start_day start_month start_hr_min end_week end_day end_month end_hr_min [offset_minutes]

Parameters
start_week  Specifies the week of the month to restart daylight savings time. Valid  values are: first, second, third, fourth, and last.

3-18

Basic Configuration

clear summertime

start_day  start_hr_min end_week end_day end_hr_min offset_minutes

Specifies the day of the week to restart daylight savings time.  Specifies the time of day to restart daylight savings time. Format is  hh:mm. Specifies the week of the month to end daylight savings time.  Specifies the day of the week to end daylight savings time. Specifies the time of day to end daylight savings time. Format is hh:mm. (Optional) Specifies the amount of time in minutes to offset daylight  savings time from the non‐daylight savings time system setting. Valid  values are 1 ‐ 1440.

Defaults
If an offset is not specified, none will be applied.

Mode
Switch command, read‐write.

Example
This example shows how set daylight savings time to recur starting on the first Sunday of April at  2 a.m. and ending the last Sunday of October at 2 a.m. with an offset time of one hour:
A2(su)->set summertime recurring first Sunday April 02:00 last Sunday October 02:00 60

clear summertime
Use this command to clear the daylight savings time configuration.

Syntax
clear summertime

Parameters
None.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to clear the daylight savings time configuration:
A2(su)->clear summertime

SecureStack A2 Configuration Guide

3-19

set prompt

set prompt
Use this command to modify the command prompt.

Syntax
set prompt prompt_string

Parameters
prompt_string Specifies a text string for the command prompt. 
Note: A prompt string containing a space in the text must be enclosed in quotes as shown in the example below.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to set the command prompt to Switch 1:
A2(su)->set prompt “Switch 1” Switch 1(su)->

show banner motd
Use this command to show the banner message of the day that will display at session login.

Syntax
show banner motd

Parameters
None.

Defaults
None.

Mode
Switch command, read‐only.

Example
This example shows how to display the banner message of the day:
A2(rw)->show banner motd O Knights of Ni, you are just and fair, and we will return with a shrubbery -King Arthur

3-20

Basic Configuration

set banner motd

set banner motd
Use this command to set the banner message of the day displayed at session login.

Syntax
set banner motd message

Parameters
message Specifies a message of the day. This is a text string that needs to be in  double quotes if any spaces are used. Use a \n for a new line and \t for a  tab (eight spaces).

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to set the message of the day banner to read “O Knights of Ni, you are  just and fair, and we will return with a shrubbery ‐ King Arthur”:
A2(rw)->set banner motd "O Knights of Ni, you are just and \n fair, and we will return with a shrubbery \n \t -King Arthur"

clear banner motd
Use this command to clear the banner message of the day displayed at session login to a blank  string.

Syntax
clear banner motd

Parameters
None.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to clear the message of the day banner to a blank string:
A2(rw)->clear banner motd

SecureStack A2 Configuration Guide

3-21

• Hw: Hardware version number. Please note that you may see different  information displayed. A2(rw)->show version Copyright (c) 2005 by Enterasys Networks. Serial number of the switch.00.07 PoE:290_21 A2H124-48P 052800949041 Table 3‐3 provides an explanation of the command output.) 3-22 Basic Configuration .33 Fw:01.00.00.00. Refer to “Downloading a New  Firmware Image” on page 3‐32 for instructions on how to download a firmware image. Defaults None. depending on the type of hardware in the stack.07 Hw:BCM5655 REV 18 Bp:01. Inc..show version show version Use this command to display hardware and firmware information. • BuFw: Backup firmware version number. • Fw: Current firmware version number.26 BuFw:01. Switch’s model number. read‐only. Example This example shows how to display version information. • PoE: Power over Ethernet driver version.00. Mode Switch command. Table 3-3 Output Model Serial # Versions show version Output Details What It Displays. (Displays only for PoE switches. Syntax show version Parameters None.. Model -------------A2H124-48 Serial # ----------------052200119001 Versions ------------------Hw:BCM5655 REV 18 Bp:01.00.26 BuFw:01. • Bp: BootPROM version.33 Fw:01.

Mode Switch command. Example This example shows how to set the system location string: A2(su)->set system location “Bldg N32-04 Closet 9” SecureStack A2 Configuration Guide 3-23 .set system name set system name Use this command to configure a name for the system. Mode Switch command. Syntax set system name [string] Parameters string  (Optional) Specifies a text string that identifies the system. the location name will be cleared. Syntax set system location [string] Parameters string (Optional) Specifies a text string that indicates where the system is  located.  Note: A name string containing a space in the text must be enclosed in quotes as shown in the example below. read‐write. Defaults If string is not specified.  Note: A location string containing a space in the text must be enclosed in quotes as shown in the example below. Defaults If string is not specified. Example This example shows how to set the system name to Information Systems: A2(su)->set system name “Information Systems” set system location Use this command to identify the location of the system. the system name will be cleared. read‐write.

3-24 Basic Configuration . read‐write. Defaults None. Usage The number of rows of CLI output displayed is set using the set length command as described in  “set length” on page 3‐25. Mode Switch command. Example This example shows how to set the system contact string: A2(su)->set system contact “Joe Smith” set width Use this command to set the number of columns for the terminal connected to the switch’s console  port. Defaults If string is not specified. Syntax set system contact [string] Parameters string (Optional) Specifies a text string that contains the name of the person to  contact for system administration. Valid values are 50 to 150.  Note: A contact string containing a space in the text must be enclosed in quotes as shown in the example below. read‐write. the contact name will be cleared.  Syntax set width screenwidth [default] Parameters screenwidth default Sets the number of terminal columns. (Optional) Makes this setting persistent for all future sessions (written to  NV‐RAM).set system contact set system contact Use this command to identify a contact person for the system. Mode Switch command.

 and from 5 to 512. Syntax show logout Parameters None. Example This example shows how to set the terminal length to 50: A2(su)->set length 50 show logout Use this command to display the time (in seconds) an idle console or Telnet CLI session will  remain connected before timing out. which  disables the scrolling screen feature described in “Displaying Scrolling  Screens” on page 1‐8. Valid values are 0. Syntax set length screenlength Parameters screenlength Sets the number of lines in the CLI display. Defaults None. read‐write. Example This example shows how to display the CLI logout setting: SecureStack A2 Configuration Guide 3-25 .set length Example This example shows how to set the terminal columns to 50: A2(su)->set width 50 set length Use this command to set the number of lines the CLI will display. This command is persistent  (written to NV‐RAM). Mode Switch command. Mode Switch command. read‐only. Defaults None.

Syntax show console [baud] [bits] [flowcontrol] [parity] [stopbits] Parameters baud bits flowcontrol parity stopbits (Optional) Displays the input/output baud rate. (Optional) Displays the number of bits per character. (Optional) Displays the type of parity. all settings will be displayed. (Optional) Displays the number of stop bits.  Defaults None.set logout A2(su)->show logout Logout currently set to: 10 minutes. read‐only. Mode Switch command. Defaults If no parameters are specified. 3-26 Basic Configuration . Syntax set logout timeout Parameters timeout Sets the number of minutes the system will remain idle before timing out. Example This example shows how to set the system timeout to 10 minutes: A2(su)->set logout 10 show console Use this command to display console settings. Mode Switch command. set logout Use this command to set the time (in minutes) an idle console or Telnet CLI session will remain  connected before timing out. (Optional) Displays the type of flow control. read‐write.

  Defaults None. 14400. read‐write.------.---9600 Disable 8 StopBits ---------1 Parity -----none set console baud Use this command to set the console port baud rate. 1200. Valid values are: 300. 2400. 19200. 600. Syntax set console baud rate Parameters rate Sets the console baud rate. Example This example shows how to set the console port baud rate to 19200: A2(su)->set console baud 19200 SecureStack A2 Configuration Guide 3-27 .  9600. and 115200. 5760. Mode Switch command.set console baud Example This example shows how to display all console settings: A2(su)->show console Baud Flow Bits -----. 4800. 38400.

For information about. Commands The commands used to review and set PoE port parameters are listed below. Consult the Installation Guide shipped with your product to determine if it is PoE-equipped...Configuring Power over Ethernet (PoE) Configuring Power over Ethernet (PoE) Important Notice This section applies only to PoE-equipped SecureStack A2 switches. Purpose To review and set PoE parameters. including the power available to the system. and per‐port PoE settings. 3-29 3-29 3-30 3-30 3-31 3-28 Basic Configuration . the usage  threshold for each module.. show inlinepower set inlinepower threshold set inlinepower trap show port inlinepower set port inlinepower Refer to page. whether or not SNMP trap messages will be sent when power status  changes..

 and 5 are PoE  modules. Syntax show inlinepower Parameters None.44 Threshold(%) -----------80 80 80 Trap ---enable enable enable set inlinepower threshold Use this command to set the PoE usage threshold on a specified unit. Syntax set inlinepower threshold usage-threshold module-number Parameters usage‐threshold  module‐number Specifies a PoE threshold as a percentage of total system power usage.  Valid values are 11 to 100. read‐write. 3.  Defaults None.00 5.00 0. Mode Switch command. so their power configurations display: A2(su)->show inlinepower Unit ---2 4 8 Status -----auto auto auto Power(W) -------360 360 360 Consumption(W) -------------0.  Specifies the unit on which to set the PoE threshold.show inlinepower show inlinepower Use this command to display switch PoE properties. Example This example shows how to display switch PoE properties. units 1. read‐only.00 0. In this case.00 1. Defaults None. Mode Switch command.20 Usage(%) -------0. SecureStack A2 Configuration Guide 3-29 .

  Syntax show port inlinepower [port-string] Parameters port‐string (Optional) Displays information for specific PoE port(s). Defaults If not specified. PoE priority and class have not been changed from  default values: 3-30 Basic Configuration .  Mode Switch command. read‐write. Mode Switch command. read‐only. Syntax set inlinepower trap {disable | enable} module-number Parameters disable | enable  module‐number Disables or enables PoE trap messaging. Example This example shows how to enable PoE trap messaging on unit 1: A2(su)->set inlinepower trap enable 1 show port inlinepower Use this command to display all ports supporting PoE. information for all PoE ports will be displayed. or whenever the unit’s PoE usage threshold is crossed.  In this case.set inlinepower trap Example This example shows how to set the PoE threshold to 50 on unit 1: A2(su)->set inlinepower threshold 50 1 set inlinepower trap Use this command to enable or disable the sending of an SNMP trap message for a unit whenever  the status of its ports changes. Example This example shows how to display PoE information for Fast Ethernet ports 1 through 6 in unit 1. The unit’s  PoE usage threshold must be set using the set inlinepower threshold command as described on  page 3‐29. the ports’ administrative state. Specifies the unit on which to disable or enable trap messaging.

1.1 auto fe. Syntax set port inlinepower port-string {[admin {off | auto}] [priority {critical | high | low}] [type type]} Parameters port‐string admin off | auto priority critical |  high | low type type Specifies the port(s) on which to configure PoE.1. read‐write.set port inlinepower A2(su)->show port Port Admin ----------fe.3.2 auto fe.1.3.5 auto fe. Defaults None. Sets the PoE administrative state to off (disabled) or auto (on).1.1 admin auto priority critical SecureStack A2 Configuration Guide 3-31 .1 with critical priority: A2(su)->set port inlinepower fe. Sets the port(s) priority for the PoE allocation algorithm to critical  (highest).6 auto inlinepower fe.4 auto fe. Mode Switch command. Example This example shows how to enable PoE on port fe.3 auto fe.1. Specifies a string describing the type of device connected to a port.1.1-6 Oper Priority ----------------------searching low searching low searching low searching low searching low searching low Class ----0 0 0 0 0 0 set port inlinepower Use this command to configure PoE parameters on one or more ports. high or low.1.

 power up the switch. proceed as follows: 1. Select (1. Select an option. With the console port connected. proceed as follows: 1.Start Boot Menu. For details on how to perform a TFTP  download using the copy command.Start operational code. refer to “copy” on page 3‐45. There are two ways to download firmware to the  switch:  • Via TFTP download. It should be used in cases when you cannot  connect the switch to perform the in‐band copy download procedure via TFTP. Via the serial (console) port. Note: The above “Boot Menu” password “administrator” can be changed using boot menu option 11. refer to “set tftp timeout” on page 3‐46 and “set tftp  retry” on page 3‐47. This procedure uses a TFTP server connected to the network and  downloads the firmware using the TFTP protocol. 2 . For information on setting  TFTP timeout and retry parameters..3 • Any other terminal applications may work but are not explicitly supported.Downloading a New Firmware Image Downloading a New Firmware Image You can upgrade the operational firmware in the SecureStack A2 switch without physically  opening the switch or being in the same location. The following message displays: Version 01. Serial console  download has been successfully tested with the following applications:  – – HyperTerminal Copyright 1999 Tera Term Pro Version 2. Use “administrator” for  the Password. type 2 to select “Start Boot Menu”.. 2):2 Password: ************* 2.29 05-09-2005 Computing MD5 Checksum of operational code. 1 . If no selection in 2 seconds then operational code will start. set the switch’s IP address using the set ip address command  as detailed in “set ip address” on page 3‐10. The backup image can be  downloaded and selected as the startup image by using the commands described in this section. 2. Downloading from a TFTP Server To perform a TFTP download. If you have not already done so. This procedure is an out‐of‐band operation that copies the  firmware through the serial port to the switch.  Download a new image file using the copy command as detailed in “copy” on page 3‐45. 3-32 Basic Configuration .00. Downloading via the Serial Port To download switch firmware via the serial (console) port.  The A2 switch allows you to download and store dual images. Before the boot up completes.

.................... Type 2... you must change your terminal baud rate.. 4 ..Downloading a New Firmware Image Boot Menu Version 01...............Run Flash Diagnostics 7 . The following Enterasys Header is in the image: MD5 Checksum.......... Verified operational code CRC. A2H124-24 A2H124-48 A2H124-48 Image Version Length...Change baud rate 3 .Set new Boot Code password [Boot Menu] 2 3... Type 8 to set the switch baud rate to 115200.0x0517 Header Version............00..Update Boot Code 8 . The following message displays:  Setting baud rate to 115200..29 05-09-2005 Options available 1 . checking CRC... Ready to RECEIVE File xcode......fe967970996c4c8c43a10cd1cd7be99a Boot File Identifier..... The following baud rate selection screen displays: 1 2 3 4 5 6 7 8 0 1200 2400 4800 9600 19200 38400 57600 115200 no change 4. 5....Retrieve event log using XMODEM (64KB)......0x7 SecureStack A2 Configuration Guide 3-33 ..0x006053b3 Ident Strings Length.. type 4 to load new operational code using XMODEM.....Load new operational code using XMODEM 5 ........Reset the system 10 .0x004d Image length..  When the XMODEM transfer is complete............Restore Configuration to factory defaults (delete config files) 11 .... 6...0x0028 Ident Strings......Delete operational code 9 ...Display operational code vital product data 6 .0x82 Image Offset. Set the terminal baud rate to 115200 and press ENTER..  From the boot menu options screen............0x0100 Image Type...bin in binary mode Send several Control-X characters to cCKCKCKCKCKCKCK XMODEM transfer complete.... the following message and header information will  display: [Boot Menu] 4 Ready to receive the file with XMODEM/CRC...........Start operational code 2 ......

..4) 7. you must change your terminal baud rate.0... type 1 to start the new operational code. From the boot menu options screen.......Downloading a New Firmware Image Image Version Bytes. The following message displays: Setting baud rate to 9600..5. The following  message displays: Operational Code Date: Tue Jun 29 08:34:05 2004 Uncompressing. 8. 9. Type 4 set the switch baud rate to 9600. From the boot menu options screen. 3-34 Basic Configuration . Set the terminal baud rate to 9600 and press ENTER......  10. type 2 to display the baud rate selection screen again.0x30 0x2e 0x35 0x2e 0x30 0x2e 0x34 (0.

 which can be selected as the startup image by using the  commands described in this section. For information about. show boot system set boot system Refer to page. Mode Switch command... Example This example shows how to display the switch’s boot firmware image: A2(su)->show boot system Current system image to boot: bootfile SecureStack A2 Configuration Guide 3-35 . Defaults None. Syntax show boot system Parameters None.. Commands The commands used to review and select the switch’s boot image file are listed below. The A2 switch allows you to  download and store a backup image. 3-35 3-36 show boot system Use this command to display the firmware image the switch loads at startup..Reviewing and Selecting a Boot Firmware Image Reviewing and Selecting a Boot Firmware Image Purpose To display and set the image file the switch loads at startup. read‐only.

set boot system set boot system Use this command to set the firmware image the switch loads at startup. Defaults None. Example This example shows how to set the boot firmware image file to “newimage”: A2(su)->set boot system newimage 3-36 Basic Configuration .  Syntax set boot system filename Parameters filename Specifies the name of the firmware image file. read‐write. Mode Switch command.

Example This example shows how to display Telnet status: A2(su)->show telnet Telnet inbound is currently: ENABLED Telnet outbound is currently: ENABLED SecureStack A2 Configuration Guide 3-37 . start and configure Telnet are listed below.. Syntax show telnet Parameters None. Mode Switch command. show telnet set telnet telnet Refer to page. Defaults None.Starting and Configuring Telnet Starting and Configuring Telnet Purpose To enable or disable Telnet.. and to start a Telnet session to a remote host. 3-37 3-38 3-38 show telnet Use this command to display the status of Telnet on the switch. The SecureStack A2  switch allows a total of four inbound and / or outbound Telnet session to run simultaneously. Commands The commands used to enable.  For information about. read‐only...

  outbound service (the ability to Telnet to other devices). The SecureStack A2 switch allows  a total of four inbound and / or outbound Telnet session to run simultaneously. Mode Switch command. telnet is now disabled. or all (both  inbound and outbound). telnet Use this command to start a Telnet connection to a remote host.13 3-38 Basic Configuration .21.13: A2(su)->telnet 10. Defaults If not specified. (Optional) Specifies inbound service (the ability to Telnet to this switch).set telnet set telnet Use this command to enable or disable Telnet on the switch.21.42. the default port number 23 will be used.42. Example This example shows how to disable inbound and outbound Telnet services: A2(su)->set telnet disable all Disconnect all telnet sessions and disable now (y/n)? [n]: y All telnet sessions have been terminated. (Optional) Specifies the server port number. Example This example shows how to start a Telnet session to a host at 10. Mode Switch command. both inbound and outbound Telnet service will be enabled or disabled. Defaults If not specified. read‐write. Syntax telnet host [port] Parameters host port Specifies the name or IP address of the remote host. read‐write. Syntax set telnet {enable | disable} [inbound | outbound | all] Parameters enable | disable inbound |  outbound | all Enables or disables Telnet services.

 the configuration is checked every two minutes and saved if there has  been a change. If you want to save a running configuration to NVRAM more often than the automatic intervals.” which means that when CLI  configuration commands are entered. On a stack. After the prompt  returns.. 3-40 3-40 3-41 3-41 3-42 3-43 3-44 3-45 3-45 3-46 3-46 3-47 3-47 3-48 SecureStack A2 Configuration Guide 3-39 . the configuration is saved across the stack every 30 minutes if there has been a  change.. show snmp persistmode set snmp persistmode save config dir show file show config configure copy delete show tftp settings set tftp timeout clear tftp timeout set tftp retry clear tftp retry Refer to page. and set and  view TFTP parameters. Although the configuration commands will actively modify the  running configuration.  execute the save config command and wait for the system prompt to return. and execute configuration files and image files.Managing Switch Configuration and Files Managing Switch Configuration and Files Configuration Persistence Mode The default state of configuration persistence mode is “auto. the configuration will be persistent. or when a configuration file stored on the switch is  executed. You can change the persistence mode from “auto” to “manual” with the set snmp persistmode  command. the configuration is saved to NVRAM automatically at the following intervals: • • On a stand‐alone unit. they will not persist across a reset unless the save config command has  been executed. If the persistence mode is set to “manual. Purpose To set and view the persistence mode for CLI configuration commands. manage. view. manually save the  running configuration.” configuration commands will not be  automatically written to NVRAM.. Commands For information about..

show snmp persistmode show snmp persistmode Use this command to display the configuration persistence mode setting. Syntax show snmp persistmode Parameters None. or require issuing the save config  command. In order to make  configuration changes persistent. Mode Switch command. This is the default  state. the save config command must be  issued as described in “save config” on page 3‐41.” which automatically saves configuration changes at  specific intervals. 3-40 Basic Configuration . This mode is useful for  reverting back to old configurations. See “Configuration Persistence Mode” on page 3‐39 for more information.” configuration commands are never automatically  saved. In this case. Sets the configuration persistence mode to manual. Defaults None. Syntax set snmp persistmode {auto | manual} Parameters auto manual Sets the configuration persistence mode to automatic. which determines whether user‐ defined configuration changes are saved automatically. the mode is set to “auto save. In order to make configuration changes persistent when the mode is manual. Usage By default. read‐only.  A2(su)->show snmp persistmode persistmode is manual set snmp persistmode Use this command to set the configuration persistence mode. which means configuration changes are not being  automatically saved.  persistence mode is set to “manual”. If the mode is set to “manual. Example This example shows how to display the configuration persistence mode setting. the save  config command must be issued as described in “Configuration Persistence Mode” on page 3‐39.

Syntax dir [filename] Parameters filename (Optional) Specifies the file name or directory to list. Mode Switch command. Example This example shows how to set the configuration persistence mode to manual: A2(su)->set snmp persistmade manual save config Use this command to save the running configuration on all switch members in a stack. all files in the system will be displayed. Mode Switch command. read‐only. Defaults None. read‐write. read‐write. Syntax save config Parameters None. Mode Switch command. SecureStack A2 Configuration Guide 3-41 . Example This example shows how to save the running configuration: A2(su)->save config dir Use this command to list configuration and image files stored in the file system.save config Defaults None. Defaults If filename is not specified.

02. A2H124-48. A2(rw)->show file configs/mypolicy 1 : 2 : 3 : #policy 4 : 5 : set policy profile 1 name "Check GUEST" pvid-status enable pvid 4095 untaggedvlans 1 6 : 7 : set policy profile 2 name "User LABORATORIES" pvid-status enable pvid 680 cosstatus enable cos 4 untagged-vlans 680 8 : 9 : set policy profile 3 name "Administrator" pvid-status enable pvid 4095 10 : 3-42 Basic Configuration . A2H124-48P. A2H124-24P.log 256017 show file Use this command to display the contents of a file.show file Example This example shows how to list all the configuration and image files in the system: A2(su)->dir Images: ================================================================== Filename: a2-series_01. Mode Switch command. read‐only.10 Size: 5115904 (bytes) Date: Thu Apr 13 14:19:33 2006 CheckSum: 8ed356d3bb823c92ab9f659550930783 Compatibility: A2H124-24.10 (Active) (Boot) Version: 01. Note  that only a portion of the file is shown in this example.02. Example This example shows how to display a text file named “mypolicy” in the configs/ directory. Defaults None. Syntax show file filename Parameters filename Specifies the name of the file to display. A2H124-24FX A2H254-16 Files: Size ================================ ======== configs: logs: current.

Specifies a filename in the configs/ directory to display. Usage The separate facilities that can be displayed by this command are identified in the display of the  current configuration by a # preceding the facility name.show config 11 : set policy profile 4 name "Guest" pvid-status enable pvid 999 cos-status enable cos 3 untagged-vlans 999 12 : 13 : set policy port fe. For example.1. enter “router” to show onlyrouter  configuration. begin ! #***** NON-DEFAULT CONFIGURATION ***** ! ! #port SecureStack A2 Configuration Guide 3-43 . For example.1 4 14 : 15 : set policy port fe. Mode Switch command. read‐only. Syntax show config [all | facility] [outfile {configs/filename}] Parameters all facility (Optional) Displays default and non‐default configuration settings.”  Examples This example shows how to write the current configuration to a file named save_config2: A2(rw)->show config all outfile configs/save_config2 This example shows how to display configuration for the facility “port”. outfile configs/filename Defaults By default. show config will display all non‐default configuration information for all facilities. (Optional) Specifies that the current configuration will be written to a text  file in the configs/ directory. “#port” indicates the facility  name “port.  A2(rw)->show config port This command shows non-default configurations only. Use 'show config all' to show both default and non-default configurations.2 4 show config Use this command to display the system configuration or write the configuration to a file. (Optional) Specifies the exact name of one facility for which to show  configuration.1.

cfg 3-44 Basic Configuration . which will require an automated reset of the chassis. Mode Switch command. the current running configuration will be replaced with the contents of  the configuration file. for example.configure set port jumbo disable ge. This is equivalent to typing the contents of the config file  directly into the CLI and can be used. Syntax configure filename [append] Parameters filename append Specifies the path and file name of the configuration file to execute. to make incremental  adjustments to the current configuration.cfg” configuration file:  A2(su)->configure configs/Jan1_2004.1 ! end configure Use this command to execute a previously downloaded configuration file stored on the switch. Defaults If append is not specified.1.  (Optional) Appends the configuration file contents to the current  configuration. read‐write. Example This example shows how to execute the “Jan1_2004.

Usage Use the dir command (page 3‐41) to display current image and configuration file names. Syntax delete filename Parameters filename Specifies the local path name to the file. Valid directories are /images and  /configs.1. read‐write. or the URL of a TFTP server.192. Specifies location and name of the destination where the file will be copied.44 Defaults None. SecureStack A2 Configuration Guide 3-45 .192.  Options are a slot location and file name.1/Jan1_2004.cfg configs/Jan1_2004.cfg delete Use this command to remove an image or a CLI configuration file from the switch. Mode Switch command.34/version01000 system:image This example shows how to download a configuration file to the configs directory:  A2(su)->copy tftp://10. Options are a local file  path in the configs directory. Defaults None.1. Mode Switch command. read‐write.  Syntax copy source destination Parameters source destination Specifies location and name of the source file to copy. Examples This example shows how to download an image via TFTP: A2(su)->copy tftp://10.copy copy Use this command to upload or download an image or a CLI configuration file. or the URL of a TFTP server.

cfg” configuration file:  A2(su)->delete configs/Jan1_2004. 3-46 Basic Configuration . Defaults None.show tftp settings Example This example shows how to delete the “Jan1_2004. Syntax set tftp timeout seconds Parameters seconds Specifies the number of seconds to wait for a reply. Defaults None. Example This example shows the output of this command. The valid range is  from 1 to 30 seconds. A2(ro)->show tftp settings TFTP packet timeout (seconds): 2 TFTP max retry: 5 set tftp timeout Use this command to configure how long TFTP will wait for a reply of either an acknowledgement  packet or a data packet during a data transfer. The TFTP retry value can  be set with the set tftp retry command.  Syntax show tftp settings Parameters None.cfg show tftp settings Use this command to display TFTP settings used by the switch during data transfers using TFTP. read‐only. Mode Switch command. Default value is 2 seconds. Usage The TFTP timeout value can be set with the set tftp timeout command.

SecureStack A2 Configuration Guide 3-47 . Defaults None. either an  acknowledgement packet or a data packet. read‐write. Mode Switch command. A2(rw)-> clear tftp timeout set tftp retry Use this command to configure how many times TFTP will resend a packet. Syntax clear tftp timeout Parameters None. A2(rw)->set tftp timeout 4 clear tftp timeout Use this command to reset the TFTP timeout value to the default value of 2 seconds. Default value is 5 retries. Example This example shows how to clear the timeout value to the default of 2 seconds. read‐write. Mode Switch command. read‐write. Defaults None. The valid range is  from 1 to 1000.clear tftp timeout Mode Switch command. Example This example sets the timeout period to 4 seconds. Syntax set tftp retry retry Parameters retry Specifies the number of times a packet will be resent.

Example This example shows how to clear the retry value to the default of 5 retries. read‐write. Mode Switch command. Syntax clear tftp retry Parameters None. Defaults None.clear tftp retry Example This example sets the retry count to 3. A2(rw)->set tftp retry 3 clear tftp retry Use this command to reset the TFTP retry value to the default value of 5 retries. A2(rw)-> clear tftp retry 3-48 Basic Configuration .

.1-9 CDP Global Status :auto-enable CDP Version Supported :30 hex SecureStack A2 Configuration Guide 3-49 . When enabled.. Defaults If port‐string is not specified. Syntax show cdp [port-string] Parameters port‐string (Optional) Displays CDP status for a specific port. read‐only.1.9: A2(su)->show cdp fe. For a detailed description  of possible port‐string values. refer to “Port String Syntax Used in the CLI”  on page 4‐1.. this protocol allows Enterasys devices to send periodic PDUs  about themselves to neighboring devices. Mode Switch command. Commands The commands used to review and configure the CDP discovery protocol are listed below.Configuring CDP Configuring CDP Purpose To review and configure the Enterasys CDP discovery protocol. Example This example shows how to display CDP information for ports fe. all CDP information will be displayed.1 through fe.. show cdp set cdp state set cdp auth set cdp interval set cdp hold-time clear cdp show neighbors Refer to page.1. This protocol is used to discover  network topology.  For information about.1. 3-49 3-51 3-51 3-52 3-53 3-53 3-54 show cdp Use this command to display the status of the CDP discovery protocol and message interval on  one or more ports.

Whether CDP is enabled. The default of 60 seconds can be reset with the set cdp interval command.2 auto-enable fe.1. refer to “set cdp hold-time” on page 3-53.7 auto-enable fe. CDP Versions Supported CDP Hold Time CDP Authentication Code CDP Transmit Frequency Port Status 3-50 Basic Configuration .1. refer to “Port String Syntax Used in the CLI” on page 4-1. Table 3-4 Output CDP Global Status show cdp Output Details What It Displays. For details.3 auto-enable fe. Port designation.1.4 auto-enable fe. Minimum time interval (in seconds) at which CDP configuration messages can be set. For details. For details.1.1. For details. The default state of auto-enabled can be reset with the set cdp state command.1.1. Authentication code for CDP discovery protocol.9 auto-enable :180 :00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 hex :60 Table 3‐4 provides an explanation of the command output.6 auto-enable fe. For a detailed description of possible port-string values. refer to “set cdp interval” on page 3-52..show cdp CDP Hold Time CDP Authentication Code CDP Transmit Frequency Port Status ----------------fe. enabled or disabled. refer to “set cdp state” on page 3-51. Whether CDP is globally auto-enabled..1 auto-enable fe. The default of 00-00-00-00-00-0000-00 can be reset using the set cdp auth command.1. Frequency (in seconds) at which CDP messages can be transmitted. The default of 180 seconds can be reset with the set cdp hold-time command. disabled or auto-enabled on the port.1.8 auto-enable fe.5 auto-enable fe. CDP version number(s) supported by the switch. refer to “set cdp auth” on page 3-51.

2: A2(su)->set cdp state disable fe.set cdp state set cdp state Use this command to enable or disable the CDP discovery protocol on one or more ports.1. Defaults None.2 set cdp auth Use this command to set a global CDP authentication code. refer to “Port String Syntax Used  in the CLI” on page 4‐1.1.1. Defaults If port‐string is not specified. Syntax set cdp state {auto | disable | enable} [port-string] Parameters auto | disable |  enable  port‐string Auto‐enables.2 This example shows how to disable the CDP for port fe. read‐write. This can be up to 16  hexadecimal values separated by commas.2: A2(su)->set cdp state enable fe. Syntax set cdp auth auth-code Parameters auth‐code Specifies an authentication code for the CDP protocol. For a detailed  description of possible port‐string values. disables or enables the CDP protocol on the specified port(s). Examples This example shows how to globally enable CDP: A2(su)->set cdp state enable This example shows how to enable the CDP for port fe.  In auto‐enable mode. the CDP state will be globally set. a port  automatically becomes CDP‐enabled upon receiving its first CDP message. (Optional) Enables or disables CDP on specific port(s).1. which is the default mode for all ports. Mode Switch command. SecureStack A2 Configuration Guide 3-51 .

5.4.2. A switch with the default authentication code (16 null characters) will recognize all switches. Usage The authentication code value determines a switch’s CDP domain.set cdp interval Mode Switch command.7. Example This example shows how to set the CDP authentication code to 1.3.2.6. Defaults None. they will be entered into each other’s CDP neighbor tables. Example This example shows how to set the CDP interval frequency to 15 seconds: A2(su)->set cdp interval 15 3-52 Basic Configuration .4.8: set cdp interval Use this command to set the message interval frequency (in seconds) of the CDP discovery  protocol. If  they have different authentication codes. read‐write. read‐write.3. they are in different domains and will not be entered  into each other’s CDP neighbor tables.5.8: A2(su)->set cdp auth 1. no  matter what their authentication code. and enter them into its CDP neighbor table.7.Valid values  are from 5 to 900 seconds.6. If two or more switches have  the same CDP authentication code. Syntax set cdp interval frequency Parameters frequency Specifies the transmit frequency of CDP messages in seconds. Mode Switch command.

Mode Switch command. (Optional) Resets the port state on specific port(s) to auto‐enabled. (Optional) Resets the hold time value to 180 seconds. Syntax set cdp hold-time hold-time Parameters hold‐time Specifies the hold time value for CDP messages in seconds. Example This example shows how to set CDP hold time to 60 seconds: A2(su)->set cdp hold-time 60 clear cdp Use this command to reset CDP discovery protocol settings to defaults.Valid values are  from 15 to 600. Defaults At least one optional parameter must be entered.  Syntax clear cdp {[state] [port-state port-string] [interval] [hold-time] [auth-code]} Parameters state port‐state port‐string interval hold‐time auth‐code (Optional) Resets the global CDP state to auto‐enabled. Mode Switch command. read‐write. (Optional) Resets the authentication code to 16 bytes of 00 (00‐00‐00‐ 00‐00‐00‐00‐00).set cdp hold-time set cdp hold-time Use this command to set the hold time value for CDP discovery protocol configuration messages.  (Optional) Resets the message frequency interval to 60 seconds. read‐write. Defaults None. Example This example shows how to reset the CDP state to auto‐enabled: A2(su)->clear cdp state SecureStack A2 Configuration Guide 3-53 .

11 cdp 140.2.1.1. Defaults If no port is specified.4.4.2.2. read‐only.102 ge.4.2.101 ge.2.6 00-01-f4-5f-1f-c0 140. Syntax show neighbors [port-string] Parameters port‐string (Optional) Specifies the port or ports for which to display Neighbor  Discovery information.11 3-54 Basic Configuration .4.101 cdp 140.6 00-01-f4-00-72-fe 140.2.1.4.2.show neighbors show neighbors This command displays Neighbor Discovery information for either the CDP or Cisco DP  protocols.6 00-01-f4-00-70-8a 140.2.104 ge. Mode Switch command.1.4.102 cdp 140. Example This example displays Neighbor Discovery information for all ports.4. A2(su)->show neighbors Port Device ID Port ID Type Network Address -----------------------------------------------------------------------------ge.4.1. all Neighbor Discovery information is displayed.6 00-01-f4-c5-f7-20 140. Usage This command displays information discovered by both the CDP and the Cisco DP protocols.1.104 cdp 140.1.2.105 ge.2.105 cdp 140.6 00-01-f4-89-4f-ae 140.

Example This example shows how to clear the CLI screen: A2(su)->cls SecureStack A2 Configuration Guide 3-55 .Clearing and Closing the CLI Clearing and Closing the CLI Purpose To clear the CLI screen or to close your CLI session. cls exit Refer to page. Mode Switch command. Commands The commands used to clear and close the CLI session are listed below.... Defaults None. Syntax cls Parameters None. 3-55 3-56 cls (clear screen) Use this command to clear the screen for the current CLI session. read‐only. For information about..

 read‐only. Mode Switch command. Usage By default.exit exit Use either of these commands to leave a CLI session. Use the set logout command (page 3‐26) to change this default. switch timeout occurs after 15 minutes of user inactivity. Syntax exit Parameters None. automatically closing your  CLI session. Defaults None.  Example This example shows how to exit a CLI session: A2(su)->exit 3-56 Basic Configuration .

Mode Switch command. For  information on how to do this. For information about. the entire system will be reset. refer to the SecureStack A2 Installation Guide shipped with your  switch. Examples This example shows how to reset the system: A2(su)->reset Are you sure you want to reload the stack? (y/n) y Saving Configuration to stacking members Reloading all switches. reset clear config Refer to page..Resetting the Switch Resetting the Switch Purpose To reset one or more switches. Syntax reset [unit] Parameters unit (Optional) Specifies a unit to be reset.. 3-57 3-58 reset Use this command to reset the switch without losing any user‐defined configuration settings. This example shows how to reset unit 1 in the stack: A2(su)->reset 1 SecureStack A2 Configuration Guide 3-57 . Commands The commands used to reset the switch and clear the configuration are listed below.. read‐write. Usage A SecureStack A2 switch can also be reset with the RESET button located on its front panel. and to clear the user‐defined configuration parameters. Defaults If no unit ID is specified..

 including stack  unit IDs and switch priority values. Defaults If all is not specified. Use clear config all when it is necessary to clear all configuration parameters. Use the clear ip address command to clear the IP address. it is important  to remember the following: • Use clear config to clear configuration parameters without clearing stack unit IDs. This selection will leave stacking priorities on all other units.  Syntax clear config [all] Parameters  all (Optional) Clears user‐defined configuration parameters and stack unit  numbers and priorities. read‐write. Usage When using the clear config command to clear configuration parameters in a stack. STACK: detach 3 units clear config Use this command to clear the user‐defined configuration parameters. • • Configuration parameters and stacking information can also be cleared on the master unit only by  selecting option 10 (restore configuration to factory defaults) from the boot menu on switch  startup. This switch is manager of the stack. Example This example shows how to clear configuration parameters including stacking parameters: A2(su)->clear config all 3-58 Basic Configuration . Mode Switch command. This  command WILL NOT clear stack parameters and avoids the process of re‐numbering the  stack.clear config Are you sure you want to reload the switch? (y/n) y Reloading switch 1. stacking configuration parameters will not be cleared.

 WebView can also be securely used over SSL port 443. For information about. Example This example shows how to display WebView status: A2(rw)->show webview WebView is Enabled. and enable or disable WebView using the commands described in this  section.2. SSL is disabled. To use WebView.Using and Configuring WebView Using and Configuring WebView Purpose By default. WebView (The Enterasys Networks embedded web server for switch configuration  and management tasks) is enabled on TCP port number 80 on the SecureStack A2 switch.16.10. type the IP address of the switch in your browser. By  default. Mode Switch command.. For example... 3-59 3-60 3-60 3-61 show webview Use this command to display WebView status.. if SSL is enabled on the switch. Defaults None. https://172.  type in https:// then the IP address of the switch. Syntax show webview Parameters None. You can  verify WebView status. show webview set webview show ssl set ssl Refer to page. To use WebView over SSL. SecureStack A2 Configuration Guide 3-59 .  Commands The commands to configure WebView and SSL are described below. read‐only.

 read‐only. Example This example shows how to display SSL status: A2(rw)->show ssl SSL status: Enabled 3-60 Basic Configuration .set webview set webview Use this command to enable or disable WebView on the switch. Defaults None. Syntax set webview {enable | disable} Parameters enable | disable Enable or disable WebView on the switch. Example This example shows how to disable WebView on the switch: A2(rw)->set webview disable show ssl Use this command to display SSL status. and then to only enable WebView on the switch when changes need to  be made. Mode Switch command. Usage It is good practice for security reasons to disable HTTP access on the switch when finished  configuring with WebView. Syntax show ssl Parameters None. read‐write. Defaults None. Mode Switch command.

 and then restarts SSL. Defaults None. Mode Switch command. Syntax set ssl {enabled | disabled | reinitialize | hostkey reinitialize} Parameters enabled | disabled reinitialize hostkey reinitialize Enable or disable the ability to use WebView over SSL. regenerates new keys. By default. Stops and then restarts the SSL process. This command can also be used to reinitialize the hostkey that is used for  encryption.set ssl set ssl Use this command to enable or disable the use of WebView over SSL port 443. Example This example shows how to enable SSL: A2(rw)->set ssl enabled SecureStack A2 Configuration Guide 3-61 . SSL is  disabled on the switch. Stops SSL. read‐write.

set ssl 3-62 Basic Configuration .

. For information about.. 2 1000BASE‐T RJ45 connectors (labeled port 25 and 26) that can be used for stack connections  when the switch is operating in a stack configuration... 4-1 4-4 4-7 4-10 4-13 4-15 4-19 4-21 4-22 4-25 4-28 4-42 Port Configuration Summary A2H124-24 and A2H124-24P Switch Ports The A2H124‐24 and A2H124‐24P stackable devices provide the following types of switch port  connections: • • 24 RJ45 10/100 Mbps Fast Ethernet copper ports.4 Port Configuration This chapter describes the Port Configuration set of commands and how to use them.  2 SFP slots (labeled port 27 and 28) that provide the option of installing Small Form Pluggable  (SFP) Mini‐GBICs for 1000BASE‐T compliant copper connections or 1000BASE‐SX\LX fiber‐ optic connections. or as standard switch ports when the  switch is operating as a stand alone device. Port Configuration Summary Reviewing Port Status Disabling / Enabling and Naming Ports Setting Speed and Duplex Mode Enabling / Disabling Jumbo Frame Support Setting Auto-Negotiation and Advertised Ability Setting Flow Control Setting Port Link Traps Configuring Broadcast Suppression Port Mirroring Link Aggregation Control Protocol (LACP) Configuring Protected Ports Refer to page. • SecureStack A2 Configuration Guide 4-1 .

2 SFP slots (labeled port 27 and 28) that provide the option of installing Small Form Pluggable  (SFP) Mini‐GBICs for 1000BASE‐T compliant copper connections or 1000BASE‐SX\LX fiber‐ optic connections. or as standard switch ports when the  switch is operating as a stand alone device. and port number: port type.Port Configuration Summary A2H124-48 and A2H124-48P Switch Ports The A2H124‐48 and A2H124‐48P stackable devices provide the following types of switch port  connections: • • 48 RJ45 10/100 Mbps Fast Ethernet copper ports. 2 1000BASE‐T RJ45 connectors (labeled port 49 and 50) that can be used for stack connections  when the switch is operating in a stack configuration.  2 SFP slots (labeled port 51 and 52) that provide the option of installing Small Form Pluggable  (SFP) Mini‐GBICs for 1000BASE‐T compliant copper connections or 1000BASE‐SX\LX fiber‐ optic connections. 2 1000BASE‐T RJ45 connectors (labeled port 17 and 18) that can be used for stack connections  when the switch is operating in a stack configuration.unit number. • Port String Syntax Used in the CLI Commands requiring a port‐string parameter use the following syntax to designate port type. or as standard switch ports when the  switch is operating as a stand alone device. or as standard switch ports when the  switch is operating as a stand alone device.port number Where port type can be: fe for 100‐Mbps Ethernet ge for 1‐Gbps Ethernet tg for 10‐Gbps Ethernet host for the host port  vlan for vlan interfaces  lag for IEEE802. 2 SFP slots (labeled port 19 and 20) that provide the option of installing Small Form Pluggable  (SFP) Mini‐GBICs for 1000BASE‐T compliant copper connections or 1000BASE‐SX\LX fiber‐ optic connections.3 link aggregation ports 4-2 Port Configuration . 2 1000BASE‐T RJ45 connectors (labeled port 25 and 26) that can be used for stack connections  when the switch is operating in a stack configuration. slot  location. 8 100BASE‐FX multimode MT‐RJ ports (even numbered 2 – 16). • A2H124-24FX Switch Ports The A2H124‐24FX stackable device provides the following types of switch port connections: • • 24 100BASE‐FX multimode MT‐RJ fiber optic ports. • A2H254-16 Switch Ports The A2H124‐16 stackable device provides the following types of switch port connections: • • • 8 100BASE‐T 10/100 Mbps copper RJ445 ports (odd numbered 1 – 15).

  ge.Port Configuration Summary Unit number can be: 1 ‐ 8 for switch units in a SecureStack A2 stack Port number can be: 1 – 52 for the A2H124‐48 and A2H124‐48P 1 – 28 for the A2H124‐24. This example shows the port‐string syntax for specifying the 100‐Mbps Ethernet ports 1 through 10  in unit 1 in the stack. *.  tg.25 This example shows the port‐string syntax for specifying all 1‐Gigabit Ethernet ports in unit 3 in  the stack.3. A2H124‐24P. and A2H124‐24FX 1 – 20 for the A2H254‐16 The highest valid port number is dependent on the number of ports in the device and the port  type.14 This example shows the port‐string syntax for specifying the first 10‐Gigabit Ethernet port of unit 3  in the stack.* This example shows the port‐string syntax for specifying all ports (of any interface type) in all units  in the stack. fe.* would represent all 100Mbps Ethernet (fe) ports in unit 3 in the stack.  Examples Note: You can use a wildcard (*) to indicate all of an item.3.3.1. For example.1-10 This example shows the port‐string syntax for specifying the 1‐Gigabit Ethernet port 14 in unit 3 in  the stack. ge. fe.* SecureStack A2 Configuration Guide 4-3 .3.*.

Defaults If port‐string is not specified.  switch ports 27 and 28 are shown as ports 25 and 26. switch ports 19 and 20 are shown as ports 17 and 18. On the A2H124‐24FX.3. duplex mode. port type. read‐only.14 Port fe.. Commands The commands used to review port status are listed below.. Example This example shows how to display operational status information for fe. For a detailed  description of possible port‐string values. operational status information for all ports will be displayed. For information about. refer to “Port String Syntax Used  in the CLI” on page 4‐2.14: A2(su)->show port fe. and statistical information about  traffic received and transmitted through one or all switch ports on the device. Mode Switch command. 4-4 4-5 4-6 show port Use this command to display whether or not one or more ports are enabled for switching. speed.Reviewing Port Status Reviewing Port Status Purpose To display operating status..3.14 enabled 4-4 Port Configuration . Usage On the A2H256‐16. show port show port status show port counters Refer to page.. Syntax show port [port-string] Parameters port‐string (Optional)  Displays operational status for specific port(s).3.

Mode Switch command. For details on using the set port alias command. Operational speed in Mbps or Kbps of the specified port. Port designation. Usage The front panel Stacking Ports will only be displayed with the show port status command when  they are in Ethernet mode. For details on using the set port disable command to change the default port status of enabled. Table 4-1 Output Port Alias (truncated) Oper Status Admin Status show port status Output Details What It Displays. Alias configured for the port.3.14 Oper Status ------up Admin Status ------up Speed -------N/A Duplex Type ------. read‐only. refer to “set port speed” on page 4-11. Operating status (up or down). refer to “set port alias” on page 4-9.-------------fe. refer to “Port String Syntax Used in the CLI” on page 4-2.show port status show port status Use this command to display operating and admin status. status information for all ports will be displayed.. For a detailed description of possible port-string values.------------N/A BaseT RJ45 Table 4‐1 provides an explanation of the command output. For information on configuring front panel stack ports refer to  “Configuring Standalone A2 Stack Ports” on page 2‐5.3. For a detailed description of  possible port‐string values. Whether the specified port is enabled (up) or disabled (down). Syntax show port status [port-string] Parameters port‐string (Optional) Displays status for specific port(s). Defaults If port‐string is not specified.14 Port Alias (truncated) -----------. refer to “set port enable” on page 4-8.. refer to “set port disable” on page 4-8. For details on using the set port enable command to re-enable ports. speed. Example This example shows how to display status information for fe. duplex mode and port type for  one or more ports on the device. refer to “Port String Syntax Used in the CLI” on  page 4‐2.14: A2(su)->show port status fe. For details on using the set port speed command to change defaults.3. Speed SecureStack A2 Configuration Guide 4-5 .

3. Switch statistics detail  performance of the SecureStack A2 device. read‐only.  If mib2 or switch are not specified. all counter statistics will be displayed for the specified port(s). Duplex mode (half or full) of the specified port. Examples This example shows how to display all counter statistics. For details on using the set port duplex command to change defaults. Syntax show port counters [port-string] [switch | mib2] Parameters port‐string (Optional) Displays counter statistics for specific port(s). Physical port and interface type.  switch | mib2  Defaults If port‐string is not specified.3.1 Port: fe. Type show port counters Use this command to display port counter statistics detailing traffic through the device and  through all MIB2 network devices.. MIB2 interface statistics detail  performance of all network devices. refer to “Setting Auto-Negotiation and Advertised Ability” on page 4-15. For a detailed  description of possible port‐string values. refer to “Port String Syntax Used  in the CLI” on page 4‐2. (Optional) Displays switch or MIB2 statistics.  Mode Switch command.1 MIB2 Interface: 1 No counter discontinuity time ----------------------------------------------------------------MIB2 Interface Counters ----------------------In Octets In Unicast Pkts In Multicast Pkts In Broadcast Pkts In Discards In Errors Out Octets Out Unicasts Pkts Out Multicast Pkts 4-6 Port Configuration 0 0 0 0 0 0 0 0 0 .show port counters Table 4-1 Output Duplex show port status Output Details (Continued) What It Displays. including MIB2 network traffic and  traffic through the device for fe..1: A2(su)->show port counters fe. counter statistics will be displayed for all ports.3.

1 port counter statistics related to traffic through the  device.1 Bridge Port: 2 802. For a detailed description of possible port-string values.3.3.1Q Switch Counters show port counters Output Details What It Displays.. MIB2 network traffic counts Counts of frames received. transmitted.1 switch Port: fe. A2(su)->show port counters fe.1Q Switch Counters ----------------------Frames Received Frames Transmitted 0 0 Table 4‐2 provides an explanation of the command output. Table 4-2 Output Port MIB2 Interface Bridge Port MIB2 Interface Counters 802. Port designation.. and filtered. refer to “Port String Syntax Used in the CLI” on page 4-2.1D bridge port designation. SecureStack A2 Configuration Guide 4-7 .show port counters Out Broadcast Pkts Out Errors 802. MIB2 interface designation.3. IEEE 802.1Q Switch Counters ---------------------Frames Received Frames Transmitted 0 0 0 0 This example shows how to display all fe.

Example This example shows how to disable fe. set port disable set port enable show port alias set port alias Refer to page. read‐write. By default. Syntax set port disable port-string Parameters port‐string Specifies the port(s) to disable. Mode Switch command. all ports are  enabled at device startup. Commands The commands used to enable. When this command is  executed. Defaults None.  For information about..1 4-8 Port Configuration .Disabling / Enabling and Naming Ports Disabling / Enabling and Naming Ports Purpose To disable and re‐enable one or more ports.1. and to assign an alias to a port. in addition to disabling the physical Ethernet link. You may want to disable ports for security or to troubleshoot network  issues. disable.1. For a detailed description of possible port‐ string values. the port will no longer learn entries  in the forwarding database. refer to “Port String Syntax Used in the CLI” on page 4‐2.. and name ports are listed below. 4-8 4-8 4-9 4-9 set port disable Use this command to administratively disable one or more ports..1: A2(su)->set port disable fe. Ports may also be assigned an alias for convenience..

1 Port ge.3 show port alias Use this command to display the alias name for one or more ports. Mode Switch command.3. For a detailed description of possible port‐ string values.1-3 user user Admin SecureStack A2 Configuration Guide 4-9 . aliases for all ports will be displayed. Example This example shows how to enable fe.  Syntax set port enable port-string Parameters port‐string Specifies the port(s) to enable. read‐write. Defaults If port‐string is not specified.3.3. Example This example shows how to display alias information for ports 1‐3 on unit 3: A2(rw)->show Port ge.1. refer to “Port String Syntax  Used in the CLI” on page 4‐2. read‐only.3 port alias ge.2 Port ge. Syntax show port alias [port-string] Parameters port‐string (Optional) Displays alias name(s) for specific port(s).3. refer to “Port String Syntax Used in the CLI” on page 4‐2.set port enable set port enable Use this command to administratively enable one or more ports. Mode Switch command.1.3: A2(su)->set port enable fe. Defaults None. For a detailed  description of possible port‐string values.

3: A2(rw)->set port alias ge. If the alias name contains  spaces. For a detailed  description of possible port‐string values. name Defaults If name is not specified.3 Admin This example shows how to clear the alias for ge.3. refer to “Port String Syntax  Used in the CLI” on page 4‐2.set port alias set port alias Use this command to assign an alias name to a port.3. the text string must be surrounded by double quotes.3: A2(rw)->set port alias ge.3.3 4-10 Port Configuration . (Optional) Assigns an alias name to the port. Maximum  length is 60 characters. the alias assigned to the port will be cleared. read‐write. Examples This example shows how to assign the alias “Admin” to ge. Mode Switch command.3. Syntax set port alias port-string [name] Parameters port‐string Specifies the port to which an alias will be assigned.

Example This example shows how to display the default speed setting for 1‐Gigabit Ethernet port 14 in  unit 3: A2(su)->show port speed ge. refer to “Port String  Syntax Used in the CLI” on page 4‐2.14.Setting Speed and Duplex Mode Setting Speed and Duplex Mode Purpose To review and set the operational speed in Mbps and the default duplex mode: Half.3.. For a  detailed description of possible port‐string values..3. for half  duplex. Mode Switch command. for full duplex for one or more ports. For information about. default speed settings for all ports will display. Defaults If port‐string is not specified. SecureStack A2 Configuration Guide 4-11 . read‐only. Note: These settings only take effect on ports that have auto-negotiation disabled. show port speed set port speed show port duplex set port duplex Refer to page. or Full. Syntax show port speed [port-string] Parameters port‐string (Optional) Displays default speed setting(s) for specific port(s). 4-10 4-11 4-11 4-15 show port speed Use this command to display the default speed setting on one or more ports... Commands The commands used to review and set port speed and duplex mode are listed below.14 default speed is 10 on port ge.

Mode Switch command.set port speed set port speed Use this command to set the default speed of one or more ports. Defaults If port‐string is not specified. refer to  “Port String Syntax Used in the CLI” on page 4‐2.3 to a port speed of 10 Mbps: A2(su)->set port speed fe. Syntax show port duplex [port-string] Parameters port‐string (Optional) Displays default duplex setting(s) for specific port(s). default duplex settings for all ports will be displayed. Example This example shows how to set fe.3 10 show port duplex Use this command to display the default duplex setting (half or full) for one or more ports. Valid values are: 10 Mbps. For a  detailed description of possible port‐string values.3. or  1000 Mbps. Mode Switch command.3. 10 | 100 | 1000 Defaults None. 4-12 Port Configuration . 100 Mbps. This setting only takes effect on  ports that have auto‐negotiation disabled.  For a detailed description of possible port‐string values. read‐write. read‐only. refer to “Port  String Syntax Used in the CLI” on page 4‐2. Syntax set port speed port-string {10 | 100 | 1000} Parameters port‐string Specifies the port(s) for which to a speed value will be set. Specifies the port speed.

Syntax set port duplex port-string {full | half} Parameters port‐string Specifies the port(s) for which duplex type will be set. read‐write.1. Mode Switch command. full | half Defaults None. This command will only  take effect on ports that have auto‐negotiation disabled.17 full SecureStack A2 Configuration Guide 4-13 . Example This example shows how to set Fast Ethernet port 17 in unit 1 to full duplex: A2(su)->set port duplex fe. refer to “Port String Syntax  Used in the CLI” on page 4‐2.3.14. Sets the port(s) to full‐duplex or half‐duplex operation.14 default duplex mode is full on port ge. For a detailed  description of possible port‐string values.set port duplex Example This example shows how to display the default duplex setting for Gigabit Ethernet port 14 in  unit 3: A2(su)->show port duplex ge. set port duplex Use this command to set the default duplex type for one or more ports.3.

Defaults If port‐string is not specified. and disable jumbo frame support on one or more ports.1. show port jumbo set port jumbo clear port jumbo Refer to page. For information about.-----------------ge. read‐only. refer to  “Port String Syntax Used in the CLI” on page 4‐2.1. 4-13 4-14 4-14 show port jumbo Use this command to display the status of jumbo frame support and maximum transmission units  (MTU) on one or more ports.. Commands The commands used to review.1 Enable 9216 4-14 Port Configuration . This allows Gigabit  Ethernet ports to transmit frames up to 10 KB in size.Enabling / Disabling Jumbo Frame Support Enabling / Disabling Jumbo Frame Support Purpose To review.--------------. Syntax show port jumbo [port-string] Parameters port‐string (Optional) Displays the status of jumbo frame support for specific  port(s).. For a detailed description of possible port‐string values. Example This example shows how to display the status of jumbo frame support for ge. enable and disable jumbo frame support are listed below.1:  A2(su)->show port jumbo ge.. enable. jumbo frame support status for all ports will display. Mode Switch command.1.1 Port Number Jumbo Status Max Frame Size ------------..

 read‐write. refer to “Port String Syntax Used in the CLI” on  page 4‐2.3. Defaults If port‐string is not specified. Syntax clear port jumbo [port-string] Parameters port‐string (Optional) Specifies the port(s) on which to reset jumbo frame  support status to enabled. jumbo frame support will be enabled or disabled on all ports.3. Example This example shows how to enable jumbo frame support for Gigabit Ethernet port 14 in unit 3: A2(su)->set port jumbo enable ge.  refer to “Port String Syntax Used in the CLI” on page 4‐2.14 SecureStack A2 Configuration Guide 4-15 . Example This example shows how to reset jumbo frame support status for Gigabit Ethernet port 14 in  unit 3: A2(su)->clear port jumbo ge. For a detailed description of possible port‐string values.14 clear port jumbo Use this command to reset jumbo frame support status to enabled on one or more ports. Mode Switch command. Syntax set port jumbo {enable | disable} [port-string] Parameters enable | disable port‐string Enables or disables jumbo frame support. jumbo frame support status will be reset on all ports. Mode Switch command. (Optional) Specifies the port(s) on which to disable or enable jumbo  frame support.set port jumbo set port jumbo Use this command to enable or disable jumbo frame support on one or more ports. For a detailed description of possible  port‐string values. read‐write. Defaults If port‐string is not specified.

During auto‐negotiation. Commands The commands used to review and configure auto‐negotiation and advertised ability are listed  below: For information about. refer to “Port String  Syntax Used in the CLI” on page 4‐2.  In normal operation.. auto‐negotiation status for all ports will be displayed. Note: Advertised ability can be activated only on ports that have auto-negotiation enabled. default duplex. the port reverts to the  values specified by default speed. read‐only.Setting Auto-Negotiation and Advertised Ability Setting Auto-Negotiation and Advertised Ability Purpose To review. For a  detailed description of possible port‐string values.. advertised ability enables a port to “advertise”  that it has the ability to operate in any mode. with all capabilities enabled. the port “tells” the device at the other end of the segment what its  capabilities and mode of operation are. 4-16 Port Configuration . and to configure port advertisement for speed and  duplex. 4-15 4-16 4-16 4-17 4-18 show port negotiation Use this command to display the status of auto‐negotiation for one or more ports. and the port flow control commands.. The user may choose to configure a port so that only  a portion of its capabilities are advertised and the others are disabled.. Mode Switch command. Syntax show port negotiation [port-string] Parameters port‐string (Optional) Displays auto‐negotiation status for specific port(s). Defaults If port‐string is not specified. disable or enable auto‐negotiation. show port negotiation set port negotiation show port advertise set port advertise clear port advertise Refer to page. If auto‐negotiation is disabled.

Enables or disables auto‐negotiation.14. advertisement for all ports will be displayed. refer to “Port String  Syntax Used in the CLI” on page 4‐2. SecureStack A2 Configuration Guide 4-17 . For a  detailed description of possible port‐string values. Defaults If port‐string is not specified.3.3. For a  detailed description of possible port‐string values. read‐write.3. set port negotiation Use this command to enable or disable auto‐negotiation on one or more ports.14 disable show port advertise Use this command to display port capability and advertisement as far as speed and duplex for  auto‐negotiation.set port negotiation Example This example shows how to display auto‐negotiation status for 1‐Gigabit Ethernet port 14 in  unit 3: A2(su)->show port negotiation ge. enable | disable  Defaults None. Syntax set port negotiation port-string {enable | disable} Parameters port‐string Specifies the port(s) for which to enable or disable auto‐negotiation.14 auto-negotiation is enabled on port ge. Mode Switch command. Example This example shows how to disable auto‐negotiation on 1‐Gigabit Ethernet port 3 in unit 14: A2(su)->set port negotiation ge. Syntax show port advertise [port-string] Parameters port‐string (Optional) Displays advertised ability for specific port(s). refer to “Port String  Syntax Used in the CLI” on page 4‐2.

Example This example shows how to display advertisement status for Gigabit ports 13 and 14:  A2(su)->show port advertise ge.1. 4-18 Port Configuration . read‐only. Advertise 100BASE‐TX full duplex mode.set port advertise Mode Switch command. Advertise 100BASE‐TX half duplex mode. Advertise 10BASE‐T half duplex mode.14 capability advertised remote ------------------------------------------------10BASE-T yes yes yes 10BASE-TFD yes yes yes 100BASE-TX yes yes yes 100BASE-TXFD yes yes yes 1000BASE-T no no no 1000BASE-TFD yes yes yes pause yes yes no set port advertise Use this command to configure what a port will advertise for speed/duplex capabilities in auto‐ negotiation. Advertise 1000BASE‐T full duplex mode. refer to “Port String Syntax Used  in the CLI” on page 4‐2.1.13-14 ge. For a detailed  description of possible port‐string values. Advertise 10BASE‐T full duplex mode. Advertise PAUSE for full‐duplex links.1. Syntax set port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause} Parameters port‐string Select the ports for which to configure advertisements.13 capability advertised remote ------------------------------------------------10BASE-T yes yes yes 10BASE-TFD yes yes yes 100BASE-TX yes yes yes 100BASE-TXFD yes yes yes 1000BASE-T no no no 1000BASE-TFD yes yes yes pause yes yes no ge. Advertise 1000BASE‐T half duplex mode. 10t 10tfd 100tx 100txfd 1000t 1000tfd pause Defaults None.

 read‐write. Mode Switch command.1.1. Do not advertise 100BASE‐TX full duplex mode. Do not advertise 10BASE‐T full duplex mode. For a detailed description of  possible port‐string values. Do not advertise 1000BASE‐T full duplex mode. Do not advertise PAUSE for full‐duplex links. 10t 10tfd 100tx 100txfd 1000t 1000tfd pause Defaults None.1 1000tfd clear port advertise Use this command to configure a port to not advertise a specific speed/duplex capability when  auto‐negotiating with another port. Do not advertise 1000BASE‐T half duplex mode. Do not advertise 10BASE‐T half duplex mode. read‐write. Example This example shows how to configure port 1 to not advertise 10 MB capability for auto‐ negotiation:  A2(su)->clear port advertise ge. Syntax clear port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause} Parameters port‐string Clear advertisements for specific port(s). Example This example shows how to configure port 1 to advertise 1000BASE‐T full duplex:  A2(su)->set port advertise ge. refer to “Port String Syntax Used in the  CLI” on page 4‐2.1 10t 10tfd SecureStack A2 Configuration Guide 4-19 .clear port advertise Mode Switch command. Do not advertise 100BASE‐TX half duplex mode.

 enable or disable port flow control. show flowcontrol set flowcontrol Refer to page. 4-19 4-20 show flowcontrol Use this command to display the flow control state. Defaults None... read‐only.3x to prevent receiving ports from being  overwhelmed by frames from transmitting devices. Mode Switch command.Setting Flow Control Setting Flow Control Purpose To review. Example This example shows how to display the port flow control state: A2(su)->show flowcontrol Flow control status: enabled 4-20 Port Configuration ... Syntax show flowcontrol Parameters None.  Commands The commands used to review and set port flow control are listed below: For information about. Flow control is used to manage the transmission  between two devices as specified by IEEE 802.

Defaults None. Example This example shows how to enable flow control: A2(su)->set flowcontrol enable SecureStack A2 Configuration Guide 4-21 . Syntax set flowcontrol {enable | disable} Parameters enable | disable Enables or disables flow control settings. read‐write.set flowcontrol set flowcontrol Use this command to enable or disable flow control. Mode Switch command.

1.3.4. Mode Switch command.3.1-4 Link traps enabled on port fe. refer to “Port String Syntax Used  in the CLI” on page 4‐2.3.  Commands For information about. For a detailed  description of possible port‐string values. Example This example shows how to display link trap status for fe.3. 4-22 Port Configuration .2. read‐write. Syntax show port trap [port-string] Parameters port‐string (Optional) Displays link trap status for specific port(s). 4-21 4-21 show port trap Use this command to display whether the port is enabled for generating an SNMP trap message if  its link state changes..3.Setting Port Link Traps Setting Port Link Traps Purpose To disable or re‐enable link traps. Defaults If port‐string is not specified. all ports are enabled to send  SNMP trap messages indicating changes to their link status (up or down). the trap status for all ports will be displayed. Link traps enabled on port fe. Link traps enabled on port fe. show port trap set port trap Refer to page. By default..3.1 through 4: A2(su)->show port trap fe. Link traps enabled on port fe... display link trap status.3.

Syntax set port trap port-string {enable|disable} Parameters port‐string Specifies the port(s) for which to enable or disable port traps. For a  detailed description of possible port‐string values. enable | disable Defaults Sending traps when link status changes is enabled by default. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Example The following example disables sending trap on Fast Ethernet port 1 on unit 3. Mode Switch command. Enables or disables sending trap messages when link status changes.1 disable SecureStack A2 Configuration Guide 4-23 .set port trap set port trap Use this command to enable of disable ports for sending SNMP trap messages when their link  status changes. read‐write. A2(su)->set port trap fe.3.

2 0 50 ge.. Broadcast suppression protects against broadcast storms and ARP sweeps.1. Example This example shows how to display the broadcast suppression thresholds for ports 1 through 4: A2(su)->show port broadcast ge. a broadcast  suppression threshold of 14881 packets per second (pps) will be used. Commands The commands used to review and configure port broadcast suppression are listed below. This feature limits  the number of received broadcast frames the switch will accept per port. Syntax show port broadcast [port-string] Parameters port‐string (Optional) Select the ports for which to show broadcast suppression  thresholds. For information about.1. read‐only. Defaults If port‐string is not specified.4 0 14881 4-24 Port Configuration . broadcast status of all ports will be displayed. By default. show port broadcast set port broadcast clear port broadcast Refer to page.1.. refer  to “Port String Syntax Used in the CLI” on page 4‐2.3 0 40 ge..Configuring Broadcast Suppression Configuring Broadcast Suppression Purpose To review and set the broadcast suppression threshold for one or more ports. Broadcast suppression  thresholds apply only to broadcast traffic—multicast traffic is not affected.. 4-22 4-23 4-24 show port broadcast Use this command to display port broadcast suppression thresholds.1-4 Port Total BC Threshold Packets (pkts/s) ---------------------------------------ge.1 0 50 ge.1. Mode Switch command. For a detailed description of possible port‐string values.1. regardless of actual port  speed.

1. Sets the packets per second threshold on broadcast traffic. Example This example configures ports 1 through 5 with a broadcast limit of 50 pps: A2(su)->set port broadcast ge. on one or  more ports. read‐write.1. Defaults None. read‐write. For a  detailed description of possible port‐string values.set port broadcast set port broadcast Use this command to set the broadcast suppression threshold.1-5 threshold SecureStack A2 Configuration Guide 4-25 . refer to “Port String  Syntax Used in the CLI” on page 4‐2.  For a detailed description of possible port‐string values. Maximum  value is 148810 for Fast Ethernet ports and 1488100 for Gigabit ports. refer to “Port  String Syntax Used in the CLI” on page 4‐2.1-5 50 clear port broadcast Use this command to clear the broadcast threshold limit to the default value of 14881 for the  selected port. Example This example clears the broadcast threshold limit to 14881 pps for ports 1 through 5: A2(su)->clear port broadcast ge. Mode Switch command. Syntax set port broadcast port-string threshold-val Parameters port‐string  Select the ports for which to configure broadcast suppression thresholds. This sets a threshold on the broadcast traffic that is received and switched out to other  ports. threshold‐val Defaults None. in packets per second. Syntax clear port broadcast port-string threshold Parameters port‐string  Select the ports for which to clear broadcast suppression thresholds. Mode Switch command.

show port mirroring set port mirroring clear port mirroring Refer to page.  A destination port will only act as a mirroring port when the session is operationally active.. then the destination port will act as a normal  port and participate in all normal operation with respect to transmitting traffic and  participating in protocols. • • • Purpose To review and configure port mirroring on the device. Commands The commands used to review and configure port mirroring are listed below.  Mirroring Features The SecureStack A2 device supports the following mirroring features: • Mirroring can be configured in a many‐to‐one configuration so that one target (destination)  port can monitor traffic on up to 4 source ports. For information about. Both transmit and receive traffic will be mirrored. When port mirroring is  enabled. Only one mirror destination port can be  configured per stack. The SecureStack A2 device allows you to mirror (or redirect) the traffic being switched on a port  for the purposes of network traffic analysis and connection assurance.Port Mirroring Port Mirroring Caution: Port mirroring configuration should be performed only by personnel who are knowledgeable about the effects of port mirroring and its impact on network operation.. 4-26 4-26 4-27 4-26 Port Configuration . A mirroring session which is configured to be active (enabled) will be operationally active  only if both a destination port and at least one source port have been configured. If  the mirroring session is not operationally active. one port becomes a monitor port for another port within the device...

11 is a target and mirroring has been enabled between these ports: A2(su)->show port mirroring Port Mirroring ============== Source Port = fe.4 is configured as  a source port and fe. and whether mirroring is  currently enabled or disabled for those ports. For a detailed description of possible port‐string values. Defaults None.  refer to “Port String Syntax Used in the CLI” on page 4‐2.show port mirroring show port mirroring Use this command to display the source and target ports for mirroring. refer to “Port  String Syntax Used in the CLI” on page 4‐2. Syntax set port mirroring {create | disable | enable} source destination} Parameters create | disable |  enable source Creates.  Specifies the source port designation. Mode Switch command. Specifies the target port designation. In this case.1. set port mirroring Use this command to create a new mirroring relationship or to enable or disable an existing  mirroring relationship between two ports. For a detailed description of possible port‐string values. disables or enables mirroring settings on the specified ports. Only one destination port  can be configured per stack.11 Frames Mirrored = Rx and Tx Port Mirroring status enabled. read‐only. This is the port that will duplicate or  “mirror” all the traffic on the monitored port.1.1. fe. Syntax show port mirroring Parameters None.1. destination SecureStack A2 Configuration Guide 4-27 . This is the port on which the traffic  will be monitored.4 Target Port = fe. Example This example shows how to display port mirroring information.

Mode Switch command.1.4 fe.4 fe. read‐write. refer to “Port String  Syntax Used in the CLI” on page 4‐2.1.1.  Syntax clear port mirroring source destination Parameters source Specifies the source port of the mirroring configuration to be cleared.11 clear port mirroring Use this command to clear a port mirroring relationship. Specifies the target port of the mirroring configuration to be cleared.1. For  a detailed description of possible port‐string values.1.1. Usage Note that LAG ports and their underlying physical ports.4 as the source port.4 fe.1.1. read‐write.1.4 and target port fe. Example This example shows how to create and enable port mirroring with fe.11 as the target port: A2(su)->set port mirroring create fe. cannot be mirrored. Example This example shows how to clear port mirroring between source port fe. Mode Switch command. and  fe. as described in “Link Aggregation  Control Protocol (LACP)” on page 4‐28.11 A2(su)->set port mirroring enable fe.1.11: A2(su)->clear port mirroring fe.11 4-28 Port Configuration .clear port mirroring Defaults None.  destination Defaults None.

 problems with looping can be avoided  since the Spanning Tree can treat this LAG as a single port.Link Aggregation Control Protocol (LACP) Link Aggregation Control Protocol (LACP) Caution: Link aggregation configuration should only be performed by personnel who are knowledgeable about Spanning Tree and Link Aggregation. a server) or to a router. at most.3ad LACP aggregations can also be run to end‐users (that is.3ad specification. Using multiple links simultaneously to increase bandwidth is a desirable switch feature. and the creation of the group if necessary. • • Attaches the port to the aggregator used by the LAG. Note: Earlier (proprietary) implementations of port aggregation referred to groups of aggregated ports as "trunks". Enabled by default. subject to management controls. which  can be accomplished if both sides agree on a set of ports that are being used as a Link Aggregation  Group (LAG). LACP: • • Maintains configuration information (reflecting the inherent properties of the individual links  as well as those established by management) to control aggregation. This standard allows the switch to determine which ports are in LAGs and configure  them dynamically. Monitoring the status of aggregated links to ensure that the aggregation is still valid. and to  determine whether those links are compatible from the point of view of aggregation. In order to allow LACP to determine whether a set of links connect to the same device. LACP Operation For each aggregatable port in the device. Since the protocol is based on the IEEE 802. 802. The allocation mechanism attempts to maximize aggregation.3ad  standard. Exchanges configuration information with other devices to allocate the link to a Link  Aggregation Group (LAG). it is  necessary to be able to establish • A globally unique identifier for each device that participates in link aggregation. Controlling the addition of a link to a LAG. the Link Aggregation Control Protocol (LACP) logically groups interfaces  together to create a greater bandwidth uplink. the proper operation of the network could be at risk. Otherwise. one Link Aggregation Group (LAG) at a time. Note: A given link is allocated to. any switch from  any vendor that supports this standard can aggregate links automatically. and detaches the port from the  aggregator when it is no longer used by the LAG. according to the IEEE 802. or link aggregation. Uses information from the partner device’s link aggregation control entity to decide whether  to aggregate ports. The operation of LACP involves the following activities: • • • • Checking that candidate links can actually be aggregated. and fully understand the ramifications of modifications beyond device defaults. SecureStack A2 Configuration Guide 4-29 . and removing the group if it  no longer has any member links. Once a LAG is formed from selected ports. Removing a link from a LAG if its membership is no longer valid.

LACPDUs sent by the first party (the actor) convey to the second party (the actor’s protocol partner) what the actor knows.x port designation.x. or ge. A means of identifying a LAG and its associated aggregator.x.0.x. On SecureStack A2 devices.0. using either the set lacp asyspri command (page 4-33). An actor is the local device sending LACPDUs. the resulting aggregation will be represented as one LAG with a lag. refer to set  lacp static (page 4‐35). both about its own state and that of its partner.x. fe. The LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator. If there are two partner devices competing for the same aggregator. Link Aggregation Group. Value assigned to aggregator ports and physical ports that are candidates for joining a LAG. or ge. which are designated in  the CLI as lag.  4-30 Port Configuration . SecureStack A2 LAGs can have up to 4 associated physical ports.x. the default admin key value is 32768. fe. Value used to build a LAG ID. The default values will result in the maximum number of  aggregations possible. or the set port lacp command (page 4-39). Its protocol partner is the device on the other end of the link aggregation. Each SecureStack A2 module provides six virtual link aggregator ports. LACP Terminology Table 4‐3 defines key terminology used in LACP configuration. Actor and Partner Admin Key System Priority SecureStack A2 Usage Considerations In normal usage (and typical implementations) there is no need to modify any of the default  LACP parameters on the switch. as understood by a given device.0.1 through lag.x. Each LAG can have up to four associated physical ports. Once underlying physical ports (for example.x) are associated with an aggregator port.Link Aggregation Control Protocol (LACP) • • A means of identifying the set of capabilities associated with each port and with each  aggregator.6.6. LACP compares the LAG IDs for each grouping of ports. will block redundant paths).1 through lag. Table 4-3 Term Aggregator LACP Terms and Definitions Definition Virtual port that controls link aggregation for underlying physical ports.x. which determines aggregation precedence. which are designated in the CLI as lag. Once  underlying physical ports (for example. Each SecureStack A2 module provides 6 aggregator ports. The protocol exchanges aggregation state/mode information by way of a port’s actor and partner operational states. For information about building static aggregations. Aggregator ports allow only underlying ports with oper keys matching theirs to join their LAG.x) are associated with an aggregator port. If the switch is placed in a configuration with its peers not running the  protocol.0. Each maintains current status of the other via LACPDUs containing information about their ports’ LACP status and operational state. The LACP implementation on SecureStack A2 devices will use this value to form an oper key and will determine which underlying physical ports are capable of aggregating by comparing oper keys. Note: Only one LACP system priority can be set on a SecureStack A2 device. no dynamic link aggregations will be formed and the switch will function normally (that  is. LAG LACPDU Link Aggregation Control Protocol Data Unit.

 the remaining port may be assigned to the  wrong VLAN.1x authentication is enabled using the set eapol command (page 14‐20) and ports that  would otherwise aggregate are not 802. The other option is to enable the singleportlag feature as described in “set lacp  singleportlag” on page 4‐36. show lacp set lacp set lacp asyspri set lacp aadminkey clear lacp set lacp static clear lacp static set lacp singleportlag clear lacp singleportlag show port lacp set port lacp clear port lacp Refer to page. LACP uses a system priority value to build a LAG ID.1X authorized. The device with the lowest LAG ID determines which underlying physical ports are  allowed into a LAG based on the ports’ LAG port priority. or if none of the aggregators have a  matching admin key and system priority. Aggregator ports allow only underlying ports with keys matching theirs to join their LAG.  If there are two partner devices competing for the same aggregator. Ports with the lowest LAG port priority  values are allowed into the LAG and all other speed groupings go into a standby state. • The LACP implementation on the SecureStack A2 device will allow up to four physical ports into  a LAG. Note: To aggregate. underlying physical ports must be running in full duplex mode and must be of the same operating speed.Link Aggregation Control Protocol (LACP) the resulting aggregation will be represented as one LAG with a lag. LACP  determines which underlying physical ports are capable of aggregating by comparing operational  keys. LACP compares the LAG IDs  for each grouping of ports. 802. This can  happen if there are simply no available aggregators.  you should ensure that the LAG and all the ports in the LAG are assigned to the egress list of the  desired VLAN.x port designation..  There is no available aggregator for two or more ports with the same LAG ID. For this reason. There are a few cases in which ports will not aggregate: • • An underlying physical port is attached to another port on this same switch (loopback). When an existing dynamically created LAG is reduced to one port. which determines aggregation precedence. The LAG with the lower LAG ID is given precedence and will be  allowed to use the aggregator. 4-31 4-32 4-33 4-33 4-34 4-35 4-35 4-36 4-35 4-37 4-39 4-41 SecureStack A2 Configuration Guide 4-31 . when the LAG is removed.. the SecureStack A2 removes  the LAG from its VLAN and adds the remaining underlying port to the VLAN. Commands The commands used to review and configure LACP are listed below..x.. Otherwise. For information about.

x.6. See “set lacp singleportlag” on page 4-36 for more about single port LAG..0. The following table describes the  output fields. Once underlying physical ports (that is.x port designation.show lacp show lacp Use this command to display information about one or more aggregator ports. link aggregation information for all LAGs will be displayed.0. Example This example shows how to display lacp information for lag. read‐only.x.1 ‐ 6.x.1 through lag. Displays if the single port LAG feature has been enabled on the switch. fe. the resulting aggregation will be represented as one Link Aggregation  Group (LAG) with a lag. Usage Each SecureStack A2 module provides 6 virtual link aggregator ports.3 Partner 00:11:88:11:74:F9 32768 0 Table 4‐4 provides an explanation of the command output. Mode Switch command. Table 4-4 Output Global Link Aggregation state Single Port LAGs show lacp Output Details What It Displays.1.1 Global Link Aggregation state: enabled Single Port LAGs: disabled Aggregator: lag. Defaults If port‐string is not specified.0.0. Valid  port designations are lag.1. which are designated in the  CLI as lag.0.x.0..1 System Identifier: System Priority: Admin Key: Oper Key: Attached Ports: Actor 00:01:F4:5F:1E:20 32768 32768 32768 ge. ge. Shows if LACP is enabled or disabled on the switch.1 ge.x) are associated  with an aggregator port.1.  Syntax show lacp [port-string] Parameters port‐string (Optional) Displays LACP information for specific LAG port(s). 4-32 Port Configuration . A2(su)->show lacp lag.

SecureStack A2 devices provide a default admin key value of 32768 for all LAG ports (lag.0. Mode Switch command. Each SecureStack A2 module provides 6 virtual link aggregator ports.6. which are designated in the CLI as lag. Remote device participating in LACP negotiation. Local device participating in LACP negotiation. Actor Partner System Identifier System Priority Admin Key Oper Key Attached Ports set lacp Use this command to disable or enable the Link Aggregation Control Protocol (LACP) on the  device..x port designation. Underlying physical ports associated with this aggregator.0. fe. Port’s assigned key. or the set port lacp command (page 4-39).x. Syntax set lacp {disable | enable} Parameters disable | enable Disables or enables LACP. MAC addresses for actor and partner. Only underlying physical ports with oper keys matching the aggregator’s will be allowed to aggregate. System priority value which determines aggregation precedence. derived from the admin key.0.x.set lacp Table 4-4 Output Aggregator show lacp Output Details (Continued) What It Displays.x) are associated with an aggregator port. Example This example shows how to disable LACP: A2(su)->set lacp disable SecureStack A2 Configuration Guide 4-33 . Only one LACP system priority can be set on a SecureStack A2 device.1 though lag. Port’s operational key.1 through lag.x. the resulting Link Aggregation Group (LAG) is represented with a lag.6). ge.. read‐write. using either the set lacp asyspri command (page 4-33). Defaults None.x. Once underlying physical ports (for example. LAG port designation.0.

 The  default admin key value is 32768. Usage LACP uses this value to determine aggregation precedence. The  LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator. Defaults None. Example This example shows how to set the LACP system priority to 1000: A2(su)->set lacp asyspri 1000 set lacp aadminkey Use this command to set the administratively assigned key for one or more aggregator ports.  Syntax set lacp asyspri value Parameters asyspri  value Sets the system priority to be used in creating a LAG (Link Aggregation  Group) ID. Valid values are 0 to 65535. LACP compares the LAG IDs for each grouping of ports. Valid values are 0 to 65535. If there are two partner devices  competing for the same aggregator. Valid values are 0 to 65535. read‐write.  Syntax set lacp aadminkey port-string value Parameters port‐string value Specifies the LAG port(s) on which to assign an admin key. Defaults None. Mode Switch command. with  precedence given to lower values. 4-34 Port Configuration . Specifies a system priority value. Mode Switch command.  Specifies an admin key value to set. read‐write.set lacp asyspri set lacp asyspri Use this command to set the LACP system priority.

Example This example shows how to set the LACP admin key to 2000 for LAG port 6:  A2(su)->set lacp aadminkey lag. Syntax clear lacp {[asyspri] [aadminkey port-string]} Parameters asyspri  aadminkey port‐string Clears system priority. Example This example shows how to clear the actor admin key for LAG port 6:  A2(su)->clear lacp aadminkey lag. Defaults None. read‐write.6 2000 clear lacp Use this command to clear LACP system priority or admin key settings. Mode Switch command.clear lacp Usage LACP will use this value to form an oper key.0.0. Only underlying physical ports with oper keys  matching those of their aggregators will be allowed to aggregate. The default admin key value for  all LAG ports is 32768. Resets admin keys for one or more ports to the default value of 32768.6 SecureStack A2 Configuration Guide 4-35 .

 For a detailed description  of possible port‐string values. Syntax clear lacp static lagportstring port-string Parameters lagportstring  port‐string Specifies the LAG aggregator port from which ports will be removed.1.  Mode Switch command. a key will be assigned according to the specified aggregator. Example This example shows how to add port fe.0. Specifies the port(s) to remove from the LAG. Specifies the LAG aggregator port to which new ports will be assigned.6 fe.6 to the LAG of aggregator port 6:  A2(su)->set lacp static lag.set lacp static set lacp static Use this command to disable or enable static link aggregation. port‐string Specifies the member port(s) to add to the LAG. read‐write. or to assign one or more underlying  physical ports to a Link Aggregation Group (LAG). aggregation will fail or undesired aggregations will form. Only ports with matching keys are allowed to  aggregate. refer to “Port String Syntax Used in the CLI”  on page 4‐2.6 clear lacp static Use this command to remove specific ports from a Link Aggregation Group. Valid values are 0 ‐ 65535. If ports other than the desired underlying physical ports share the same admin key value.4. refer to “Port String Syntax Used in the CLI”  on page 4‐2. 4-36 Port Configuration . For a detailed description of  possible port‐string values. (Optional) Specifies the new member port and LAG port aggregator  admin key value. Defaults If not specified.  Syntax set lacp static {disable | enable} | lagportstring [key] port-string Parameters disable | enable lagportstring  key Disables or enables static link aggregation. Note: This key value must be unique. For example a key of 4  would be assigned to lag.0.1.

1. the LAG (lag.set lacp singleportlag Defaults None. This could cause problems if the LAG and the port have different configurations  (the LAG and the port may have different VLAN or Policy configurations). Example This example shows how to enable single port LAGs:  A2(su)->set lacp singleportlag enable SecureStack A2 Configuration Guide 4-37 .x.6 from the LAG of aggregator port 6:  A2(su)->clear lacp static lag. Example This example shows how to remove fe.x) will not be used but instead the port’s syntax will be used (for  example.1. Mode Switch command.3. LAGs are maintained when only one port is receiving  protocol transmissions from a partner.6 fe. read‐write. Defaults None. Mode Switch command.  Syntax set lacp singleportlag {enable | disable} Parameters disable | enable Enables or disables the formation of single port LAGs.24). Usage When single port LAGs are enabled. fe. If single port LAGs are not enabled and a LAG goes down  to one port.6 set lacp singleportlag Use this command to enable or disable the formation of single port LAGs. read‐write.0.

Usage State definitions. such as ActorAdminState and Partner AdminState.clear lacp singleportlag clear lacp singleportlag Use this command to reset the single port LAG function back to the default state of disabled. read‐write. Displays LACP status in detailed or summary information. Syntax clear lacp singleportlag Parameters None. Defaults None. it  means the state is true for the associated actor or partner ports: 4-38 Port Configuration . Example This example shows how to reset the single port LAG function back to disabled:  A2(su)->clear lacp singleportlag show port lacp Use this command to display link aggregation information for one or more underlying physical  ports. status detail |  summary  counters Defaults None. Syntax show port lacp port port-string {[status {detail | summary}] | [counters]} Parameters port port‐string Displays LACP information for specific port(s). are indicated with letter  abbreviations. For a detailed description  of possible port‐string values. Mode Switch command. read‐only. If the show port lacp command displays one or more of the following letters. Mode Switch command. Displays LACP counter information. refer to “Port String Syntax Used in the CLI”  on page 4‐2.

1.1.1.12: A2(su)->show port lacp port fe.000000000000.12 status summary Port Aggr Actor System Partner System Pri: System ID: Key: Pri: System ID: Key: fe.00e0639db587.1.3 2002  specification.1.12:  A2(su)-> show port lacp port fe.(32768.12 LACPDUsRx: 11067 LACPDUsTx: 0 IllegalRx: 0 UnknownRx: 0 MarkerPDUsRx: 0 MarkerPDUsTx: 0 MarkerResponsePDUsRx: 0 MarkerResponsePDUsTx: 374 SecureStack A2 Configuration Guide 4-39 .show port lacp • • • • • • • • E = Expired  F = Defaulted D = Distributing (tx enabled) C = Collecting (rx enabled) S = Synchronized (actor and partner agree) G = Aggregation allowed S/l = Short/Long LACP timeout A/p = Active/Passive LACP  For more information about these states. 1411)] This example shows how to display LACP counters for port fe. refer to set port lacp (page 4‐39) and the IEEE 802.12 none [(32768.32768).1.1.12 ActorPort: 1411 PartnerAdminPort: 1411 ActorSystemPriority: 32768 PartnerOperPort: 1411 ActorPortPriority: 32768 PartnerAdminSystemPriority: 32768 ActorAdminKey: 32768 PartnerOperSystemPriority: 32768 ActorOperKey: 32768 PartnerAdminPortPriority: 32768 ActorAdminState: -----GlA PartnerOperPortPriority: 32768 ActorOperState: -F----lA PartnerAdminKey: 1411 ActorSystemID: 00-e0-63-9d-b5-87 PartnerOperKey: 1411 SelectedAggID: none PartnerAdminState: --DCSGlp AttachedAggID: none PartnerOperState: --DC-Glp MuxState: Detached PartnerAdminSystemID: 00-00-00-00-00-00 DebugRxState: port Disabled PartnerOperSystemID: 00-00-00-00-00-00 This example shows how to display summarized LACP status information for port fe.1.12 counters Port Instance: fe.12 status detail Port Instance: fe. Examples This example shows how to display detailed LACP status information for port fe.1.12: A2(su)->show port lacp port fe.

 Valid values are 0 ‐ 65535. lacpagg ‐ Aggregation on this port. The default key value is 32768. Sets the port’s actor admin key. using either this command. Sets a default value to use as the port’s partner admin key.  lacpcollect ‐ Transition to collection state. Aggregator ports allow only  underlying ports with oper keys matching theirs to join their LAG. (Optional) Disables LACPDU processing on this port. Valid values are 0 ‐ 65535. LACP will use this value to form an oper  key and will determine which underlying physical ports are capable of  aggregating by comparing oper keys. These settings will  determine the specified underlying physical ports’ ability to join a LAG. aportpri aportpri asyspri asyspri Sets the port’s actor port priority.  lacpsync ‐ Transition to synchronization state.  lacptimeout ‐ Transmitting LACP PDUs every 1 sec. refer to “Port String Syntax Used  in the CLI” on page 4‐2. Syntax set port lacp port port-string {[aadminkey aadminkey] [aadminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire}] [aportpri aportpri] [asyspri asyspri] [enable | [disable] [padminkey padminkey] [padminport padminport] [padminportpri padminportpri] [padminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire}] [padminsysid padminsysid] [padminsyspri padminsyspri] Parameters port port‐string Specifies the physical port(s) on which to configure LACP.set port lacp set port lacp Use this command to set link aggregation parameters for one or more ports. 4-40 Port Configuration . The LACP implementation on the  SecureStack A2 device uses this value to determine aggregation  precedence when there are two devices competing for the same  aggregator. Only ports with  matching admin keys are allowed to aggregate. lacpexpire ‐ Transition to expired state. and their administrative  state once aggregated. lacpdist ‐ Transition to distribution state. Valid  values are 1 ‐ 65535. Sets the port’s actor LACP administrative state to allow for:  lacpactive ‐ Transmitting LACP PDUs. Note: Only one LACP system priority can be set on a SecureStack A2 device. Sets the port’s actor system priority. lacpdef ‐ Transition to defaulted state. with higher precedence given to  lower values. Valid values are 1 ‐ 65535. aadminkey  aadminkey aadminstate  lacpactive |  lacptimeout |  lacpagg | lacpsync  | lacpcollect |  lacpdist | lacpdef |  lacpexpire  enable disable padminkey  padminkey (Optional) Enables LACPDU processing on this port. or the set lacp asyspri command (“set lacp asyspri” on page 4-33). with lower  values designating higher priority. (default). vs 30 sec. For a detailed  description of possible port‐string values.

 with lower values given higher priority. Mode Switch command.  Sets a default value to use as the port’s partner port priority. Usage LACP commands and parameters beginning with an “a” (such as aadminkey) set actor values. Actors and  partners maintain current status of the other via LACPDUs containing information about their  ports’ LACP status and operational state. Defaults At least one parameter must be entered per port‐string. port(s) will be enabled with the LACP parameters entered.3. padminstate  Sets a port’s partner LACP administrative state.3. Valid values  are 0 ‐ 65535. with lower values given higher priority.  Corresponding commands and parameters beginning with a “p” (such as padminkey) set  corresponding partner values.  while partner refers to its remote device partner at the other end of the negotiation. This is a MAC  address. See aadminstate for valid  lacpactive |  options. Valid values are 0  ‐ 65535. read‐write. If enable or disable are not specified. Sets a default value to use as the port’s partner priority. Actor refers to the local device participating in LACP negotiation.16: A2(su)->set port lacp ge. lacptimeout |  lacpagg | lacpsync  | lacpcollect |  lacpdist | lacpdef |  lacpexpire padminsysid  padminsysid padminsyspri  padminsyspri Sets a default value to use as the port’s partner system ID.set port lacp padminport  padminport padminportpri  padminportpri Sets a default value to use as the port’s partner admin value. Valid values  are 1 ‐ 65535. Example This example shows how to set the actor admin key to 3555 for port ge.16 aadminkey 3555 SecureStack A2 Configuration Guide 4-41 .

aadminkey  aportpri  asyspri  Clears a port’s specific actor admin state. Clears the port’s actor system priority. Mode Switch command. refer to “Port String  Syntax Used in the CLI” on page 4‐2.3.3. or all partner admin state(s). padminstate  Clears the port’s specific partner admin state. Example This example shows how to clear all link aggregation parameters for port ge. Clears a port’s actor port priority. Clears the port’s default partner admin key. or all actor admin state(s). Clears the port’s default partner system ID. Clears a port’s actor admin key.16:  A2(su)->clear port lacp port ge. lacptimeout |  lacpagg | lacpsync  | lacpcollect |  lacpdist | lacpdef |  lacpexpire | all padminsyspri  padminsysid  padminkey  padminportpri  padminport  Clears the port’s default partner priority value.16 4-42 Port Configuration .clear port lacp clear port lacp Use this command to clear link aggregation settings for one or more ports. refer to the set port lacp command (“set  lacpactive |  port lacp” on page 4‐39). lacpactive |  lacptimeout |  lacpagg | lacpsync  | lacpcollect |  lacpdist | lacpdef |  lacpexpire | all Defaults None. Syntax clear port lacp port port-string {[aadminkey] [aportpri] [asyspri] [aadminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all}] [padminsyspri] [padminsysid] [padminkey] [padminportpri] [padminport] [padminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all}]} Parameters port port‐string Specifies the physical port(s) on which LACP settings will be cleared. For  aadminstate  descriptions of specific states. Deletes a partner port from the LACP configuration. For  a detailed description of possible port‐string values. read‐write. Clears the port’s default partner port priority.

. set port protected show port protected clear port protected set port protected name show port protected name clear port protected name Refer to page. even  when they are on the same VLAN. regardless of having the same VLAN membership. if they are in the same VLAN. Protected ports can also  forward traffic to protected ports in a different group.  Ports are unprotected by default.   Protected Port Operation Ports that are configured to be protected cannot forward traffic to other protected ports in the  same group. protected ports can  forward traffic to ports which are unprotected (not listed in any group). A port may belong to only one  group of protected ports. However... Multiple groups of protected ports are supported. 4-43 4-43 4-44 4-45 4-45 4-46 SecureStack A2 Configuration Guide 4-43 . It does not apply across multiple switches in a  network..   This feature only applies to ports within a switch. Unprotected  ports can forward traffic to both protected and unprotected ports. Ports may be designated as either protected or unprotected. Commands For information about.Configuring Protected Ports Configuring Protected Ports The Protected Port feature is used to prevent ports from forwarding traffic to each other.

4-44 Port Configuration .  Id can range from 0 to 2. information about all protected ports is displayed. Defaults None.1.1.  Specifies the id of the group to which the ports should be assigned.1 through ge. Syntax set port protected port-string group-id Parameters port‐string group‐id Specifies the port or ports to be protected.3 to protected port group 1:  A2(rw)->set port protected ge.1. A port can be assigned to only one group. Mode Read‐only.set port protected set port protected Use this command to specify a port to be protected and assign the port to a group of protected  ports.1-3 1 show port protected Use this command to display information about the ports configured for protected mode. Id can  range from 0 to 2. Defaults If no parameters are entered.  (Optional) Specifies the id of the group for which to display information. read‐write. Syntax show port protected [port-string] | [group-id] Parameters port‐string group‐id (Optional) Specifies the port or ports for which to display information. Example This example shows how to assign ports ge. Mode Switch command.

1.1.1 1 ge.1-3 SecureStack A2 Configuration Guide 4-45 . all protected ports and groups are cleared.  (Optional) Specifies the id of the group to remove from protected mode.1.  Id can range from 0 to 2.1 through ge.3 clear port protected Use this command to remove a port or group from protected mode. Syntax clear port protected [port-string] | [group-id] Parameters port‐string group‐id (Optional) Specifies the port or ports to remove from protected mode.clear port protected Example This example shows how to display information about all protected ports: A2(ro)->show port protected Group id Port ---------------------1 ge. read‐write.1.3: A2(rw)->clear port protected ge. Mode Switch command.1.1.2 1 ge. Defaults If no parameters are entered. Example This example shows how to clear protected ports ge.

Example This example shows how to assign the name “group1” to protected port group 1: A2(rw)->set port protected name 1 group1 show port protected name Use this command to display the name for the group ids specified. Id can range from 0 to 2. Example This example shows how to show the name of protected port group 1:  A2(ro)->show port protected name 1 Group ID Group Name ----------------------------1 group1 4-46 Port Configuration . Syntax set port protected name group-id name Parameters group‐id name Specifies the id of this group. Syntax show port protected name group-id Parameters group‐id Specifies the id of the group to display. Specifies a name for the group. The name can be up to 32 characters in  length.set port protected name set port protected name Use this command to assign a name to a protected port group id. Defaults None. Defaults None. read‐write. Mode Read‐only. Mode Switch command. Id can range from 0 to 2.

Example This example shows how to clear the name of protected port group 1:  A2(rw)->clear port protected name 1 SecureStack A2 Configuration Guide 4-47 . Mode Switch command. Id can range  from 0 to 2. Syntax clear port protected name group-id Parameters group‐id Specifies the id of the group for which to clear the name. read‐write. Defaults None.clear port protected name clear port protected name Use this command to clear the name of a protected group.

clear port protected name 4-48 Port Configuration .

5 SNMP Configuration This chapter describes the Simple Network Management Protocol (SNMP) set of commands and  how to use them. find and solve network problems. described in RFC 1907. RFC 2573.  Version 2 (SNMPv2c) — The second release of SNMP.  SecureStack A2 devices support three versions of SNMP:  • • • Version 1 (SNMPv1) — This is the initial implementation of SNMP. has additions  and enhancements to data types. including SNMP traps. counter size. Refer to RFC 1157 for a full  description of functionality. and protocol operations. For information about.  SNMP agents and MIBs. Version 3 (SNMPv3) — This is the most recent version of SNMP. and Communities Configuring SNMP Access Rights Configuring SNMP MIB Views Configuring SNMP Target Parameters Configuring SNMP Target Addresses Configuring SNMP Notification Parameters Creating a Basic SNMP Trap Configuration Refer to page. and RFC 2575. RFC 2574. and includes significant  enhancements to administration and security.  RFC 2572. and plan for network growth.. SNMP enables network administrators to manage network  performance.  SecureStack A2 Configuration Guide 5-1 .. and Remote Monitoring  (RMON) MIBs. 5-1 5-4 5-8 5-16 5-20 5-25 5-29 5-33 5-41 SNMP Configuration Summary SNMP is an application‐layer protocol that facilitates the exchange of management information  between network devices. Groups. community strings. SNMPv1 and SNMPv2c The components of SNMPv1 and SNMPv2c network management fall into three categories:  • • Managed devices (such as a switch).. SNMPv3 is fully described in RFC 2571.. SNMP Configuration Summary Reviewing SNMP Statistics Configuring SNMP Users. which run on managed devices.

 An SNMP entity consists  of an SNMP engine and SNMP applications. An SNMP engine consists of the following four  components:  • • Dispatcher — This component sends and receives messages. The advanced security features provided  in SNMPv3 are as follows:  – – – Message integrity — Collects data securely without being tampered with or corrupted.  SNMPv3 SNMPv3 is an interoperable standards‐based protocol that provides secure access to devices by  authenticating and encrypting frames over the network. 5-2 SNMP Configuration .SNMP Configuration Summary • SNMP network management applications. These concepts have been combined into an SNMP entity.  Encryption — Scrambles the contents of a frame to prevent it from being seen by an  unauthorized source. and privacy (authPriv).  Table 5-1 Model v1 v2c SNMP Security Levels Security Level NoAuthNoPriv NoAuthNoPriv Authentication Community string Community string Encryption None None How It Works Uses a community string match for authentication. A security level is the permitted level of security within a security model. such as the Enterasys NetSight application. which  communicate with agents to get statistics and alerts from the managed devices.  Authentication — Determines the message is from a valid source. The message processing subsystem also accepts incoming  messages from the dispatcher. A combination of a security model  and a security level determines which security mechanism is employed when handling an SNMP  frame. and returns the enclosed PDU  to the dispatcher.  authentication required (AuthNoPriv). Access control subsystem — This component determines which users and which operations  are allowed access to managed objects.  Message processing subsystem — This component accepts outgoing PDUs from the  dispatcher and prepares them for transmission by wrapping them in a message header and  returning them to the dispatcher. Security subsystem — This component authenticates and encrypts messages. Table 5‐1 identifies the levels of SNMP security available on SecureStack A2 devices and  authentication required within each model. Uses a community string match for authentication.  The three levels of SNMP security are: No authentication required (NoAuthNoPriv). • • About SNMP Security Models and Levels An SNMP security model is an authentication strategy that is set up for a user and the group in  which the user resides. in SNMPv3.  Unlike SNMPv1 and SNMPv2c. processes each message header. the concept of SNMP agents and SNMP managers no  longer apply.

Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms.  If no optional context parameters are configured for v1 and v2 “community” names and v3 “user”  groups. target parameters can be specified when setting up optional  notification filters — even though these parameters have not yet been created with the set snmp  targetparams command. often associated with a particular  physical or logical device.  SecureStack A2 Configuration Guide 5-3 . Example This example permits the “powergroup” to manage all MIBs via SNMPv3: A2(su)->set snmp access powergroup security-model usm Configuration Considerations Commands for configuring SNMP on the SecureStack A2 device are independent during the  SNMP setup process. Provides DES 56-bit encryption in addition to authentication based on the CBCDES (DES-56) standard. A context is a collection of MIB objects. when operating from the switch CLI. these groups are able to access all SNMP MIB objects when in switch mode. For instance. SecureStack A2 devices allow access to all SNMP  MIBs or contexts.SNMP Configuration Summary Table 5-1 Model v3 SNMP Security Levels (Continued) Security Level NoAuthNoPriv AuthNoPriv Authentication User name MD5 or SHA Encryption None None How It Works Uses a user name match for authentication. All SNMP contexts known to the device can be displayed using the show snmp context command  as described in “show snmp context” on page 5‐22. Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms. authPriv MD5 or SHA DES Using SNMP Contexts to Access Specific MIBs By default.  Specifying a context parameter when setting up SNMP user group would permit or restrict the  group’s switch management access to the MIB(s) specified by the context (MIB object ID) value.

 read‐only..  Commands The commands used to review SNMP statistics are listed below... Table 5-2 Output EngineId Engine Boots show snmp engineid Output Details What It Displays.. 5-4 SNMP Configuration . 5-4 5-5 show snmp engineid Use this command to display the SNMP local engine ID. String identifying the SNMP agent on the device.  Syntax show snmp engineid Parameters None.Reviewing SNMP Statistics Reviewing SNMP Statistics Purpose To review SNMP statistics. Number of times the SNMP engine has been started or reinitialized. Mode Switch command. Example This example shows how to display SNMP engine properties: A2(su)->show snmp engineid EngineId: 80:00:15:f8:03:00:e0:63:9d:b5:87 Engine Boots = 12 Engine Time = 162181 Max Msg Size = 2048 Table 5‐2 shows a detailed explanation of the command output.. This is the SNMP v3 engine’s  administratively unique identifier.. Defaults None. For information about. show snmp engineid show snmp counters Refer to page.

Mode Switch command. Engine Time Max Msg Size show snmp counters Use this command to display SNMP traffic counter values.. Syntax show snmp counters Parameters None. Time in seconds since last reboot. in bytes. Example This example shows how to display SNMP counter values A2(su)->show snmp counters --.mib2 SNMP group counters: snmpInPkts = 396601 snmpOutPkts = 396601 snmpInBadVersions = 0 snmpInBadCommunityNames = 0 snmpInBadCommunityUses = 0 snmpInASNParseErrs = 0 snmpInTooBigs = 0 snmpInNoSuchNames = 0 snmpInBadValues = 0 snmpInReadOnlys = 0 snmpInGenErrs = 0 snmpInTotalReqVars = 403661 snmpInTotalSetVars = 534 snmpInGetRequests = 290 snmpInGetNexts = 396279 snmpInSetRequests = 32 snmpInGetResponses = 0 snmpInTraps = 0 snmpOutTooBigs = 0 snmpOutNoSuchNames = 11 snmpOutBadValues = 0 snmpOutGenErrs = 0 snmpOutGetRequests = 0 snmpOutGetNexts = 0 snmpOutSetRequests = 0 snmpOutGetResponses = 396601 SecureStack A2 Configuration Guide 5-5 ..show snmp counters Table 5-2 Output show snmp engineid Output Details (Continued) What It Displays. read‐only. of SNMP frame. Defaults None. Maximum accepted length.

" Number of valid SNMP PDUs delivered to the SNMP protocol entity with the value of the error-status field as "readOnly. Number of SNMP Get-Request PDUs accepted and processed by the SNMP protocol entity." Number of SNMP PDUs delivered to the SNMP protocol entity with the value of the error-status field as "badValue. Number of messages delivered to the SNMP entity from the transport service." Number of SNMP PDUs delivered to the SNMP protocol entity with the value of the error-status field as "noSuchName.USM Stats counters: usmStatsUnsupportedSecLevels usmStatsNotInTimeWindows usmStatsUnknownUserNames usmStatsUnknownEngineIDs usmStatsWrongDigests usmStatsDecryptionErrors = = = = = = 0 0 0 0 0 0 Table 5‐3 shows a detailed explanation of the command output. Number of SNMP messages delivered to the SNMP entity that represented an SNMP operation not allowed by the SNMP community named in the message. Number of SNMP messages passed from the SNMP protocol entity to the transport service.show snmp counters snmpOutTraps snmpSilentDrops snmpProxyDrops = 0 = 0 = 0 --.1 (Abstract Syntax Notation) or BER (Basic Encoding Rules) errors encountered by the SNMP entity when decoding received SNMP messages. Number of SNMP Get-Next PDUs accepted and processed by the SNMP protocol entity.. snmpInASNParseErrs snmpInTooBigs snmpInNoSuchNames snmpInBadValues snmpInReadOnlys snmpInGenErrs snmpInTotalReqVars snmpInTotalSetVars snmpInGetRequests snmpInGetNexts snmpInSetRequests 5-6 SNMP Configuration . Number of SNMP PDUs delivered to the SNMP protocol entity with the value of the error-status field as "tooBig.." Number of MIB objects retrieved successfully by the SNMP protocol entity as the result of receiving valid SNMP Get-Request and Get-Next PDUs. Number of SNMP Set-Request PDUs accepted and processed by the SNMP protocol entity. Number of SNMP messages delivered to the SNMP entity for an unsupported SNMP version. Number of ASN. Table 5-3 Output snmpInPkts snmpOutPkts snmpInBadVersions snmpInBadCommunityNames snmpInBadCommunityUses show snmp counters Output Details What It Displays." Number of SNMP PDUs delivered to the SNMP protocol entity with the value of the error-status field as "genErr. Number of SNMP messages delivered to the SNMP entity that used an SNMP community name not known to the entity. Number of MIB objects altered successfully by the SNMP protocol entity as the result of receiving valid SNMP Set-Request PDUs.

Number of packets received by the SNMP engine that were dropped because they could not be decrypted." Number of SNMP PDUs generated by the SNMP protocol entity with the value of the error-status field as "badValue. Number of SNMP Set-Request PDUs generated by the SNMP protocol entity. Number of packets received by the SNMP engine that were dropped because they did not contain the expected digest value. Number of SNMP Get. Number of SNMP Get-Response PDUs generated by the SNMP protocol entity." Number of SNMP Get-Request PDUs generated by the SNMP protocol entity. Number of SNMP Trap PDUs generated by the SNMP protocol entity. Number of SNMP Trap PDUs accepted and processed by the SNMP protocol entity.show snmp counters Table 5-3 Output show snmp counters Output Details (Continued) What It Displays." Number of SNMP PDUs generated by the SNMP protocol entity with the value of the error-status field as "genErr. Set. Number of packets received by the SNMP engine that were dropped because they appeared outside of the authoritative SNMP engine's window. snmpInGetResponses snmpInTraps snmpOutTooBigs snmpOutNoSuchNames snmpOutBadValues snmpOutGenErrs snmpOutGetRequests snmpOutGetNexts snmpOutSetRequests snmpOutGetResponses snmpOutTraps snmpSilentDrops snmpProxyDrops usmStatsUnsupportedSec Levels usmStatsNotInTimeWindows usmStatsUnknownUserNames usmStatsUnknownEngineIDs usmStatsWrongDigests usmStatsDecriptionErrors SecureStack A2 Configuration Guide 5-7 . or Inform request error messages that were dropped because the reply was larger than the proxy target’s maximum message size. Number of SNMP PDUs generated by the SNMP protocol entity with the value of the error-status field as "tooBig. or Inform request error messages that were dropped because the reply was larger than the requestor’s maximum message size. Number of SNMP Get-Response PDUs accepted and processed by the SNMP protocol entity. Number of packets received by the SNMP engine that were dropped because they requested a security level that was unknown to the SNMP engine or otherwise unavailable." Number of SNMP PDUs generated by the SNMP protocol entity with the value of the error-status as "noSuchName.. Number of packets received by the SNMP engine that were dropped because they referenced an snmpEngineID that was not known to the SNMP engine. Set.. Number of SNMP Get-Next PDUs generated by the SNMP protocol entity. Number of packets received by the SNMP engine that were dropped because they referenced a user that was not known to the SNMP engine. Number of SNMP Get.

5-9 5-10 5-11 5-11 5-12 5-13 5-13 5-14 5-15 5-8 SNMP Configuration . show snmp user set snmp user clear snmp user show snmp group set snmp group clear snmp group show snmp community set snmp community clear snmp community Refer to page.. groups. Groups.. Group — A collection of users who share the same SNMP access privileges. Community — A name used to authenticate SNMPv1 and v2 users. Groups.. Commands The commands used to review and configure SNMP users.. and v1 and v2 communities. groups.Configuring SNMP Users. These are defined as  follows: • • • User — A person registered in SNMPv3 to access SNMP management. and communities are listed  below. and Communities Purpose To review and configure SNMP users. and Communities Configuring SNMP Users. For information about.

 information about all SNMP users will be displayed. user information about the local SNMP engine will be displayed. detailed SNMP information will be displayed. volatile | nonvolatile  (Optional) Displays user information for a specified storage type.SNMP user information ----. If not specified. SecureStack A2 Configuration Guide 5-9 . If user is not specified.List of registered users: Guest admin1 admin2 netops This example shows how to display information for the SNMP “guest” user: (su)->show snmp user guest --. Syntax show snmp user [list] | [user] | [remote remote] [volatile | nonvolatile | readonly] Parameters list user remote remote  (Optional) Displays a list of registered SNMP user names.  (Optional) Displays information about users on a specific remote SNMP  engine. These are people registered to  access SNMP management. (Optional) Displays information about a specific user. user information for all storage types will be displayed. read‐only. Mode Switch command.SNMP user information --EngineId: 00:00:00:63:00:00:00:a1:00:00:00:00 Username = Guest Auth protocol = usmNoAuthProtocol Privacy protocol = usmNoPrivProtocol Storage type = nonVolatile Row status = active Table 5‐4 shows a detailed explanation of the command output. If remote is not specified. | read‐only Defaults If list is not specified. Examples This example shows how to display an SNMP user list: (su)->show snmp user list --.show snmp user show snmp user Use this command to display information about SNMP users.

Example This example shows how to create a new SNMP user named “netops”. Status of this entry: active. Auth protocol Privacy protocol Storage type Row status set snmp user Use this command to create a new SNMPv3 user.  Minimum of 8 character. Whether a privacy protocol is applied when authentication protocol is in use.set snmp user Table 5-4 Output EngineId Username show snmp user Output Details What It Displays. Mode Switch command. privacy privpassword (Optional) Applies encryption and specifies an encryption password. SNMPv1 or v2 community name or SNMPv3 user name. Syntax set snmp user user [remote remoteid] [authentication {md5 | sha}] [authpassword] [privacy privpassword] [volatile | nonvolatile] Parameters user remote remoteid  Specifies a name for the SNMPv3 user.. this user will be  registered on the local SNMP engine without authentication and encryption. SNMP local engine identifier. By default. notInService. Whether entry is stored in volatile. or notReady. authentication md5  (Optional) Specifies the authentication type required for this user as MD5  | sha or SHA.. (Optional) Registers the user on a specific remote SNMP engine. Defaults If remote is not specified. Minimum of 8 characters. s volatile |  nonvolatile  (Optional) Specifies a storage type for this user entry. nonvolatile or read-only memory. nonvolatile will be applied. If authentication is not specified. If storage type is not specified. authpassword (Optional) Specifies a password for this user when authentication is  required. Entries related to this  user will be stored in permanent (nonvolatile) memory: A2(su)->set snmp user netops 5-10 SNMP Configuration . Type of authentication protocol applied to this user. read‐write. If privacy is not specified. no encryption will be applied. no authentication will be applied. the user will be registered for the local SNMP engine.

 user information about all SNMP versions will be displayed. read‐write. Defaults If groupname is not specified. If user is not specified. information about all SNMP groups will be displayed. (Optional) Removes the user from a specific remote SNMP engine. (Optional) Displays information about users within the specified group. Syntax show snmp group [groupname groupname] [user user] [security-model {v1 | v2c | usm}] [volatile | nonvolatile | read-only] Parameters groupname  groupname user user (Optional) Displays information for a specific SNMP group. the user will be removed from the local SNMP engine. Mode Switch command. SecureStack A2 Configuration Guide 5-11 .  Syntax clear snmp user user [remote remote] Parameters user remote remote  Specifies an SNMPv3 user to remove. volatile |  nonvolatile | read‐ only (Optional) Displays SNMP group information for a specified storage type. If security‐model is not specified. Example This example shows how to remove the SNMP user named “bill”: A2(su)->clear snmp user bill show snmp group Use this command to display an SNMP group configuration. information for all storage types will be displayed. If not specified. An SNMP group is a collection of  SNMPv3 users who share the same access privileges. security‐model v1 |  (Optional) Displays information about groups assigned to a specific  v2c | usm security SNMP model. information about all SNMP users will be displayed.clear snmp user clear snmp user Use this command to remove a user from the SNMPv3 security‐model list. Defaults If remote is not specified.

 This associates SNMPv3 users to a group that shares  common access privileges. v2c | usm volatile |  nonvolatile (Optional) Specifies a storage type for SNMP entries associated with the  group. security‐model v1 |  Specifies an SNMP security model to assign to the group... nonvolatile or read-only memory. nonvolatile storage will be applied.SNMP group information --Security model = SNMPv1 Security/user name = public Group name = Anyone Storage type = nonVolatile Row status = active Security model Security/user name Group name Storage type Row status = = = = = SNMPv1 public. Name of SNMP group. Example This example shows how to display SNMP group information: A2(su)->show snmp group --. or notReady. Status of this entry: active.set snmp group Mode Switch command. set snmp group Use this command to create an SNMP group.router1 Anyone nonVolatile active Table 5‐5 shows a detailed explanation of the command output. User belonging to the SNMP group. Syntax set snmp group groupname user user security-model {v1 | v2c | usm} [volatile | nonvolatile] Parameters groupname user user Specifies an SNMP group name to create. read‐only. Defaults If storage type is not specified. Specifies an SNMPv3 user name to assign to the group. notInService. SNMP version associated with this group. 5-12 SNMP Configuration . Table 5-5 Output Security model Security/user name Group name Storage type Row status show snmp group Output Details What It Displays. Whether entry is stored in volatile.

  community names act as passwords to remote management. security‐model v1 |  (Optional) Clears the settings associated with a specific security model. assign a user named “public”  and assign SNMPv3 security to the group: A2(su)->set snmp group anyone user public security-model usm clear snmp group Use this command to clear SNMP group settings globally or for a specific SNMP group and user. settings related to all security models will be cleared. Syntax clear snmp group groupname user [security-model {v1 | v2c | usm}] Parameters groupname  user Specifies the SNMP group to be cleared. read‐write. Mode Switch command. information will be displayed for all SNMP communities.  Syntax show snmp community [name] Parameters name (Optional) Displays SNMP information for a specific community name. In SNMPv1 and v2.clear snmp group Mode Switch command. Defaults If name is not specified. read‐write. Example This example shows how to clear all settings assigned to the “public” user within the SNMP group  “anyone”: A2(su)->clear snmp group anyone public show snmp community Use this command to display SNMP community names and status. Specifies the SNMP user to be cleared. Example This example shows how to create an SNMP group called “anyone”. v2c | usm Defaults If not specified. SecureStack A2 Configuration Guide 5-13 .

 Valid values are full or partial context names. If context is not specified. A2(su)->show snmp community public --. (Optional) Specifies the storage type for these entries. Example This example shows how to display information about the SNMP “public” community name. To  review all contexts configured for the device. For  a description of this output. Syntax set snmp community community [securityname securityname] [context context] [transport transport] [volatile | nonvolatile] Parameters community securityname  securityname context context Specifies a community group name. If transport tag is not specified. 5-14 SNMP Configuration . use the show snmp context  command as described in “show snmp context” on page 5‐22.Configured community strings --Name Security name Context Transport tag Storage type Status = = = = = = public public nonVolatile active set snmp community Use this command to configure an SNMP community group. the community name will be used. transport transport volatile |  nonvolatile Defaults If securityname is not specified. access will be granted for the default context. read‐write. (Optional) Specifies the set of transport endpoints from which SNMP  request with this community name will be accepted. Makes a link to a  target address table. nonvolatile will be applied. (Optional) Specifies a subset of management information this community  will be allowed to access. refer to set snmp community (page 5‐14). Mode Switch command.set snmp community Mode Switch command. none will be applied. If storage type is not specified.  (Optional) Specifies an SNMP security name to associate with this  community. read‐only.

clear snmp community Example This example shows how to set an SNMP community name called “vip” A2(su)->set snmp community vip clear snmp community Use this command to delete an SNMP community name. read‐write. Mode Switch command. Syntax clear snmp community name Parameters name Specifies the SNMP community name to clear. Example This example shows how to delete the community name “vip.” A2(su)->clear snmp community vip SecureStack A2 Configuration Guide 5-15 .  Defaults None.

. 2c or 3 (usm). authentication or privacy are not specified. security‐model v1 |  (Optional) Displays access information for SNMP security model version  v2c | usm 1. If security‐model is not specified.  Syntax show snmp access [groupname] [security-model {v1 | v2c | usm}] [noauthentication | authentication | privacy] [context context] [volatile | nonvolatile | read-only] Parameters groupname (Optional) Displays access information for a specific SNMPv3 group... 5-16 5-18 5-19 show snmp access Use this command to display access rights and security levels configured for SNMP one or more  groups. Commands The commands used to review and configure SNMP access are listed below. show snmp access set snmp access clear snmp access Refer to page. access information for all SNMP groups will be displayed. noauthentication |  authentication |  privacy context context (Optional) Displays access information for a specific security level. access information for all SNMP versions will be displayed. If context is not specified.. If noauthentication. 5-16 SNMP Configuration . access information for all  security levels will be displayed.  volatile |  nonvolatile | read‐ only Defaults If groupname is not specified. assigning viewing privileges and security levels to  SNMP user groups. For information about.Configuring SNMP Access Rights Configuring SNMP Access Rights Purpose To review and configure SNMP access rights.  (Optional) Displays access information for a specific context. For a  description of how to specify SNMP contexts. all contexts will be displayed. (Optional) Displays access entries for a specific storage type. refer to “Using SNMP  Contexts to Access Specific MIBs” on page 5‐3.

Whether or not SNMP context match must be exact (full context name match) or a partial match with a given prefix. SecureStack A2 Configuration Guide 5-17 . read‐only. Security model applied to this group. Valid levels are: • noAuthNoPrivacy (no authentication required) • AuthNoPrivacy (authentication required) • authPriv (privacy -. nonvolatile or read‐only are not specified.. and SNMPv3 (User based .show snmp access If volatile. Name of the view that allows this group to send an SNMP trap message. Table 5-6 Output Group Security model Security level show snmp access Output Details What It Displays. nonvolatile or read-only memory. or notReady. Status of this entry: active. SNMP group name. notInService. all entries of all storage types will be  displayed.USM). Security level applied to this group. Example This example shows how to display SNMP access information: A2(su)->show snmp Group = Security model = Security level = Read View = Write View = Notify View = Context match = Storage type = Row status = Group Security model Security level Read View Write View Notify View Context match Storage type Row status = = = = = = = = = access SystemAdmin USM noAuthNoPriv All All exact match nonVolatile active NightOperator USM noAuthNoPriv All All exact match nonVolatile active Table 5‐6 shows a detailed explanation of the command output.. Whether access entries for this group are stored in volatile.most secure level) Read View Write View Notify View Context match Storage type Row status Name of the view that allows this group to view SNMP MIB objects. SNMPv2c. Valid types are: SNMPv1.  Mode Switch command. Name of the view that allows this group to configure the contents of the SNMP agent.

 To review all contexts configured for the device. If notify view is not specified. 2c or 3 (usm). context context exact  (Optional) Sets the context for this access configuration and specifies that  | prefix the match must be exact (matching the whole context string) or a prefix  match only. Mode Switch command.set snmp access set snmp access Use this command to set an SNMP access configuration.  authentication (without privacy) or privacy. Context is a subset of management information this SNMP  group will be allowed to access.  Defaults If security level is not specified.  (Optional) Specifies a write access view. none will be applied. (Optional) Stores associated SNMP entries as temporary or permanent. If context is not specified. none will be applied.  Syntax set snmp access groupname security-model {v1 | v2c | usm} [noauthentication | authentication | privacy] [context context] [exact | prefix] [read read] [write write] [notify notify] [volatile | nonvolatile] Parameters groupname Specifies a name for an SNMPv3 group. no authentication will be applied. or  read‐only. use the show  snmp context command as described in “show snmp context” on  page 5‐22. If storage type is not specified. If write view is not specified. v2c | usm noauthentication |  authentication |  privacy (Optional) Applies SNMP security level as no authentication. access will be enabled for the default context. read read write write notify notify volatile |  nonvolatile | read‐ only (Optional) Specifies a read access view. exact match will be applied. entries will be stored as permanent and will be held through device  reboot. If context is specified  without a context match. read‐write. If read view is not specified none will be applied. security‐model v1 |  Specifies SNMP version 1. (Optional) Specifies a notify access view. Example This example permits the “powergroup” to manage all MIBs via SNMPv3: A2(su)->set snmp access powergroup security-model usm 5-18 SNMP Configuration . Valid values are full or partial context  names. Privacy specifies that  messages sent on behalf of the user are protected from disclosure.

clear snmp access clear snmp access Use this command to clear the SNMP access entry of a specific group. security‐model v1 |  Specifies the security model to be cleared for the SNMP access group. none will be applied. and level of security. including its set SNMP  security‐model. If context is not specified. Example This example shows how to clear SNMP version 3 access for the “mis‐group” via the  authentication protocol: A2(su)->clear snmp access mis-group security-model usm authentication SecureStack A2 Configuration Guide 5-19 . read‐write. Syntax clear snmp access groupname security-model {v1 | v2c | usm} [noauthentication | authentication | privacy] [context context] Parameters groupname Specifies the name of the SNMP group for which to clear access. v2c | usm noauthentication |  authentication |  privacy context context  (Optional) Clears a specific security level for the SNMP access group. Defaults If security level is not specified. all levels will be cleared. Mode Switch command. Enter / ‐ /  to clear the default context. (Optional) Clears a specific context for the SNMP access group.

 all SNMP MIB view configuration information will be displayed. 5-20 5-22 5-23 5-24 show snmp view Use this command to display the MIB configuration for SNMPv3 view‐based access (VACM)... For information about. Mode Switch command. show snmp view show snmp context set snmp view clear snmp view Refer to page...Configuring SNMP MIB Views Configuring SNMP MIB Views Purpose To review and configure SNMP MIB views. read‐only. Example This example shows how to display SNMP MIB view configuration information: A2(su)->show snmp view --.  Syntax show snmp view [viewname] [subtree oid-or-mibobject] [volatile | nonvolatile | read-only] Parameters viewname subtree oid‐or‐mibobject volatile | nonvolatile |  read‐only (Optional) Displays information for a specific MIB view. (Optional) Displays entries for a specific storage type.  Defaults If no parameters are specified. (Optional) Displays information for a specific MIB subtree when  viewname is specified. Commands The commands used to review and configure SNMP MIB views are listed below.SNMP MIB View information --View Name = All Subtree OID = 1 Subtree mask = View Type = included 5-20 SNMP Configuration . SNMP views map SNMP objects to access rights.

show snmp view Storage type Row status View Name Subtree OID Subtree mask View Type Storage type Row status View Name Subtree OID Subtree mask View Type Storage type Row status = nonVolatile = active = = = = = = = = = = = = All 0. notInService. or notReady.2.3. SecureStack A2 Configuration Guide 5-21 .1 included nonVolatile active Table 5‐7 provides an explanation of the command output.. Bitmask applied to a MIB subtree. Whether or not subtree use must be included or excluded for this view.6. Name assigned to a MIB view. For details on using the set snmp view  command to assign variables.1.. Name identifying a MIB subtree.0 included nonVolatile active Network 1. refer to “set snmp view” on page 5‐23. Whether storage is in nonVolatile or Volatile memory Status of this entry: active. Table 5-7 Output View Name Subtree OID Subtree mask View Type Storage type Row status show snmp view Output Details What It Displays.

show snmp context show snmp context Use this command to display the context list configuration for SNMP’s view‐based access control. Mode Switch command. Defaults None.Configured contexts: default context (all mibs) 5-22 SNMP Configuration . Example This example shows how to display a list of all SNMP contexts known to the device: A2(su)->show snmp context --. other  contexts can be applied to limit access to a subset of management information. read‐only. Usage An SNMP context is a collection of management information that can be accessed by an SNMP  agent or entity. When created using the set snmp access command (“set snmp access” on page 5‐18). The default context allows all SNMP agents to access all management information  (MIBs).  Syntax show snmp context Parameters None.

Mode Switch command.6. mask will be set to 255.  (Optional) Specifies subtree use (default) or no subtree use.  subtree subtree mask mask included |  excluded volatile |  nonvolatile Specifies a MIB subtree name.255. Example This example shows how to set an SNMP MIB view to “public” with a subtree name of 1. read‐write.1  included: A2(su)->set snmp view viewname public subtree 1. Defaults If not specified. (Optional) Specifies a bitmask for a subtree. If storage type is not specified.3. Syntax set snmp view viewname viewname subtree subtree [mask mask] [included | excluded] [volatile | nonvolatile] Parameters viewname viewname Specifies a name for a MIB view.3.255 If not specified.1 included SecureStack A2 Configuration Guide 5-23 . nonvolatile (permanent) will be applied.255.set snmp view set snmp view Use this command to set a MIB configuration for SNMPv3 view‐based access (VACM). subtree use will be included. (Optional) Specifies the use of temporary or permanent (default) storage.6.

Example This example shows how to delete SNMP MIB view “public”: A2(su)->clear snmp view public 1.clear snmp view clear snmp view Use this command to delete an SNMPv3 MIB view. read‐write. Specifies the subtree name of the MIB view to be deleted. Syntax clear snmp view viewname subtree Parameters viewname subtree Specifies the MIB view name to be deleted. Mode Switch command.1 5-24 SNMP Configuration . Defaults None.6.3.

(Optional) Displays target parameter entries for a specific storage  type. Syntax show snmp targetparams [targetParams] [volatile | nonvolatile | read-only] Parameters targetParams volatile | nonvolatile |  read‐only (Optional) Displays entries for a specific target parameter..SNMP TargetParams information --Target Parameter Name = v1ExampleParams Security Name = public Message Proc. entries of all storage types will be displayed. Model = SNMPv1 Security Level = noAuthNoPriv SecureStack A2 Configuration Guide 5-25 . Commands The commands used to review and configure SNMP target parameters are listed below. Mode Switch command. entries associated with all target parameters will be displayed.. Example This example shows how to display SNMP target parameters information: A2(su)->show snmp targetparams --. show snmp targetparams set snmp targetparams clear snmp targetparams Refer to page. 5-25 5-27 5-28 show snmp targetparams Use this command to display SNMP parameters used to generate a message to a target.Configuring SNMP Target Parameters Configuring SNMP Target Parameters Purpose To review and configure SNMP target parameters.. A target parameter entry can be bound to a target  IP address allowed to receive SNMP notification messages with the set snmp targetaddr  command (“set snmp targetaddr” on page 5‐30).. read‐only. Defaults If targetParams is not specified. If not specified. For information about. This controls where and under what  circumstances SNMP notifications will be sent.

Model Security Level Storage type Row status = nonVolatile = active = = = = = = = = = = = = v2cExampleParams public SNMPv2c noAuthNoPriv nonVolatile active v3ExampleParams CharlieDChief USM authNoPriv nonVolatile active Table 5‐8 shows a detailed explanation of the command output.show snmp targetparams Storage type Row status Target Parameter Name Security Name Message Proc. Unique identifier for the parameter in the SNMP target parameters table. Storage type Row status 5-26 SNMP Configuration . Whether entry is stored in volatile. notInService. nonvolatile or read-only memory.. or notReady. Type of security level (auth: security level is set to use authentication protocol. Model Security Level show snmp targetparams Output Details What It Displays. Table 5-8 Output Target Parameter Name Security Name Message Proc. Status of this entry: active. noauth: security level is not set to use authentication protocol. Maximum length is 32 bytes.. Model Security Level Storage type Row status Target Parameter Name Security Name Message Proc. or privacy). Security string definition. SNMP version.

security‐model v1 |  Specifies the SNMP security model applied to this target parameter as  v2c | usm version 1. read‐write. security level will be set to noauthentication. and authentication: A2(su)->set snmp targetparams v1ExampleParams user fred security-model usm message-processing v3 authentication SecureStack A2 Configuration Guide 5-27 . 2c or 3 (usm).  If not specified. If not specified. storage type will be set to nonvolatile. Example This example shows how to set SNMP target parameters named “v1ExampleParams” for a user  named “fred” using version 3 security model and message processing.  Syntax set snmp targetparams paramsname user user security-model {v1 | v2c | usm} messageprocessing {v1 | v2c | v3} [noauthentication | authentication | privacy] [volatile | nonvolatile] Parameters paramsname user user  Specifies a name identifying parameters used to generate SNMP messages  to a particular target.  Maximum length is 32 bytes. (Optional) Specifies the storage type applied to this target parameter. Specifies an SNMPv1 or v2 community name or an SNMPv3 user name. | v3 noauthentication |  authentication |  privacy volatile |  nonvolatile  (Optional) Specifies the SNMP security level applied to this target  parameter as no authentication. 2c or 3. Privacy specifies that messages sent on behalf of the user are  protected from disclosure. message‐ Specifies the SNMP message processing model applied to this target  processing v1 | v2c  parameter as version 1. authentication (without privacy) or  privacy. Mode Switch command. a named set of security/authorization criteria  used to generate a message to a target. Defaults None.set snmp targetparams set snmp targetparams Use this command to set SNMP target parameters.

Example This example shows how to clear SNMP target parameters named “v1ExampleParams”: A2(su)->clear snmp targetparams v1ExampleParams 5-28 SNMP Configuration . Mode Switch command. read‐write.clear snmp targetparams clear snmp targetparams Use this command to clear the SNMP target parameter configuration. Defaults None. Syntax clear snmp targetparams targetParams Parameters targetParams Specifies the name of the parameter in the SNMP target parameters table  to be cleared.

..255.. and UDP port) set with the set snmp targetparams command ((page 5‐27)). Commands The commands used to review and configure SNMP target addresses are listed below. parameters (such as  timeout.Configuring SNMP Target Addresses Configuring SNMP Target Addresses Purpose To review and configure SNMP target addresses which will receive SNMP notification messages.2.255. show snmp targetaddr set snmp targetaddr clear snmp targetaddr Refer to page. If not specified. displays target address  | read‐only information for a specific storage type. entries of all storage types will be displayed for a target address. Defaults If targetAddr is not specified.3. 5-29 5-30 5-31 show snmp targetaddr Use this command to display SNMP target address information.116 UDP Port# = 162 Target Mask = 255.  volatile | nonvolatile  (Optional) When target address is specified. Mode Switch command. or target. For information about. retry count.  An address configuration can be linked to optional SNMP transmit. Example This example shows how to display SNMP target address information: A2(su)->show snmp targetaddr Target Address Name = labmachine Tag List = v2cTrap IP Address = 10.255 Timeout = 1500 Retry count = 4 SecureStack A2 Configuration Guide 5-29 . read‐only. Syntax show snmp targetaddr [targetAddr] [volatile | nonvolatile | read-only] Parameters targetAddr (Optional) Displays information for a specific target address name.. entries for all target address names will be displayed.

nonvolatile or read-only memory..01 seconds and the  default is 1500 (15 seconds. Unique identifier in the snmpTargetAddressTable. This value is in . Whether entry is stored in volatile.set snmp targetaddr Parameters Storage type Row status = v2cParams = nonVolatile = active Table 5‐9 shows a detailed explanation of the command output.) (Optional) Specifies the number of message retries allowed if a response is  not received. notInService. Status of this entry: active.  Maximum length is 32 bytes. The target address is a unique identifier  and a specific IP address that will receive SNMP notification messages and determine which  community strings will be accepted. Default is 3. Target IP address mask. Retry setting for the target address. (Optional) Specifies the maximum round trip time allowed to  communicate to this target address. Syntax set snmp targetaddr targetaddr ipaddr param param [udpport udpport] [mask mask] [timeout timeout] [retries retries] [taglist taglist] [volatile | nonvolatile] Parameters targetaddr ipaddr param param udpport udpport mask mask timeout timeout Specifies a unique identifier to index the snmpTargetAddrTable. Specifies an entry in the SNMP target parameters table. Table 5-9 Output Target Address Name Tag List IP Address UDP Port# Target Mask Timeout Retry count Parameters Storage type Row status show snmp targetaddr Output Details What It Displays. retries retries 5-30 SNMP Configuration . Tags a location to the target address as a place to send notifications. Timeout setting for the target address. and UDP port).. This address configuration can be linked to optional SNMP  transmit parameters (such as timeout. which is used  when generating a message to the target. Maximum length is 32 bytes. Target IP address.  (Optional) Specifies which UDP port of the target host to use. or notReady. Number of the UDP port of the target host to use. Specifies the IP address of the target. (Optional) Specifies the IP mask of the target. Entry in the snmpTargetParamsTable. set snmp targetaddr Use this command to configure an SNMP target address. retry count.

 refer to “Creating a Basic SNMP Trap  Configuration” on page 5‐41: A2(su)->set snmp targetaddr tr 192. For  more information on configuring a basic SNMP trap. This tags a location  to the target address as a place to send notifications. timeout will be set to 1500.” This trap notification  will be sent to the workstation 192. If not specified.190. number of retries will be set to 3. If not specified. It will use security  and authorization criteria contained in a target parameters entry called “v2cExampleParams”. read‐write. or permanent storage for SNMP  entries.168. mask will be set to 255.80 (which is target address “tr”).190. udpport will be set to 162. volatile |  nonvolatile Defaults If not specified. (Optional) Specifies temporary (default). If not specified. Defaults None. If taglist is not specified.  “tag 1 tag 2”).clear snmp targetaddr taglist taglist (Optional) Specifies a list of SNMP notify tag values. Mode Switch command. Mode Switch command. storage type will be nonvolatile.255 If not specified. Syntax clear snmp targetaddr targetAddr Parameters targetAddr Specifies the target address entry to delete.255. List must be enclosed  in quotes and tag values must be separated by a space (for example.80 param v2cExampleParams taglist TrapSink clear snmp targetaddr Use this command to delete an SNMP target address entry. read‐write.168.255. Example This example shows how to configure a trap notification called “TrapSink. SecureStack A2 Configuration Guide 5-31 . none will be set.

clear snmp targetaddr Example This example shows how to clear SNMP target address entry “tr”: A2(su)->clear snmp targetaddr tr 5-32 SNMP Configuration .

Configuring SNMP Notification Parameters Configuring SNMP Notification Parameters About SNMP Notify Filters Profiles indicating which targets should not receive SNMP notification messages are kept in the  NotifyFilter table. When the NotifyFilter table contains profile entries.. Commands The commands used to configure SNMP notification parameters and filters are listed below. Notifications are entities which  handle the generation of SNMP v1 and v2 “traps” or SNMP v3 “informs” messages to select  management targets. For information about.. Optional notification filters identify which targets should not receive  notifications. Purpose To configure SNMP notification parameters and optional filters. It will then apply the appropriate subtree‐specific filter when generating notification  messages. meaning that no filtering is associated with any SNMP  target.. “Traps” or “informs” notifications will be sent to all  destinations in the SNMP targetAddrTable that have tags matching those found in the  NotifyTable.. show snmp notify set snmp notify clear snmp notify show snmp notifyfilter set snmp notifyfilter clear snmp notifyfilter show snmp notifyprofile set snmp notifyprofile clear snmp notifyprofile Refer to page. refer to “Creating a Basic SNMP Trap Configuration” on page 5‐41. 5-34 5-35 5-36 5-36 5-37 5-38 5-38 5-39 5-40 SecureStack A2 Configuration Guide 5-33 . For a sample SNMP trap configuration showing how SNMP notification parameters  are associated with security and authorization criteria (target parameters) and mapped to a  management target address. the SNMP agent will find any filter profile  name that corresponds to the target parameter name contained in an outgoing notification  message. then no filtering will take place. If this table is empty.

  Syntax show snmp notify [notify] [volatile | nonvolatile | read-only] Parameters notify volatile |  nonvolatile | read‐ only (Optional) Displays notify entries for a specific notify name. Mode Switch command. Type of notification: SNMPv1 or v2 trap or SNMPv3 InformRequest message. (Optional) Displays notify entries for a specific storage type. nonvolatile or read-only memory.. which determines which  management targets will receive SNMP notifications. nonvolatile or read‐only are not specified.SNMP notifyTable information --Notify name = 1 Notify Tag = Console Notify Type = trap Storage type = nonVolatile Row status = active Notify name Notify Tag Notify Type Storage type Row status = = = = = 2 TrapSink trap nonVolatile active Table 5‐10 shows a detailed explanation of the command output. Status of this entry: active. Example This example shows how to display the SNMP notify information: A2(su)->show snmp notify --. or notReady. A unique identifier used to index the SNMP notify table. Whether access entry is stored in volatile. Defaults If a notify name is not specified. notInService. all entries will be displayed. Name of the entry in the SNMP notify table. If volatile. read‐only. all storage type entries will be displayed. 5-34 SNMP Configuration .show snmp notify show snmp notify Use this command to display the SNMP notify configuration. Table 5-10 Output Notify name Notify Tag Notify Type Storage type Row status show snmp notify Output Details What It Displays..

 This creates an entry in the SNMP notify  table. Specifies an SNMP notify tag.set snmp notify set snmp notify Use this command to set the SNMP notify configuration. message type will be set to trap. This  command’s tag parameter can be used to bind each entry to a target address using the set snmp  targetaddr command (“set snmp targetaddr” on page 5‐30). Notifications will be sent as trap messages and storage type will  automatically default to permanent: A2(su)->set snmp notify hello tag world trap SecureStack A2 Configuration Guide 5-35 . Defaults If not specified. If not specified. or permanent storage for SNMP  entries. This binds the notify name to the SNMP  target address table. (Optional) Specifies SNMPv1 or v2 Trap messages (default) or SNMP v3  InformRequest messages. which is used to select management targets who should receive notification messages. storage type will be set to nonvolatile. Mode Switch command. Example This example shows how to set an SNMP notify configuration with a notify name of “hello” and a  notify tag of “world”. Syntax set snmp notify notify tag tag [trap | inform] [volatile | nonvolatile] Parameters notify tag tag trap | inform volatile |  nonvolatile  Specifies an SNMP notify name.  (Optional) Specifies temporary (default). read‐write.

5-36 SNMP Configuration . Syntax show snmp notifyfilter [profile] [subtree oid-or-mibobject] [volatile | nonvolatile | read-only] Parameters profile subtree oid‐or‐ mibobject volatile |  nonvolatile | read‐ only (Optional) Displays a specific notify filter. Syntax clear snmp notify notify Parameters notify Specifies an SNMP notify name to clear. read‐only. (Optional) Displays notify filter entries of a specific storage type.clear snmp notify clear snmp notify Use this command to clear an SNMP notify configuration. Defaults None. all notify filter information will be displayed. Mode Switch command. read‐write. Mode Switch command. identifying which profiles will not  receive SNMP notifications. Usage See “About SNMP Notify Filters” on page 5‐33 for more information about notify filters. Example This example shows how to clear the SNMP notify configuration for “hello”: A2(su)->clear snmp notify hello show snmp notifyfilter Use this command to display SNMP notify filter information. (Optional) Displays a notify filter within a specific subtree. Defaults If no parameters are specified.

 In this case. Mode Switch command.3.6 SecureStack A2 Configuration Guide 5-37 .SNMP notifyFilter information --Profile = pilot1 Subtree = 1.set snmp notifyfilter Example This example shows how to display SNMP notify filter information.6: A2(su)->set snmp notifyfilter pilot1 subtree 1. (Optional) Specifies that subtree is included or excluded. (Optional) Applies a subtree mask. Specifies a MIB subtree ID target for the filter. Syntax set snmp notifyfilter profile subtree oid-or-mibobject [mask mask] [included | excluded] [volatile | nonvolatile] Parameters profile subtree oid‐or‐ mibobject mask mask included |  excluded volatile |  nonvolatile  Specifies an SNMP filter notify name. mask is not set. (Optional) Specifies a storage type. This identifies which  management targets should NOT receive notification messages.3.3. Example This example shows how to create an SNMP notify filter called “pilot1” with a MIB subtree ID of  1. If storage type is not specified. If not specified.6 will not receive SNMP notification messages: A2(su)->show snmp notifyfilter --. which is useful for fine‐tuning the  amount of SNMP traffic generated. Defaults If not specified. subtree will be included. read‐write. Usage See “About SNMP Notify Filters” on page 5‐33 for more information about notify filters.3. the notify profile  “pilot1” in subtree 1.6 Filter type = included Storage type = nonVolatile Row status = active set snmp notifyfilter Use this command to create an SNMP notify filter configuration. nonvolatile (permanent) will be applied.

 all notify profile information will be displayed. Mode Switch command.  (Optional) Displays notify filter entries of a specific storage type. This associates target parameters  to an SNMP notify filter to determine who should not receive SNMP notifications.clear snmp notifyfilter clear snmp notifyfilter Use this command to delete an SNMP notify filter configuration. 5-38 SNMP Configuration . read‐only. Specifies a MIB subtree ID containing the filter to be deleted. Syntax clear snmp notifyfilter profile subtree oid-or-mibobject Parameters profile subtree oid‐or‐ mibobject Specifies an SNMP filter notify name to delete. Syntax show snmp notifyprofile [profile] [targetparam targetparam] [volatile | nonvolatile | read-only] Parameters profile targetparam  targetparam volatile |  nonvolatile | read‐ only (Optional) Displays a specific notify profile.3. Defaults If no parameters are specified.6 show snmp notifyprofile Use this command to display SNMP notify profile information. Example This example shows how to delete the SNMP notify filter “pilot1”: A2(su)->clear snmp notifyfilter pilot1 subtree 1. read‐write. (Optional) Displays entries for a specific target parameter. Defaults None. Mode Switch command.

Defaults If storage type is not specified. Mode Switch command. (Optional) Specifies a storage type. read‐write. Syntax set snmp notifyprofile profile targetparam targetparam [volatile | nonvolatile] Parameters profile targetparam  targetparam volatile |  nonvolatile  Specifies an SNMP filter notify name. to a set of SNMP target parameters to determine which management targets should  not receive SNMP notifications. A2(su)->set snmp notifyprofile area51 targetparam v3ExampleParams SecureStack A2 Configuration Guide 5-39 .set snmp notifyprofile Example This example shows how to display SNMP notify information for the profile named “area51”: A2(su)->show snmp notifyprofile area51 --. Specifies an associated entry in the SNMP Target Params Table. created with the set snmp notifyfilter command (“set snmp notifyfilter” on  page 5‐37). Example This example shows how to create an SNMP notify profile named area51 and associate a target  parameters entry. nonvolatile (permanent) will be applied.SNMP notifyProfile information --Notify Profile = area51 TargetParam = v3ExampleParams Storage type = nonVolatile Row status = active set snmp notifyprofile Use this command to create an SNMP notify filter profile configuration. This associates a  notification filter.

Specifies an associated entry in the snmpTargetParamsTable. Syntax clear snmp notifyprofile profile targetparam targetparam Parameters profile targetparam  targetparam Specifies an SNMP filter notify name to delete. read‐write. Mode Switch command. Defaults None.clear snmp notifyprofile clear snmp notifyprofile Use this command to delete an SNMP notify profile configuration. Example This example shows how to delete SNMP notify profile “area51”: A2(su)->clear snmp notifyprofile area51 targetparam v3ExampleParams 5-40 SNMP Configuration .

Create a new notification entry.. where appropriate.  a console.  Table 5-11 To do this . Create an SNMP target parameters entry to associate security and authorization criteria to the  users in the community created in Step 1. and map the  parameters to a management target address. Create an SNMP target parameters entry.190. 3. Verify if any applicable SNMP notification entries exist. Verify if any applicable SNMP notification entries exist. 4. The following configuration example shows how to use CLI commands to associate SNMP  notification parameters with security and authorization criteria (target parameters). Creating an SNMPv1 or v3 Trap. Configure a trap notification called TrapSink. Create a community name. or create a new one.. Create a community name that will act as an SNMP user password.Creating a Basic SNMP Trap Configuration Creating a Basic SNMP Trap Configuration Traps are notification messages sent by an SNMPv1 or v2 agent to a network management station. It will use security and authorization criteria contained  in a target parameters entry called v2cExampleParams.80 (which is target address tr). Table 5‐11 shows the commands used to complete an SNMPv2 trap configuration on a  SecureStack A2 device. Create a target address entry. and when power supply errors  occur. such as when a port or  device goes up or down.168.. Note: This example illustrates how to configure an SNMPv2 trap notification. when there are authentication failures. You will use this  entry to send SNMP notification messages to the appropriate management targets created in  Step 2. or an SNMPv3 Inform notification would require using the same commands with different parameters.. Always ensure that v1/v2 communities or v3 users used for generating traps or informs are pre-configured with enough privileges to access corresponding MIBs.  This trap notification will be sent with the community name mgmt to the workstation  192. Complete an SNMPv2 trap configuration on a SecureStack A2 device as follows: 1. set snmp community set snmp targetparams show snmp notify set snmp notify set snmp targetaddr Example This example shows how to:  • • Create an SNMP community called mgmt. or a terminal to indicate the occurrence of a significant event. 2. A2(su)->set snmp community mgmt A2(su)->set snmp targetparams v2cExampleParams user mgmt SecureStack A2 Configuration Guide 5-41 . Basic SNMP Trap Configuration Use these commands . Create a target address entry to bind a management IP address to: – – The notification entry and tag name created in Step 3 and The target parameters entry created in Step 2.

Creating a Basic SNMP Trap Configuration security-model v2c message-processing v2c A2(su)->set snmp notify entry1 tag TrapSink A2(su)->set snmp targetaddr tr 192. In this case it was built using the  set snmp targetaddr command.  Searches for the doors matching such a key. 5-42 SNMP Configuration . and a “procedure” for crossing the  doorstep. the SNMP agent requires the  equivalent of a trap “door”. a “key” to unlock the door. Verifies that the mgmt community name is available. 5. in fact. in this case. available. The agent checks targetparams entries and determines this description was made with  the set snmp targetparams command. Determines if the “keys” for trap “doors” do exist. This command also specifies that this door leads to the  management station 192. and the “procedure” (targetparams) to cross the doorstep  is called v2ExampleParams.80 param v2cExampleParams taglist TrapSink How SNMP Will Use This Configuration In order to send a trap/notification requested by a MIB code. the parameters set for the entry1 key  shows that it opens only the door TrapSink. the  key that SNMP is looking for is the notification entry created with the set snmp notify  command which. which tells exactly which SNMP protocol to use and  what community name to provide.168. 2. Verifies that the specified door TrapSink is. For example. 4.  Verifies that the v2ExampleParams description of how to step through the door is. is a key labeled entry1. In the example configuration above. To determine if all these elements are in place. it has been configured using  the set snmp community command. In this case. 3. the community name is mgmt.168.80. the SNMP agent proceeds as follows: 1. In this case. in fact. 6.  there.190.190.  Sends the trap notification message.

6
Spanning Tree Configuration
This chapter describes the Spanning Tree Configuration set of commands and how to use them.
For information about... Spanning Tree Configuration Summary Configuring Spanning Tree Bridge Parameters Configuring Spanning Tree Port Parameters Refer to page... 6-1 6-3 6-32 Caution: Spanning Tree configuration should be performed only by personnel who are very knowledgeable about Spanning Trees and the configuration of the Spanning Tree Algorithm. Otherwise, the proper operation of the network could be at risk.

Spanning Tree Configuration Summary
Overview: Single, Rapid, and Multiple Spanning Tree Protocols
The IEEE 802.1D Spanning Tree Protocol (STP) resolves the problems of physical loops in a  network by establishing one primary path between any two devices in a network. Any duplicate  paths are barred from use and become standby or blocked paths until the original path fails, at  which point they can be brought into service.

RSTP
The IEEE 802.1w Rapid Spanning Protocol (RSTP), an evolution of 802.1D, can achieve much  faster convergence than legacy STP in a properly configured network. RSTP significantly reduces  the time to reconfigure the network’s active topology when physical topology or configuration  parameter changes occur. It selects one switch as the root of a Spanning Tree‐connected active  topology and assigns port roles to individual ports on the switch, depending on whether that port  is part of the active topology.  RSTP provides rapid connectivity following the failure of a switch, switch port, or a LAN. A new  root port and the designated port on the other side of the bridge transition to forwarding through  an explicit handshake between them. By default, user ports are configured to rapidly transition to  forwarding in RSTP.

MSTP
The IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) builds upon 802.1D and RSTP by  optimizing utilization of redundant links between switches in a network. When redundant links  exist between a pair of switches running single STP, one link is forwarding while the others are  blocking for all traffic flowing between the two switches. The blocking links are effectively used 

SecureStack A2 Configuration Guide

6-1

Spanning Tree Configuration Summary

only if the forwarding link goes down. MSTP assigns each VLAN present on the network to a  particular Spanning Tree instance, allowing each switch port to be in a distinct state for each such  instance: blocking for one Spanning Tree while forwarding for another. Thus, traffic associated  with one set of VLANs can traverse a particular inter‐switch link, while traffic associated with  another set of VLANs can be blocked on that link. If VLANs are assigned to Spanning Trees  wisely, no inter‐switch link will be completely idle, maximizing network utilization.  For details on creating Spanning Tree instances, refer to “set spantree msti” on page 6‐12. For details on mapping Spanning Tree instances to VLANs, refer to “set spantree mstmap” on  page 6‐13.
Note: MSTP and RSTP are fully compatible and interoperable with each other and with legacy STP 802.1D.

Spanning Tree Features
The SecureStack A2 device meets the requirements of the Spanning Tree Protocols by performing  the following functions: • • • • • • Creating a single Spanning Tree from any arrangement of switching or bridging elements.  Compensating automatically for the failure, removal, or addition of any device in an active  data path. Achieving port changes in short time intervals, which establishes a stable active topology  quickly with minimal network disturbance. Using a minimum amount of communications bandwidth to accomplish the operation of the  Spanning Tree Protocol. Reconfiguring the active topology in a manner that is transparent to stations transmitting and  receiving data packets. Managing the topology in a consistent and reproducible manner through the use of Spanning  Tree Protocol parameters.
Note: The term “bridge” is used as an equivalent to the term “switch” or “device” in this document.

6-2

Spanning Tree Configuration

Configuring Spanning Tree Bridge Parameters

Configuring Spanning Tree Bridge Parameters
Purpose
To display and set Spanning Tree bridge parameters, including device priorities, hello time,  maximum wait time, forward delay, path cost, and topology change trap suppression.

Commands
The commands used to review and set Spanning Tree bridge parameters are listed below.
For information about... show spantree stats set spantree show spantree version set spantree version clear spantree version show spantree bpdu-forwarding set spantree bpdu-forwarding show spantree bridgeprioritymode set spantree bridgeprioritymode clear spantree bridgeprioritymode show spantree mstilist set spantree msti clear spantree msti show spantree mstmap set spantree mstmap clear spantree mstmap show spantree vlanlist show spantree mstcfgid set spantree mstcfgid clear spantree mstcfgid set spantree priority clear spantree priority set spantree hello clear spantree hello set spantree maxage clear spantree maxage set spantree fwddelay Refer to page... 6-5 6-7 6-7 6-8 6-8 6-9 6-9 6-10 6-10 6-11 6-11 6-12 6-12 6-13 6-13 6-14 6-14 6-15 6-16 6-16 6-17 6-17 6-18 6-18 6-19 6-19 6-20

SecureStack A2 Configuration Guide

6-3

Configuring Spanning Tree Bridge Parameters

For information about... clear spantree fwddelay show spantree backuproot set spantree backuproot clear spantree backuproot show spantree tctrapsuppress set spantree tctrapsuppress clear spantree tctrapsuppress set spantree protomigration show spantree spanguard set spantree spanguard clear spantree spanguard show spantree spanguardtimeout set spantree spanguardtimeout clear spantree spanguardtimeout show spantree spanguardlock clear/set spantree spanguardlock show spantree spanguardtrapenable set spantree spanguardtrapenable clear spantree spanguardtrapenable show spantree legacypathcost set spantree legacypathcost clear spantree legacypathcost

Refer to page... 6-20 6-21 6-21 6-22 6-22 6-23 6-24 6-24 6-25 6-25 6-26 6-26 6-27 6-27 6-28 6-28 6-29 6-29 6-30 6-30 6-31 6-31

6-4

Spanning Tree Configuration

show spantree stats

show spantree stats
Use this command to display Spanning Tree information for one or more ports.

Syntax
show spantree stats [port port-string] [sid sid] [active]

Parameters
port port‐string (Optional) Displays information for the specified port(s). For a detailed  description of possible port‐‐string values, refer to “Port String Syntax Used  in the CLI” on page 4‐2. (Optional) Displays information for a specific Spanning Tree identifier. If  not specified, SID 0 is assumed. (Optional) Displays information for ports that have received STP BPDUs  since boot.

sid sid active

Defaults
If port‐string is not specified, Spanning Tree information for all ports will be displayed. If sid is not specified, information for Spanning Tree 0 will be displayed. If active is not specified information for all ports will be displayed regardless of whether or not  they have received BPDUs.

Mode
Switch command, read‐only.

Example
This example shows how to display the device’s Spanning Tree configuration:
A2(su)->show spantree stats Spanning tree status Spanning tree instance Designated Root MacAddr Designated Root Priority Designated Root Cost Designated Root Port Root Max Age Root Hello Time Root Forward Delay Bridge ID MAC Address Bridge ID Priority Bridge Max Age Bridge Hello Time Bridge Forward Delay Topology Change Count Time Since Top Change Max Hops enabled 0 00-e0-63-9d-c1-c8 0 10000 lag.0.1 20 sec 2 sec 15 sec 00-01-f4-da-5e-3d 32768 20 sec 2 sec 15 sec 7 00 days 03:19:15 20

Table 6‐1 shows a detailed explanation of command output.

SecureStack A2 Configuration Guide

6-5

show spantree stats

Table 6-1
Output

show spantree Output Details
What It Displays... Spanning Tree ID. Whether Spanning Tree is enabled or disabled. MAC address of the designated Spanning Tree root bridge. Port through which the root bridge can be reached. Priority of the designated root bridge. Total path cost to reach the root. Amount of time (in seconds) a BPDU packet should be considered valid. Interval (in seconds) at which the root device sends BPDU (Bridge Protocol Data Unit) packets. Amount of time (in seconds) the root device spends in listening or learning mode. Unique bridge MAC address, recognized by all bridges in the network. Bridge priority, which is a default value, or is assigned using the set spantree priority command. For details, refer to “set spantree priority” on page 6-17. Maximum time (in seconds) the bridge can wait without receiving a configuration message (bridge “hello”) before attempting to reconfigure. This is a default value, or is assigned using the set spantree maxage command. For details, refer to “set spantree maxage” on page 6-19. Amount of time (in seconds) the bridge sends BPDUs. This is a default value, or is assigned using the set spantree hello command. For details, refer to “set spantree hello” on page 6-18. Amount of time (in seconds) the bridge spends in listening or learning mode. This is a default value, or is assigned using the set spantree fwddelay command. For details, refer to “set spantree fwddelay” on page 6-20. Number of times topology has changed on the bridge. Amount of time (in days, hours, minutes and seconds) since the last topology change. Maximum number of hops information for a particular Spanning Tree instance may traverse (via relay of BPDUs within the applicable MST region) before being discarded.

Spanning tree instance Spanning tree status Designated Root MacAddr Designated Root Port Designated Root Priority Designated Root Cost Root Max Age Root Hello Time Root Forward Delay Bridge ID MAC Address Bridge ID Priority

Bridge Max Age

Bridge Hello Time

Bridge Forward Delay

Topology Change Count Time Since Top Change Max Hops

6-6

Spanning Tree Configuration

set spantree

set spantree
Use this command to globally enable or disable the Spanning Tree protocol on the switch.

Syntax
set spantree {disable | enable}

Parameters
disable | enable Globally disables or enables Spanning Tree.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to disable Spanning Tree on the device:
A2(su)->set spantree disable

show spantree version
Use this command to display the current version of the Spanning Tree protocol running on the  device.

Syntax
show spantree version

Parameters
None.

Defaults
None.

Mode
Switch command, read‐only.

Example
This example shows how to display Spanning Tree version information for the device:
A2(su)->show spantree version Force Version is mstp

SecureStack A2 Configuration Guide

6-7

set spantree version

set spantree version
Use this command to set the version of the Spanning Tree protocol to MSTP (Multiple Spanning  Tree Protocol), RSTP (Rapid Spanning Tree Protocol) or to STP 802.1D‐compatible.

Syntax
set spantree version {mstp | stpcompatible | rstp}

Parameters
mstp stpcompatible rstp Sets the version to STP 802.1s‐compatible. Sets the version to STP 802.1D‐compatible. Sets the version to 802.1w‐compatible.

Defaults
None.

Mode
Switch command, read‐write.

Usage
In most networks, Spanning Tree version should not be changed from its default setting of mstp  (Multiple Spanning Tree Protocol) mode. MSTP mode is fully compatible and interoperable with  legacy STP 802.1D and Rapid Spanning Tree (RSTP) bridges. Setting the version to stpcompatible  mode will cause the bridge to transmit only 802.1D BPDUs, and will prevent non‐edge ports from  rapidly transitioning to forwarding state. 

Example
This example shows how to globally change the Spanning Tree version from the default of MSTP  to RSTP:
A2(su)->set spantree version rstp

clear spantree version
Use this command to reset the Spanning Tree version to MSTP mode.

Syntax
clear spantree version

Parameters
None.

Defaults
None.

Mode
Switch command, read‐write.

6-8

Spanning Tree Configuration

show spantree bpdu-forwarding

Example
This example shows how to reset the Spanning Tree version:
A2(su)->clear spantree version

show spantree bpdu-forwarding
Use this command to display the Spanning Tree BPDU forwarding mode.

Syntax
show spantree bpdu-forwarding

Parameters
None.

Defaults
None.

Mode
Switch command, read‐only.

Example
This example shows how to display the Spanning Tree BPDU forwarding mode:
A2(su)->show spantree bpdu-forwarding BPDU forwarding is disabled.

set spantree bpdu-forwarding
Use this command to enable or disable Spanning Tree BPDU forwarding. By default BPDU  forwarding is disabled.

Syntax
set spantree bpdu-forwarding {disable | enable}

Parameters
disable | enable Disables or enables BPDU forwarding;.

Defaults
By default BPDU forwarding is disabled.

Mode
Switch command, read‐write.

Usage
The Spanning Tree protocol must be disabled (set spantree disable) for this feature to take effect.

SecureStack A2 Configuration Guide

6-9

1t value to which the entered value is closest. which are 0 to 61440. Sets the bridge priority mode to use 802. 6-10 Spanning Tree Configuration . Syntax show spantree bridgeprioritymode Parameters None. Defaults None.1D (legacy) values. Mode Switch command. Values will automatically be rounded up or down. in  increments of 4096.show spantree bridgeprioritymode Example This example shows how to enable BPDU forwarding: A2(rw)-> set spantree bpdu-forwarding enable show spantree bridgeprioritymode Use this command to display the Spanning Tree bridge priority mode setting. set spantree bridgeprioritymode Use this command to set the Spanning Tree bridge priority mode to 802. read‐only. Example This example shows how to display the Spanning Tree bridge priority mode setting:  A2(rw)->show spantree bridgeprioritymode Bridge Priority Mode is set to IEEE802. Syntax set spantree bridgeprioritymode {8021d | 8021t} Parameters 8021d 8021t Sets the bridge priority mode to use 802.1t. This is the default bridge priority mode. Defaults None Mode Switch command.1t mode.  depending on the 802. which are 0 ‐  65535.1t values.1D (legacy) or 802. read‐write.

1D:  A2(rw)->set spantree bridgeprioritymode 8021d clear spantree bridgeprioritymode Use this command to reset the Spanning Tree bridge priority mode to the default setting of 802. Example This example shows how to set the bridge priority mode to 802. SecureStack A2 Configuration Guide 6-11 . read‐write. Example This example shows how to reset the bridge priority mode to 802. Defaults None. Syntax clear spantree bridgeprioritymode Parameters None. The  default for the switch is to use 802. Mode Switch command.1t. Syntax show spantree mstilist Parameters None.1t: A2(rw)->clear spantree bridgeprioritymode show spantree mstilist Use this command to display a list of Multiple Spanning Tree (MST) instances configured on the  device.clear spantree bridgeprioritymode Usage The mode affects the range of priority values used to determine which device is selected as the  Spanning Tree root as described in set spantree priority (“set spantree priority” on page 6‐17). Defaults None. read‐only. Mode Switch command.1t bridge priority mode.

Syntax clear spantree msti [sid sid] Parameters sid sid (Optional) Deletes a specific multiple Spanning Tree ID. In this case. all MST instances will be cleared. Example This example shows how to create an MST instance 2:  A2(su)->set spantree msti sid 2 create clear spantree msti Use this command to delete one or more Multiple Spanning Tree instances. SecureStack A2 devices will support up to 4 MST instances. Syntax set spantree msti sid sid {create | delete} Parameters sid sid Sets the Multiple Spanning Tree ID. Valid values are 1 ‐ 4094. Mode Switch command. read‐write. Defaults None.  Defaults If sid is not specified. read‐write. SID 2 has been configured: A2(su)->show spantree mstilist Configured Multiple Spanning Tree instances: 2 set spantree msti Use this command to create or delete a Multiple Spanning Tree instance. create | delete Creates or deletes an MST instance. Mode Switch command.set spantree msti Example This example shows how to display a list of MST instances. 6-12 Spanning Tree Configuration .

 In this case. information for all assigned FIDs will be displayed. Defaults If sid is not specified. this essentially maps one or more VLAN IDs to a Spanning Tree (SID).  and must correspond to a SID created using the set msti command.  Since VLANs are mapped to FIDs. Syntax show spantree mstmap [fid fid] Parameters fid fid (Optional) Displays information for specific FIDs. Valid values are 1 ‐ 4093. read‐only.  and must correspond to a VLAN ID created using the set vlan command. this shows to which SID a VLAN is mapped. Syntax set spantree mstmap fid [sid sid] Parameters  fid sid sid Specifies one or more FIDs to assign to the MST.show spantree mstmap Example This example shows how to delete all MST instances:  A2(su)->clear spantree msti show spantree mstmap Use this command to display the mapping of a filtering database ID (FID) to a Spanning Trees. SecureStack A2 Configuration Guide 6-13 . Example This example shows how to display SID to FID mapping information for FID 1. (Optional) Specifies a Multiple Spanning Tree ID. FID(s) will be mapped to Spanning Tree 0. Since VLANs are  mapped to FIDs. Mode Switch command. Valid values are 1 ‐ 4094. Defaults If fid is not specified. no  new mappings have been configured: A2(su)->show spantree mstmap fid 1 FID: SID: 1 0 set spantree mstmap Use this command to map one or more filtering database IDs (FIDs) to a SID.

 read‐only. all SID to FID mappings will be reset. 6-14 Spanning Tree Configuration . Syntax show spantree vlanlist [vlan-list] Parameters vlan‐list (Optional) Displays SIDs assigned to specific VLAN(s). SID assignment will be displayed for all VLANs. Example This example shows how to map FID 2 back to SID 0:  A2(su)->clear spantree mstmap 2 show spantree vlanlist Use this command to display the Spanning Tree ID(s) assigned to one or more VLANs. Mode Switch command. Mode Switch command. Defaults If not specified. Defaults If fid is not specified. Example This example shows how to map FID 3 to SID 2:  A2(su)->set spantree mstmap 3 sid 2 clear spantree mstmap Use this command to map a FID back to SID 0. Syntax clear spantree mstmap fid Parameters fid Specifies one or more FIDs to reset to 0. read‐write. read‐write.clear spantree mstmap Mode Switch command.

 the  default revision level of 0. revision level. and configuration digest. For this information to display. Syntax show spantree mstcfgid Parameters None. 16 and 42  are mapped to VLAN 1. Mode Switch command.  configuration name. SIDs 2. and the FIDs must  be mapped to SID 1 using the set spantree mstmap command as described in “set spantree  mstmap” on page 6‐13: A2(su)->show spantree vlanlist 1 The following SIDS are assigned to VLAN 1: 2 16 42 show spantree mstcfgid Use this command to display the MST configuration identifier elements. and the default configuration name (a string representing the bridge  MAC address) have not been changed. For information on using the set spantree mstcfgid  command to change these settings. including format selector. Defaults None. refer to “set spantree mstcfgid” on page 6‐16: A2(su)->show spantree mstcfgid MST Configuration Identifier: Format Selector: 0 Configuration Name: 00:01:f4:89:51:94 Revision Level: 0 Configuration Digest: ac:36:17:7f:50:28:3c:d4:b8:38:21:d8:ab:26:de:62 SecureStack A2 Configuration Guide 6-15 . the SID instance must be created using the  set spantree msti command as described in “set spantree msti” on page 6‐12. read‐only.show spantree mstcfgid Example This example shows how to display the SIDs mapped to VLAN 1. In this case. In this case. Example This example shows how to display the MST configuration identifier elements.

Example This example shows how to set the MST configuration name to “mstconfig”: A2(su)->set spantree mstconfigid cfgname mstconfig clear spantree mstcfgid Use this command to reset the MST revision level to a default value of 0.set spantree mstcfgid set spantree mstcfgid Use this command to set the MST configuration name and/or revision level. Valid values are 0 ‐ 65535. Syntax clear spantree mstcfgid Parameters None. Defaults None. Mode Switch command. Example This example shows how to reset the MST configuration identifier elements to default values: A2(su)->clear spantree mstcfgid 6-16 Spanning Tree Configuration . Syntax set spantree mstcfgid {cfgname name | rev level} Parameters cfgname name rev level Specifies an MST configuration name. and the configuration  name to a default string representing the bridge MAC address. read‐write. read‐write. Mode Switch command.  Specifies an MST revision level. Defaults None.

 with 0 indicating highest priority and 61440  lowest priority. the device with the lowest MAC address will then  become the root device. SID 0 is assumed. If not specified. priority will be reset on Spanning Tree 0. Syntax clear spantree priority [sid] Parameters sid (Optional) Resets the priority on a specific Spanning Tree. Valid values  are 0 ‐ 4094.set spantree priority set spantree priority Use this command to set the device’s Spanning Tree priority. Example This example shows how to set the bridge priority to 4096 on SID 1: A2(su)->set spantree priority 4096 1 clear spantree priority Use this command to reset the Spanning Tree priority to the default value of 32768. Mode Switch command. If not specified. If all devices have the same priority. priority will be set on Spanning Tree 0.  Syntax set spantree priority priority [sid] Parameters priority Specifies the priority of the bridge. (Optional) Sets the priority on a specific Spanning Tree. Mode Switch command.  some priority values may be rounded up or down. SecureStack A2 Configuration Guide 6-17 . Usage The device with the highest priority (lowest numerical value) becomes the Spanning Tree root  device. Valid values are from 0 to 61440 (in  increments of 4096). read‐write. sid Defaults If sid is not specified. Valid values  are 0 ‐ 4094. Defaults If sid is not specified. Depending on the bridge priority mode (set with the set spantree  bridgeprioritymode command described in “set spantree bridgeprioritymode” on page 6‐10. read‐write. SID 0 is assumed.

Defaults None. Mode Switch command. Syntax set spantree hello interval Parameters interval Specifies the number of seconds the system waits before broadcasting a  bridge hello message (a multicast message indicating that the system is  active). Example This example shows how to globally reset the Spanning Tree hello time: A2(su)->clear spantree hello 6-18 Spanning Tree Configuration . This is the time interval (in  seconds) the device will transmit BPDUs indicating it is active. Valid values are 1 ‐ 10. Defaults None. Example This example shows how to globally set the Spanning Tree hello time to 10 seconds: A2(su)->set spantree hello 10 clear spantree hello Use this command to reset the Spanning Tree hello time to the default value of 2 seconds. read‐write.  Syntax clear spantree hello Parameters None. Mode Switch command. read‐write.set spantree hello Example This example shows how to reset the bridge priority on SID 1: A2(su)->clear spantree priority 1 set spantree hello Use this command to set the device’s Spanning Tree hello time.

Mode Switch command. read‐write. read‐write. Example This example shows how to set the maximum aging time to 25 seconds: A2(su)->set spantree maxage 25 clear spantree maxage Use this command to reset the maximum aging time for a Spanning Tree to the default value of 20  seconds. Defaults None.set spantree maxage set spantree maxage Use this command to set the bridge maximum aging time. Valid values are 6 ‐  40.  Syntax set spantree maxage agingtime Parameters agingtime Specifies the maximum number of seconds that the system retains the  information received from other bridges through STP. a new root port is selected from among  the device ports attached to the network. Usage The bridge maximum aging time is the maximum time (in seconds) a device can wait without  receiving a configuration message (bridge “hello”) before attempting to reconfigure. Syntax clear spantree maxage Parameters None. All device  ports (except for designated ports) should receive configuration messages at regular intervals. Defaults None.  Any port that ages out STP information provided in the last configuration message becomes the  designated port for the attached LAN. If it is a root port. SecureStack A2 Configuration Guide 6-19 . Mode Switch command.

Defaults None.e. Valid values  are 4 ‐ 30. 6-20 Spanning Tree Configuration . In addition.  Syntax set spantree fwddelay delay Parameters delay Specifies the number of seconds for the bridge forward delay. read‐write. This delay is required because every device must  receive information about topology changes before it starts to forward frames..  Syntax clear spantree fwddelay Parameters None.  otherwise. Defaults None. each  port needs time to listen for conflicting information that would make it return to a blocking state. Usage The forward delay is the maximum time (in seconds) the root device will wait before changing  states (i. Example This example shows how to globally set the bridge forward delay to 16 seconds: A2(su)->set spantree fwddelay 16 clear spantree fwddelay Use this command to reset the Spanning Tree forward delay to the default setting of 15 seconds. Mode Switch command.set spantree fwddelay Example This example shows how to globally reset the maximum aging time: A2(su)->clear spantree maxage set spantree fwddelay Use this command to set the Spanning Tree forward delay. temporary data loops might result. listening to learning to forwarding).

 then status will be shown for Spanning Tree instance 0.Valid values are 0 ‐ 4094.show spantree backuproot Mode Switch command. Defaults If a SID is not specified. SID 0 is assumed. Enables or disables the backup root function. read‐only. Example This example shows how to globally reset the bridge forward delay: A2(su)->clear spantree fwddelay show spantree backuproot Use this command to display the backup root status for an MST instance. Mode Switch command.  Syntax set spantree backuproot sid {disable | enable} Parameters sid disable | enable Specifies the Spanning Tree instance on which to enable or disable the  backup root function. Syntax show spantree backuproot [sid] Parameters sid (Optional) Display backup root status for a specific Spanning Tree  identifier. Valid values are 0 ‐ 4094. Example This example shows how to display the status of the backup root function on SID 0: A2(rw)->show spantree backuproot Backup root is set to disable on sid 0 set spantree backuproot Use this command to enable or disable the Spanning Tree backup root function on the switch. Defaults None. read‐write. If not specified. SecureStack A2 Configuration Guide 6-21 .

Usage The Spanning Tree backup root function is disabled by default on the SecureStack A2. Example This example shows how to reset the backup root function to disabled on SID 2: A2(rw)->clear spantree backuproot 2 show spantree tctrapsuppress Use this command to display the status of topology change trap suppression on Rapid Spanning  Tree edge ports. Example This example shows how to enable the backup root function on SID 2: A2(rw)->set spantree backuproot 2 enable clear spantree backuproot Use this command to reset the Spanning Tree backup root function to the default state of disabled. stale Spanning Tree  information is prevented from circulating if the root bridge is lost.clear spantree backuproot Mode Switch command. If the root bridge is lost. Defaults None.Valid values are 0 ‐ 4094. When this  feature is enabled and the switch is directly connected to the root bridge. Syntax clear spantree backuproot sid Parameters sid Specifies the Spanning Tree on which to clear the backup root  function. read‐write. read‐write. the  backup root will dynamically lower its bridge priority so that it will be selected as the new root  over the lost root bridge. Mode Switch command. 6-22 Spanning Tree Configuration .  Syntax show spantree tctrapsuppress Parameters None.

 RSTP non‐edge (bridge) ports that transition to forwarding or blocking cause the  switch to issue a topology change trap. read‐only. This is because there is usually no need for network management to monitor edge  port STP transition states. Example This example shows how to display the status of topology change trap suppression: A2(rw)->show spantree tctrapsuppress Topology change Trap Suppression is set to enabled set spantree tctrapsuppress Use this command to disable or enable topology change trap suppression on Rapid Spanning Tree  edge ports. Defaults None. When topology change trap suppression is enabled. Mode Switch command. Mode Switch command. read‐write. When topology change trap  suppression is disabled. Example This example shows how to allow Rapid Spanning Tree edge ports to transmit topology change  traps: A2(rw)->set spantree tctrapsuppress disable SecureStack A2 Configuration Guide 6-23 . Usage By default. such as when PCs are powered on. including edge and bridge ports.set spantree tctrapsuppress Defaults None. edge ports (such as end station PCs) are prevented from sending topology  change traps. all ports.  Syntax set spantree tctrapsuppress {disable | enable} Parameters disable | enable Disables or enables topology change trap suppression. will transmit topology change  traps. which  is the device default.

Mode Switch command. read‐write. this forces a port to transmit MSTP BPDUs. Syntax set spantree protomigration <port-string> Parameters port‐string Reset the protocol state migration machine for specific port(s). When operating in RSTP mode.clear spantree tctrapsuppress clear spantree tctrapsuppress Use this command to clear the status of topology change trap suppression on Rapid Spanning Tree  edge ports to the default state of enabled (edge port topology changes do not generate traps). Example This example shows how to clear topology change trap suppression setting: A2(rw)->clear spantree tctrapsuppress set spantree protomigration Use this command to reset the protocol state migration machine for one or more Spanning Tree  ports.1. For a  detailed description of possible port‐string values. Example This example shows how to reset the protocol state migration machine on port 20: A2(su)->set spantree protomigration ge. read‐write. Mode Switch command. Defaults None.  Syntax clear spantree tctrapsuppress Parameters None.20 6-24 Spanning Tree Configuration . refer to “Port String  Syntax Used in the CLI” on page 4‐2. Defaults None.

 read‐only. the Spanning Tree state of that port will be changed to ʺblockingʺ and will no longer  forward traffic.  The port can be configured to be re‐enabled after a set time period.  When Spanguard is enabled. Defaults None. The port will remain disabled until the amount of time defined by set spantree  SecureStack A2 Configuration Guide 6-25 .  Syntax set spantree spanguard {enable | disable} Parameters enable | disable Enables or disables the span guard function. Defaults None. Example This example shows how to display the span guard function status: A2(su)->show spantree spanguard Spanguard is disabled set spantree spanguard Use this command to enable or disable the Spanning Tree span guard function. Mode Switch command. Syntax show spantree spanguard Parameters None. Usage Span guard is designed to disable. if a non‐loopback BPDU is received on an  edge port. or only after manual  intervention. Mode Switch command. read‐write.  described in “set spantree adminedge” on page 6‐38. or lock out an ʺedgeʺ port when an unexpected BPDU is  received.  A port can be defined as an edge (user) port using the set spantree adminedge command. A port designated as an edge port is  expected to be connected to a workstation or other end‐user type of device. and not to another  switch in the network.show spantree spanguard show spantree spanguard Use this command to display the status of the Spanning Tree span guard function.

Defaults None. the configuration of the port is changed so it is not longer an edge  port. Mode Switch command. Example This example shows how to enable the span guard function: A2(rw)->set spantree spanguard enable clear spantree spanguard Use this command to reset the status of the Spanning Tree span guard function to disabled.clear spantree spanguard spanguardtimeout (“set spantree spanguardtimeout” on page 6‐27) has passed since the last seen  BPDU. the port is manually unlocked (set or clear spantree spanguardlock. read‐only. Mode Switch command. Syntax show spantree spanguardtimeout Parameters None. Defaults None. span guard  is disabled and span guard traps are enabled. Span guard is enabled and disabled only on a global basis across the stack. Example This example shows how to reset the status of the span guard function to disabled: A2(rw)->clear spantree spanguard show spantree spanguardtimeout Use this command to display the Spanning Tree span guard timeout setting. By default. or the span guard function is disabled. 6-26 Spanning Tree Configuration . read‐write. “clear / set spantree  spanguardlock” on page 6‐28). Syntax clear spantree spanguard Parameters None.

Defaults None. SecureStack A2 Configuration Guide 6-27 . Mode Switch command. Mode Switch command. A value of 0 will keep the port locked until manually unlocked. Syntax set spantree spanguardtimeout timeout Parameters timeout Specifies a timeout value in seconds. read‐write. Syntax clear spantree spanguardtimeout Parameters None. Valid values are 0 to 65535. read‐write. The default  value is 300 seconds. Example This example shows how to set the span guard timeout to 600 seconds: A2(su)->set spantree spanguardtimeout 600 clear spantree spanguardtimeout Use this command to reset the Spanning Tree span guard timeout to the default value of 300  seconds.set spantree spanguardtimeout Example This example shows how to display the span guard timeout setting: A2(su)->show spantree spanguardtimeout Spanguard timeout: 300 set spantree spanguardtimeout Use this command to set the amount of time (in seconds) an edge port will remain locked by the  span guard function. Defaults None.

1: A2(su)->show spantree spanguardlock ge. When span guard is enabled. read‐only. Defaults If no port string is specified. refer to “Port String Syntax Used in the CLI” on page 4‐2. the span guard lock status for all ports is displayed. refer to “Port String  Syntax Used in the CLI” on page 4‐2. For a detailed description of possible port‐string  values. read‐write. it locks ports that receive BPDUs when those ports  have been defined as edge (user) ports (as described in “set spantree adminedge” on page 6‐38).1 Port ge.1 is Unlocked clear / set spantree spanguardlock Use either of these commands to unlock one or more ports locked by the Spanning Tree span  guard function.1.1. Example This example shows how to display the span guard lock status for ge. Mode Switch command. Syntax clear spantree spanguardlock port-string set spantree spanguardlock port-string Parameters port‐string Specifies port(s) to unlock.show spantree spanguardlock Example This example shows how to reset the span guard timeout to 300 seconds: A2(rw)->clear spantree spanguardtimeout show spantree spanguardlock Use this command to display the span guard lock status of one or more ports.  For a detailed description of possible port‐string values. Mode Switch command. 6-28 Spanning Tree Configuration . Syntax show spantree spanguardlock [port-string] Parameters port‐string (Optional) Specifies the port(s) for which to show span guard lock status. Defaults None.1.

show spantree spanguardtrapenable Example This example shows how to unlock port ge.1. Example This example shows how to disable the span guard trap function: A2(su)->set spantree spanguardtrapenable disable SecureStack A2 Configuration Guide 6-29 . Syntax show spantree spanguardtrapenable Parameters None. read‐write. Mode Switch command. read‐only. Defaults None. sending traps  is enabled.16: A2(rw)->clear spantree spanguardlock ge.16 show spantree spanguardtrapenable Use this command to display the state of the Spanning Tree span guard trap function. Syntax set spantree spanguardtrapenable {disable | enable} Parameters disable | enable Disables or enables sending span guard traps. Mode Switch command.1. Example This example shows how to display the state of the span guard trap function: A2(ro)->show spantree spanguardtrapenable Spanguard SNMP traps are enabled set spantree spanguardtrapenable Use this command to enable or disable the sending of an SNMP trap message when span guard  has locked a port. Defaults None. By default.

6-30 Spanning Tree Configuration . Syntax clear spantree spanguardtrapenable Parameters None. Mode Switch command. Mode Switch command.clear spantree spanguardtrapenable clear spantree spanguardtrapenable Use this command to reset the Spanning Tree span guard trap function back to the default state of  enabled. Defaults None. read‐write. Example This example shows how to reset the span guard trap function to enabled: A2(rw)->clear spantree spanguardtrapenable show spantree legacypathcost Use this command to display the default Spanning Tree path cost setting. Example This example shows how to display the default Spanning Tree path cost setting. Syntax show spantree legacypathcost Parameters None. Defaults None. read‐only. A2(su)->show spantree legacypathcost Legacy Path Cost is disabled.

Defaults None. legacy path cost is disabled. Usage By default.1d1998 values to calculate path cost. A2(rw)->set spantree adminpathcost enable clear spantree legacypathcost Use this command to set the Spanning Tree default value for legacy path cost to 802. Example This example clears the legacy path cost to 802.set spantree legacypathcost set spantree legacypathcost Use this command to enable or disable legacy (802.1D) path cost values. Example This example shows how to set the default path cost values to 802. Syntax set spantree legacypathcost {disable | enable} Parameters disable enable Use 802. Syntax clear spantree legacypathcost Defaults None. A2(rw)->clear spantree legacypathcost SecureStack A2 Configuration Guide 6-31 . Enabling the device to calculate legacy path costs affects  the range of valid values that can be entered in the set spantree adminpathcost command.1t values.1t2001 values to calculate path cost. Mode Switch command.1t values. read‐write. Mode Switch command. read‐write.1D. Use 802.

. 6-33 6-33 6-34 6-34 6-35 6-35 6-36 6-37 6-37 6-38 6-38 6-39 6-32 Spanning Tree Configuration . set spantree portadmin clear spantree portadmin show spantree portadmin show spantree portpri set spantree portpri clear spantree portpri show spantree adminpathcost set spantree adminpathcost clear spantree adminpathcost show spantree adminedge set spantree adminedge clear spantree adminedge Refer to page..Configuring Spanning Tree Port Parameters Configuring Spanning Tree Port Parameters Purpose To display and set Spanning Tree port parameters. For information about. Commands The commands used to review and set Spanning Tree port parameters are listed below...

12: A2(rw)->clear spantree portadmin fe. For a detailed  description of possible port‐string values.5: A2(rw)->set spantree portadmin fe. Example This example shows how to reset the default Spanning Tree admin state to enable on fe.5 disable clear spantree portadmin Use this command to reset the default Spanning Tree admin status to enable on one or more ports. refer to “Port String Syntax Used  in the CLI” on page 4‐2.12 SecureStack A2 Configuration Guide 6-33 .1. Syntax clear spantree portadmin port-string Parameters port‐string Resets the default admin status on specific port(s). read‐write. read‐write. Defaults None.set spantree portadmin set spantree portadmin Use this command to disable or enable the Spanning Tree algorithm on one or more ports. Mode Switch command.1. disable | enable Defaults None. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Disables or enables Spanning Tree. For a  detailed description of possible port‐string values.1. Mode Switch command. Example This example shows how to disable Spanning Tree on fe. Syntax set spantree portadmin port-string {disable | enable} Parameters port‐string Specifies the port(s) for which to enable or disable Spanning Tree.1.

(Optional) Displays port priority for a specific Spanning Tree identifier. status will be displayed for all ports. port priority will be displayed for all Spanning Tree ports.  Valid values are 0 ‐ 4094. Defaults If port‐string is not specified.1 has portadmin set to enabled show spantree portpri Use this command to show the Spanning Tree priority for one or more ports. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Example This example shows how to display port admin status for ge. Syntax show spantree portadmin [port port-string] Parameters port port‐string (Optional) Displays status for specific port(s). 6-34 Spanning Tree Configuration .1. If sid is not specified.  For a detailed description of possible port‐string values. read‐only. If not specified.show spantree portadmin show spantree portadmin Use this command to display the status of the Spanning Tree algorithm on one or more ports. ort priority is a  component of the port ID.1 Port ge.1. Syntax show spantree portpri [port port-string] [sid sid] Parameters port port‐string (Optional) Specifies the port(s) for which to display Spanning Tree priority. Mode Switch command. read‐only. which is one element used in determining Spanning Tree port roles. SID 0 is assumed. Mode Switch command. port priority will be displayed for Spanning Tree 0. For a detailed description of  possible port‐string values.1. refer to “Port String Syntax Used in the CLI”  on page 4‐2. sid sid Defaults If port‐string is not specified.1: A2(ro)->show spantree portadmin port ge.

  Valid values are 0 ‐ 4094.set spantree portpri Example This example shows how to display the port priority for fe.2. SID 0 will be assumed. Valid values are from 0 to 240 (in increments of 16) with 0  indicating high priority. Specifies a number that represents the priority of a link in a Spanning Tree  bridge. sid sid SecureStack A2 Configuration Guide 6-35 .  Syntax clear spantree portpri port-string [sid sid] Parameters port‐string Specifies the port(s) for which to set Spanning Tree port priority.2. refer to “Port String  Syntax Used in the CLI” on page 4‐2.3 to 240 on SID 1 A2(su)->set spantree portpri fe. If not specified.7 has a Port Priority of 128 on SID 0 set spantree portpri Use this command to set a port’s Spanning Tree priority. port priority will be set for Spanning Tree 0. For a  detailed description of possible port‐string values.7: A2(su)->show spantree portpri port fe.2. Example This example shows how to set the priority of fe.1. read‐write. SID 0 is assumed. priority sid sid Defaults If sid is not specified.1. For a  detailed description of possible port‐string values. Mode Switch command.  Syntax set spantree portpri port-string priority [sid sid] Parameters port‐string Specifies the port(s) for which to set Spanning Tree port priority. (Optional) Resets the port priority for a specific Spanning Tree identifier. (Optional) Sets port priority for a specific Spanning Tree identifier.3 240 sid 1 clear spantree portpri Use this command to reset the bridge priority of a Spanning Tree port to a default value of 128.7 Port fe. If not specified. Valid  values are 0 ‐ 4094. refer to “Port String  Syntax Used in the CLI” on page 4‐2.

sid sid Defaults If port‐string is not specified.1. read‐only. admin path cost for all Spanning Tree ports will be displayed.3. Valid values are 0 ‐ 4094. Mode Switch command. refer to “Port String  Syntax Used in the CLI” on page 4‐2.3 sid 1 show spantree adminpathcost Use this command to display the admin path cost for a port on one or more Spanning Trees. If not specified. admin path cost for Spanning Tree 0 will be displayed.3.1. Example This example shows how to reset the priority of fe.3. read‐write. Mode Switch command.show spantree adminpathcost Defaults If sid is not specified.3 to 128 on SID 1 A2(su)->clear spantree portpri fe.  Syntax show spantree adminpathcost [port port-string] [sid sid] Parameters port port‐string (Optional) Displays the admin path cost value for specific port(s).4 sid 1 Port fe. For a  detailed description of possible port‐string values. port priority will be set for Spanning Tree 0. (Optional) Displays the admin path cost for a specific Spanning Tree  identifier.4 has a Port Admin Path Cost of 0 on SID 1 6-36 Spanning Tree Configuration . SID 0 will be assumed. If sid is not specified. Example This example shows how to display the admin path cost for fe.4 on SID 1: A2(su)->show spantree adminpathcost port fe.

SecureStack A2 Configuration Guide 6-37 .3.2 200 sid 1 clear spantree adminpathcost Use this command to reset the Spanning Tree default value for port admin path cost to 0. For a detailed  description of possible port‐string values. (Optional) Sets the admin path cost for a specific Spanning Tree identifier. Syntax set spantree adminpathcost port-string cost [sid sid] Parameters port‐string Specifies the port(s) on which to set an admin path cost. admin path cost will be set for Spanning Tree 0. cost sid sid Defaults If sid is not specified. If not specified. Syntax clear spantree adminpathcost port-string [sid sid] Parameters port‐string Specifies the port(s) for which to reset admin path cost. For a detailed  description of possible port‐string values. admin path cost will be reset for Spanning Tree 0.3. refer to “Port String Syntax Used  in the CLI” on page 4‐2. refer to “Port String Syntax  Used in the CLI” on page 4‐2. SID 0 is assumed.  Valid values are 0 ‐ 4094. Specifies the port path cost. (Optional) Resets the admin path cost for specific Spanning Tree(s).2 on SID 1: A2(su)->set spantree adminpathcost fe. sid sid Defaults If sid is not specified. Mode Switch command.set spantree adminpathcost set spantree adminpathcost Use this command to set the administrative path cost on a port and one or more Spanning Trees.  Valid values are 0 ‐ 4094. If not specified. Example This example shows how to set the admin path cost to 200 for fe. read‐write. Va1id values are 0 ‐ 200000000. read‐write. SID 0 will be assumed. Mode Switch command.

 For a detailed description of possible port‐string  values. For a detailed description of possible port‐string values. Example This example shows how to display the edge port status for fe.3. read‐only.show spantree adminedge Example This example shows how to reset the admin path cost to 0 for fe.3. refer to “Port String Syntax Used in the CLI” on page 4‐2. 6-38 Spanning Tree Configuration .3.3.  refer to “Port String Syntax Used in the CLI” on page 4‐2. Defaults If port‐string is not specified edge port administrative status will be displayed for all Spanning Tree  ports. Syntax set spantree adminedge port-string {true | false} Parameters port‐string true | false Specifies the edge port.2 has a Port Admin Edge of Edge-Port set spantree adminedge Use this command to set the edge port administrative status on a Spanning Tree port.2 on SID 1: A2(su)->clear spantree adminpathcost fe. Syntax show spantree adminedge [port port-string] Parameters port‐string (Optional) Displays edge port administrative status for specific  port(s). Mode Switch command. Enables (true) or disables (false) the specified port as a Spanning Tree edge  port.2: A2(su)->show spantree adminedge port fe.2 sid 1 show spantree adminedge Use this command to display the edge port administrative status for a port.2 Port fe. Defaults None.3.

1. If a Spanning Tree BDPU is not received on the port within  a few seconds.1. Syntax clear spantree adminedge port-string Parameters port‐string Specifies port(s) on which to reset edge port status. read‐write. Usage The default behavior of the edge port administrative status begins with the value set to false  initially after the device is powered up.clear spantree adminedge Mode Switch command.11 true clear spantree adminedge Use this command to reset a Spanning Tree port to non‐edge status. Example This example shows how to reset fe. refer to “Port String Syntax Used  in the CLI” on page 4‐2.11 as an edge port: A2(su)->set spantree adminedge fe. For a detailed  description of possible port‐string values.11 SecureStack A2 Configuration Guide 6-39 .1. read‐write.  Example This example shows how to set fe.1.11 as a non‐edge port: A2(su)->clear spantree adminedge fe. Defaults None. the status setting changes to true. Mode Switch command.

clear spantree adminedge 6-40 Spanning Tree Configuration .

  For information about. are assigned to a VLAN.1Q virtual LANs  (VLANs). is set to “public” with read‐write access. some or all of the ports on the device can be configured as GVRP ports..  Also. in effect. refer to “Port  String Syntax Used in the CLI” on page 4‐2. 7-1 7-3 7-5 7-8 7-14 7-20 7-23 VLAN Configuration Summary Virtual LANs allow the network administrator to partition network traffic into logical groups and  control the flow of that traffic through the network. The default community name. the users  creating the traffic.1Q VLANs. the DEFAULT VLAN.1Q VLAN Configuration This chapter describes the SecureStack A2 system’s capabilities to implement 802. which enable frames  received with a particular VLAN ID and protocol to be transmitted on a limited number of ports. all ports on the device are assigned to VLAN ID 1. It is VLAN ID  1. untagged.7 802. which determines remote access for SNMP  management..  This keeps the traffic associated with a particular VLAN and protocol isolated from the other parts  of the network.. Port String Syntax Used in the CLI For information on how to designate VLANs and port numbers in the CLI syntax. Once the traffic and. VLAN Configuration Summary Viewing VLANs Creating and Naming Static VLANs Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Configuring the VLAN Egress List Setting the Host VLAN Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Refer to page. As a default. Creating a Secure Management VLAN By default at startup. there is one VLAN configured on the SecureStack A2 device. SecureStack A2 Configuration Guide 7-1 .. The allowable range for VLAN IDs is 1 to 4093. Note: The device can support up to 1024 802. then broadcast and multicast traffic is contained  within the VLAN and users can be allowed or denied access to any of the network’s resources.

Set a private community name and access policy and confirm settings. Assign host status to the VLAN.. 3.1 and wants untagged frames. 2.1. Task Create a new VLAN.1. 7-5 7-9 7-16 7-21 5-14 The commands used to create a secure management VLAN are listed in Table 7‐1. Set a private community name and access policy.1.VLAN Configuration Summary If the SecureStack A2 device is to be configured for multiple VLANs..  Table 7-1 Command Set for Creating a Secure Management VLAN Use these commands. Remove the port from the default VLAN’s egress list.1Q VLAN Configuration . This example  assumes the management station is attached to fe. Create a new VLAN and confirm settings. you must: Step 1. The process described here would be repeated on every device that is connected in the network to  ensure that each device has a secure management VLAN.. Set the PVID for the desired switch port to the VLAN created in Step 1.1 (“clear vlan egress” on page 7-17) set host vlan 2 (“set host vlan” on page 7-21) set snmp community private (“set snmp community” on page 5-14) (Optional) show snmp community (“show snmp community” on page 5-13) To do this. set port vlan fe. To create a secure management VLAN.1 untagged (“set vlan egress” on page 7-16) clear vlan egress 1 fe. It also makes management secure by preventing configuration via ports  assigned to other VLANs. Add the desired switch port to the egress list for the VLAN created in Step 1... Assign host status to the VLAN. Refer to page. it may be desirable to  configure a management‐only VLAN..1. 5. set vlan create 2 (“set vlan” on page 7-5) (Optional) show vlan 2 (“show vlan” on page 7-3) Set the PVID to the new VLAN. 7-2 802. 4. Add the port to the new VLAN’s egress list. This allows a station connected to the management VLAN  to manage the device.1 2 (“set port vlan” on page 7-9) set vlan egress 2 fe.

Viewing VLANs Viewing VLANs Purpose To display a list of VLANs currently configured on the device. to determine how one or more  VLANs were created. Only ports  that use a specified VLAN as their default VLAN (PVID) will be displayed. Ports that won’t include a VLAN tag in their transmitted frames are listed as untagged  ports. read‐only. Example This example shows how to display information for VLAN 1.. the ports allowed and disallowed to transmit traffic belonging to VLAN(s). For information about. In this case. VLAN 1 is named  “DEFAULT VLAN”. (Optional) Displays port information for one or more VLANs. The default VLAN. vlan‐list  portinfo  vlan vlan‐list |  vlan‐name port port‐string Defaults If no options are specified. or the WebView management application. Mode Switch command. 7-3 show vlan Use this command to display all information related to one or more VLANs. Static VLANs are  manually created using the set vlan command (“set vlan” on page 7‐5). There are no forbidden ports (prevented from transmitted frames) on VLAN 1: SecureStack A2 Configuration Guide 7-3 . Ports allowed to transmit frames belonging to VLAN 1 are listed as egress  ports. show vlan Refer to page. (Optional) Displays port information for one or more ports..  VLAN 1..  and if those ports will transmit the traffic with a VLAN tag included.  (Optional) Displays VLAN attributes related to one or more ports. is always statically configured and can’t be deleted. Commands The command used to view VLANs is listed below. all information related to static and dynamic VLANs will be displayed. Syntax show vlan [static] [vlan-list] [portinfo [vlan vlan-list | vlan-name] [port portstring]] Parameters static (Optional) Displays information related to static VLANs. (Optional) Displays information for a specific VLAN or range of VLANs..  SNMP MIBs.

1-4. 7-4 802.1-10.3. Forbidden Egress Ports None. Whether it is permanent (static) or dynamic. fe.1Q VLAN Configuration . Whether it is enabled or disabled.1.2.1-10.. Table 7‐2 provides an explanation of the command output. VLAN ID. Ports prevented from transmitted frames for this VLAN. Ports configured to transmit untagged frames for this VLAN. fe. Table 7-2 Output VLAN NAME Status VLAN Type Egress Ports Forbidden Egress Ports Untagged Ports show vlan Output Details What It Displays.1.1-4. ge..1-7. Name assigned to the VLAN.1-7. Ports configured to transmit frames for this VLAN.3. ge.show vlan A2(su)->show vlan 1 VLAN: 1 NAME: DEFAULT VLAN VLAN Type: Default Egress Ports fe. Untagged Ports fe.2.

 enabled or disabled. Specifies one or more VLAN IDs to be created. Mode Switch command. 7-5 7-6 7-6 7-7 set vlan Use this command to create a new static IEEE 802. Enter the VLAN ID using a unique number between 1 and 4093. If a duplicate VLAN ID is entered.  Syntax set vlan {create | enable | disable} vlan-list Parameters create | enable |  disable vlan‐list Creates. or to enable or disable an existing  VLAN.Creating and Naming Static VLANs Creating and Naming Static VLANs Purpose To create a new static VLAN. The VLAN IDs of 0 and 4094 and  higher may not be used for user‐defined VLANs.. read‐write. set vlan set vlan name clear vlan clear vlan name Refer to page.. Usage Once a VLAN is created.1Q VLAN.. For information about. or to enable or disable existing VLAN(s). enables or disables VLAN(s).. the device assumes that the  Administrator intends to modify the existing VLAN. Commands The commands used to create and name static VLANs are listed below. SecureStack A2 Configuration Guide 7-5 . Defaults None. you can assign it a name using the set vlan name command described in  “set vlan name” on page 7‐6. Each VLAN ID must be unique.

  Syntax set vlan name vlan-list vlan-name Parameters vlan‐list vlan‐name Specifies the VLAN ID of the VLAN(s) to be named. read‐write. Example This example shows how to set the name for VLAN 7 to green: A2(su)->set vlan name 7 green clear vlan Use this command to remove a static VLAN from the list of VLANs recognized by the device. Defaults None. Syntax clear vlan vlan-list Parameters vlan‐list Specifies the VLAN ID of the VLAN(s) to be removed. Mode Switch command. 7-6 802.1Q VLAN Configuration . read‐write. Mode Switch command. Specifies the string used as the name of the VLAN (1 to 32 characters).set vlan name Examples This example shows how to create VLAN 3: A2(su)->set vlan create 3 This example shows how to disable VLAN 3: A2(su)->set vlan disable 3 set vlan name Use this command to set or change the ASCII name for a new or existing VLAN.  Defaults None.

 read‐write. Defaults None.clear vlan name Example This example shows how to remove a static VLAN 9 from the device’s VLAN list: A2(su)->clear vlan 9 clear vlan name Use this command to remove the name of a VLAN from the VLAN list. Example This example shows how to clear the name for VLAN 9: A2(su)->clear vlan name 9 SecureStack A2 Configuration Guide 7-7 . Syntax clear vlan name vlan-list Parameters vlan‐list  Specifies the VLAN ID of the VLAN(s) for which the name will be cleared. Mode Switch command.

Example This example shows how to display PVIDs assigned to Fast Ethernet ports 1 through 6 in unit 2. show port vlan set port vlan clear port vlan show port ingress filter set port ingress filter show port discard set port discard Refer to page.2. For information about. Mode Switch command. In  this case.Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Purpose To assign default VLAN IDs to untagged frames on one or more ports.1 is set to 1 fe.1Q VLAN Configuration .  Commands The commands used to configure port VLAN IDs and ingress filtering are listed below... port VLAN information for all ports will be displayed. refer to “Port String Syntax Used  in the CLI” on page 4‐2. For a detailed  description of possible port‐string values.. read‐only.2 is set to 1 7-8 802.2. Defaults If port ‐string is not specified..2. PVID determines the  VLAN to which all untagged frames received on one or more ports will be classified. 7-8 7-9 7-10 7-10 7-11 7-12 7-13 show port vlan Use this command to display port VLAN identifier (PVID) information. untagged frames received on these ports will be classified to VLAN 1: A2(su)->show port vlan fe. and to set the frame discard mode.1-6 fe. Syntax show port vlan [port-string] Parameters port‐string (Optional) Displays PVID information for specific port(s). to configure VLAN ingress  filtering and constraints.

 For a detailed  description of possible port‐string values. (Optional) Does not prompt for or make egress list changes.2.set port vlan fe.1.10 4 A2(su)->set vlan 4 create A2(su)->set vlan egress 4 fe. Mode Switch command.5 fe.1. Specifies the VLAN ID of the VLAN to which port(s) will be added.10 is added to VLAN 4’s  untagged egress list. Example This example shows how to add Fast Ethernet port 10 in unit 1 to the port VLAN list of VLAN 4  (PVID 4). If the specified  VLAN has not already been created. Since VLAN 4 is a new VLAN.3 fe.10 untagged A2(su)->clear vlan egress 1 fe.4 fe.6 is is is is set set set set to to to to 1 1 1 1 set port vlan Use this command to configure the PVID (port VLAN identifier) for one or more ports.1. Then port fe. The port must then be cleared from the egress list of VLAN 1 (the default  VLAN) as shown: A2(su)->set port vlan fe. (Optional) Adds port(s) to VLANʹs untagged egress list and removes them  from other untagged egress lists. it is created. read‐write. Usage The PVID is used to classify untagged frames as they ingress into a given port.10 SecureStack A2 Configuration Guide 7-9 . pvid modify‐egress no‐modify‐egress Defaults None.  Syntax set port vlan port-string pvid [modify-egress | no-modify-egress] Parameters port‐string Specifies the port(s) for which to configure a VLAN identifier.2. It will prompt the user to add the  VLAN to the port’s egress list as untagged.1.2. refer to “Port String Syntax Used  in the CLI” on page 4‐2. and to remove the default VLAN from the port’s egress  list.2. this command will create it.

 read‐only.clear port vlan clear port vlan Use this command to reset a port’s 802. the ports are disabled for ingress filtering: 7-10 802. Example This example shows how to display the port ingress filter status for Fast Ethernet ports 10 through  15 in unit 1. In this case. For a detailed  description of possible port‐string values. refer to “Port String Syntax Used  in the CLI” on page 4‐2. Syntax clear port vlan port-string Parameters port‐string Specifies the port(s) to be reset to the host VLAN ID 1. Syntax show port ingress-filter [port-string] Parameters port‐string (Optional) Specifies the port(s) for which to display ingress filtering status.3-11 show port ingress filter Use this command to show all ports that are enabled for port ingress filtering. Mode Switch command.1. refer to “Port String  Syntax Used in the CLI” on page 4‐2.3 through 11 to a VLAN ID of 1 (Host VLAN): A2(su)->clear port vlan fe.  For a detailed description of possible port‐string values. Mode Switch command. If the VLAN ID specified in the  received frame is not on the port’s VLAN egress list.1. Defaults If port‐string is not specified. ingress filtering status for all ports will be displayed. Defaults None. which limits  incoming VLAN ID frames according to a port VLAN egress list. read‐write. Example This example shows how to reset ports fe. then that frame is dropped and not  forwarded.1Q port VLAN ID (PVID) to the host VLAN ID 1.1Q VLAN Configuration .

--------fe.13 disabled fe.1.14 disabled fe. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Example This example shows how to enable port ingress filtering on fe.3 enable SecureStack A2 Configuration Guide 7-11 .1. Mode Switch command.1.3: A2(su)->set port ingress-filter fe.10 disabled fe. Ingress filtering is implemented according to the IEEE 802.10-15 Port State -------.  Syntax set port ingress-filter port-string {disable | enable} Parameters port‐string Specifies the port(s) on which to enable of disable ingress filtering. disable | enable Defaults None.1. read‐write. For a  detailed description of possible port‐string values.1.1.11 disabled fe. the VLAN IDs of incoming frames are compared to the  port’s egress list. If the received VLAN ID does not match a VLAN ID on the port’s egress list.1.1Q standard.15 disabled set port ingress filter Use this command to discard all frames received with a VLAN ID that don’t match the port’s  VLAN egress list. Usage When ingress filtering is enabled on a port.1. then  the frame is dropped. Disables or enables ingress filtering.1.set port ingress filter A2(su)->show port ingress-filter fe.12 disabled fe.

7 Port Discard Mode -----------.2. read‐only.show port discard show port discard Use this command to display the frame discard mode for one or more ports. frame discard mode will be displayed for all ports. Defaults If port-string is not specified.1Q VLAN Configuration . In  this case.2.------------fe. or neither. For a  detailed description of possible port‐string values.7 tagged 7-12 802. Syntax show port discard [port-string] Parameters port‐string (Optional) Displays the frame discard mode for specific port(s). They can also be set to  discard both tagged and untagged frames. Example This example shows how to display the frame discard mode for Fast Ethernet port 7 in unit 2. the port has been set to discard all tagged frames: A2(su)->show port discard fe. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Ports can be set to  discard frames based on whether or not the frame contains a VLAN tag. Mode Switch command.

  Syntax set port discard port-string {tagged | untagged | both | none} Parameters port‐string Specifies the port(s) for which to set frame discard mode. Typically an Administrator does  not want the end users defining what VLAN they use for communication. A common practice is to discard all tagged packet on user ports.set port discard set port discard Use this command to set the frame discard mode on one or more ports. Tagged ‐ Discard all incoming (received) tagged packets on the defined  port(s). None ‐ No packets will be discarded. Example This example shows how to discard all tagged frames received on port ge. For a detailed  description of possible port‐string values. all incoming untagged frames. Untagged ‐ Discard all incoming untagged packets. refer to “Port String Syntax Used  in the CLI” on page 4‐2.3: A2(su)->set port discard ge. Usage The options are to discard all incoming tagged frames.3.3. neither  (essentially allow all traffic). Mode Switch command. tagged |  • untagged | both |  none • • • Defaults None. or both (essentially discarding all traffic). read‐write.3 tagged SecureStack A2 Configuration Guide 7-13 . Both ‐ All traffic will be discarded (tagged and untagged).

  Setting a port to forbidden prevents it from participating in the specified VLAN and ensures that  any dynamic requests (either through GVRP or dynamic egress) for the port to join the VLAN will  be ignored. This  setting is usually used to configure a port connected to an end user device. or untagged. In general. This determines which ports on  the switch will be eligible to transmit frames for a particular VLAN.. VLANs  have no egress (except for VLAN 1) until they are configured by static administration. For information about.. ports 1. Frames sent between  VLAN aware switches are typically tagged...8.Configuring the VLAN Egress List Configuring the VLAN Egress List Purpose To assign or remove ports on the egress list of a particular VLAN. 7. 8  could be allowed to transmit frames belonging to VLAN 20 and ports 7. For example. Setting a port to untagged allows it to transmit frames without a tag header. The default VLAN defaults its egress to untagged for all ports. Commands The commands used to configure VLAN egress and dynamic VLAN egress are listed below. 9. Note  that the Port Egress list for ports 7 and 8 would contain both VLAN 20 and 30. 10 could be allowed to  transmit frames tagged with VLAN 30 (a port can belong to multiple VLAN Egress lists). forbidden.1Q VLAN Configuration . The port egress type for all ports can be set to tagged. 5. or through  dynamic mechanisms such as GVRP. show port egress set vlan forbidden set vlan egress clear vlan egress show vlan dynamicegress set vlan dynamicegress Refer to page. 7-15 7-15 7-16 7-17 7-18 7-19 7-14 802.

3 1 tagged static fe. SecureStack A2 Configuration Guide 7-15 .1. read‐write. For a detailed  description of possible port‐string values.2 10 untagged static fe. Specifies the port(s) to set as forbidden for the specified vlan‐id.1. Defaults If port‐string is not specified.show port egress show port egress Use this command to display the VLAN membership for one or more ports.1.1.1 1 tagged static fe. Syntax show port egress [port-string] Parameters port‐string (Optional) Displays VLAN membership for specific port(s).  Example This example shows you how to show VLAN egress information for fe.1-3 Port Vlan Egress Registration Number Id Status Status ------------------------------------------------------fe.1. This setting  instructs the device to ignore dynamic requests (either through GVRP or dynamic egress) for the  port to join the VLAN.2 1 tagged static fe. Mode Switch command.1.1 10 untagged static fe.1 through 3. VLAN membership will be displayed for all ports.  Defaults None.3 10 untagged static set vlan forbidden Use this command to prevent one or more ports from participating in a VLAN. refer to “Port String Syntax Used  in the CLI” on page 4‐2.1. In this case. Both are static VLANs: A2(su)->show port egress fe.1.  all three ports are allowed to transmit VLAN 1 frames as tagged and VLAN 10 frames as  untagged. Syntax set vlan forbidden vlan-id port-string Parameters vlan‐id port‐string Specifies the VLAN for which to set forbidden port(s).

set vlan egress Mode Switch command.5-10 This example shows how to forbid Fast Ethernet ports 13 through 15 in unit 1 from joining VLAN  7 and disallow egress on those ports: A2(su)->set vlan egress 7 fe. tagged — Causes the port(s) to transmit 802.3 to forbidden for VLAN 6: A2(su)->set vlan forbidden 6 fe.5 through 10 to the egress list of VLAN 7. Syntax set vlan egress vlan-list port-string [untagged | forbidden | tagged] Parameters vlan‐list port‐string Specifies the VLAN where a port(s) will be added to the egress list. or to prevent one or more  ports from participating in a VLAN. Example This example shows you how to set fe.1. refer to  “Port String Syntax Used in the CLI” on page 4‐2. forbidden or tagged is not specified.1Q tagged frames. the port will be added to the VLAN egress list  as tagged. This determines which ports will transmit frames for a  particular VLAN. (Optional) Adds the specified ports as:  • • untagged — Causes the port(s) to transmit frames without an IEEE  802. Specifies one or more ports to add to the VLAN egress list of the specified  vlan‐list.13-15 forbidden 7-16 802. read‐write.1.3 set vlan egress Use this command to add ports to the VLAN egress list for the device.  forbidden — Instructs the device to ignore dynamic requests (either  through GVRP or dynamic egress) from the port(s) to join the VLAN  and disallows egress on that port.1Q header tag.1. For a detailed description of possible port‐string values.1. Examples This example shows how to add fe. untagged |  forbidden |  tagged • Defaults If untagged.1. read‐write.1Q VLAN Configuration . This means that  these ports will transmit VLAN 7 frames as tagged: A2(su)->set vlan egress 7 fe. Mode Switch command.

2. read‐write. Mode Switch command.  refer to “Port String Syntax Used in the CLI” on page 4‐2.3.3. For a detailed description of possible port‐string values. Examples This example shows how to remove fe. Specifies one or more ports to be removed from the VLAN egress list of the  specified vlan‐list.14 from the egress list of VLAN 9: A2(su)->clear vlan egress 9 fe. (Optional) Clears the forbidden setting from the specified port(s) and resets  the port(s) as able to egress frames if so configured by either static or  dynamic means. tagged and untagged settings will be cleared. Syntax clear vlan egress vlan-list port-string [forbidden] Parameters vlan‐list port‐string Specifies the number of the VLAN from which a port(s) will be removed  from the egress list.1.14 This example shows how to remove all Fast Ethernet ports in unit 2 from the egress list of VLAN  4: A2(su)->clear vlan egress 4 fe. forbidden Defaults If forbidden is not specified.2 untagged clear vlan egress Use this command to remove ports from a VLAN’s egress list.* SecureStack A2 Configuration Guide 7-17 .clear vlan egress This example shows how to allow Fast Ethernet port 2 in unit 1 to transmit VLAN 7 frames as  untagged: A2(su)->set vlan egress 7 fe.

1Q VLAN Configuration . the dynamic egress status for all VLANs will be displayed. read‐write. Mode Switch command. Example This example shows how to display the dynamic egress status for VLANs 50‐55: A2(rw)->show vlan dynamicegress 50-55 VLAN 50 is disabled VLAN 51 is disabled VLAN 52 is disabled VLAN 53 is enabled VLAN 54 is enabled VLAN 55 is enabled 7-18 802. Defaults If vlan‐list is not specified. Syntax show vlan dynamicegress [vlan-list] Parameters vlan‐list (Optional) Displays dynamic egress status for specific VLAN(s).show vlan dynamicegress show vlan dynamicegress Use this command to display the status of dynamic egress (enabled or disabled) for one or more  VLANs.

 the switch  will tag the packet to VLAN 55 and also add port ge. For example. Enables or disables dynamic egress.3. you enable dynamic egress for VLAN 55.5 to VLAN 55’s egress list.  Now. when an AppleTalk user plugs into port ge. the switch will add the receiving port to that VLAN’s egress list. which allows the  AppleTalk user to receive AppleTalk traffic. Then.3. assume you have 20 AppleTalk users on your network who are mobile users (that is.set vlan dynamicegress set vlan dynamicegress Use this command to administratively set the dynamic egress status for one or more VLANs. You can create an AppleTalk VLAN with a VLAN ID of 55 with a classification rule that all  AppleTalk traffic gets tagged with VLAN ID 55.  Syntax set vlan dynamicegress vlan-list {enable | disable} Parameters vlan‐list enable | disable Specify the VLANs by ID to enable or disable dynamic egress. but you want to keep the AppleTalk traffic isolated in its own  VLAN. read‐write. Usage If dynamic egress is enabled for a particular VLAN. Dynamic egress is  disabled on the SecureStack A2 by default. Example This example shows how to enable dynamic egress on VLAN 55: A2(rw)->set vlan dynamicegress 55 enable SecureStack A2 Configuration Guide 7-19 . Mode Switch command.5 and sends an AppleTalk packet.  use different ports every day). Defaults None. when a port receives a frame tagged with that  VLAN’s ID.

. 7-20 802. read‐only. For information about. Example This example shows how to display the host VLAN: A2(su)->show host vlan Host vlan is 7.1Q VLAN Configuration .. Commands The commands needed to configure host VLANs are listed below.. show host vlan set host vlan clear host vlan Refer to page. This secures the host port  for management‐only tasks.. Defaults None. 7-20 7-21 7-22 show host vlan Use this command to display the current host VLAN. Mode Switch command.  Syntax show host vlan Parameters None.  Note: The host port is the management entity of the device. Refer to “Creating a Secure Management VLAN” on page 7-1 for more information.Setting the Host VLAN Setting the Host VLAN Purpose To configure a host VLAN that only select devices are allowed to access.

  Defaults None. you must create a VLAN using the set of commands described in “Creating and Naming Static VLANs” on page 7-5. This would allow a  management station connected to the management VLAN to manage all ports on the device and  make management secure by preventing management via ports assigned to other VLANs.set host vlan set host vlan Use this command to assign host status to a VLAN. a host VLAN could be specifically created for device management. Mode Switch command. read‐write. Note: Before you can designate a VLAN as the host VLAN. Usage The host VLAN should be a secure VLAN where only designated users are allowed access.  Syntax set host vlan vlan-id Parameters vlan‐id Specifies the number of the VLAN to set as the host VLAN. Example This example shows how to set VLAN 7 as the host VLAN: A2(su)->set host vlan 7 SecureStack A2 Configuration Guide 7-21 . For  example.

Syntax clear host vlan Parameters None.clear host vlan clear host vlan Use this command to reset the host VLAN to the default setting of 1. Example This example shows how to set the host VLAN to the default setting: A2(su)->clear host vlan 7-22 802. read‐write. Defaults None.1Q VLAN Configuration . Mode Switch command.

 However.  How It Works In Figure 7‐1 on page 7‐24. SecureStack A2 Configuration Guide 7-23 . which is connected to Switch 3 and Switch 5 declares  the same information to those two devices and the port egress list of each port is updated with the  new information. port 1 and Switch 2. if switches are disconnected or if end stations are removed. the registered information  remains accurate. GVRP then creates the VLANs and adds the  receiving port to its tagged member list for the extracted VLAN ID (s). A switch that receives this frame. This ensures  that. and extracts the VLAN IDs. When a VLAN  is declared. These two devices  register this in the port egress lists of the ports (Switch 1. The entry will always  remain registered and will not time out. dynamic entries will time‐out and their  registrations will be removed from the member list if the end station A is removed. the information is transmitted out GVRP configured ports on the device in a GARP  formatted frame using the GVRP multicast MAC address. Switch 2. port 1) that received  the frames with the information.  examines the frame. Figure 7‐1 shows an example of  how VLAN blue from end station A would be propagated across a switch network. Switch 4. The information is then  transmitted out the other GVRP configured ports of the device. port 1 is registered as being a member of VLAN Blue and  then declares this fact out all its ports (2 and 3) to Switch 1 and Switch 2. Configuring a VLAN on an 802.1Q switch creates a static VLAN entry. even if the actual station on the VLAN is several hops away.Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Enabling/Disabling GVRP (GARP VLAN Registration Protocol) About GARP VLAN Registration Protocol (GVRP) The following sections describe the device operation when its ports are operating under the  Generic Attribute Registration Protocol (GARP) application – GARP VLAN Registration Protocol  (GVRP). The end result is that the port egress list of a port is updated with information about VLANs that  reside on that port. accordingly. Overview The purpose of GVRP is to dynamically create VLANs across a switched network.

show gvrp show garp timer set gvrp clear gvrp set garp timer Refer to page. individual port  settings (enable or disable) and timer settings.. The GVRP command set is used to  display GVRP configuration information. GVRP is enabled globally on the device.  Commands The commands used to configure GVRP are listed below. 7-25 7-25 7-27 7-27 7-28 7-24 802. By default. the current global GVRP state setting..  but disabled on all ports.1Q VLAN Configuration . For information about..Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Figure 7-1 Example of VLAN Propagation via GVRP Switch 2 Switch 3 1 Switch 1 R 2D 3 D 1 R 1 R 2 End Station A D 3 D Switch 4 1 R Switch 5 1 R R D = Port registered as a member of VLAN Blue = Port declaring VLAN Blue Purpose To dynamically create VLANs across a switched network..

Example This example shows how to display GVRP status for the device and for fw. For a  detailed description of possible port‐string values.1 GVRP status ----------disabled show garp timer Use this command to display GARP timer values for one or more ports.2.2. Syntax show gvrp [port-string] Parameters port‐string (Optional) Displays GVRP configuration information for specific port(s).show gvrp show gvrp Use this command to display GVRP configuration information.1: A2(su)->show gvrp fe. Mode Switch command. refer to “Port String  Syntax Used in the CLI” on page 4‐2.1 Global GVRP status is enabled. Port Number ----------fe. read‐only. Mode Switch command. GVRP configuration information will be displayed for all ports and  the device.2. GARP timer information will be displayed for all ports. Syntax show garp timer [port-string] Parameters port‐string (Optional) Displays GARP timer information for specific port(s). Defaults If port‐string is not specified. For  a detailed description of possible port‐string values. read‐only. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Defaults If port‐string is not specified. SecureStack A2 Configuration Guide 7-25 .

---------.10 20 60 1000 Table 7‐3 provides an explanation of the command output. leave.7 20 60 1000 fe. Join timer setting.9 20 60 1000 fe. Leavall timer setting.1Q documentation.6 20 60 1000 fe. refer to “Port String Syntax Used in the CLI” on page 4-2. refer to “set gvrp” on page 7‐27. Port designation.3 20 60 1000 fe. refer to the standard IEEE 802.1-10 Port based GARP Configuration: (Timer units are centiseconds) Port Number Join Leave Leaveall ----------.1.1.1Q VLAN Configuration .8 20 60 1000 fe.5 20 60 1000 fe. A2(su)->show garp timer fe.1 20 60 1000 fe. which is not supplied with this device.1.---------fe. For details on using the set gvrp  command to enable or disable GVRP.1.1.4 20 60 1000 fe.1. Table 7-3 Output Port Number Join Leave Leaveall show gvrp configuration Output Details What It Displays.. refer to “set garp timer” on page 7‐28.---------.1.1..show garp timer Example This example shows how to display GARP timer information on Fast Ethernet ports 1 through 10  in unit 1: Note: For a functional description of the terms join.2 20 60 1000 fe.1. Leave timer setting. and leaveall timers.1.1. 7-26 802. For details on using the set  garp timer command to change default timer values. For a detailed description of possible port-string values.

 refer to “Port String Syntax Used in the CLI” on  page 4‐2. Mode Switch command. For a detailed description of  possible port‐string values.1. Examples This example shows how to enable GVRP globally on the device: A2(su)->set gvrp enable This example shows how to disable GVRP globally on the device: A2(su)->set gvrp disable This example shows how to enable GVRP on fe. For a detailed  description of possible port‐string values.set gvrp set gvrp Use this command to enable or disable GVRP globally on the device or on one or more ports. Syntax clear gvrp [port-string] Parameters port‐string (Optional) Clears GVRP status on specific port(s). read‐write. Mode Switch command. Defaults If port‐string is not specified. SecureStack A2 Configuration Guide 7-27 .1. Syntax set gvrp {enable | disable} [port-string] Parameters disable |  enable port‐string Disables or enables GVRP on the device. GVRP will be disabled or enabled for all ports.3: A2(su)->set gvrp enable fe. read‐write.3 clear gvrp Use this command to clear GVRP status or on one or more ports. refer to “Port String Syntax Used in  the CLI” on page 4‐2. (Optional) Disables or enables GVRP on specific port(s). GVRP status will be cleared for all ports. Defaults If port‐string is not specified.

1Q standard.* This example shows how to set the leaveall timer value to 20000 centiseconds for all ports: A2(su)->set garp timer leaveall 20000 *. Usage The setting of these timers is critical and should only be changed by personnel familiar with the  802.1Q standards documentation. leave.set garp timer Example This example shows how to clear GVRP status globally on the device: A2(su)->clear gvrp set garp timer Use this command to adjust the values of the join. Mode Switch command. and leaveall timers.* This example shows how to set the leave timer value to 300 centiseconds for all ports: A2(su)->set garp timer leave 300 *.) Specifies the port(s) on which to configure GARP timer settings.) Sets the GARP leave timer in centiseconds (Refer to 802. which is not supplied with this device.) Sets the GARP leaveall timer in centiseconds (Refer to 802.*.1Q standard. read‐write.*.  Syntax set garp timer {[join timer-value] [leave timer-value] [leaveall timer-value]} port-string Parameters join timer‐value leave timer‐value leaveall timer‐ value port‐string Sets the GARP join timer in centiseconds (Refer to 802. For a  detailed description of possible port‐string values.1Q VLAN Configuration .1Q standard. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Examples This example shows how to set the GARP join timer value to 100 centiseconds for all ports: A2(su)->set garp timer join 100 *.* 7-28 802.*. Defaults None.

. Assign or unassign ports to Diffserv policies so that only ports activated for a policy will be  allowed to transmit frames accordingly. Refer to page .  SecureStack A2 devices support Diffserv policy‐based provisioning of network resources by  allowing IT administrators to: • • • Create.... 8-2 8-3 8-10 8-17 For information about .8 Differentiated Services Configuration This chapter describes the Differentiated Services (Diffserv) set of commands and how to use  them. Prioritize and police traffic according to assigned policies and conditions. Globally Enabling or Disabling Diffserv Creating Diffserv Classes and Matching Conditions Configuring Diffserv Policies and Assigning Classes Assigning Policies to Service Ports SecureStack A2 Configuration Guide 8-1 . change or remove Diffserv policies based on business‐specific use of network services.

 By default. Example This example shows how to enable Diffserv:  A2(rw)->set diffserv adminmode enable 8-2 Differentiated Services Configuration .. Command The command used to globally enable or disable Diffserv on the device is listed below and  described in the associated section as shown. read‐write.. set diffserv adminmode Refer to page. 8‐2 set diffserv adminmode Use this command to globally enable or disable Diffserv on the device. Mode Switch command. Defaults None. Syntax set diffserv adminmode {enable | disable} Parameters enable | disable  Enables or disables Diffserv. this function is  disabled at device startup.. For information about.Globally Enabling or Disabling Diffserv Globally Enabling or Disabling Diffserv Purpose To globally enable or disable Diffserv on the device..

......... Mode Switch command... Class Rule Table Size Current/Max.... show diffserv info show diffserv class set diffserv class create set diffserv class delete set diffserv class match set diffserv class rename Refer to page.................. create.......... Commands The commands used to review..... Enable 0 / 25 0 / 150 0 / 12 0 / 120 0 / 120 0 / 48 SecureStack A2 Configuration Guide 8-3 . read‐only..... Policy Instance Table Size Current/Max.. and configure Diffserv classes and matching conditions..... Class Table Size Current/Max......... 8-3 8-4 8-4 8-5 8-6 8-9 show diffserv info Use this command to display general Diffserv status information...... Example This example shows how to display general Diffserv status information:  A2(rw)->show diffserv info DiffServ Admin Mode............... and configure Diffserv classes and matching conditions are  listed below and described in the associated section as shown... create. Defaults None. Policy Table Size Current/Max..... Policy Attribute Table Size Current/Max. For information about... Service Table Size Current/Max....Creating Diffserv Classes and Matching Conditions Creating Diffserv Classes and Matching Conditions Purpose To review............. Syntax show diffserv info Parameters None........

Syntax set diffserv class create {all classname} Parameters all classname Specifies that all match conditions must be met before the associated policy  is executed. read‐write. Specifies a class name for this new Diffserv class.------------------------------guest All admin All set class create Use this command to create a new Diffserv class. there  are two classes configured. read‐only. Defaults None. 8-4 Differentiated Services Configuration . detailed classname Displays detailed Diffserv information for a specific class. Syntax show diffserv class {summary | detailed classname} Parameters summary  Displays a summary of Diffserv class information.-----------. named “guest” and “admin”:  A2(rw)->show diffserv class summary Class Name Class Type Ref Class Name ----------------. Mode Switch command. Example This example shows how to display a summary of Diffserv class information.show diffserv class show diffserv class Use this command to display information about Diffserv classes. Defaults None. In this case. Mode Switch command.

Syntax set diffserv class delete classname Parameters classname Specifies the class name to be deleted. then Remove the specified class using the set diffserv policy class remove command (page 8‐12). Usage You cannot use this command to delete a class that has been assigned to a policy. Before deleting a  class with an assigned policy and service port(s). you must first: • • Remove the service port(s) assigned to the policy using the set diffserv service remove  command (page 8‐19). Defaults None.set diffserv class delete Example This example shows how to create a Diffserv class called “admin”:  A2(rw)->set diffserv class create all admin set diffserv class delete Use this command to delete a Diffserv class and remove any match assigned to the class. Example This example shows how to delete the Diffserv “admin” class:  A2(rw)->set diffserv class delete admin SecureStack A2 Configuration Guide 8-5 . read‐write. Mode Switch command.

Matches to a specific class based on destination or source layer 4  port number or keyword. 3. dstmac | scrmac classname  Matches to a specific class based on destination or source MAC  macaddr macmask address. and 4 packet  parameters. Valid tosmask  values are 1 ‐ 8.  set diffserv class match {[every classname] [dstmac | scrmac classname macaddr macmask] [dstip | srcip classname ipaddr ipmask] [dstl4port | srcl4port{keyword classname keyword | number classname portnumber}] [ipdscp classname dscpval] [ipprecedence classname precedencenumber] [iptos classname tosbits tosmask] [protocol {keyword classname protocol-name | number classname protocol-number}] [refclass {add | remove}{classname refclassname}] [vlan classname vlanid]} Parameters every classname Matches all packets to a specific class. Matches to a specific class based on the value of the IP precedence  field. Matches to a specific class based on the value of the IP type of  service (TOS) field.  Matches to a specific class based on the value of the IP Diffserv  Code Point. Valid keyword values are: • • • • • • • • • • ipdscp classname dscpval domain echo ftp ftpdata http smtp snmp telnet tftp www Valid portnumber values are 0 ‐ 65535. ipprecedence classname  precedencenumber iptos classname tosbits  tosmask 8-6 Differentiated Services Configuration .set diffserv class match set diffserv class match Use this command to match a Diffserv class to a service condition based on layer 2. Valid tosbits values are 0 ‐ 255. dstip | srcip classname  ipaddr ipmask dstl4port | srcl4port  keyword classname  keyword | number  classname portnumber Matches to a specific class based on destination or source IP  address. Valid numeric or keyword values can be entered as  listed in Table 8‐1 below. Valid precedencenumber values are: 0 ‐ 7.

af33 (Assured Forwarding) af41.20. Mode Switch command.24. af22.36. af32. af42.14 18. Valid values are 1‐  4094. Usage Any policy that is applied must be composed of rules that come from only one of the following  four groups. Matches to a specific class based on VLAN ID.40.cs7 (Class Selector PHB) af11.12. af12. af13 (Assured Forwarding) af21.16. af43 (Assured Forwarding) ef (Expedited Forwarding) Code Point Map b'000000 b'xxx000 b'001xx0 b'010xx0 b'011xx0 b'100xx0 b'101110 Defaults None. Valid protocol‐name keyword are: classname protocol‐name |  number classname protocol‐ • icmp number • igmp • • • refclass add | remove  classname refclassname vlan classname vlanid ip tcp udp Valid protocol‐number values are 0 ‐ 255.22 26. Table 8-1 Valid IP DSCP Numeric and Keyword Values Numeric Value 0 0.30 34.28.  Adds or removes a set of already defined match conditions to a  specific class. af23 (Assured Forwarding) af31.set diffserv class match Matches to a specific class based on number or keyword in the IP  protocol keyword  protocol field. read‐write.38 46 Keyword (Usage) be (best effort) cs0 .48.32. • Layer 3: – – – – – – Destination IP address (dstip) Destination Layer 4 port (dstl4port) IP Diffserv Code Point (ipdscp) IP precedence field (ipprecedence) IP type of service (TOS) field (iptos) IP protocol field (protocol) SecureStack A2 Configuration Guide 8-7 .56 10.8.

 The layer 4 port match must precede the protocol type. A2(rw)->set diffserv class match dstl4port keyword http http A2(rw)->set diffserv class match protocol keyword http tcp 8-8 Differentiated Services Configuration .32 and only  that IP address type:  A2(rw)->set diffserv class match srcip admin 130.  Class matches of layer 4 destination or source must be sequenced before the corresponding  protocol match.  Examples This example shows how to match the “admin” class to source IP address 130.set diffserv class match – – • Source IP address (srcip) Source Layer 4 port (srcl4port) Layer 2: – – – Destination MAC address (dstmac) Source MAC address (scrmac) VLAN ID (vlan) • Layer 2 Layer 3 source: – – – Source MAC address (scrmac) Source IP address (srcip) VLAN ID (vlan) • Layer 2 Layer 3 destination: – – – Destination MAC address (dstmac) Destination IP address (dstip) VLAN ID (vlan) Note: The match type every will work with any group. Once a class is added to a policy. You cannot create and add a class to a policy before adding any rules (match conditions) to the  class. You cannot create outbound policies.32 255. as illustrated in the third example below. you cannot add any more rules (match conditions) to the  class.  You can only add rules that fit into the same category (shown in the groupings above) to a class. You can only add classes of the same category to a policy.10.0.255.  For example. if you create a class and add the match conditions dstip and dstl4port. you will only  be able to add other rules from the L3 group.255 This example shows how to match the “admin” class to VLAN 10:  A2(rw)->set diffserv class match vlan admin 10 This example shows how to match the ʺhttpʺ class to TCP packets with a destination port of 80  (HTTP).10.0.255.

Mode Switch command. Example This example shows how to rename the Diffserv “admin” class to “system”: A2(rw)->set diffserv class rename admin system SecureStack A2 Configuration Guide 8-9 . Syntax set diffserv class rename classname newclassname Parameters classname newclassname Specifies the class name previously set for this new Diffserv class.set diffserv class rename set diffserv class rename Use this command to change the name of a Diffserv class. Defaults None. Specifies a new class name. Read‐Write.

 and configure Diffserv policies and assign classes are listed  below and described in the associated section as shown... show diffserv policy set diffserv policy create set diffserv policy delete set diffserv policy class set diffserv policy mark set diffserv policy police style simple set diffserv policy police action conform set diffserv policy police action nonconform set diffserv policy rename Refer to page. 8-11 8-11 8-12 8-12 8-13 8-14 8-14 8-15 8-16 8-10 Differentiated Services Configuration . create. create..Configuring Diffserv Policies and Assigning Classes Configuring Diffserv Policies and Assigning Classes Purpose To review.. Commands The commands used to review. and configure Diffserv policies and assign classes. For information about.

SecureStack A2 Configuration Guide 8-11 . Defaults None. to which members of the “admin” class have been assigned.  Applies this policy to incoming packets. Example This example shows how to display a summary of Diffserv policy information.----------. Mode Switch command. read‐write. In this case. Syntax show diffserv policy {summary | detailed policyname} Parameters summary  detailed  policyname Displays Diffserv policy summary information.------------------------------admin In admin set diffserv policy create Use this command to create a new Diffserv policy. Syntax set diffserv policy create policyname {in} Parameters policyname in  Specifies a policy name. Defaults None. This  policy is applied to incoming traffic on its assigned service ports:  A2(rw)->show diffserv policy summary Policy Name Policy Type Class Members -------------------. there  is one policy named “admin”. Displays detailed Diffserv information for a specific policy. Read‐Only. Mode Switch command.show diffserv policy show diffserv policy Use this command to display information about Diffserv policies.

Mode Switch command. Syntax set diffserv policy class {add | remove} policyname classname Parameters add | remove policyname classname Adds or removes the specified class. read‐write. 8-12 Differentiated Services Configuration . Once added.  Specifies a class name to add or remove. Usage In order to delete a policy you must first remove the service port(s) assigned to the policy using  the set diffserv service remove command as described in “set diffserv service” on page 8‐19.set diffserv policy delete Example This example shows how to create a Diffserv policy called “admin” and apply it to incoming  packets:  A2(rw)->set diffserv policy create admin in set diffserv policy delete Use this command to delete a Diffserv policy.  Defaults None.  Specifies the policy name to be associated with the class. Syntax set diffserv policy delete policyname Parameters policyname Specifies a policy name to be deleted. Defaults None. policies  will be active for the specified class. Example This example shows how to delete the Diffserv “admin” policy:  A2(rw)->set diffserv policy delete admin set diffserv policy class Use this command to add or remove a Diffserv class to a specified policy.

 read‐write. Syntax set diffserv policy mark {ipdscp | ipprecedence policyname classname value} Parameters ipdscp |  ipprecedence policyname classname value Specifies that packets will be marked with either an IP DSCP or precedence  value. read‐write. Example This example shows how to add the “system” class to the “admin” policy:  A2(rw)->set diffserv policy class add admin system set diffserv policy mark Use this command to mark all packets for the associated Diffserv traffic stream with a specific IP  DSCP or IP precedence value. Example This example shows how to mark packets matching the “admin” policy in the “system” class for  DSCP expedited forwarding precedence:  A2(rw)->set diffserv policy mark ipdscp admin system ef SecureStack A2 Configuration Guide 8-13 . Specifies the policy name being configured. Usage Class must be added to a policy using this command before policy parameters. and policing. Valid precedence values are:  0 ‐ 7. such as  bandwidth. marking. Defaults None. can be configured.set diffserv policy mark Mode Switch command. Specifies an IP DSCP or precedence value.  Specifies a Diffserv class to associate to this policy. Valid numeric or keyword DCSP  values can be entered as listed in Section 8‐1. Mode Switch command.

 Valid values are 1 ‐ 4294967295. Defaults None.set diffserv policy police style simple set diffserv policy police style simple Use this command to establish the policing style for a Diffserv policy based only on bandwidth for  the specified class.  Specifies a Diffserv class to associate to this policing action. Specifies an IP DHCP or precedence value set with the set diffserv  policy mark command (page 8‐13). Specifies a bandwidth value. 8-14 Differentiated Services Configuration . markdscp | markprec  Specifies a policing action based on IP DHCP or precedence. Valid values are 1 ‐ 128. Example This example shows how to configure a bandwidth‐based policing style for the “admin” Diffserv  policy:  A2(rw)->set diffserv policy police style simple admin system 1000 128 set diffserv policy police action conform Use this command to configure traffic policing actions for packets that conform to associated  Diffserv classifications. Defaults None. Syntax set diffserv policy police action conform {drop | send policyname classname} | {markdscp | markprec policyname classname value} Parameters drop | send policyname classname value Specifies whether the policing action for packets conforming to the  classification parameters will be to drop or send packets. read‐write. Specifies the policy name being configured. Syntax set diffserv policy police style simple policyname classname bandwidth burstsize Parameters policyname classname bandwidth burstsize Specifies the policy name being configured. Specifies a burst size value. Mode Switch command.  Specifies a Diffserv class to associate to this policy.

” class “system. Mode Switch command. Specifies an IP DHCP or precedence value set with the set diffserv  policy mark command (page 8‐13).” class “system.” A2(rw)->set diffserv policy police action nonconform drop admin system SecureStack A2 Configuration Guide 8-15 . Specifies the policy name being configured. Example This example shows how to set the policing action to  send for packets conforming to Diffserv  policy “admin. Defaults None.  Specifies a Diffserv class to associate to this policing action.set diffserv policy police action nonconform Mode Switch command. read‐write. Example This example shows how to set the policying action to drop for packets not conforming to the  Diffserv policy “admin. Syntax set diffserv policy police action nonconform {drop | send policyname classname} | {markdscp | markprec policyname classname value} Parameters drop | send policyname classname value Specifies whether the policing action for packets not conforming to the  classification parameters will be to drop or send packets. read‐write. markdscp | markprec  Specifies a policing action based on IP DHCP or precedence.”  A2(rw)->set diffserv policy police action conform send admin system set diffserv policy police action nonconform Use this command to configure traffic policing actions for packets that do not conform to  associated Diffserv classifications.

Mode Switch command. Syntax set diffserv policy rename policyname newpolicyname Parameters policyname newpolicyname Specifies the policy name previously set for this new Diffserv class. Specifies a new policy name. Defaults None. read‐write. Example This example shows how to rename the “admin” Diffserv policy to “system”:  A2(rw)->set diffserv policy rename admin system 8-16 Differentiated Services Configuration .set diffserv policy rename set diffserv policy rename Use this command to change the name of a Diffserv policy.

. 8-17 8-18 8-19 show diffserv service info Use this command to display information about Diffserv service ports. Defaults None....1 In ge. read‐only.. Syntax show diffserv service info {summary | detailed port-string} {in} Parameters summary  detailed port‐string in Displays Diffserv service port summary information..... Commands The commands used to review and assign Diffserv policies to service ports are listed below and  described in the associated section as shown...1..1.... Enable Interface Direction ----------.3 In OperStatus ---------Up Up Up Policy Name ---------------------admin admin admin SecureStack A2 Configuration Guide 8-17 . Displays detailed information for a specific port(s)....1....Assigning Policies to Service Ports Assigning Policies to Service Ports Purpose To review and assign Diffserv policies and their associated classes to service ports.----------ge. Mode Switch command.. For information about... Example This example shows how to display a summary of incoming Diffserv service port traffic:  A2(rw)->show diffserv service info summary in DiffServ Admin Mode. Displays information about incoming traffic. show diffserv service info show diffserv service stats set diffserv service Refer to page.....2 In ge....

............. Defaults None. Syntax show diffserv service stats {summary | detailed port-string} {in} Parameters summary  detailed port‐string in Displays Diffserv a summary of service statistics...... Mode Switch command..........1 Direction.................... Up Policy Name......... read‐only...............................1:  A2(rw)->show diffserv service stats detailed ge.1.......... In Operational Status......................1 in Interface...1............ Displays information about incoming traffic. system In Discarded Packets........................ ge. Displays detailed statistics for a specific port.. 0 8-18 Differentiated Services Configuration ........1.....show diffserv service stats show diffserv service stats Use this command to display Diffserv policy service statistics............. admin Class Name........................ Example This example shows how to display a detailed incoming traffic statistics about service port ge...

1.  Defaults None. read‐write.  Adds or removes the specified policy to incoming traffic. Syntax set diffserv service {add | remove} {in} port-string policyname Parameters add | remove in  port‐string policyname Adds or removes the specified policy. Specifies the policy name to be added to or removed from port traffic.set diffserv service set diffserv service Use this command to add or remove a Diffserv policy to incoming traffic on one or more ports.1‐10:  A2(rw)->set diffserv service add in ge. Mode Switch command.5 admin SecureStack A2 Configuration Guide 8-19 . Specifies the port(s) to which this policy configuration will be applied. Example This example shows how to apply the Diffserv policy named “admin” to incoming traffic on ports  ge1.

set diffserv service 8-20 Differentiated Services Configuration .

 The higher priority traffic through the device is serviced first before lower priority  traffic. In addition. which allows you to assign mission‐ critical data to higher priority through the device by delaying less critical traffic during periods of  congestion. CoS-based classification rules will take precedence over priority settings configured with the set port priority command described in this section. A priority 0 through 7 can be set on each port.  For information about. SecureStack A2 Configuration Guide 9-1 . Port Priority Configuration Summary Configuring Port Priority Configuring Priority to Transmit Queue Mapping Configuring Quality of Service (QoS) Configuring Port Traffic Rate Limiting Refer to page. with 0 being the lowest priority. 9-1 9-2 9-5 9-8 9-12 Port Priority Configuration Summary The SecureStack A2 device supports Class of Service (CoS). the frames received  through that port without a priority indicated in their tag header are classified as a priority 4 and  transmitted according to that priority. For example.9 Port Priority and Rate Limiting Configuration This chapter describes the Port Priority and Rate Limiting set of commands and how to use them.1D (802.. if the priority of a port is set to 4... Class of Service is based on the IEEE 802.1p) standard specification. The Class of Service capability of the device is implemented by a priority queueing  mechanism. Note: When CoS override is enabled using the set policy profile command as described in “set policy profile” on page 8-4. and  allows you to define eight priorities (0 through 7)  and assign them to transmit queues for each  port.. A port receiving a  frame without priority information in its tag header is assigned a priority according to the default  priority setting on the port. the device’s rate limiting capabilities allow you to further prioritize traffic by limiting  the rate of inbound traffic on a per port/priority basis.

show port priority set port priority clear port priority Refer to page.2.1D priority for one or more ports..Configuring Port Priority Configuring Port Priority Purpose To view or configure port priority characteristics as follows: • Display or change the port default Class‐of Service (CoS) transmit priority (0 through 7) of  each port for frames that are received (ingress) without priority information in their tag  header. priority for all ports will be displayed.2.2. For information about. A2(su)->show port priority fe.4 is set to 0 fe. Mode Switch command.2.2. Set each port to transmit frames according to 802.1p) priority set in the frame header.3 is set to 0 fe.5 is set to 0 9-2 Port Priority and Rate Limiting Configuration .. • • Commands The commands to configure port priority are listed below.. refer to “Port String Syntax Used  in the CLI” on page 4‐2. Defaults If port-string is not specified.1 through 5. 9-5 9-3 9-4 show port priority Use this command to display the 802.2.2.1-5 fe. Example This example shows how to display the port priority for the fe. read‐only.2 is set to 0 fe.1D (802. For a detailed  description of possible port‐string values. Syntax show port priority [port-string] Parameters port‐string (Optional) Displays priority information for a specific port.. Display the current traffic class mapping‐to‐priority of each port.1 is set to 0 fe.

 A port receiving a frame without priority information in its tag header is assigned a  priority according to the priority setting on the port. Mode Switch command.1p) Class‐of‐Service transmit priority (0 through 7) on  each port. For a detailed description of  possible port‐string values. read‐write.  priority Defaults None.3.1D (802.3 6 SecureStack A2 Configuration Guide 9-3 . Specifies a value of 0 to 7 to set the CoS priority for the port entered in the  port‐string. Frames received by this port  without priority information in their frame header are set to the default setting of 6: A2(su)->set port priority fe.set port priority set port priority Use this command to set the 802.1. Priority value of 0 is the lowest priority. For example. if the priority of a port is set to  5. A frame with priority information in its tag header is transmitted according to that priority. the frames received through that port without a priority indicated in their tag header are  classified as a priority 5. Example This example shows how to set a default priority of 6 on fe. refer to “Port String Syntax Used in the CLI” on  page 4‐2.1. Syntax set port priority port-string priority Parameters port‐string Specifies the port for which to set priority.

1.  Example This example shows how to reset fe. Syntax clear port priority port-string Parameters port‐string  Specifies the port for which to clear priority. refer to “Port String Syntax Used in the CLI” on  page 4‐2.1.clear port priority clear port priority Use this command to reset the current CoS port priority setting to 0. Defaults None. This will cause all frames  received without a priority value in its header to be set to priority 0.11 9-4 Port Priority and Rate Limiting Configuration . Mode Switch command. For a detailed description of  possible port‐string values.11 to the default priority: A2(rw)->clear port priority fe. read‐write.

 or according to a priority  based on a percentage of port transmission capacity. priority queue information for all ports will be displayed. the mapping values are applied globally to all Fast Ethernet ports on the stack.x).x). with 0 as the lowest level)  associated with the current transmit queues (0 being the lowest priority) for each selected port. set using the set  port priority command described in “set port priority” on page 9‐3. For information about... 9-5 9-6 9-7 show port priority-queue Use this command to display the port priority levels (0 through 7.Configuring Priority to Transmit Queue Mapping Configuring Priority to Transmit Queue Mapping Purpose To perform the following: • • View the current priority to transmit queue mapping of each physical port. When you use the set port priority-queue command to configure a Fast Ethernet port (fe. Configure each port to either transmit frames according to the port priority.. Mode Switch command. Defaults If port-string is not specified.x. read‐only. Note: Priority to transmit queue mapping on an individual port basis can only be configured on Gigabit Ethernet ports (ge. Syntax show port priority-queue [port-string] Parameters port‐string (Optional) Displays the mapping of priorities to transmit queues for one  or more ports. assigned to transmit queues using the set  port txq command described in “set port txq” on page 9‐9. show port priority-queue set port priority-queue clear port priority-queue Refer to page. SecureStack A2 Configuration Guide 9-5 . Clear current port priority queue settings for one or more ports. A  frame with a certain port priority is transmitted according to the settings entered using the set  port priority‐queue command described in “set port priority‐queue” on page 9‐6.. • Commands The commands used in configuring transmit priority queues are listed below.x.

Usage Although there are eight queues implemented in the switch hardware. and so forth: A2(su)->show Port P0 --------. frames with 1 or 2 priority.1 P1 P2 P3 P4 P5 P6 P7 -.-0 0 2 3 4 5 5 set port priority-queue Use this command to map 802.1p) priorities to transmit queues. You can apply the new settings to one or more ports.-. only six are available for  use in prioritizing various data and control traffic.1.x.-ge. the mapping values are applied globally to all Fast Ethernet ports on the  stack.1 1 port priority-queue ge. frames with  a priority of 0 are associated with transmit queue 1.-. Priority to transmit queue mapping on an individual port basis can only be configured on Gigabit  Ethernet ports (ge. refer to “Port String  Syntax Used in the CLI” on page 4‐2. read‐write.x). Refer to “Configuring Quality of Service  (QoS)” on page 9‐8 for more information about configuring the priority mode and weight for these  queues. with 0 being the lowest priority queue) for each port priority of  the selected port.-. Syntax set port priority-queue port-string priority queue Parameters port‐string Specifies the port(s) for which to set priority‐to‐queue mappings.1. In this case.1. This enables you to  change the transmit queue (0 to 5.1.  priority queue Defaults None. The 7th and 8th queues are reserved for  stacking and network control‐related communications.x.-.x). Mode Switch command. are associated with  transmit queue 0.1D (802. For a  detailed description of possible port‐string values. Specifies a value of 0 through 5 (0 is the lowest level) that determines the  queue on which to transmit the frames with the port priority entered in  this command. 9-6 Port Priority and Rate Limiting Configuration . When you use the set port priority‐queue command to configure a Fast  Ethernet port (fe.-. Specifies a value of 0 through 7 (0 is the lowest level) that determines  what priority frames will be transmitted on the transmit queue entered in  this command.set port priority-queue Example This example shows how to display priority queue information for ge.

12: A2(su)->clear port priority-queue ge. Syntax clear port priority-queue port-string Parameters port‐string Specifies the port for which to clear priority‐to‐queue mappings. read‐write. refer to “Port String  Syntax Used in the CLI” on page 4‐2.12 5 0 clear port priority-queue Use this command to reset port priority queue settings back to defaults for one or more ports. Defaults None. Example This example shows how to clear the priority queue settings on ge.2. A2(su)->set port priority-queue ge.2.2.12 SecureStack A2 Configuration Guide 9-7 .clear port priority-queue Example This example shows how to set priority 5 frames received on ge.12 to transmit on queue 0. For a  detailed description of possible port‐string values.2. Mode Switch command.

9-8 Port Priority and Rate Limiting Configuration . Commands The commands to configure the Quality of Service are listed below. For a  detailed description of possible port‐string values..  The commands in this section allow you to set the priority mode and weight for each of the  available six queues (queues 0 through 5) for each physical port on the switch. The seventh and eighth queues are  reserved for stacking and network control related communications. the QoS setting of all physical ports will be displayed. but only six are  available for use in prioritizing various data and control traffic.Configuring Quality of Service (QoS) Configuring Quality of Service (QoS) Purpose Eight transmit queues are implemented in the switch hardware for each port. refer to “Port String  Syntax Used in the CLI” on page 4‐2.. For information about. Defaults If the port‐string is not specified. only on the physical ports that make up the LAG. LAG ports have no transmit queue  information. Only physical ports will be displayed. Syntax show port txq [port-string] Parameters port‐string (Optional) Specifies port(s) for which to display QoS settings.. show port txq set port txq clear port txq Refer to page.  Priority mode and  weight cannot be configured on LAGs.. Mode Switch command. 9-8 9-9 9-10 show port txq Use this command to display QoS transmit queue information for one or more physical ports. read‐only.

12 WRR 2 10 15 20 24 29 ge.16 WRR 2 10 15 20 24 29 ge. For a detailed  description of possible port‐string values.1.23 WRR 2 10 15 20 24 29 ge.  SecureStack A2 Configuration Guide 9-9 .--. but only six  are available for use in prioritizing various data and control traffic.13 WRR 2 10 15 20 24 29 ge.1.15 WRR 2 10 15 20 24 29 ge. read‐write.1.1.22 WRR 2 10 15 20 24 29 ge.20 WRR 2 10 15 20 24 29 ge.1.1. value0 ‐ value5  Specifies percentage to allocate to a specific transmit queue.1.14 WRR 2 10 15 20 24 29 ge.1. The values  must total 100 percent.19 WRR 2 10 15 20 24 29 ge. Only physical ports can be configured with this command.24 WRR 2 10 15 20 24 29 Q6 --SP SP SP SP SP SP SP SP SP SP SP SP SP SP SP Q7 --SP SP SP SP SP SP SP SP SP SP SP SP SP SP SP set port txq Use this command to set QoS transmit queue arbitration values for physical ports.--. Syntax set port txq port-string value0 value1 value2 value3 value4 value5 Parameters port‐string Specifies port(s) on which to set queue arbitration values.1. The seventh and eighth queues  are reserved for stacking and network control related communications and cannot be configured. Defaults None. refer to “Port String Syntax Used  in the CLI” on page 4‐2. Usage Eight transmit queues are implemented in the switch hardware for each physical port.11 WRR 2 10 15 20 24 29 ge.10-24 Port Alg Q0 Q1 Q2 Q3 Q4 Q5 ------.--.1.17 WRR 2 10 15 20 24 29 ge.1. LAG ports  cannot be configured.1.10 WRR 2 10 15 20 24 29 ge.--.1.10 through 24:  A2(su)->show port txq ge.set port txq Example This example shows how to display the current algorithm and transmit queue weights configured  on ports ge. Mode Switch command.--.18 WRR 2 10 15 20 24 29 ge.21 WRR 2 10 15 20 24 29 ge.--ge.1.1.1.1.

 transmit queues are defined as follows: Queue 0 1 2 3 Mode WRR WRR WRR WRR Weight 1 2 3 4 Queue 4 5 6 7 Mode WRR WRR Strict (not configurable) Strict (not configurable) Weight 5 6 – – Mode Switch command.1.  Weights are specified in the range  of 0 to 100 percent.clear port txq Queues can be set for strict priority (SP) or weighted round‐robin (WRR).  Examples This example shows how to change the arbitration values for the six transmit queues belonging to  ge.1:  A2(su)->set port txq ge.--.--.  If set for WRR mode.1:  A2(su)->set port txq ge. For a detailed description of possible port‐string values.1. LAG ports  cannot be configured.  Queues can be changed back to WRR by changing the weight  of queues 0 through 5.1.1 STR SP SP SP SP SP SP SP SP clear port txq Use this command to clear port transmit queue values back to their default values.1.1 17 17 17 17 16 16 This example shows how to change the algorithm to strict priority for the six transmit queues  belonging to ge. Syntax clear port txq port-string Parameters port‐string Clears transmit queue values on specific port(s) back to their default  values.--. refer to  “Port String Syntax Used in the CLI” on page 4‐2.  Queues 0 through 5 can be changed to strict priority by configuring queues 0 through 4 at 0  percent and queue 5 at 100 percent.--.  Weights specified for queues 0 through 5 on any port must total 100 percent.--. or by issuing the clear port txq command. 9-10 Port Priority and Rate Limiting Configuration .--.1. Defaults By default.--.1.--ge. read‐write.1 0 0 0 0 0 100 A2(su)->show port txq ge.  weights may be assigned to those queues with this command.1 Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7 ------. Only physical ports can be configured with this command.

--.--.1.--.1 WRR 2 10 15 20 24 29 SP SP SecureStack A2 Configuration Guide 9-11 .1.1:  A2(su)->clear port txq ge.--.clear port txq Example This example shows how to clear transmit queue values on ge.1 Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7 ------.--ge.--.1.1.1 A2(su)->show port txq ge.--.--.

 The  allowable range for the rate limiting is 64 kilobytes per second minimum up to the maximum  transmission rate allowable on the interface type.1p priority levels.. Defaults If port‐string is not specified. refer to “Port String  Syntax Used in the CLI” on page 4‐2.Configuring Port Traffic Rate Limiting Configuring Port Traffic Rate Limiting Purpose To limit the rate of inbound traffic on the SecureStack A2 device on a per port/priority basis. Commands The commands to configure traffic rate limiting are listed below. For a  detailed description of possible port‐string values. frames are dropped until the rate falls below the limit. If  the rate exceeds the programmed limit. Syntax show port ratelimit [port-string] Parameters port‐string (Optional) Displays rate limiting information for specific port(s).. Mode Switch command. or all of the eight 802. Once configured. the rate of all traffic entering the  port with the priorities configured to that port is not allowed to exceed the programmed limit.  some. The list of priorities can include one. Rate limit is configured for a given port and list of priorities.. 9-12 9-14 9-15 show port ratelimit Use this command to show the traffic rate limiting configuration on one or more ports. rate limiting information will be displayed for all ports. show port ratelimit set port ratelimit clear port ratelimit Refer to page. 9-12 Port Priority and Rate Limiting Configuration . For information about.. read‐only.

2.2. Currently rules can only be applied to inbound traffic.2.show port ratelimit Example This example shows how to display the current rate limiting information for fe.1 fe.2.2.. Table 9-1 Output Port Number Index Threshold (kB/s) Action Direction Priority List Status show port ratelimit Output Details What It Displays. Port Number ----------fe. SecureStack A2 Configuration Guide 9-13 .1 fe.1 Global Ratelimiting status is disabled.2.2.1p) port priority level. Whether or not frames not conforming to rate limiting will be discarded.2.1: A2(su)->show port ratelimit fe.1D (802.1 fe. For a detailed description of possible port-string values.1 fe.1 fe. Port designation. Resource index for this port. refer to “Port String Syntax Used in the CLI” on page 4-2. Whether or not this rule is active or disabled. 802.2.2.1 fe. Port rate limiting threshold in kilobytes per second.1 fe.1 Threshold (kB/s) --------64 64 64 64 64 64 64 64 Priority List ----------0 0 0 0 0 0 0 0 Index ----1 2 3 4 5 6 7 8 Action -----------discard discard discard discard discard discard discard discard Direction --------inbound inbound inbound inbound inbound inbound inbound inbound Status -------disabled disabled disabled disabled disabled disabled disabled disabled Table 9‐1 shows a detailed explanation of the command output..

483. globally disables or enables the port  rate limiting function. Specifies the 802. (Optional) Assigns a resource index for this port. index 1. to a threshold of  125 KBps: A2(rw)->set port ratelimit enable A2(rw)->set port ratelimit fe. priority 5.2. Syntax set port ratelimit {disable | enable} | port-string priority threshold {disable | enable} [inbound] [index] Parameters disable | enable When entered without a port‐string. Example This example shows how to: • • globally enable rate limiting configure rate limiting for inbound traffic on port fe. Mode Switch command.1D (802. port‐string priority threshold inbound  index Defaults Threshold will be applied to inbound traffic on the port/priority.1p) port priority level associated with the port‐ string.647 kilobytes per second. When entered with a port‐string. and will overwrite index 1 for any  subsequent rate limits configured. disables or  enables rate limiting on specific port(s) when the global function is  enabled. read-write. If index is not specified. Range is  64 up to a maximum of 2.1 5 125 enable inbound 9-14 Port Priority and Rate Limiting Configuration . settings will be applied to index 1. For a detailed description of possible port‐string values.  refer to “Port String Syntax Used in the CLI” on page 4‐2. Specifies a port on which to set the rate limiting threshold and other  parameters.147. The value can be 0 to 7. Specifies a port rate limiting threshold in kilobytes per second. (Optional) Applies this rate policing rule to inbound traffic.1. with 0 specifying the lowest priority.2.set port ratelimit set port ratelimit Use this command to configure the traffic rate limiting status and threshold (in kilobytes per  second) for one or more ports.

 For a detailed  description of possible port‐string values. read‐write. Syntax clear port ratelimit port-string [index] Parameters port‐string Specifies the port(s) on which to clear rate limiting.clear port ratelimit clear port ratelimit Use this command to clear rate limiting parameters for one or more ports. index Defaults If not specified. Mode Switch command.2. refer to “Port String Syntax  Used in the CLI” on page 4‐2.1 SecureStack A2 Configuration Guide 9-15 . all index entries will be reset. Example This example shows how to clear all rate limiting parameters on port fe. (Optional) Specifies the associated resource index to be reset. A2(su)->clear port ratelimit fe.2.1.

clear port ratelimit 9-16 Port Priority and Rate Limiting Configuration .

 A multicast server does not have to establish a separate connection with each client. the broadcast traffic must be carefully pruned at every  SecureStack A2 Configuration Guide 10-1 . to support IP multicasting across the  Internet. IGMP provides the final step in an IP multicast packet delivery service. About Multicasting Multicasting is used to support real‐time applications such as video conferences or streaming  audio. multicast devices use  this information. 10-1 10-2 IGMP Overview About IP Multicast Group Management The Internet Group Management Protocol (IGMP) runs between hosts and their immediately  neighboring multicast device.. along with a multicast routing protocol. Based on the group membership information learned from IGMP. a device can determine which (if  any) multicast traffic needs to be forwarded to each of its ports.  For information about. Although this approach reduces the network  overhead required by a multicast server.. It  merely broadcasts its service to the network. If  there is more than one device on the LAN performing IP multicasting. IGMP Overview Configuring IGMP at Layer 2 Refer to page.. The purpose of IP multicast group management is to optimize a switched network’s performance  so multicast packets will only be forwarded to those ports containing multicast group hosts or  multicast devices instead of flooding to all ports in the subnet (VLAN). since it is only concerned  with forwarding multicast traffic from the local device to group members on a directly attached  subnetwork or LAN segment. one of these devices is  elected “querier” and assumes the responsibility of querying the LAN for group members. The protocol’s mechanisms allow a host to inform its local device  that it wants to receive transmissions addressed to a specific multicast group. A multicast‐enabled device can periodically ask its hosts if they want to receive multicast traffic. and any hosts that want to receive the multicast  register with their local multicast switch/router.. This device supports IP multicast group management by passively snooping on the IGMP query  and IGMP report packets transferred between IP multicast devices and IP multicast host groups to  learn IP multicast group members.10 IGMP Configuration This chapter describes the IGMP Configuration set of commands and how to use them. At Layer‐3.

Configuring IGMP at Layer 2 multicast switch/router it passes through to ensure that traffic is only passed to the hosts that  subscribed to this service. For information about. 10-3 10-3 10-4 10-5 10-5 10-6 10-7 10-7 10-8 10-9 10-10 10-2 IGMP Configuration . Commands The commands used to configure switch‐related IGMP snooping are listed below... Configuring IGMP at Layer 2 Purpose To configure IGMP snooping from the switch CLI. show igmpsnooping set igmpsnooping adminmode set igmpsnooping interfacemode set igmpsnooping groupmembershipinterval set igmpsnooping maxresponse set igmpsnooping mcrtrexpiretime set igmpsnooping add-static set igmpsnooping remove-static show igmpsnooping static show igmpsnooping mfdb clear igmpsnooping Refer to page...

.fe...0 Data Frames Forwarded by the CPU.....2... Multicast Router Present Expiration Time.........5.  Syntax set igmpsnooping adminmode {enable | disable} Parameters enable | disable Enables or disables IGMP snooping on the system..  Syntax show igmpsnooping Parameters None......1...fe........ Usage Configured information is displayed whether or not IGMP snooping is enabled.. refer to “set igmpsnooping adminmode” on page 10‐3.0 set igmpsnooping adminmode Use this command to enable or disable IGMP on the system...... refer to “set igmpsnooping interfacemode” on page 10‐4..... Max Response Time.......... Example This example shows how to display IGMP snooping information: A2(su)->show igmpsnooping Admin Mode.. Interfaces Enabled for IGMP Snooping..... Defaults None...fe......4.........1...........1... SecureStack A2 Configuration Guide 10-3 ...........1... Status  information is displayed only when the function is enabled.show igmpsnooping show igmpsnooping Use this command to display IGMP snooping information...1.........1..fe.... Mode Switch command...... For information on enabling IGMP on  the system..3 fe.. read‐only.. For information on enabling  IGMP on one or more ports.... Enable 260 100 0 fe.1.......6 Multicast Control Frame Count.... Group Membership Interval.... Defaults None..

Mode Switch command. it must be globally enabled on the  device using the set igmpsnooping adminmode command as described in “set igmpsnooping  adminmode” on page 10‐3.set igmpsnooping interfacemode Mode Switch command. Example This example shows how to enable IGMP on ports ge. and then enabled on a port(s) using the set igmpsnooping interface  mode command as described in “set igmpsnooping interfacemode” on page 10‐4. and then enabled on a port(s) using this command.1‐10: A2(su)->set igmpsnooping interfacemode ge. it must be globally enabled on the  device with this command.  Syntax set igmpsnooping interfacemode port-string {enable | disable} Parameters port‐string  enable | disable Specifies one or more ports on which to enable or disable IGMP. Example This example shows how to enable IGMP on the system: A2(su)->set igmpsnooping adminmode enable set igmpsnooping interfacemode Use this command to enable or disable IGMP on one or all ports. read‐write. Defaults None.1-10 enable 10-4 IGMP Configuration . read‐write. Usage In order for IGMP snooping to be enabled on one or all ports. Usage In order for IGMP snooping to be enabled on one or all ports. Enables or disables IGMP.

  Defaults None. Valid values are 100 ‐  255 seconds. SecureStack A2 Configuration Guide 10-5 . Mode Switch command.  Syntax set igmpsnooping groupmembershipinterval time Parameters time Specifies the IGMP group membership interval. Valid values are 2 ‐ 3600  seconds. Usage The IGMP group membership interval time sets the frequency of host‐query frame transmissions  and must be greater than the IGMP maximum response time as described in “set igmpsnooping  maxresponse” on page 10‐5.  Syntax set igmpsnooping maxresponse time Parameters time Specifies the IGMP maximum query response time.  This value works together with the set igmpsnooping maxresponsetime  command to remove ports from an IGMP group and must be greater than  the max response time value. read‐write. This value works together with the set igmpsnooping  groupmembershipinterval command to remove ports from an IGMP group  and must be lesser than the group membership interval value. Example This example shows how to set the IGMP group membership interval to 250 seconds: A2(su)->set igmpsnooping groupmembershipinterval 250 set igmpsnooping maxresponse Use this command to configure the IGMP query maximum response time for the system. The default value is 100 seconds.  Defaults None.set igmpsnooping groupmembershipinterval set igmpsnooping groupmembershipinterval Use this command to configure the IGMP group membership interval time for the system.

  Syntax set igmpsnooping mcrtrexpire time Parameters time Specifies the IGMP multicast router expiration time. Usage This timer is for expiring the switch from the multicast database. read‐write. If the timer expires. Mode Switch command. then the entry will be removed. read‐write. A value of 0 will configure the system with an infinite  expiration time. Example This example shows how to set the IGMP maximum response time to 100 seconds: A2(su)->set igmpsnooping maxresponse 100 set igmpsnooping mcrtrexpiretime Use this command to configure the IGMP multicast router expiration time for the system. Defaults None. Valid values are 0 ‐  3600 seconds. Usage This value must be less than the IGMP maximum response time described in “set igmpsnooping  groupmembershipinterval” on page 10‐5. The default value is 0.  Example This example shows how to set the IGMP multicast router expiration time to infinity: A2(su)->set igmpsnooping mcrtrexpiretime 0 10-6 IGMP Configuration .set igmpsnooping mcrtrexpiretime Mode Switch command. and the only  address left is the multicast switch.

 all ports are removed from the entry.11. A2(su)->set igmpsnooping add-static 233. Specifies the VLANs on which to configure the entry. Syntax set igmpsnooping remove-static group vlan-list [modify] [port-string] Parameters group vlan‐list modify port‐string Specifies the multicast group IP address of the entry. Usage Use this command to create and configure Layer 2 IGMP entries.set igmpsnooping add-static set igmpsnooping add-static This command creates a new static IGMP entry or adds one or more new ports to an existing entry.1. Specifies the VLANs on which the entry is configured. If modify is not specified. all ports are added to the entry. Mode Switch command. (Optional) Removes the specified port or ports from an existing entry.22. (Optional) Specifies the port or ports to remove from the entry. Defaults If no ports are specified. a new entry is created.33  configured on VLAN 20 configured with the port ge. read‐write.1.22. Syntax set igmpsnooping add-static group vlan-list [modify] [port-string] Parameters group vlan‐list modify port‐string Specifies the multicast group IP address for the entry.33 20 ge. (Optional) Adds the specified port or ports to an existing entry.1 set igmpsnooping remove-static This command deletes a static IGMP entry or removes one or more new ports from an existing  entry. Defaults If no ports are specified. Example This example creates an IGMP entry for the multicast group with IP address of 233.11.1. (Optional) Specifies the port or ports to add to the entry. SecureStack A2 Configuration Guide 10-7 .

1 from the entry for the multicast group with IP address of  233.22. read‐only. Defaults If no group is specified.33 Type = IGMP IGMP Port List = ge.show igmpsnooping static Mode Switch command. A2(su)->set igmpsnooping remove-static 233.8. Example This example displays the static IGMP ports for VLAN 20.11.22.1.1. (Optional) Specifies the IGMP group for which to display static IGMP  ports. Syntax show igmpsnooping static vlan-list [group group] Parameters vlan‐list group group Specifies the VLAN for which to display static IGMP ports.1(su)->show igmpsnooping static 20 -------------------------------------------------------------------------------Vlan Id = 20 Static Multicast Group Address = 233.1 10-8 IGMP Configuration .10.33 configured on VLAN 20. 120.11. information for all groups is displayed.11. read‐write. Mode Switch command.33 20 ge.22.1 show igmpsnooping static This command displays static IGMP ports for one or more VLANs or IGMP groups.1. Example This example removes port ge.

4........ge.. 0 SecureStack A2 Configuration Guide 10-9 .....ge.. ge..5...1..1...3..7 This example shows how to display multicast forwarding database statistics: A2(su)->show igmpsnooping mfdb stats Max MFDB Table Entries.....ge......2.------------------------00:14:01:00:5E:02:CD:B0 Dynamic Network Assist Fwd: ge....ge...... Examples This example shows how to display multicast forwarding database entries: A2(su)->show igmpsnooping mfdb MAC Address Type Description Interfaces ----------------------.7 00:32:01:00:5E:7F:FF:FA Dynamic Network Assist Fwd: ge..6.1.------.3..ge..6.8. 1 Current Entries...... Mode Switch command...---------------. Defaults If stats is not specified.1.4.7.... 256 Most MFDB Entries Since Last Reset.. read‐only. Syntax show igmpsnooping mfdb [stats] Parameters stats (Optional) Displays MFDB statistics.. all MFDB table entries will be displayed........show igmpsnooping mfdb show igmpsnooping mfdb Use this command to display multicast forwarding database (MFDB) information......4.1.1.1 00:32:01:00:5E:37:96:D0 Dynamic Network Assist Fwd: ge.... ge.

Mode Switch command. read‐write. 10-10 IGMP Configuration . Defaults None.clear igmpsnooping clear igmpsnooping Use this command to clear all IGMP snooping entries. Example This example shows how to clear all IGMP snooping entries: A2(su)->clear igmpsnooping Are you sure you want to clear all IGMP snooping entries? (y/n)y IGMP Snooping Entries Cleared.  Syntax clear igmpsnooping Parameters None.

For information about..  Note: The commands in this chapter pertain to network management of the SecureStack A2 device from the switch CLI only.  and the logging buffer. Configuring System Logging Monitoring Network Events and Status Managing Switch Network Addresses and Routes Configuring Simple Network Time Protocol (SNTP) Configuring Node Aliases Refer to page. Commands Commands to configure system logging are listed below. Syslog default settings.11 Logging and Network Management This chapter describes switch‐related logging and network management commands and how to  use them.. 11-2 11-3 11-4 11-4 11-5 11-6 11-7 SecureStack A2 Configuration Guide 11-1 .. For information about.. including Syslog server settings. show logging server set logging server clear logging server show logging default set logging default clear logging default show logging application Refer to page. 11-1 11-12 11-17 11-24 11-31 Configuring System Logging Purpose To display and configure system logging.....

11-2 Logging and Network Management . 11-8 11-9 11-9 11-10 11-10 11-11 show logging server Use this command to display the Syslog configuration for a particular server. For details on setting this using the set logging server command.90. Example This example shows how to display Syslog server configuration information: A2(ro)->show logging server IP Address Facility Severity Description Port Status ------------------------------------------------------------------------1 132.. Syslog facility that will be encoded in messages sent to this server. refer to “set logging server” on page 11-3. Syslog server’s IP address. Valid values are: local0 to local7. Valid values are 1‐8. Defaults If index is not specified... Syntax show logging server [index] Parameters index (Optional) Displays Syslog information pertaining to a specific server  table entry.82..140..84 local4 warning(5) default 514 enabled Table 11‐1 provides an explanation of the command output.140. Severity level at which the server is logging messages. all Syslog server information will be displayed. Text string description of this facility/server..show logging server For information about. set logging application clear logging application show logging local set logging local clear logging local show logging buffer Refer to page.  Table 11-1 Output IP Address Facility Severity Description show logging server Output Details What It Displays. read‐only.111 local4 warning(5) default 514 enabled 2 132. Mode Switch command.

(Optional) Specifies the severity level at which the server will log  messages.. SecureStack A2 Configuration Guide 11-3 . (Optional) Enables or disables this facility/server configuration. severity and port will be set to defaults configured with the set logging  default command (“set logging default” on page 11‐5). (Optional) Specifies the Syslog message server’s IP address. UDP port the client uses to send to the server. (Optional) Specifies the default UDP port the client uses to send to the  server.. (Optional) Specifies the server’s facility name. Syntax set logging server index [ip-addr ip-addr] [facility facility] [severity severity] [descr descr] [port port] [state {enable | disable}] Parameters index ip‐addr ip‐addr facility facility severity severity Specifies the server table index number for this server. Whether or not this Syslog configuration is currently enabled or disabled. Defaults If ip‐addr is not specified. Valid values are 1 ‐  8. the server will not be enabled or disabled. set logging server Use this command to configure a Syslog server. If not specified. facility. If state is not specified.set logging server Table 11-1 Output Port Status show logging server Output Details (Continued) What It Displays. an entry in the Syslog server table will be created with the specified  index number and a message will display indicating that no IP address has been assigned. Valid values are: local0 to  local7. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages descr descr port port state enable |  disable (Optional) Specifies a textual string description of this facility/server.

113. Example This command shows how to remove the Syslog server with index 1 from the server table: A2(su)->clear logging server 1 show logging default Use this command to display the Syslog server default values. facility local4.141. Defaults None.89.  Valid values are 1 ‐ 8. severity level 3 on port 514: A2(su)->set logging server 1 ip-addr 134. Mode Switch command. read‐write. Syntax clear logging server index Parameters index Specifies the server table index number for the server to be removed. Defaults None. 11-4 Logging and Network Management . IP address  134. Example This command shows how to enable a Syslog server configuration for index 1. Syntax show logging default Parameters None.89. Mode Switch command.113 facility local4 severity 3 port 514 state enable clear logging server Use this command to remove a server from the Syslog server table.clear logging server Mode Switch command. read‐write. read‐only.141.

 For an explanation of the  command output. Valid values and  corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages port port Specifies the default UDP port the client uses to send to the server. Specifies the default logging severity level. read‐write. A2(su)->show logging default Facility Severity Port ----------------------------------------local4 warning(5) 514 Defaults: set logging default Use this command to set logging default values. Example This example shows how to set the Syslog default facility name to local2 and the severity level to 4  (error logging): A2(su)->set logging default facility local2 severity 4 SecureStack A2 Configuration Guide 11-5 . Valid values are: local0 to local7. Syntax set logging default {[facility facility] [severity severity] port port]} Parameters facility facility severity severity Specifies the default facility name. Defaults None.set logging default Example This command shows how to display the Syslog server default values. refer back to Table 11‐1 on page 11‐2. Mode Switch command.

Defaults At least one optional parameter must be entered.clear logging default clear logging default Use this command to reset logging default values. Example This example shows how to reset the Syslog default severity level to 6: A2(su)->clear logging default severity 11-6 Logging and Network Management . Syntax clear logging default {[facility] [severity] [port]} Parameters facility  severity  port (Optional) Resets the default facility name to local4. (Optional) Resets the default UDP port the client uses to send to the server  to 514. (Optional) Resets the default logging severity level to 6 (notifications of  significant conditions). Mode Switch command. read‐write. All three optional keywords must be entered to reset all logging values to defaults.

show logging application show logging application Use this command to display the severity level of Syslog messages for one or all applications  configured for logging on your system. which are set using the set logging application command. Table 11‐2 describes the output of this command. information for all applications will be displayed. Mode Switch command. Defaults If no parameter is specified. all (Optional) Displays severity level for all applications configured for  logging. A mnemonic abbreviation of the textual description for applications being logged. Syntax show logging application [mnemonic | all] Parameters mnemonic (Optional) Displays severity level for one application configured for  logging. refer to “set logging application” on page 11-8. Application show logging application Output Details What it displays. Sample mnemonics and their  corresponding applications are listed in Table 11‐3 on page 11‐8. This range (from 1 to 8) and its associated severity list is shown in the CLI output.. Mnemonics will vary depending on the number and types of  applications running on your system.. Current Severity Level SecureStack A2 Configuration Guide 11-7 . A2(ro)->show logging application SNMP Application Current Severity Level --------------------------------------------90 SNMP 6 1(emergencies) 4(errors) 7(information) 2(alerts) 5(warnings) 8(debugging) 3(critical) 6(notifications) Table 11-2 Output... Example This example shows how to display system logging information pertaining to the SNMP  application. Note: Mnemonic values are case sensitive and must be typed as they appear in Table 11-3. read‐only. Severity level at which the server is logging messages for the listed application. For a description of these entries.

set logging application set logging application Use this command to set the severity level of log messages for one or all applications. Note: Mnemonic values are case sensitive and must be typed as they appear in Table 11-3. use the  show logging application command as described in “show logging  application” on page 11‐7. This parameter will vary depending on the number and types of  applications running on your system. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages Table 11-3 Mnemonic CLIWEB SNMP STP Driver System Stacking UPN Router Mnemonic Values for Logging Applications Application Command Line Interface and Webview management Simple Network Management Protocol Spanning Tree Protocol Hardware drivers Non-application items such as general chassis management Stacking management User Personalized Networking Router Defaults If level is not specified. all level level Sets the logging severity level for all applications. Syntax set logging application {[mnemonic | all]} [level level] Parameters mnemonic Specifies a case sensitive mnemonic abbreviation of an application to be  logged. 11-8 Logging and Network Management . Sample mnemonics and their corresponding  applications are listed in Table 11‐3 on page 11‐8. none will be applied. (Optional) Specifies the severity level at which the server will log  messages for applications. To display a complete list.

Example This example shows how to set the severity level for SNMP to 4 so that error conditions will be  logged for that application. SecureStack A2 Configuration Guide 11-9 . all Defaults None. A2(rw)->set logging application SNMP level 4 clear logging application Use this command to reset the logging severity level for one or all applications to the default value  of 6 (notifications of significant conditions). read‐write. Mode Switch command.clear logging application Mode Switch command. Example This example shows how to reset the logging severity level to 6 for SNMP. Valid mnemonic  values and their corresponding applications are listed in Table 11‐3 on  page 11‐8. Syntax show logging local Parameters None. Syntax clear logging application {mnemonic | all} Parameters mnemonic  Resets the severity level for a specific application to 6. Defaults None. read‐write. Resets the severity level for all applications to 6. A2(rw)->clear logging application SNMP show logging local Use this command to display the state of message logging to the console and a persistent file.

Defaults None. logging to the  console is enabled and logging to a persistent file is disabled. Mode Switch command. Syntax set logging local console {enable | disable} file {enable | disable} Parameters console enable | disable file enable | disable Enables or disables logging to the console. In this case. Defaults None.set logging local Mode Switch command. Enables or disables logging to a persistent file. Example This example shows how to display the state of message logging. Example This command shows how to enable logging to the console and disable logging to a persistent file: A2(su)->set logging local console enable file disable clear logging local Use this command to clear the console and persistent store logging for the local session. read‐only. A2(su)->show logging local Syslog Console Logging enabled Syslog File Logging disabled set logging local Use this command to configure log messages to the console and a persistent file. 11-10 Logging and Network Management . Mode Switch command. read‐write. read‐write. Syntax clear logging local Parameters None.

42.1.1. Syntax show logging buffer Parameters None. Mode Switch command.42.4.13 CLI[5]User:rw logged in from 10.71.show logging buffer Example This example shows how to clear local logging: A2(su)->clear logging local show logging buffer Use this command to display the last 256 messages logged.13 CLI[5]User: debug failed login from 10. Defaults None. Example This example shows a portion of the information displayed with the show logging buffer  command: A2(su)->show logging buffer <165>Sep 4 07:43:09 10.71.2.122 (telnet) <165>Sep 4 07:43:24 10.100 (telnet) SecureStack A2 Configuration Guide 11-11 . read‐only.

11-12 11-13 11-13 11-14 11-15 11-15 history Use this command to display the contents of the command history buffer. read‐only. Syntax history Parameters None... It shows there are  five commands in the buffer: A2(su)->history 1 hist 2 show gvrp 3 show vlan 4 show igmp 5 show ip address 11-12 Logging and Network Management .Monitoring Network Events and Status Monitoring Network Events and Status Purpose To display switch events and command history.. history show history set history ping show users disconnect Refer to page. For information about. and to display  and disconnect current user sessions. The command history  buffer includes all the switch commands entered up to a maximum of 100. as specified in the set  history command (“set history” on page 11‐13). Mode Switch command.. Defaults None. to set the size of the history buffer. Commands Commands to monitor switch network events and status are listed below. Example This example shows how to display the contents of the command history buffer.

show history show history Use this command to display the size (in lines) of the history buffer. Example This example shows how to set the size of the command history buffer to 30 lines: A2(su)->set history 30 SecureStack A2 Configuration Guide 11-13 . Mode Switch command. Syntax show history Parameters None. read‐only. Example This example shows how to display the size of the history buffer: A2(su)->show history History buffer size: 20 set history Use this command to set the size of the history buffer. read‐write. Defaults None.  (Optional) Makes this setting persistent for all future sessions. Mode Switch command. Valid values are 1 to 100. Syntax set history size [default] Parameters size default Specifies the size of the history buffer in lines. Defaults None.

29.  Syntax ping host Parameters host  Specifies the IP address of the device to which the ping will be sent.  Examples This example shows how to ping IP address 134.89.141.141.255 11-14 Logging and Network Management .141. the host at IP address is not responding: A2(su)->ping 134.29 is alive In this example.255 no answer from 134.ping ping Use this command to send ICMP echo‐request packets to another node on the network from the  switch CLI.141.89.89. In this case. Mode Switch command.29 134.89.89. Defaults None.141. this host is alive: A2(su)->ping 134. read‐write.

141.119 telnet rw 134.141. Syntax disconnect { ip-addr | console } Parameters ip‐addr console Specifies the IP address of the Telnet session to be disconnected. read‐only.----.192. Mode Switch command. Mode Switch command. Example This example shows how to use the show users command.141.192. there are two Telnet  users logged in with Read‐Write access privileges from IP addresses 134. Closes an active console port. Syntax show users Parameters None.18 disconnect Use this command to close an active console port or Telnet session from the switch CLI.141. read‐write.119 and  134. In this output. This  address is displayed in the output shown in “show users” on page 12‐15.-------------------------* telnet rw 134.  SecureStack A2 Configuration Guide 11-15 .18:  A2(su)->show users Session User Location -------.192. Defaults None.192. Defaults None.show users show users Use this command to display information about the active console port or Telnet session(s) logged  in to the switch.

119 This example shows how to close the current console session: A2(su)->disconnect console 11-16 Logging and Network Management .192.disconnect Examples This example shows how to close a Telnet session to host 134.119: A2(su)->disconnect 134.141.141.192.

. Example This example shows how to display the ARP table:  A2(su)->show arp LINK LEVEL ARP TABLE IP Address Phys Address Flags Interface ----------------------------------------------------10. read‐only. and to display MAC address information.1. Syntax show arp Parameters None. Commands Commands to manage switch network addresses and routes are listed below.Managing Switch Network Addresses and Routes Managing Switch Network Addresses and Routes Purpose To display or delete switch ARP table entries. show arp set arp clear arp traceroute show mac show mac agetime set mac agetime clear mac agetime Refer to page.21..194 00-00-5e-00-01-1 S host SecureStack A2 Configuration Guide 11-17 .1 00-00-5e-00-01-1 S host 134.20. 11-17 11-18 11-18 11-19 11-20 11-22 11-22 11-23 show arp Use this command to display the switch’s ARP table.142. Mode Switch command.. For information about.. Defaults None.

. Specifies the MAC address to map to the IP address and add to the ARP  table.192 00-00-5e-00-01-1 S host 134. Table 11-4 Output IP Address Phys Address Flags show arp Output Details What It Displays. Syntax clear arp {ip-address | all} 11-18 Logging and Network Management .192.119 00-00-5e-00-01-1 S host ----------------------------------------------------- Table 11‐4 provides an explanation of the command output.232 to MAC address 00‐00‐0c‐40‐0f‐bc:  A2(su)->set arp 192.18 00-00-5e-00-01-1 S host 134.manually configured entry (static) P .142. MAC address mapped to IP address.232 00-00-0c-40-0f-bc clear arp Use this command to delete a specific entry or all entries from the switch’s ARP table.respond to ARP requests for this entry set arp Use this command to add mapping entries to the switch’s ARP table. The MAC address can be formatted as xx:xx:xx:xx:xx:xx or xx‐xx‐ xx‐xx‐xx‐xx..168. Syntax set arp ip-address mac-address Parameters ip‐address mac‐address Specifies the IP address to map to the MAC address and add to the ARP  table.219. IP address mapped to MAC address. Defaults None.219.191. Mode Switch command.142. Possible values and their definitions include: S . Example This example shows how to map IP address 192.192. Route status.168.142. read‐write.set arp 134.

(Optional) Specifies the time to live (TTL) of the first outgoing probe  packet. (Optional) Specifies the maximum time to live (TTL) used in outgoing  probe packets. (Optional) Bypasses the normal host routing tables. Syntax traceroute [-w waittime] [-f first-ttl] [-m max-ttl] [-p port] [-q nqueries] [-r] [-d] [-n] [-v] host Parameters ‐w waittime ‐f first‐ttl ‐m max‐ttl ‐p port ‐q nqueries ‐r ‐d ‐n ‐v host (Optional) Specifies time in seconds to wait for a response to a probe. (Optional) Displays hop addresses numerically. max‐ttl will be set to 30 seconds. or clears all ARP  entries.) (Optional) Displays verbose output.1. Defaults If not specified. Example This example shows how to delete entry 10. first‐ttl will be set to 1 second. (Optional) Specifies the number of probe inquiries.1.10 traceroute Use this command to display a hop‐by‐hop path through an IP network from the device to a  specific destination host. If not specified. If not specified. Three UDP or ICMP probes will be transmitted for each hop between the  source and the traceroute destination. (Supported in a future  release. Specifies the host to which the route of an IP packet will be traced. SecureStack A2 Configuration Guide 11-19 . waittime will be set to 5 seconds. (Optional) Specifies the base UDP port number used in probes. including the size and destination of  each response.10.  Defaults None.traceroute Parameters ip‐address | all Specifies the IP address in the ARP table to be cleared. Mode Switch command.10.10 from the ARP table: A2(su)->clear arp 10. read‐write. (Optional) Sets the debug socket option.

1: A2(su)->show mac port ge. Examples This example shows how to display MAC address information for ge.000 ms 3 192.167.167. hop 2 is 14. port will be set to 33434.000 ms 2 14.000 ms 0. Mode Switch command.17 (192.45) 40.252.000 ms 20. read‐only. (Optional) Displays MAC addresses for specific port(s). Mode Switch command.0.252. If ‐r is not specified.45 (14. If ‐d is not specified.000 ms 20. If ‐v is not specified.252.252.17 (192. If not specified.17) 50.0.  Syntax show mac [address mac-address] [fid fid] [port port-string] [type {other | learned | self | mgmt}] Parameters address mac‐address fid fid port port‐string type other |learned |  self | mgmt (Optional) Displays a specific MAC address (if it is known by the  device).000 ms 20.1.1.000 ms 20.000 ms show mac Use this command to display MAC addresses in the switch’s filtering database.com (192.3. normal host routing tables will be used. learned.40) 20. (Optional) Displays information related to other. nqueries will be set to 3.1. the debug socket option will not be used.167. 40 byte packets 1 matrix.167.show mac If not specified.0. self or  mgmt (management) address type.201.17.1 11-20 Logging and Network Management . (Optional) Displays MAC addresses for a specific filter database  identifier. 30 hops max. summary output will be displayed. Example This example shows how to use traceroute to display a round trip path to host 192.17 traceroute to 192.167.167. Round trip times for each of the three UDP probes are displayed next to each hop: A2(su)->traceroute 192.3. read‐only. In  this case. hop 1 is the SecureStack A2 switch. all MAC addresses for the device will be displayed. These are  addresses learned on a port through the switching process.  Defaults If no parameters are specified.167.252.252.45. and hop 3 is back to the host IP  address.17).enterasys.000 ms 10.

3..------------. Valid types are: • Learned • Self • Management • Other • mcast (multicast) VLAN Status Egress Ports The VLAN ID configured for the multicast MAC address.------------. The ports which have been added to the egress ports list. MAC addresses mapped to the port(s) shown.3. The status of the multicast address.---.---. Address type.--------------------------01-01-23-34-45-56 20 any mcast perm ge.. Port designation. Filter database identifier.------. Table 11-5 Output MAC Address FID Port Type show mac Output Details What It Displays.1 Table 11‐5 provides an explanation of the command output.------. SecureStack A2 Configuration Guide 11-21 .show mac MAC Address FID Port Type ----------------.1 Learned MAC Address VLAN Port Type Status Egress Ports ----------------.-------00-09-6B-0F-13-E6 15 ge.

000. read‐only. read‐only. Defaults None. Example This example shows how to display the MAC timeout period: A2(su)->show mac agetime Aging time: 300 seconds set mac agetime Use This command to set the timeout period for aging learned MAC entries.show mac agetime show mac agetime Use this command to display the timeout period for aging learned MAC entries. Syntax show mac agetime Parameters None.000 seconds. Mode Switch command. Mode Switch command. Syntax set mac agetime time Parameters time Specifies the timeout period in seconds for agoning learned MAC  addresses. Example This example shows how to set the MAC timeout period: A2(su)->set mac agetime 250 11-22 Logging and Network Management . Default value is 300  seconds. Valid values are 10 to 1. Defaults None.

clear mac agetime clear mac agetime Use this command to reset the timeout period for aging learned MAC entries to the default value  of 300 seconds. Example This example shows how to reset the MAC timeout period to the default value of 300 seconds. read‐only. Syntax clear mac agetime Parameters None. Mode Switch command. A2(su)->clear mac agetime SecureStack A2 Configuration Guide 11-23 . Defaults None.

Example This example shows how to display SNTP client settings: A2(su)->show sntp SNTP Version: 3 Current Time: TUE SEP 09 16:13:33 2003 11-24 Logging and Network Management ... Defaults None. show sntp set sntp client clear sntp client set sntp server clear sntp server set sntp poll-interval clear sntp poll-interval set sntp poll-retry clear sntp poll-retry set sntp poll-timeout clear sntp poll-timeout Refer to page. Syntax show sntp Parameters None. Mode Switch command.. Commands For information about. read‐only. 11-24 11-26 11-26 11-27 11-27 11-28 11-28 11-29 11-29 11-30 11-30 show sntp Use this command to display SNTP client settings..Configuring Simple Network Time Protocol (SNTP) Configuring Simple Network Time Protocol (SNTP) Purpose To configure the Simple Network Time Protocol (SNTP). which synchronizes device clocks in a  network.

2. Status SecureStack A2 Configuration Guide 11-25 . Time zone name and amount it is offset from UTC (Universal Time).8. Table 11-6 Output SNTP Version Current Time Timezone Client Mode Broadcast Count Poll Interval Poll Retry Poll Timeout show sntp Output Details What It Displays.show sntp Timezone: 'EST'. Whether or not broadcast reception or unicast transmission and reception was successful.6 2 Active 144. Number of SNTP broadcast frames received. Default of 512 seconds can be reset using the set sntp poll-interval command (“set sntp poll-interval” on page 11-28). Set using set sntp client command (“set sntp client” on page 11-26). SNTP version number.111. Current time on the system clock.29. Highest precedence is 1 and lowest is 10. offset from UTC is -4 hours and 0 minutes Client Mode: unicast Broadcast Count: 0 Poll Interval: 512 seconds Poll Retry: 1 Poll Timeout: 5 seconds SNTP Poll Requests: 1175 Last SNTP Update: TUE SEP 09 16:05:24 2003 Last SNTP Request: TUE SEP 09 16:05:24 2003 Last SNTP Status: Success SNTP-Server Precedence Status ------------------------------------------10.. Precedence level of SNTP server in relation to its peers. Number of poll retries to a unicast SNTP server. Whether SNTP client is operating in unicast or broadcast mode. Default of 1 can be reset using the set sntp poll-retry command (“set sntp poll-retry” on page 11-29). Default of 5 seconds can be reset using set sntp poll-timeout command (“set sntp poll-timeout” on page 11-30). Whether or not the SNTP server is active.. Interval between SNTP unicast requests. Date and time of most recent SNTP request. Timeout for a response to a unicast SNTP request.19 1 Active Table 11‐6 provides an explanation of the command output. IP address(es) of SNTP server(s). SNTP Poll Requests Total number of SNTP poll requests. Default of 1 can be reset using the set sntp server command (“set sntp server” on page 11-27). Last SNTP Update Last SNTP Request Last SNTP Status SNTP-Server Precedence Date and time of most recent SNTP update.

Defaults None. Enables SNTP in unicast (point‐to‐point) client mode. Mode Switch command. Example This example shows how to clear the SNTP client’s operational mode: A2(su)->clear sntp client 11-26 Logging and Network Management .set sntp client set sntp client Use this command to set the SNTP operation mode. Example This example shows how to enable SNTP in broadcast mode: A2(su)->set sntp client broadcast clear sntp client Use this command to clear the SNTP client’s operational mode. read‐write. Mode Switch command. Syntax set sntp client {broadcast | unicast | disable} Parameters broadcast  unicast  disable Enables SNTP in broadcast client mode. Defaults None. In this mode. Disables SNTP. Syntax clear sntp client Parameters None. read‐write. the  client must supply the IP address from which to retrieve the current time.

Example This example shows how to remove the server at IP address 10. Removes all servers from the SNTP server list.set sntp server set sntp server Use this command to add a server from which the SNTP client will retrieve the current time when  operating in unicast mode. Mode Switch command.  Valid values are 1 (highest) to 10 (lowest). Defaults If precedence is not specified.  Mode Switch command.21.21.21.1.100 SecureStack A2 Configuration Guide 11-27 . Example This example shows how to set the server at IP address 10.1. read‐write.100 clear sntp server Use this command to remove one or all servers from the SNTP server list. Syntax set sntp server ip-address [precedence] Parameters ip‐address precedence Specifies the SNTP server’s IP address.100 as an SNTP server: A2(su)->set sntp server 10. Syntax clear sntp server {ip-address | all} Parameters ip‐address  all Specifies the IP address of a server to remove from the SNTP server list.21. read‐write.100 from the SNTP server list: A2(su)->clear sntp server 10. 1 will be applied. (Optional) Specifies this SNTP server’s precedence in relation to its peers. Defaults None. Up to 10 servers can be set as SNTP servers.1.1.

Syntax set sntp poll-interval interval Parameters  interval Specifies the poll interval in seconds. Defaults None. read‐write.  Defaults None. Mode Switch command. Mode Switch command.set sntp poll-interval set sntp poll-interval Use this command to set the poll interval between SNTP unicast requests. read‐write. Valid values are 16 to 16284. Syntax clear sntp poll-interval Parameters None. Example This example shows how to set the SNTP poll interval to 30 seconds: A2(su)->set sntp poll-interval 30 clear sntp poll-interval Use this command to clear the poll interval between unicast SNTP requests. Example This example shows how to clear the SNTP poll interval: A2(su)->clear sntp poll-interval 11-28 Logging and Network Management .

 read‐write. Mode Switch command. Valid values are 0 to 10. Example This example shows how to set the number of SNTP poll retries to 5: A2(su)->set sntp poll-retry 5 clear sntp poll-retry Use this command to clear the number of poll retries to a unicast SNTP server. Mode Switch command.set sntp poll-retry set sntp poll-retry Use this command to set the number of poll retries to a unicast SNTP server. Defaults None. Defaults None. read‐write. Example This example shows how to clear the number of SNTP poll retries: A2(su)->clear sntp poll-retry SecureStack A2 Configuration Guide 11-29 . Syntax set sntp poll-retry retry Parameters retry Specifies the number of retries. Syntax clear sntp poll-retry Parameters None.

set sntp poll-timeout set sntp poll-timeout Use this command to set the poll timeout (in seconds) for a response to a unicast SNTP request. Valid values are 1 to 30. Mode Switch command. Syntax clear sntp poll-timeout Parameters None. Syntax set sntp poll-timeout timeout Parameters timeout Specifies the poll timeout in seconds. Defaults None. Example This example shows how to set the SNTP poll timeout to 10 seconds: A2(su)->set sntp poll-timeout 10 clear sntp poll-timeout Use this command to clear the SNTP poll timeout.  Defaults None. read‐write. Example This example shows how to clear the SNTP poll timeout: A2(su)->clear sntp poll-timeout 11-30 Logging and Network Management . read‐write. Mode Switch command.

5 47 fe.2. node alias configurations will be displayed for all ports. and re‐enable node (port) alias functionality.2.2. which determines what network  protocols are running on one or more ports. show nodealias config set nodealias clear nodealias config Refer to page.4 47 fe.1-9 Port Number Max Entries --------------------fe.1 16 fe.2.6 47 fe.2.2. read‐only.2.  Defaults If port‐string is not specified. Example This example shows how to display node alias configuration settings for ports fe.8 47 fe. Commands For information about.. 11-31 11-32 11-33 show nodealias config Use this command to display node alias configuration settings on one or more ports.2.1 through 9: A2(rw)->show nodealias config fe.3 47 fe.2. Syntax show nodealias config [port-string] Parameters port‐string (Optional) Displays node alias configuration settings for specific port(s). disable.. Mode Switch command.7 47 fe.2 47 fe. SecureStack A2 Configuration Guide 11-31 .2.9 4000 Used Entries -----------0 0 2 0 0 2 0 0 1 Status -----Enable Enable Enable Enable Enable Enable Enable Enable Enable Table 11‐7 provides an explanation of the command output.2.Configuring Node Aliases Configuring Node Aliases Purpose To review...

 Valid range is 0 to  4096. Mode Switch command. The default value is 32.3 11-32 Logging and Network Management .1. Whether or not a node alias agent is enabled (default) or disabled on this port. Number of alias entries (out of the maximum amount configured) already used by this port. node aliases are dynamically assigned to ports enabled with an alias  agent. Maximum number of alias entries configured for this port. Example This example shows how to disable the node alias agent on fe. read‐write.1.  Defaults None.3: A2(su)->set nodealias disable fe. Node aliases cannot be statically  created. Set the maximum number of alias entries per ports.set nodealias Table 11-7 Output Port Number Max Entries Used Entries Status show nodealias config Output Details What It Displays.. Port designation. or set the  maximum number of alias entries per port. but can be deleted using the clear node alias command as described in “clear nodealias  config” on page 11‐33. Syntax set nodealias {enable | disable | maxentries maxentries} port-string Parameters enable | disable maxentries maxentries port‐string Enables or disables a node alias agent. Specifies the port(s) on which to enable/disable node alias agent or set  a maximum number of entries. Usage Upon packet reception. which is the default setting on SecureStack A2 devices. set nodealias Use this command to enable or disable a node alias agent on one or more ports..

 read‐write.  Defaults None.3: A2(su)->clear nodealias config fe.3 SecureStack A2 Configuration Guide 11-33 . Syntax clear nodealias config port-string Parameters port‐string Specifies the port(s) on which to reset the node alias configuration.1. Mode Switch command.1. Example This example shows how to reset the node alias configuration on fe.clear nodealias config clear nodealias config Use this command to reset node alias state to enabled and clear the maximum entries value.

clear nodealias config 11-34 Logging and Network Management .

 These MIB  “groups” each gather specific sets of data to meet common network monitoring requirements. jabbers. broadcast and multicast packets. RMON Monitoring Group Functions Statistics Group Commands History Group Commands Alarm Group Commands Event Group Commands Filter Group Commands Packet Capture Commands Refer to page. Records statistics measured by the RMON probe for each monitored interface on the device. For information about. CRC errors.12 Configuring RMON This chapter describes the commands used to configure RMON on a SecureStack A2 switch.  planning... What It Monitors.. CLI Command(s) “show rmon stats” on page 12-3 “set rmon stats” on page 12-5 “clear rmon stats” on page 12-6 SecureStack A2 Configuration Guide 12-1 . Table 12-1 RMON Group Statistics RMON Monitoring Group Functions and Commands What It Does. 12-1 12-3 12-7 12-10 12-15 12-19 12-24 RMON Monitoring Group Functions RMON (Remote Network Monitoring) provides comprehensive network fault diagnosis. and performance tuning information and allows for interoperability between SNMP  management stations and monitoring agents. fragments.. oversized and undersized packets. packets sent. RMON extends the SNMP MIB capability by  defining additional MIBs that generate a much richer set of data about network usage.  Table 12‐1 lists the RMON monitoring groups supported on SecureStack A2 devices. and counters for packets.. each group’s  function and the elements it monitors.... and the associated configuration commands needed. bytes sent (octets). Packets dropped.

Records periodic statistical samples from a network. starting threshold. What It Monitors. “show rmon channel” on page 12-19 “set rmon channel” on page 12-20 “clear rmon channel” on page 12-21 “show rmon filter” on page 12-21 “set rmon filter” on page 12-22 “clear rmon filter” on page 12-23 Packet Capture Allows packets to be captured upon a filter match.. last time event was sent. Alarm type. Controls the generation and notification of events from the device. “show rmon capture” on page 12-24 “set rmon capture” on page 12-25 “clear rmon capture” on page 12-26 12-2 Configuring RMON .. an event is generated. “show rmon event” on page 12-15 “set rmon event properties” on page 12-16 “set rmon event status” on page 12-17 “clear rmon event” on page 12-18 Filter Allows packets to be matched by a filter equation.RMON Monitoring Group Functions Table 12-1 RMON Group History RMON Monitoring Group Functions and Commands (Continued) What It Does. Packets matching the filter configuration. description. “show rmon alarm” on page 12-10 “set rmon alarm properties” on page 12-11 “set rmon alarm status” on page 12-13 “clear rmon alarm” on page 12-14 Event Event type.. interval. stop threshold. Sample period.. These matched packets form a data stream or “channel” that may be captured. CLI Command(s) “show rmon history” on page 12-7 “set rmon history” on page 12-8 “clear rmon history” on page 12-9 Alarm Periodically gathers statistical samples from variables in the probe and compares them with previously configured thresholds. If the monitored variable crosses a threshold. number of samples and item(s) sampled. Packets matching the filter configuration.

Note: Due to hardware limitations..Statistics Group Commands Statistics Group Commands Purpose To display. show rmon stats set rmon stats clear rmon stats Refer to page.  Syntax show rmon stats [port-string] Parameters port‐string (Optional) Displays RMON statistics for specific port(s). Example This example shows how to display RMON statistics for Gigabit Ethernet port 1 in switch 1.  Defaults If port‐string is not specified.1 : Port: ge. Mode Switch command.127 Octets = = = = 0 0 0 0 SecureStack A2 Configuration Guide 12-3 .1. configure. RMON stats will be displayed for all ports..1.1 Drop Events Collisions Jabbers Broadcast Pkts = = = = 0 0 0 0 Packets Octets 0 64 Octets 65 . A2(su)->show rmon stats ge. read‐only.. the only frame error counted is oversized frames.. 12-3 12-5 12-6 show rmon stats Use this command to display RMON statistics measured for one or more ports.1 ------------------------------------Index = 1 Owner = monitor Data Source = ifIndex. Commands For information about. and clear RMON statistics.

show rmon stats

Multicast Pkts CRC Errors Undersize Pkts Oversize Pkts Fragments

= = = = =

0 0 0 0 0

128 256 512 1024

- 255 Octets - 511 Octets - 1023 Octets - 1518 Octets

= = = =

0 0 0 0

Table 12‐2 provides an explanation of the command output. Table 12-2
Output Port Owner Data Source Drop Events

show rmon stats Output Details
What It Displays... Port designation. Name of the entity that configured this entry. Monitor is default. Data source of the statistics being displayed. Total number of times that the switch was forced to discard frames due to lack of available switch device resources. This does not display the number of frames dropped, only the number of times the switch was forced to discard frames. Total number of collisions that have occurred on this interface. Total number of frames that were greater than 1518 bytes and had either a bad FCS or a bad CRC. Total number of frames (including bad frames, broadcast frames, and multicast frames) received on this interface. Total number of good frames that were directed to the broadcast address. This value does not include multicast frames. Total number of good frames that were directed to the multicast address. This value does not include broadcast frames. Number of frames with bad Cyclic Redundancy Checks (CRC) received from the network. The CRC is a 4-byte field in the data frame that ensures that the data received is the same as the data that was originally sent. Number of frames received containing less than the minimum Ethernet frame size of 64 bytes (not including the preamble) but having a valid CRC. Number of frames received that exceeded 1518 data bytes (not including the preamble) but had a valid CRC. Number of received frames that are not the minimum number of bytes in length, or received frames that had a bad or missing Frame Check Sequence (FCS), were less than 64 bytes in length (excluding framing bits, but including FCS bytes) and had an invalid CRC. It is normal for this value to increment since fragments are a normal result of collisions in a half-duplex network. Total number of packets, including bad, broadcast and multicast. Total number of octets (bytes) of data, including those in bad frames, received on this interface. Total number of frames, including bad frames, received that were 64 bytes in length (excluding framing bits, but including FCS bytes). Total number of frames, including bad frames, received that were between 65 and 127 bytes in length (excluding framing bits, but including FCS bytes). Total number of frames, including bad frames, received that were between 128 and 255 bytes in length (excluding framing bits, but including FCS bytes). Total number of frames, including bad frames, received that were between 256 and 511 bytes in length (excluding framing bits, but including FCS bytes).

Collisions Jabbers Packets Broadcast Pkts Multicast Pkts CRC Errors

Undersize Pkts Oversize Pkts Fragments

Packets Octets 0 – 64 Octets 65 – 127 Octets 128 – 255 Octets 256 – 511 Octets

12-4

Configuring RMON

set rmon stats

Table 12-2
Output

show rmon stats Output Details (Continued)
What It Displays... Total number of frames, including bad frames, received that were between 512 and 1023 bytes in length (excluding framing bits, but including FCS bytes). Total number of frames, including bad frames, received that were between 1024 and 1518 bytes in length (excluding framing bits, but including FCS bytes).

512 – 1023 Octets 1024 – 1518 Octets

set rmon stats
Use this command to configure an RMON statistics entry.

Syntax
set rmon stats index port-string [owner]

Parameters
index port‐string owner Specifies an index for this statistics entry. Specifies port(s) to which this entry will be assigned. (Optional) Assigns an owner for this entry.

Defaults
If owner is not specified, monitor will be applied.

Mode
Switch command, read‐write.

Example
This example shows how to configure RMON statistics entry 2 for ge.1.20:
A2(rw)->set rmon stats 2 ge.1.20

SecureStack A2 Configuration Guide

12-5

clear rmon stats

clear rmon stats
Use this command to delete one or more RMON statistics entries.

Syntax
clear rmon stats {index-list | to-defaults}

Parameters
index‐list to‐defaults Specifies one or more stats entries to be deleted, causing them to disappear  from any future RMON queries. Resets all history entries to default values. This will cause entries to  reappear in RMON queries.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to delete RMON statistics entry 2:
A2(rw)->clear rmon stats 2

12-6

Configuring RMON

History Group Commands

History Group Commands
Purpose
To display, configure, and clear RMON history properties and statistics.

Commands
For information about... show rmon history set rmon history clear rmon history Refer to page... 12-7 12-8 12-9

show rmon history
Use this command to display RMON history properties and statistics. The RMON history group  records periodic statistical samples from a network.

Syntax
show rmon history [port-string]

Parameters
port‐string (Optional) Displays RMON history entries for specific port(s).

Defaults
If port‐string is not specified, information about all RMON history entries will be displayed.

Mode
Switch command, read‐only.

Example
This example shows how to display RMON history entries for Gigabit Ethernet port 1 in switch 1.  A control entry displays first, followed by actual entries corresponding to the control entry. In this  case, the default settings for entry owner, sampling interval, and maximum number of entries.  (buckets) have not been changed from their default values. For a description of the types of  statistics shown, refer to Table 12‐2.
A2(su)->show rmon history ge.1.1
:

Port: ge.1.1 ------------------------------------Index 1 Owner = monitor Status = valid Data Source = ifIndex.1 Interval = 30 Buckets Requested = 50 Buckets Granted = 10
SecureStack A2 Configuration Guide 12-7

set rmon history

Sample 2779 Drop Events Octets Packets Broadcast Pkts Multicast Pkts CRC Align Errors

= = = = = =

Interval Start: 1 days 0 hours 2 minutes 22 seconds 0 Undersize Pkts = 0 0 Oversize Pkts = 0 0 Fragments = 0 0 Jabbers = 0 0 Collisions = 0 0 Utilization(%) = 0

set rmon history
Use this command to configure an RMON history entry.

Syntax
set rmon history index [port-string] [buckets buckets] [interval interval] [owner owner]

Parameters
index‐list port‐string buckets buckets interval interval owner owner Specifies an index number for this entry. (Optional) Assigns this entry to a specific port. (Optional) Specifies the maximum number of entries to maintain. (Optional) Specifies the sampling interval in seconds. (Optional) Specifies an owner for this entry.

Defaults
If buckets is not specified, the maximum number of entries maintained will be 50. If not specified, interval will be set to 30 seconds. If owner is not specified, monitor will be applied.

Mode
Switch command, read‐write.

Example
This example shows how configure RMON history entry 1 on port fe.2.1 to sample every 20  seconds:
A2(rw)->set rmon history 1 fe.2.1 interval 20

12-8

Configuring RMON

clear rmon history

clear rmon history
Use this command to delete one or more RMON history entries or reset one or more entries to  default values. For specific values, refer to “set rmon history” on page 12‐8.

Syntax
clear rmon history {index-list | to-defaults}

Parameters
index‐list to‐defaults Specifies one or more history entries to be deleted, causing them to  disappear from any future RMON queries. Resets all history entries to default values. This will cause entries to  reappear in RMON queries.

Defaults
None.

Mode
Switch command, read‐write.

Example
This example shows how to delete RMON history entry 1:
A2(rw)->clear rmon history 1

SecureStack A2 Configuration Guide

12-9

Alarm Group Commands

Alarm Group Commands
Purpose
To display, configure, and clear RMON alarm entries and properties.

Commands
For information about... show rmon alarm set rmon alarm properties set rmon alarm status clear rmon alarm Refer to page... 12-10 12-11 12-13 12-14

show rmon alarm
Use this command to display RMON alarm entries. The RMON alarm group periodically takes  statistical samples from RMON variables and compares them with previously configured  thresholds. If the monitored variable crosses a threshold an RMON event is generated.

Syntax
show rmon alarm [index]

Parameters
index (Optional) Displays RMON alarm entries for a specific entry index ID.

Defaults
If index is not specified, information about all RMON alarm entries will be displayed.

Mode
Switch command, read‐only.

Example
This example shows how to display RMON alarm entry 3:
A2(rw)->show rmon alarm 3 Index 3 --------------------Owner = Status = Variable = Sample Type = Interval = Rising Threshold = Rising Event Index =

Manager valid 1.3.6.1.4.1.5624.1.2.29.1.2.1.0 delta Startup Alarm 30 Value 1 Falling Threshold 2 Falling Event Index

= = = =

rising 0 0 0

Table 12‐3 provides an explanation of the command output.
12-10 Configuring RMON

set rmon alarm properties

Table 12-3
Output Index Owner Status Variable Sample Type

show rmon alarm Output Details
What It Displays... Index number for this alarm entry. Text string identifying who configured this entry. Whether this event entry is enabled (valid) or disabled. MIB object to be monitored. Whether the monitoring method is an absolute or a delta sampling. Whether alarm generated when this entry is first enabled is rising, falling, or either. Interval in seconds at which RMON will conduct sample monitoring. Minimum threshold for causing a rising alarm. Maximum threshold for causing a falling alarm. Index number of the RMON event to be triggered when the rising threshold is crossed. Index number of the RMON event to be triggered when the falling threshold is crossed.

Startup Alarm Interval Rising Threshold Falling Threshold Rising Event Index Falling Event Index

set rmon alarm properties
Use this command to configure an RMON alarm entry, or to create a new alarm entry with an  unused alarm index number. 

Syntax
set rmon alarm properties index [interval interval] [object object] [type {absolute | delta}] [startup {rising | falling | either}] [rthresh rthresh] [fthresh fthresh] [revent revent] [fevent fevent] [owner owner]

Parameters
index interval interval object object Specifies an index number for this entry. Maximum number or entries is  50. Maximum value is 65535. (Optional) Specifies an interval (in seconds) for RMON to conduct sample  monitoring.  (Optional) Specifies a MIB object to be monitored.
Note: This parameter is not mandatory for executing the command, but must be specified in order to enable the alarm entry configuration.

type absolute |  delta

(Optional) Specifies the monitoring method as: sampling the absolute  value of the object, or the difference (delta) between object samples.

SecureStack A2 Configuration Guide

12-11

set rmon alarm properties

startup rising |  falling | either

(Optional) Specifies the type of alarm generated when this event is first  enabled as: • Rising ‐ Sends alarm when an RMON event reaches a maximum  threshold condition is reached, for example, more than 30 collisions  per second. Falling ‐ Sends alarm when RMON event falls below a minimum  threshold condition, for example when the network is behaving  normally again. Either ‐ Sends alarm when either a rising or falling threshold is  reached.

• rthresh rthresh fthresh fthresh revent revent fevent fevent owner owner

(Optional) Specifies a minimum threshold for causing a rising alarm.  Specifies a maximum threshold for causing a falling alarm. Specifies the index number of the RMON event to be triggered when the  rising threshold is crossed. Specifies the index number of the RMON event to be triggered when the  falling threshold is crossed. (Optional) Specifies the name of the entity that configured this alarm  entry.

Defaults
interval ‐ 3600 seconds type ‐ absolute startup ‐ rising rthresh ‐ 0 fthresh ‐ 0 revent ‐ 0 fevent ‐ 0 owner ‐ monitor

Mode
Switch command, read‐write.

Example
This example shows how to configure a rising RMON alarm. This entry will conduct monitoring  of the delta between samples every 30 seconds:
A2(rw)->set rmon alarm properties 3 interval 30 object 1.3.6.1.4.1.5624.1.2.29.1.2.1.0 type delta rthresh 1 revent 2 owner Manager

12-12

Configuring RMON

 then enabled using this  command. Maximum number or entries is  50. Maximum value is 65535.  Syntax set rmon alarm status index enable Parameters index enable Specifies an index number for this entry. An RMON alarm entry can be created and configured at the same time by specifying  an unused index with the set rmon alarm properties command.set rmon alarm status set rmon alarm status Use this command to enable an RMON alarm entry. Defaults None. An alarm is a notification that a statistical  sample of a monitored variable has crossed a configured threshold. read‐write. Example This example shows how to enable RMON alarm entry 3: A2(rw)->set rmon alarm status 3 enable SecureStack A2 Configuration Guide 12-13 . configured using the set rmon alarm  properties command (“set rmon alarm properties” on page 12‐11). Mode Switch command. Usage An RMON alarm entry can be created using this command. Enables this alarm entry.

Mode Switch command. Example This example shows how to clear RMON alarm entry 1: A2(rw)->clear rmon alarm 1 12-14 Configuring RMON . Defaults None.clear rmon alarm clear rmon alarm Use this command to delete an RMON alarm entry. Syntax clear rmon alarm index Parameters index Specifies the index number of entry to be cleared. read‐write.

Commands For information about.. SecureStack A2 Configuration Guide 12-15 .. show rmon event set rmon event properties set rmon event status clear rmon event Refer to page. read‐only.Event Group Commands Event Group Commands Purpose To display and clear RMON events. and to configure RMON event properties. 12-15 12-16 12-17 12-18 show rmon event Use this command to display RMON event entry properties... information about all RMON entries will be displayed. Mode Switch command. Example This example shows how to display RMON event entry 3: A2(rw)->show rmon event 3 Index 3 ---------------Owner = Status = Description = Type = Community = Last Time Sent = Manager valid STP Topology change log-and-trap public 0 days 0 hours 0 minutes 37 seconds Table 12‐4 provides an explanation of the command output. Defaults If index is not specified. Syntax show rmon event [index] Parameters index (Optional) Displays RMON properties and log entries for a specific entry  index ID.

(Optional) Specifies the name of the entity that configured this entry. SNMP community name if message type is set to trap. (Optional) Specifies an SNMP community name to use if the message  type is set to trap. owner owner Defaults If description is not specified. 12-16 Configuring RMON . If owner is not specified. read‐write. Last Time Sent set rmon event properties Use this command to configure an RMON event entry. Index number for this event entry.  Syntax set rmon event properties index [description description] [type {none | log | trap | both}] [community community] [owner owner] Parameters index description  description type none | log |  trap | both community  community Specifies an index number for this entry. none will be applied. monitor will be applied. Mode Switch command. Text string description of this event. refer to “Creating a Basic SNMP Trap Configuration” on  page 5‐41. Text string identifying who configured this entry. Maximum number of entries is  100. and SNMP trap. For details on setting SNMP traps and community  names. an SNMP trap. or to create a new event entry with an  unused event index number. Maximum value is 65535. a log  table entry.. When an event notification matching this entry was sent.set rmon event properties Table 12-4 Output Index Owner Status Description Type Community show rmon event Output Details What It Displays. If not specified. (Optional) Specifies a text string description of this event. Whether this event entry is enabled (valid) or disabled. or none.. or both a log entry and a trap message. (Optional) Specifies the type of RMON event notification as: none. Whether the event notification will be a log entry. type none will be applied. both.

  Syntax set rmon event status index enable Parameters index enable Specifies an index number for this entry. Events can be fired by RMON alarms and can be configured to  create a log entry.set rmon event status Example This example shows how to create and enable an RMON event entry called “STP topology  change” that will send both a log entry and an SNMP trap message to the “public” community: A2(rw)->set rmon event properties 2 description "STP topology change" type both community public owner Manager set rmon event status Use this command to enable an RMON event entry. Maximum value is 65535. Usage An RMON event entry can be created using this command. Mode Switch command. An RMON event entry can be created and configured at the same time by specifying an  unused index with the set rmon event properties command. read‐write. or both. generate a trap. Enables this event entry. Example This example shows how to enable RMON event entry 1: A2(rw)->set rmon event status 1 enable SecureStack A2 Configuration Guide 12-17 . then enabled using this  command. Maximum number of entries is  100. configured using the set rmon event  properties command (“set rmon event properties” on page 12‐16). Defaults None. An event entry describes the parameters of an  RMON event that can be triggered.

 read‐write. Defaults None.clear rmon event clear rmon event Use this command to delete an RMON event entry and any associated log entries. Syntax clear rmon event index Parameters index Specifies the index number of the entry to be cleared. Mode Switch command. Example This example shows how to clear RMON event 1: A2(rw)->clear rmon event 1 12-18 Configuring RMON .

 read‐only. Therefore. the buffer will be overwritten... Filtering will be performed on the frames  captured in the buffer. Only one interface can be configured  for capturing and filtering at a time. and  buffer control information will be saved across resets. the capture will stop.Filter Group Commands Filter Group Commands The packet capture and filter function is disabled by default..  When packet capture is enabled on an interface. but captured frames within the buffer will  not be saved. the SecureStack A2 switch will capture 100 frames  as close to sequentially as possible. This function cannot be used concurrently with port mirroring. The system will check to prevent  concurrently enabling both functions. with up to three filters. show rmon channel set rmon channel clear rmon channel show rmon filter set rmon filter clear rmon filter Refer to page. Defaults If port‐string is not specified. If  there is data in the buffer when the function is started. These 100 frames will be placed into a buffer for inspection. only a subset of the frames captured will be available for display. Note: Packet capture is sampling only and does not guarantee receipt of back to back packets. filter. and a warning will be generated in the CLI if attempted. One channel at a time can be supported. 12-19 12-20 12-21 12-21 12-22 12-23 show rmon channel Use this command to display RMON channel entries for one or more ports. SecureStack A2 Configuration Guide 12-19 . Mode Switch command.. Syntax show rmon channel [port-string] Parameters port‐string (Optional) Displays RMON channel entries for a specific port(s). information about all channels will be displayed. Commands For information about. Once 100  frames have been captured. Configured channel.

(Optional) Specifies a description for this channel. control will be set to off. it will be set to monitor. Syntax set rmon channel index port-string [accept {matched | failed}] [control {on | off}] [description description] [owner owner] Parameters index Specifies an index number for this entry. If a description is not specified. Maximum value is 65535. Mode Switch command.2. none will be applied.2.12: A2(rw)->show rmon channel fe. Maximum number of  entries is 2.  Specifies the port on which traffic will be monitored. 12-20 Configuring RMON . Defaults If an action is not specified. If owner is not specified. (Optional) Specifies the action of the filters on this channel as: • • control on | off description  description owner owner matched ‐ Packets will be accepted on filter matches failed ‐ Packets will be accepted if they fail a match port‐string accept matched |  failed (Optional) Enables or disables control of the flow of data through the  channel.12 Channel index= 628 EntryStatus= valid ---------------------------------------------------------Control off AcceptType matched OnEventIndex 0 OffEventIndex 0 EventIndex 0 Status ready Matches 4498 Description Thu Dec 16 12:57:32 EST 2004 Owner NetSight smith set rmon channel Use this command to configure an RMON channel entry. (Optional) Specifies the name of the entity that configured this entry. packets will be accepted on filter matches. If not specified.12 Port fe. read‐write. An entry will automatically be  created if an unused index number is chosen.set rmon channel Example This example shows how to display RMON channel information for fe.2.

2. read‐only. Example This example shows how to display all RMON filter entries and channel information: A2(rw)->show rmon filter SecureStack A2 Configuration Guide 12-21 . Defaults None. Mode Switch command.clear rmon channel Example This example shows how to create an RMON channel entry: A2(rw)->set rmon channel 54313 fe. Defaults If no options are specified. information for all filter entries will be displayed. Syntax show rmon filter [index index | channel channel] Parameters index index |  channel channel (Optional) Displays information about a specific filter entry. Example This example shows how to clear RMON channel entry 2: A2(rw)->clear rmon channel 2 show rmon filter Use this command to display one or more RMON filter entries.12 accept failed control on description "capture all" clear rmon channel Use this command to clear an RMON channel entry. read‐write. Syntax clear rmon channel index Parameters index Specifies the channel entry to be cleared. Mode Switch command. or about all  filters which belong to a specific channel.

channel‐index offset offset status status smask smask snotmask snotmask data data dmask dmask dnotmask dnotmask owner Defaults If owner is not specified. none (0) will be applied. Syntax set rmon filter index channel-index [offset offset] [status status] [smask smask] [snotmask snotmask] [data data] [dmask dmask] [dnotmask dnotmask] [owner owner] Parameters index Specifies an index number for this entry. (Optional) Specifies an offset from the beginning of the packet to look for  matches. (Optional) Specifies the inversion mask that indicates which bits should  be set or not set (Optional) Specifies the data to be matched. 12-22 Configuring RMON .NAC-D ----------------------------Data ff ff ff ff ff ff ----------------------------DataMask ff ff ff ff ff ff ----------------------------DataNotMask 00 00 00 00 00 00 set rmon filter Use this command to configure an RMON filter entry. (Optional) Specifies the mask applied to data to indicate which bits are  significant. (Optional) Specifies the name of the entity that configured this entry.  Specifies the channel to which this filter will be applied. read‐write.  If no other options are specified. it will be set to monitor.set rmon filter Index= 55508 Channel Index= 628 EntryStatus= valid ---------------------------------------------------------Data Offset 0 PktStatus 0 PktStatusMask 0 PktStatusNotMask 0 Owner ETS. An entry will automatically be  created if an unused index number is chosen. Maximum value is 65535. (Optional) Specifies packet status bits that are to be matched. (Optional) Specifies the mask applied to status to indicate which bits are  significant. Mode Switch command. Maximum number of  entries is 10. (Optional) Specifies the inversion mask that indicates which bits should  be set or not set.

Syntax clear rmon filter {index index | channel channel} Parameters index index |  channel channel Clears a specific filter entry. read‐write. or all entries belonging to a specific channel.clear rmon filter Example This example shows how to create RMON filter 1 and apply it to channel 9: A2(rw)->set rmon filter 1 9 offset 30 data 0a154305 dmask ffffffff clear rmon filter Use this command to clear an RMON filter entry. Example This example shows how to clear RMON filter entry 1: A2(rw)->clear rmon filter index 1 SecureStack A2 Configuration Guide 12-23 . Defaults None. Mode Switch command.

show rmon capture set rmon capture clear rmon capture Refer to page.Packet Capture Commands Packet Capture Commands Note that packet capture filter is sampling only and does not guarantee receipt of back to back  packets. enable... (Optional) Displays only the buffer control entry specified by index. all buffer control entries and associated captured packets will be  displayed. Defaults If no options are specified.. configure. Syntax show rmon capture [index [nodata]] Parameters index nodata (Optional) Displays the specified buffer control entry and all captured  packets associated with that entry. 12-24 12-25 12-26 show rmon capture Use this command to display RMON capture entries and associated buffer control entries. Purpose To display RMON capture entries.. Mode Switch command. Example This example shows how to display RMON capture entries and associated buffer entries: A2(rw)->show rmon capture Buf.control= 28062 Channel= 38283 EntryStatus= valid ---------------------------------------------------------FullStatus avail FullAction lock Captured packets 251 Capture slice 1518 Download size 100 Download offset 0 Max Octet Requested 50000 Max Octet Granted 50000 Start time 1 days 0 hours 51 minutes 15 seconds 12-24 Configuring RMON . Commands For information about. and clear capture  entries. or disable capture entries. read‐only.

If owner is not specified. (Optional) Specifies the maximum octets from each packet to be  downloaded from the buffer. Currently. owner Defaults If not specified. (Optional) Specifies the first octet from each packet that will be retrieved. SecureStack A2 Configuration Guide 12-25 . If not specified. If not specified. the only value accepted is ‐1. 100 will be applied. If loadsize is not specified. Syntax set rmon capture index {channel [action {lock}] [slice slice] [loadsize loadsize] [offset offset] [asksize asksize] [owner owner]} Parameters index channel action lock  Specifies a buffer control entry. (Optional) Specifies the action of the buffer when it is full as: • slice slice loadsize loadsize offset offset asksize asksize lock ‐ Packets will cease to be accepted (Optional) Specifies the maximum octets from each packet to be saved in  a buffer. the only value allowed is 1518. 1518 will be applied. The default is 100. offset defaults to 0. Specifies the channel to which this capture entry will be applied.set rmon capture Owner monitor captureEntry= 1 Buff. Currently.control= 28062 -------------------------------------------Pkt ID 9 Pkt time 1 days 0 hours 51 minutes 15 seconds Pkt Length 93 Pkt status 0 Data: 00 00 5e 00 01 01 00 01 f4 00 7d ce 08 00 45 00 00 4b b4 b9 00 00 40 11 32 5c 0a 15 43 05 86 8d bf e5 00 a1 0e 2b 00 37 cf ca 30 2d 02 01 00 04 06 70 75 62 6c 69 63 a2 20 02 02 0c 92 02 01 00 02 01 00 30 14 30 12 06 0d 2b 06 01 02 01 10 07 01 01 0b 81 fd 1c 02 01 01 00 11 0b 00 set rmon capture Use this command to configure an RMON capture entry. which requests as many  octets as possible. it will be set to monitor. asksize defaults to ‐1 (which will request as many octets as possible) If slice is not specified. (Optional) Specifies the name of the entity that configured this entry. action defaults to lock. (Optional) Specifies the requested maximum octets to be saved in this  buffer.

 read‐write.clear rmon capture Mode Switch command. Example This example shows how to create RMON capture entry 1 to “listen” on channel 628: A2(rw)->set rmon capture 1 628 clear rmon capture Use this command to clears an RMON capture entry. Defaults None. Mode Switch command. read‐write. Syntax clear rmon capture index Parameters index  Specifies the capture entry to be cleared. Example This example shows how to clear RMON capture entry 1: A2(rw)->clear rmon capture 1 12-26 Configuring RMON .

 the DHCP server can also be configured to assign the  following to requesting clients: • • Default router(s) DNS server(s) and domain name SecureStack A2 Configuration Guide 13-1 .13 Configuring DHCP Server This chapter describes the commands to configure the IPv4 DHCP server functionality on a  SecureStack A2 switch. and whether the address  assignment is dynamic (automatic)  or static (. DHCP Overview Configuring General DHCP Server Parameters Configuring IP Address Pools Refer to page.. For information about. the lease expiration. This is managed by means of “static”  address pools configured on the server. DHCP Server DHCP server functionality allows the SecureStack A2 switch to provide basic IP configuration  information to a client on the network who requests such information using the DHCP protocol.manual). and DHCP is used  simply to convey the assigned address to the client.  Manual—A client’s IP address is assigned by the network administrator.  In addition to assigning IP addresses. 13-1 13-3 13-11 DHCP Overview Dynamic Host Configuration Protocol (DHCP) for IPv4 is a network layer protocol that  implements automatic or manual assignment of IP addresses and other configuration information  to client devices by servers. • The amount of time that a particular IP address is valid for a system is called a lease.. A DHCP server manages a user‐configured pool of IP addresses from  which it can make assignments upon client requests. A relay agent passes DHCP messages  between clients and servers which are on different physical subnets.  DHCP provides the following mechanisms for IP address allocation by a DHCP server: • Automatic—DHCP server assigns an IP address to a client for a limited period of time (or  until the client explicitly relinquishes the address) from a defined pool of IP addresses  configured on the server.. The  SecureStack A2 maintains a lease database which contains information about each assigned IP  address. the MAC address to which it is assigned. The DHCP lease database is stored in flash  memory..

10 Note: The IP address of the system’s host port is automatically excluded.0.0. The following tasks provide basic DHCP server functionality when the DHCP pool is associated  with the system’s host IP address.255.0.0 2. or enabling conflict logging.50 mask 255.255. and  configure the IP address and mask for the manual binding. The only required steps are  to name the pool and define the network number and mask for the pool. Configuring a DHCP Server For DHCP to function on SecureStack A2 systems.1 192.0. For example: set dhcp exclude 192. 13-2 Configuring DHCP Server .255. Up to 128 non‐overlapping address ranges can be excluded  on the SecureStack A2.2233.0 All DHCP clients served by this switch must be in the same VLAN as the system’s host port.DHCP Overview • • • NetBIOS WINS server(s) and node name Boot file DHCP options as defined by RFC 2132 Note: A total of 16 address pools. Note that the pool  has to be in the same subnet and use the same mask as the system host port IP address.255. • Configure static address pools for manual address assignment. For  example: set dhcp pool auto-pool network 192.0. the system has to “know about” the IP network  for which the DHCP pool is to be created. The only required steps are to  name the pool. dynamic and/or static. the system then “knows” about the configured subnet. Configure the system (stack) host port IP address with the set ip address command. For  example: set ip address 192. can be configured on the SecureStack A2. Optional DHCP server tasks include: • You can limit the scope of addresses assigned to a pool for dynamic address assignment with  the set dhcp exclude command.255.200 255.255.4455 set dhcp pool static-pool host 192.0 • Set other DHCP server parameters such as the number of ping packets to be sent before  assigning an IP address.0. configure either the hardware address of the client or the client identifier.0.0. Once the  system’s IP address is configured. 3.0. Configure an IP address pool for dynamic IP address assignment.0.   1. This is done by associating the DHCP address pool with  the switch’s host port IP address. Enable DHCP server functionality on the system with the set dhcp enable command.0 255. For example: set dhcp pool static-pool hardware-address 0011.

set dhcp set dhcp bootp set dhcp conflict logging show dhcp conflict clear dhcp conflict set dhcp exclude clear dhcp exclude set dhcp ping clear dhcp ping show dhcp binding clear dhcp binding show dhcp server statistics clear dhcp server statistics Refer to page. Mode Switch command. and conflict information. DHCP server is  disabled.. Commands Commands to configure DHCP server parameters and to display and clear DHCP server  information are listed below.. Defaults None.  server statistics. SecureStack A2 Configuration Guide 13-3 . read‐write. 13-3 13-4 13-4 13-5 13-5 13-6 13-7 13-7 13-8 13-8 13-9 13-9 13-10 set dhcp Use this command to enable or disable the DHCP server functionality on the SecureStack A2.. By default.Configuring General DHCP Server Parameters Configuring General DHCP Server Parameters Purpose To configure DHCP server parameters. For information about. Syntax set dhcp {enable | disable} Parameters enable | disable Enable or disable DHCP server functionality.. and to display and clear address binding information.

Syntax set dhcp conflict logging Parameters None. read‐write. address allocation for BOOTP clients is disabled. conflict logging is enabled. A2(rw)->set dhcp enable set dhcp bootp Use this command to enable or disable automatic address allocation for BOOTP clients. Example This example enables address allocation for BOOTP clients. Defaults None. A2(rw)->set dhcp bootp enable set dhcp conflict logging Use this command to enable conflict logging. Use the clear  dhcp conflict logging command to disable conflict logging. Example This example enables DHCP conflict logging. “Interoperation  Between DHCP and BOOTP.set dhcp bootp Example This example enables DHCP server functionality. Refer to RFC 1534. By  default. Syntax set dhcp bootp {enable | disable} Parameters enable | disable Enable or disable address allocation for BOOTP clients.  A2(rw)->set dhcp conflict logging 13-4 Configuring DHCP Server . Defaults None. Mode Switch command. Mode Switch command. read‐write.” for more information. By default.

3 192. conflict information for all addresses is displayed.4 192. Mode Read‐only.0. Syntax clear dhcp conflict {logging | ip-address| *} Parameters logging ip‐address * Disable conflict logging.0. or to disable conflict  logging.12 Detection Method ----------------Ping Ping Ping Ping Detection Time --------------0 days 19h:01m:23s 0 days 19h:00m:46s 0 days 19h:01m:25s 0 days 19h:01m:26s clear dhcp conflict Use this command to clear conflict information for one or all addresses.2 192. A2(ro)->show dhcp conflict IP address ----------192. Example This example displays conflict information for all addresses. read‐write. for one address or all addresses.0. Mode Switch command.0. SecureStack A2 Configuration Guide 13-5 . Note that ping is the only detection  method used.0.0. Clear the conflict information for all IP addresses.0. Defaults None.0. Defaults If no address is specified. Syntax show dhcp conflict [address] Parameters address [Optional] Specifies the address for which to display conflict information. Clear the conflict information for the specified IP address.show dhcp conflict show dhcp conflict Use this command to display conflict information.

28. A2(rw)set dhcp pool auto1 network 172.20.0 24 A2(rw)->set dhcp exclude 172. Up to 128 non‐ overlapping address ranges can be excluded. Example This example first configures the address pool named “auto1” with 255 addresses for the Class C  network 172. Mode Switch command.0.28. with the set dhcp pool network command.80 172. (Optional) Specifies the last IP address in the address range to be  excluded. A2(rw)->clear dhcp conflict 192. read‐write.100 13-6 Configuring DHCP Server .0. Syntax set dhcp exclude low-ipaddr [high-ipaddr] Parameters low‐ipaddr high‐ipaddr Specifies the first IP address in the address range to be excluded from  assignment. with the set dhcp exclude command.20. Then.0.2.  A2(rw)->clear dhcp conflict logging This example clears the conflict information for the IP address 192.2 set dhcp exclude Use this command to configure the IP addresses that the DHCP server should not assign to DHCP  clients.0. Multiple address ranges can be configured but the ranges cannot overlap.20.28.0. the example limits the  scope of the addresses that can be assigned by a DHCP server by excluding addresses 172.80  – 100.28.20.28.20. Defaults None.set dhcp exclude Examples This example disables DHCP conflict logging.

clear dhcp exclude clear dhcp exclude Use this command to clear the configured IP addresses that the DHCP server should not assign to  DHCP clients. Defaults None. Syntax set dhcp ping packets number Parameters packets number Specifies the number of ping packets to be sent. or range from 2 to 10. A2(rw)->set dhcp ping packets 3 SecureStack A2 Configuration Guide 13-7 . The value of number can  be 0. Mode Switch command. read‐write.1. Syntax clear dhcp exclude low-ipaddr [high-ipaddr] Parameters low‐ipaddr high‐ipaddr Specifies the first IP address in the address range to be cleared. Entering 0 disables this function.168.100 set dhcp ping Use this command to configure the number of ping packets the DHCP server sends to an IP  address before assigning the address to a requesting client. Example This example sets the number of ping packets sent to 3. read‐write.88 192. Example This example clears the previously excluded range of IP addresses between 192.1.168.1. A2(rw)->clear dhcp exclude 192.168. Defaults None.1.168. The default  value is 2 packets.100. (Optional) Specifies the last IP address in the address range to be cleared. Mode Switch command.88 through  192.

Example This example resets the number of ping packets sent back to the default value. Example This example displays binding information about all addresses. Mode Read‐only.0. A2(rw)->clear dhcp ping packets show dhcp binding Use this command to display binding information for one or all IP addresses.0.0. Syntax show dhcp binding [ip-address] Parameters ip‐address (Optional) Specifies the IP address for which to display binding  information. A2(rw)->show dhcp binding IP address Hardware Address --------------------------192.0.6 00:33:44:56:22:39 192.12 00:33:44:56:22:36 13-8 Configuring DHCP Server Lease Expiration ----------------00:11:02 00:10:22 00:09:11 00:10:05 00:10:30 Type ----Automatic Automatic Automatic Automatic Automatic .0. Defaults If no IP address is specified. Defaults None.0.0. read‐write.0.8 00:33:44:56:22:33 192. Syntax clear dhcp ping packets Parameters None.0.0.clear dhcp ping clear dhcp ping Use this command to reset the number of ping packets sent by the DHCP server back to the  default value of 2.11 00:33:44:56:22:35 192. Mode Switch command.10 00:33:44:56:22:34 192. binding information for all addresses is displayed.

A2(ro)->show dhcp server statistics Automatic Bindings Expired Bindings Malformed Bindings 36 6 0 SecureStack A2 Configuration Guide 13-9 .0. Syntax clear dhcp binding {ip-addr | *} Parameters ip‐addr * Specifies the IP address for which to clear/delete the DHCP binding.1. Defaults None. Mode Read‐only. Defaults None. Example This example displays server statistics. Example This example deletes the DHCP address binding for IP address 192. Mode Switch command.0. A2(rw)->clear dhcp binding 192.0.168. Syntax show dhcp server statistics Parameters None.clear dhcp binding 192.1.13 00:33:44:56:22:37 192.1 show dhcp server statistics Use this command to display DHCP server statistics.168.14                     00:33:44:56:22:38 infinite infinite Manual Manual clear dhcp binding Use this command to clear (delete) one or all DHCP address bindings.0. read‐write. Delete all address bindings.1.

 read‐write. Defaults None. Example This example clears all DHCP server counters. Mode Switch command. Syntax clear dhcp server statistics Parameters None.clear dhcp server statistics Messages ---------DHCP DISCOVER DHCP REQUEST DHCP DECLINE DHCP RELEASE DHCP INFORM Messages ---------DHCP OFFER DHCP ACK DHCP NACK Received ---------382 3855 0 67 1 Sent -----381 727 2 clear dhcp server statistics Use this command to clear all DHCP server counters. A2(rw)->clear dhcp server statistics 13-10 Configuring DHCP Server .

If a manual pool is configured with a client‐identifier.Configuring IP Address Pools Configuring IP Address Pools Manual Pool Configuration Considerations • The subnet of the IP address being issued should be on the same subnet as the ingress  interface (that is.. Commands Commands to configure DHCP dynamic (automatic) and static (manual) address pools and to  display DHCP address pool configurations are listed below. set dhcp pool clear dhcp pool set dhcp pool network clear dhcp pool network set dhcp pool hardware-address clear dhcp pool hardware-address set dhcp pool host clear dhcp pool host set dhcp pool client-identifier clear dhcp pool client-identifier Refer to page. can be configured on the SecureStack A2.  Note: A total of 16 address pools. A manual pool can be configured using either the client’s hardware address (set dhcp pool  hardware‐address) or the client’s client‐identifier (set dhcp pool client‐identifier). then the incoming DHCP request packet  from that client must include that client‐identifier in order for the request to be processed. The hardware address is not checked.. • • • • Purpose To configure and clear DHCP address pool parameters... If the incoming DHCP request packet contains a client‐identifier. but using  both is not recommended. A hardware address and type (Ethernet or IEEE 802) configured in a manual pool is checked  only when a client‐identifier is not also configured for the pool and the incoming DHCP  request packet does not include a client‐identifier option. The  hardware address is not checked. the subnet of the host IP address of the switch. the subnet of the routing interface). 13-13 13-13 13-14 13-14 13-15 13-16 13-16 13-17 13-17 13-18 SecureStack A2 Configuration Guide 13-11 . dynamic and/or static. then a manual pool  configured with that client‐identifier must exist on the switch in order for the request to be  processed.  For information about. and to display address pool configuration  information. or if routing interfaces are  configured.

13-19 13-19 13-20 13-20 13-21 13-21 13-22 13-22 13-23 13-24 13-24 13-25 13-25 13-26 13-26 13-27 13-27 13-28 13-28 13-29 13-30 13-12 Configuring DHCP Server .... set dhcp pool client-name clear dhcp pool client-name set dhcp pool bootfile clear dhcp pool bootfile set dhcp pool next-server clear dhcp pool next-server set dhcp pool lease clear dhcp pool lease set dhcp pool default-router clear dhcp pool default-router set dhcp pool dns-server clear dhcp pool dns-server set dhcp pool domain-name clear dhcp pool domain-name set dhcp pool netbios-name-server clear dhcp pool netbios-name-server set dhcp pool netbios-node-type clear dhcp pool netbios-node-type set dhcp pool option clear dhcp pool option show dhcp pool configuration Refer to page..Configuring IP Address Pools For information about.

 read‐write. read‐write. Pool names may be up to 31  characters in length.set dhcp pool set dhcp pool Use this command to create and assign a name to a DHCP server pool of addresses. Example This example creates an address pool named “auto1. Mode Switch command. Defaults None.  Syntax clear dhcp pool poolname Parameters poolname Specifies the name of the address pool. Mode Switch command.” A2(rw)->set dhcp pool auto1 clear dhcp pool Use this command to delete a DHCP server pool of addresses. Pool names may be up to 31  characters in length.” A2(rw)->clear dhcp pool auto1 SecureStack A2 Configuration Guide 13-13 . Note that entering this command is not  required to create an address pool before configuring other address pool parameters. Up to 16  address pools may be configured on a SecureStack A2. Example This example deletes the address pool named “auto1. Defaults None. Syntax set dhcp pool poolname Parameters poolname Specifies the name of the address pool.

20.0.100 clear dhcp pool network Use this command to remove the network number and mask of a DHCP server pool of addresses. the mask could have been specified as 255. Specifies an IP subnet for the address pool.28.0 with a prefix length of 24 for the automatic  DHCP pool named “auto1.” Alternatively.20. In order to limit the scope of the addresses configured with this command.255. Defaults None.28. Usage Use this command to configure a set of IP addresses to be assigned by the DHCP server using the  specified address pool.20.  use the set dhcp exclude command described on page 13‐6.28. 13-14 Configuring DHCP Server . Syntax set dhcp pool poolname network number {mask | prefix-length} Parameters poolname number mask prefix‐length Specifies the name of the address pool. Pool names may be up to 31  characters in length.20.80 – 100.28.  Examples This example configures the IP subnet 172.20. by excluding addresses 172. A2(rw)set dhcp pool auto1 network 172. Pool names may be up to 31  characters in length. Specifies the subnet mask as an integer.80 172.20. A2(rw)set dhcp exclude 172.set dhcp pool network set dhcp pool network Use this command to configure the subnet number and mask for an automatic DHCP address  pool. read‐write.0 by the  previous example.28.0 24 This example limits the scope of 255 addresses created for the Class C network 172.28.255.  Syntax clear dhcp pool poolname network Parameters poolname Specifies the name of the address pool. Mode Switch command. Specifies the subnet mask in dotted quad notation.

” A2(rw)->clear dhcp pool auto1 network set dhcp pool hardware-address Use this command to configure the MAC address of the DHCP client and create an address pool  for manual binding. Ethernet is assumed. (Optional) Specifies the protocol of the hardware platform. You can use either this command or the set dhcp pool client‐identifier  command to create a manual binding pool. read‐write. read‐write. Valid values  are 1 for Ethernet or 6 for IEEE 802.” Alternatively.f401. Defaults If no type is specified. Mode Switch command. Ethernet. Pool names may be up to 31  characters in length.2710 as the Ethernet MAC address for the manual address pool  named “manual1.2710 SecureStack A2 Configuration Guide 13-15 . the MAC address could have be entered as 00:01:f4:01:27:10. This value  can be entered using dotted hexadecimal notation or colons. Specifies the MAC address of the client’s hardware platform. A2(rw)->set dhcp pool manual1 hardware-address 0001. Mode Switch command. Example This example deletes the network and mask from the address pool named “auto1. but using both is not recommended. Default value is 1. Example This example specifies 0001.f401.set dhcp pool hardware-address Defaults None.  Syntax set dhcp pool poolname hardware-address hw-addr [type] Parameters poolname hw‐addr type Specifies the name of the address pool.

(Optional) Specifies the subnet mask as an integer. the class A. Pool names may be up to 31  characters in length. Specifies the IP address for manual binding. Example This example shows how to configure the minimum requirements for a manual binding address  pool. Pool names may be up to 31  characters in length. read‐write. Mode Switch command. the hardware address of the client’s hardware platform is configured. (Optional) Specifies the subnet mask in dotted quad notation. or C natural mask will be used.  Syntax clear dhcp pool poolname hardware-address Parameters poolname Specifies the name of the address pool. Syntax set dhcp pool poolname host ip-address [mask | prefix-length] Parameters poolname ip‐address mask prefix‐length Specifies the name of the address pool. Defaults None. followed by  configuration of the address to be assigned to that client manually. read‐write. First.” A2(rw)->clear dhcp pool manual1 hardware-address set dhcp pool host Use this command to configure an IP address and network mask for a manual DHCP binding. B. 13-16 Configuring DHCP Server . Example This example deletes the client hardware address from the address pool named “manual1.clear dhcp pool hardware-address clear dhcp pool hardware-address Use this command to remove the hardware address of a DHCP client from a manual binding  address pool. Defaults If a mask or prefix is not specified. Mode Switch command.

12.2710 A2(rw)->set dhcp pool manual1 host 15.  Syntax clear dhcp pool poolname host Parameters poolname Specifies the name of the address pool.99 255.1.clear dhcp pool host A2(rw)->set dhcp pool manual1 hardware-address 0001.f401. read‐write. Pool names may be up to 31  characters in length.248. You can use either this command or the set dhcp pool hardware‐address  command to create a manual binding pool. but using both is not recommended. Defaults None. Mode Switch command. read‐write. Specifies the unique client identifier for this client.255.” A2(rw)->clear dhcp pool manual1 host set dhcp pool client-identifier Use this command to configure the client identifier of the DHCP client and create an address pool  for manual binding. SecureStack A2 Configuration Guide 13-17 . The value must be  entered in xx:xx:xx:xx:xx:xx format.0 clear dhcp pool host Use this command to remove the host IP address from a manual binding address pool.  Syntax set dhcp pool poolname client-identifier id Parameters poolname id Specifies the name of the address pool. Mode Switch command. Example This example deletes the host IP address from the address pool named “manual1. Pool names may be up to 31  characters in length. Defaults None.

0 clear dhcp pool client-identifier Use this command to remove the unique identifier of a DHCP client from a manual binding  address pool.clear dhcp pool client-identifier Usage The client identifier is formed by concatenating the media type and the MAC address.  A2(rw)->set dhcp pool manual2 client-identifier 01:00:01:22:33:44:55 A2(rw)->set dhcp pool manual2 host 10.  then the client identifier configured with this command must be 01:00:01:22:33:44:55.255.” A2(rw)->clear dhcp pool manual1 client-identifier 13-18 Configuring DHCP Server . Pool names may be up to 31  characters in length.1.10 255. Mode Switch command. if the client hardware type is Ethernet and the client MAC address is 00:01:22:33:44:55. read‐write.12.  Syntax clear dhcp pool poolname client-identifier Parameters poolname Specifies the name of the address pool. Example This example deletes the client identifier from the address pool named “manual1.255. using a client identifier rather than the hardware address of the client’s hardware platform. Defaults None. For  example. Example This example shows how to configure the minimum requirements for a manual binding address  pool.

Defaults None. read‐write.0 A2(rw)->set dhcp pool manual2 client-name appsvr1 clear dhcp pool client-name Use this command to delete a DHCP client name from an address pool for manual binding.255. Client names may be up to  31 characters in length. Syntax set dhcp pool poolname client-name name Parameters poolname name Specifies the name of the address pool. read‐write.10 255. Syntax clear dhcp pool poolname client-name Parameters poolname Specifies the name of the address pool.” A2(rw)->set dhcp pool manual2 client-identifier 01:22:33:44:55:66 A2(rw)->set dhcp pool manual2 host 10. Pool names may be up to 31  characters in length.12. Defaults None. Mode Switch command. Specifies the name to be assigned to this client.1.255.” A2(rw)->clear dhcp pool manual2 client-name SecureStack A2 Configuration Guide 13-19 . Pool names may be up to 31  characters in length. Mode Switch command.set dhcp pool client-name set dhcp pool client-name Use this command to assign a name to a DHCP client when creating an address pool for manual  binding. Example This example configures the client name “appsvr1” to the manual binding pool “manual2. Example This example deletes the client name from the manual binding pool “manual2.

Example This example removes the boot image filename from address pool named “auto1. Defaults None.img clear dhcp pool bootfile Use this command to remove a default boot image from the address pool being configured. Syntax clear dhcp pool poolname bootfile Parameters poolname Specifies the name of the address pool. read‐write. Syntax set dhcp pool poolname bootfile filename Parameters poolname filename Specifies the name of the address pool. Mode Switch command.” A2(rw)->set dhcp pool auto1 bootfile image1.” A2(rw)->clear dhcp pool auto1 bootfile 13-20 Configuring DHCP Server . Example This example sets the boot image filename for address pool named “auto1. Specifies the boot image file name. read‐write. Mode Switch command. Pool names may be up to 31  characters in length. Pool names may be up to 31  characters in length. Defaults None.set dhcp pool bootfile set dhcp pool bootfile Use this command to specify a default boot image for the DHCP clients who will be served by the  address pool being configured.

  Syntax set dhcp pool poolname next-server ip-address Parameters poolname ip‐address Specifies the name of the address pool.10 clear dhcp pool next-server Use this command to remove the boot image file server from the address pool being configured. Example This example specifies the file server from which clients being served by address pool “auto1”  should download the boot image file “image1.img.1.”  A2(rw)->clear dhcp pool auto1 next-server SecureStack A2 Configuration Guide 13-21 .1. Example This example removes the file server from address pool “auto1.  Defaults None. Specifies the IP address of the file server the DHCP client should contact  to load the default boot image. read‐write. Mode Switch command.” A2(rw)->set dhcp pool auto1 bootfile image1. Defaults None. Syntax clear dhcp pool poolname next-server Parameters poolname Specifies the name of the address pool.img A2(rw)->set dhcp pool auto1 next-server 10. read‐write. Pool names may be up to 31  characters in length. Pool names may be up to 31  characters in length. Mode Switch command.set dhcp pool next-server set dhcp pool next-server Use this command to specify the file server from which the default boot image is to be loaded by  the client.

 enter 0 for days. Value can  range from 0 to 59. Value can range from 0 to 1439.  specifies the number of minute an address lease will remain valid.set dhcp pool lease set dhcp pool lease Use this command to specify the duration of the lease for an IP address assigned by the DHCP  server from the address pool being configured. A2(rw)->set dhcp pool auto1 lease 0 12 clear dhcp pool lease Use this command to restore the default lease time value of one day for the address pool being  configured. (Optional) When a days value and an hours value have been assigned. a lease duration of 1 day is configured. 13-22 Configuring DHCP Server . Defaults Clears the lease time for this address pool to the default value of one day. Specifies that the duration of the lease will be unlimited. (Optional) When a days value has been assigned. Example This example configures a lease duration of 12 hours for the address pool being configured. specifies the number of  hours an address lease will remain valid. Value  can range from 0 to 86399. Specifies the number of days an address lease will remain valid. infinite Defaults If no lease time is specified. Mode Switch command. Note  that to configure a lease time less than one day. Pool names may be up to 31  characters in length. Syntax clear dhcp pool poolname lease Parameters poolname Specifies the name of the address pool. Syntax set dhcp pool poolname lease {days [hours [minutes]] | infinite} Parameters poolname days hours minutes Specifies the name of the address pool. then the number of hours and  minutes. read‐write. Pool names may be up to 31  characters in length.

10.1 to the address pool named “auto1. address8  Specifies the name of the address pool.set dhcp pool default-router Mode Switch command. Specifies the IP address of a default router.. Example This example assigns a default router at 10.  (Optional) Specifies. in order of preference...10. up to 7 additional default  router addresses..1 SecureStack A2 Configuration Guide 13-23 . Syntax set dhcp pool poolname default-router address [address2 . address8] Parameters poolname address address2 . Mode Switch command. Example This example restores the default lease duration of one day for address pool “auto1. read‐write.” A2(rw)->set dhcp pool auto1 default-router 10.10. read‐write.”  A2(rw)->clear dhcp pool auto1 lease set dhcp pool default-router Use this command to specify a default router list for the DHCP clients served by the address pool  being configured. Defaults None. Up to 8 default routers can be configured. Pool names may be up to 31  characters in length.10.

Syntax clear dhcp pool poolname default-router Parameters poolname Specifies the name of the address pool.” A2(rw)->set dhcp pool auto1 dns-server 10. Mode Switch command. address8] Parameters poolname address address2 . Up to 8 DNS servers can be configured.14.14. up to 7 additional DNS  server addresses. Defaults None. Example This example assigns a DNS server at 10. Pool names may be up to 31  characters in length. Mode Switch command. read‐write.. Syntax set dhcp pool poolname dns-server address [address2 .10. read‐write. Example This example removes the default router from the address pool “auto1. in order of preference..10.clear dhcp pool default-router clear dhcp pool default-router Use this command to delete the default routers configured for this address pool.1 to the address pool “‘auto1.1 13-24 Configuring DHCP Server . address8  Specifies the name of the address pool. Defaults None.” A2(rw)->clear dhcp pool auto1 default-router set dhcp pool dns-server Use this command to specify one or more DNS servers for the DHCP clients served by the address  pool being configured.. Pool names may be up to 31  characters in length. Specifies the IP address of a DNS server..  (Optional) Specifies.

 The domain name can be up to 255  characters in length. Specifies the domain name string. Mode Switch command. Example This example removes the DNS server list from the address pool “auto1. Pool names may be up to 31  characters in length. Example This example assigns the “mycompany.clear dhcp pool dns-server clear dhcp pool dns-server Use this command to remove the DNS server list from the address pool being configured. Defaults None. Pool names may be up to 31  characters in length.com SecureStack A2 Configuration Guide 13-25 . Syntax set dhcp pool poolname domain-name domain Parameters poolname domain Specifies the name of the address pool.”  A2(rw)->set dhcp pool auto1 domain-name mycompany. read‐write. read‐write. Mode Switch command. Defaults None. Syntax clear dhcp pool poolname dns-server Parameters poolname Specifies the name of the address pool.com” domain name to the address pool “auto1.” A2(rw)->clear dhcp pool auto1 dns-server set dhcp pool domain-name Use this command to specify a domain name to be assigned to DHCP clients served by the address  pool being configured.

Syntax set dhcp pool poolname netbios-name-server address [address2 .” A2(rw)->clear dhcp pool auto1 domain-name set dhcp pool netbios-name-server Use this command to assign one or more NetBIOS name servers for the DHCP clients served by  the address pool being configured. Defaults None. Specifies the IP address of a NetBIOS name server. in order of preference.1 to the address pool being configured. Mode Switch command.10.1 13-26 Configuring DHCP Server .15. Example This example assigns a NetBIOS name server at 10..  (Optional) Specifies. address8] Parameters poolname address address2 . Pool names may be up to 31  characters in length.. read‐write.10. Pool names may be up to 31  characters in length. Up to 8 NetBIOS name servers can be configured.clear dhcp pool domain-name clear dhcp pool domain-name Use this command to remove the domain name from the address pool being configured. A2(rw)->set dhcp pool auto1 netbios-name-server 10. read‐write. Defaults None. Example This example removes the domain name from the address pool “auto1.15. Syntax clear dhcp pool poolname domain-name Parameters poolname Specifies the name of the address pool.. address8  Specifies the name of the address pool.. Mode Switch command. up to 7 additional NetBIOS  name server addresses.

clear dhcp pool netbios-name-server clear dhcp pool netbios-name-server Use this command to remove the NetBIOS namer server list from the address pool being  configured. Specifies the NetBIOs node type to be broadcast (no WINS). Specifies the NetBIOs node type to be mixed (broadcast. clear dhcp pool poolname netbios-name-server Parameters poolname Specifies the name of the address pool. Specifies the NetBIOs node type to be hybrid (WINS. Example This example specifies hybrid as the NetBIOS node type for the address pool “auto1. then WINS). A2(rw)->clear dhcp pool auto1 netbios-name-server set dhcp pool netbios-node-type Use this command to specify a NetBIOS node (server) type for the DHCP clients served by the  address pool being configured. Example This example removes the NetBIOS name server list from the address pool auto1. then broadcast). Defaults None. Pool names may be up to 31  characters in length. read‐write.  Syntax set dhcp pool poolname netbios-node-type {b-node | h-node | p-node | m-node} Parameters poolname b‐node h‐node p‐node m‐node Specifies the name of the address pool. Pool names may be up to 31  characters in length. read‐write.” A2(rw)->set dhcp pool auto1 netbios-node-type h-node SecureStack A2 Configuration Guide 13-27 . Mode Switch command. Mode Switch command. Specifies the NetBIOs node type to be peer (WINS only). Defaults None.

 read‐write. Mode Switch command. Specifies the DHCP option code. Syntax clear dhcp pool poolname netbios-node-type Parameters poolname Specifies the name of the address pool. Specifies the data in IP address format. Pool names may be up to 31  characters in length.clear dhcp pool netbios-node-type clear dhcp pool netbios-node-type Use this command to remove the NetBIOS node type from the address pool being configured. 13-28 Configuring DHCP Server . read‐write. Defaults None. Defaults None. Value can range  from 1 to 254. Specifies the data in HEX format. as defined in RFC 2132. An ASCII character string containing a  space must be enclosed in quotations. Up to 8 IP addresses can be entered. Up to 8 HEX strings can be entered. described in RFC 2132. Example This example removes the NetBIOS node type from the address pool “auto1. Mode Switch command.” A2(rw)->clear dhcp pool auto1 netbios-node-type set dhcp pool option Use this command to configure DHCP options. Specifies the data in ASCII format. Pool names may be up to 31  characters in length. Syntax set dhcp pool poolname option code {ascii string | hex string-list | ip addresslist} Parameters poolname code ascii string hex string‐list ip address‐list Specifies the name of the address pool.

clear dhcp pool option Examples This example configures DHCP option 19. Value can range  from 1 to 254.253 clear dhcp pool option Use this command to remove a DHCP option from the address pool being configured.3. which specifies whether the client should configure its  IP layer for packet forwarding. Pool names may be up to 31  characters in length. A2(rw)->set dhcp pool auto1 option 72 ip 168.252 168.” A2(rw)->clear dhcp pool auto1 option 19 SecureStack A2 Configuration Guide 13-29 . IP forwarding is enabled with the 01 value. as defined in RFC 2132. Defaults None. read‐write. Syntax clear dhcp pool poolname option code Parameters poolname code Specifies the name of the address pool. In this case. Example This example removes option 19 from address pool “auto1. A2(rw)->set dhcp pool auto1 option 19 hex 01 This example configures DHCP option 72.24. In this case.24.3. Specifies the DHCP option code. two Web server addresses are configured. Mode Switch command. which assigns one or more Web servers for DHCP  clients.

show dhcp pool configuration show dhcp pool configuration Use this command to display configuration information for one or all address pools.0.168.1.1 255.0.0 infinite 13-30 Configuring DHCP Server .255.0 255.0.10. Defaults None.0.0 infinite 19 hex 01 Manual 00:01:f4:01:27:10 ieee802 192.255.1. Pool names may be up to 31  characters in length.1 255.255. Syntax show dhcp pool configuration {poolname | all} Parameters poolname Specifies the name of the address pool.0 1 days 0 hrs 0 mins 192.0. Mode Read‐only.0.255. Example This example displays configuration information for all address pools.1 Manual appsvr1 01:00:01:f4:01:27:10 10. A2(rw)->show dhcp pool configuration all Pool: Atg_Pool Pool Type Network Lease Time Default Routers Pool: static1 Pool Type Client Name Client Identifier Host Lease Time Option Pool: static2 Pool Type Hardware Address Hardware Address Type Host Lease Time Dynamic 192.

 For details.. 802. refer to  “Configuring RADIUS” on page 14‐3. refer to Chapter 5. Overview of Security Methods Configuring RADIUS Configuring 802. To access the switch. When  HACA is active per a valid RADIUS configuration. For details.  monitor. the user names and passwords used to  access the switch via Telnet. Host Access Control Authentication (HACA) – authenticates user access of Telnet  management.1X Authentication Configuring MAC Authentication Configuring Multiple Authentication Methods Configuring VLAN Authorization (RFC 3580) Configuring MAC Locking Configuring Secure Shell (SSH) Configuring Layer 2 Access Control Lists Refer to page. console local management and WebView via a central RADIUS Client/Server  application. 14-1 14-3 14-11 14-22 14-34 14-41 14-45 14-55 14-57 Overview of Security Methods The following security methods are available for controlling which users are allowed to access. refer to “Setting User Accounts and Passwords” on  page 3‐2. The level of management access is dependent on the associated  access policy. Only in the case of a RADIUS timeout will those credentials be  compared against credentials locally configured on the switch. For details. SSH. and manage the switch.1X Port Based Network Access Control using EAPOL (Extensible Authentication Protocol)  – provides a mechanism via a RADIUS server for administrators to securely authenticate and  • • • SecureStack A2 Configuration Guide 14-1 . this essentially overrides login user accounts.. you must enter an SNMP user or  community name string.14 Security Configuration This chapter describes the Security Configuration set of commands and how to use them. SNMP user or community names – allows access to the SecureStack A2 switch via a network  SNMP management application. and COM ports will be validated against the  configured RADIUS server.. When RADIUS is enabled.. WebView.  • Login user accounts and passwords – used to log in to the CLI via a Telnet connection or local  COM port connection. For information about.

802. refer to “Configuring MAC  Locking” on page 14‐45. preventing the use of  unauthorized devices and MAC spoofing on the port For details. For details. Secure Shell (SSH) – provides secure Telnet. refer to “Configuring Secure Shell  (SSH)” on page 14‐55.1X  Authentication” on page 14‐11. RFC 3580 Tunnel Attributes provide a mechanism to contain an 802. refer to “Configuring MAC Authentication” on page 14‐22. MAC Locking – locks a port to one or more MAC addresses. • • • • • 14-2 Security Configuration .  For details. • MAC Authentication – provides a mechanism for administrators to securely authenticate  source MAC addresses and grant appropriate access to end user devices communicating with  SecureStack A2 ports.Overview of Security Methods grant appropriate access to end user devices communicating with SecureStack A2 ports. which allows client authentication packets to be forwarded through the switch to an upstream device. Refer to “Configuring VLAN Authorization (RFC 3580)” on  page 14‐41.1X authentication must be globally disabled with the set dot1x command. Note: To configure EAP pass-through. Multiple Authentication Methods – allows users to authenticate using multiple methods of  authentication on the same port. refer to “Configuring Multiple Authentication  Methods” on page 14‐34. For  details on using CLI commands to configure 802. Layer 2 Access Control Lists – allows filtering ingressing packets based on IP or MAC address. refer to “Configuring Layer 2 Access Control Lists” on page 14‐57. For details. refer to “Configuring 802.1X. For details.1X authenticated user to a  VLAN regardless of the PVID.

Reset RADIUS server settings to default values.Configuring RADIUS Configuring RADIUS Purpose To perform the following: • • • • • • Review the RADIUS client/server configuration on the switch. Enable or disable the RADIUS client.. 14-4 14-5 14-7 14-8 14-9 14-10 SecureStack A2 Configuration Guide 14-3 . Commands The commands used to review and configure RADIUS are listed below: For information about. Set local and remote login options..  authentication realm... Configure a RADIUS accounting server. Set primary and secondary server parameters. including IP address. show radius set radius clear radius show radius accounting set radius accounting clear radius accounting Refer to page. and number of user login attempts allowed. timeout period.

 (Optional) Displays RADIUS server configuration information. Maximum amount of time (in seconds) to establish contact with the RADIUS server before retry attempts begin.show radius show radius Use this command to display the current RADIUS client/server configuration.20. read‐only.16. For use with the server parameter to show server configuration for all  servers or a specific RADIUS server as defined by an index.10 Auth-Port --------1812 Realm-Type ----------------management-access Table 14‐1 provides an explanation of the command output. Whether RADIUS is enabled or disabled. Example This example shows how to display RADIUS configuration information:  A2(rw)->show radius RADIUS status: Enabled RADIUS retries: 3 RADIUS timeout: 20 seconds RADIUS Server IP Address ----------------------10 172. IP address. and UDP authentication port.. Number of retry attempts before the RADIUS server times out. (Optional) Displays the maximum amount of time (in seconds) to establish  contact with the RADIUS server before retry attempts begin..  Table 14-1 Output RADIUS status RADIUS retries show radius Output Details What It Displays. The default value of 20 can be reset using the set radius command as described in “set radius” on page 14-5. The default value of 3 can be reset using the set radius command as described in “set radius” on page 14-5. Defaults If no parameters are specified. RADIUS timeout RADIUS Server 14-4 Security Configuration . RADIUS server’s index number. Syntax show radius [status | retries | timeout | server [index | all]] Parameters status retries timeout server  index | all (Optional) Displays the RADIUS server’s enable status. Mode Switch command. all RADIUS configuration information will be displayed. (Optional) Displays the number of retry attempts before the RADIUS server  times out.

• Any-access: Means that both Management-access and Network-access have been enabled. Valid values are from 1  to 30. Specifies the maximum amount of time (in seconds) to establish contact  with the RADIUS server before retry attempts begin. or configure RADIUS authentication. Local Management) has to authenticate through the  RADIUS server. any: Means that both management‐access and network‐access have  been enabled.set radius Table 14-1 Output Realm-Type show radius Output Details (Continued) What It Displays. Only the network-access realm allows access to the local “admin” account. set radius Use this command to enable. network‐access: This means that all the users have to authenticate to a  RADIUS server before they are allowed access to the network. SSH. Realm defines who has to go through the RADIUS server for authentication. Telnet. Specifies the index number. Default is 3.. Default is 20 seconds. SecureStack A2 Configuration Guide 14-5 . • Network-access: This means that all the users have to authenticate to a RADIUS server before they are allowed access to the network. Syntax set radius {enable | disable} | {retries number-of-retries} | {timeout timeout} | {server index ip-address port [secret-value] [realm {management-access | any | network-access}} | {realm {management-access | any | network-access} {index| all}} Parameters enable | disable retries number‐of‐ retries timeout timeout Enables or disables the RADIUS client.. the local “admin” account is disabled for access to the switch using the console. IP address and the UDP authentication port for  the RADIUS server. • management‐access: This means that anyone trying to access the switch  (Telnet. index | all Applies the realm setting to a specific server or to all servers. or Local Management. SSH. disable. none will be applied. • Management-access: This means that anyone trying to access the switch (Telnet. Defaults If secret‐value is not specified.  (Optional) Specifies an encryption key to be used for authentication  between the RADIUS client and server. Local Management) has to authenticate through the RADIUS server.  Valid values are from 1 to 10. Specifies the number of retry attempts before the RADIUS server times out. Realm allows you to define who has to go through the RADIUS server for  authentication. server index  ip_address port  secret‐value  realm  management‐ access | any |  network‐access • • Note: If the management-access or any access realm has been configured.

 with up  to two servers active at any given time. the any access realm will be used. and its IP  address(es) has been configured with the same password the RADIUS client will use. The all parameter at the end of the command means that  any of the defined RADIUS servers can be used for this Authentication.  Examples This example shows how to enable the RADIUS client for authenticating with RADIUS server 1 at  IP address 192.203. read‐write. UDP authentication port 1812.203 1812 pwsecret This example shows how to set the RADIUS timeout to 5 seconds: A2(su)->set radius timeout 5 This example shows how to set RADIUS retries to 10: A2(su)->set radius retries 10 This example shows how to force any management‐access to the switch (Telnet.168.set radius If realm is not specified.6. The RADIUS client can only be enabled on the switch once a RADIUS server is online.  A2(rw)->set radius realm management-access all 14-6 Security Configuration . and an authentication password of  “pwsecret. web. SSH) to  authenticate through a RADIUS server. Usage The SecureStack A2 device allows up to 10 RADIUS accounting servers to be configured. the “server secret” password entered here must match that  already configured as the Read‐Write (rw) password on the RADIUS server: A2(su)->set radius server 1 192.” As previously noted. Mode Switch command.168.6.

For use with the server parameter to clear the server configuration for all  servers or a specific RADIUS server as defined by an index. Deletes server settings. read‐write.  Syntax clear radius [retries] | [timeout] | [server {index | all | realm {index | all}}] Parameters retries  timeout  server  index | all realm Resets the maximum number of attempts a user can contact the RADIUS  server before timing out to 3. Defaults None. Examples This example shows how to clear all settings on all RADIUS servers: A2(su)->clear radius server all This example shows how to reset the RADIUS timeout to the default value of 20 seconds: A2(su)->clear radius timeout SecureStack A2 Configuration Guide 14-7 . Mode Switch command. Resets the realm setting for all servers or a specific RADIUS server as  defined by an index.  Resets the maximum amount of time to establish contact with the RADIUS  server before timing out to 20 seconds.clear radius clear radius Use this command to clear RADIUS server settings.

--------. Defaults If no parameters are specified.16. In this case. (Optional) Displays the maximum amount of time before timing out.2.show radius accounting show radius accounting Use this command to display the RADIUS accounting configuration. refer to “set radius accounting” on  page 14‐9: A2(ro)->show radius accounting RADIUS accounting status: Disabled RADIUS Acct Server IP Address Acct-Port Retries Timeout Status -----------------.------. (Optional) Displays counters for a RADIUS accounting server.---------. Syntax show radius accounting [server] | [counter ip-address] | [retries] | [timeout] Parameters server counter ip‐address retries timeout (Optional) Displays one or all RADIUS accounting server configurations. Example This example shows how to display RADIUS accounting configuration information.  One server has been configured. all RADIUS accounting configuration information will be  displayed.  (Optional) Displays the maximum number of attempts to contact the  RADIUS accounting server before timing out. This transmits accounting  information between a network access server and a shared accounting server. For details on enabling and configuring RADIUS accounting. read‐only. Mode Switch command.  RADIUS accounting is not currently enabled and global default settings have not been changed.10 1856 3 20 Disabled 14-8 Security Configuration .-----1 172.------.

 read‐write.  Device will prompt for this entry upon creating a server instance. Valid timeout  values are 1 ‐ 30. As previously noted.  Syntax set radius accounting {[enable | disable][retries retries] [timeout timeout] [server ip_address port [server-secret] Parameters enable | disable retries retries  timeout timeout  Enables or disables the RADIUS accounting client.set radius accounting set radius accounting Use this command to configure RADIUS accounting.4. as  shown in the example below.) server ip_address  port server‐secret Mode Switch command. Examples This example shows how to enable the RADIUS accounting client for authenticating with the  accounting server at IP address 10. Specifies the accounting server’s: • • • IP address UDP authentication port (0 ‐ 65535) server‐secret (Read‐Write password to access this accounting server. Sets the maximum amount of time (in seconds) to establish contact with a  specified RADIUS accounting server before timing out.4.12 1800 Enter secret: Re-enter secret: This example shows how to set the RADIUS accounting timeout to 30 seconds: A2(su)->set radius accounting timeout 30 This example shows how to set RADIUS accounting retries to 10: A2(su)->set radius accounting retries 10 SecureStack A2 Configuration Guide 14-9 . Valid retry values are 1 ‐ 10. Defaults None. Sets the maximum number of attempts to contact a specified RADIUS  accounting server before timing out.2.12. UDP authentication port 1800.2. the  “server secret” password entered here must match that already configured as the Read‐Write (rw)  password on the RADIUS accounting server: A2(su)->set radius accounting server 10.

 read‐write.  Syntax clear radius accounting {server ip-address | retries | timeout | counter} Parameters server ip‐address retries timeout  counter Clears the configuration on one or more accounting servers.clear radius accounting clear radius accounting Use this command to clear RADIUS accounting configuration settings. Resets the timeout to 5 seconds. Mode Switch command. Defaults None. Example This example shows how to reset the RADIUS accounting timeout to 5 seconds.  A2(su)->clear radius accounting timeout 14-10 Security Configuration . Resets the retries to the default value of 2. Clears counters.

Configuring 802.1X Authentication

Configuring 802.1X Authentication
Purpose
To review and configure 802.1X authentication for one or more ports using EAPOL (Extensible  Authentication Protocol). 802.1X controls network access by enforcing user authorization on  selected ports, which results in allowing or denying network access according to RADIUS server  configuration.
Note: One user per EAPOL-configured port can be authenticated on SecureStack A2 devices. Only one method of authentication can be deployed per port. Note: To configure EAP pass-through, which allows client authentication packets to be forwarded through the switch to an upstream device, 802.1X authentication must be globally disabled with the set dot1x command (“set dot1x” on page 14-15).

Commands
The commands used to review and configure 802.1X are listed below:
For information about... show dot1x show dot1x auth-config set dot1x set dot1x auth-config clear dot1x auth-config show eapol set eapol clear eapol Refer to page... 14-12 14-13 14-15 14-16 14-17 14-18 14-20 14-21

SecureStack A2 Configuration Guide

14-11

show dot1x

show dot1x
Use this command to display 802.1X status, diagnostics, statistics, and reauthentication or  initialization control information for one or more ports.

Syntax
show dot1x [auth-diag] [auth-stats] [port [init | reauth]] [port-string]

Parameters
auth‐diag auth‐stats port init | reauth port‐string (Optional) Displays authentication diagnostics information. (Optional) Displays authentication statistics. (Optional) Displays the status of port initialization and reauthentication  control for the port. (Optional) Displays information for specific port(s). For a detailed  description of possible port‐string values, refer to “Port String Syntax Used  in the CLI” on page 4‐2.

Defaults
If no parameters are specified, 802.1X status will be displayed. If port‐string is not specified, information for all ports will be displayed.

Mode
Switch command, read‐only.

Examples
This example shows how to display 802.1X status: 
A2(su)->show dot1x DOT1X is disabled.

This example shows how to display authentication diagnostics information for fe.1.1: 
A2(su)->show dot1x auth-diag fe.1.1 Port : 1 Auth-Diag Enter Connecting: EAP Logoffs While Connecting: Enter Authenticating: Success While Authenticating Timeouts While Authenticating: Fails While Authenticating: ReAuths While Authenticating: EAP Starts While Authenticating: EAP logoff While Authenticating: Backend Responses: Backend Access Challenges: Backend Others Requests To Supp: Backend NonNak Responses From: Backend Auth Successes: Backend Auth Fails:

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

14-12

Security Configuration

show dot1x auth-config

This example shows how to display authentication statistics for fe.1.1: 
A2(su)->show dot1x auth-stats Port: 1 Auth-Stats EAPOL Frames Rx: EAPOL Frames Tx: EAPOL Start Frames Rx: EAPOL Logoff Frames Rx: EAPOL RespId Frames Rx: EAPOL Resp Frames Rx: EAPOL Req Frames Tx: EAP Length Error Frames Rx: Last EAPOL Frame Version: Last EAPOL Frame Source: fe.1.1 0 0 0 0 0 0 0 0 0 00:00:00:00:00:00

This example shows how to display the status of port reauthentication control for fe.1.1 through  fe.1.6: 
A2(su)->show dot1x port reauth fe.1.1-6 Port 1: Port reauthenticate: FALSE Port 2: Port reauthenticate: FALSE Port 3: Port reauthenticate: FALSE Port 4: Port reauthenticate: FALSE Port 5: Port reauthenticate: FALSE Port 6: Port reauthenticate: FALSE

show dot1x auth-config
Use this command to display 802.1X authentication configuration settings for one or more ports.

Syntax
show dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod] [reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod] [port-string]

Parameters
authcontrolled‐ portcontrol maxreq quietperiod reauthenabled reauthperiod servertimeout supptimeout txperiod (Optional) Displays the current value of the controlled Port control  parameter for the port. (Optional) Displays the value set for maximum requests currently in use by  the backend authentication state machine. (Optional) Displays the value set for quiet period currently in use by the  authenticator PAE state machine. (Optional) Displays the state of reauthentication control used by the  Reauthentication Timer state machine. (Optional) Displays the value, in seconds, set for the reauthentication  period used by the reauthentication timer state machine. (Optional) Displays the server timeout value, in seconds, currently in use  by the backend authentication state machine. (Optional) Displays the authentication supplicant timeout value, in  seconds, currently in use by the backend authentication state machine. (Optional) Displays the transmission period value, in seconds, currently in  use by the authenticator PAE state machine.

SecureStack A2 Configuration Guide

14-13

show dot1x auth-config

port‐string

(Optional) Limits the display of desired information information to specific  port(s). For a detailed description of possible port‐string values, refer to  “Port String Syntax Used in the CLI” on page 4‐2.

Defaults
If no parameters are specified, all 802.1X settings will be displayed. If port‐string is not specified, information for all ports will be displayed.

Mode
Switch command, read‐only.

Examples
This example shows how to display the EAPOL port control mode for fe.1.1: 
A2(su)->show dot1x auth-config authcontrolled-portcontrol fe.1.1 Port 1: Auth controlled port control: Auto

This example shows how to display the 802.1X quiet period settings for fe.1.1: 
A2(su)->show dot1x auth-config quietperiod fe.1.1 Port 1: Quiet period: 30

This example shows how to display all 802.1X authentication configuration settings for ge.1.1: 
A2(ro)->show dot1x auth-config Port : 1 Auth-Config PAE state: Backend auth state: Admin controlled directions: Oper controlled directions: Auth controlled port status: Auth controlled port control: Quiet period: Transmission period: Supplicant timeout: Server timeout: Maximum requests: Reauthentication period: Reauthentication control: ge.1.1 Initialize Initialize Both Both Authorized Auto 60 30 30 30 2 3600 Disabled

14-14

Security Configuration

set dot1x

set dot1x
Use this command to enable or disable 802.1X authentication, to reauthenticate one or more access  entities, or to reinitialize one or more supplicants.

Syntax
set dot1x {enable | disable | port {init | reauth} {true | false} [port-string]}

Parameters
enable | disable port init | reauth  true | false port‐string Enables or disables 802.1X. Enable or disable 802.1X reauthentication or initialization control on one or  more ports. Configure initialization or reauthentication control. Enable (true) or disable (false) reinitialization/reauthentication. (Optional) Specifies the port(s) to reinitialize or reauthenticate.

Defaults
If no ports are specified, the reinitialization or reauthentication setting will be applied to all ports.

Mode
Switch command, read‐write.

Usage
Disabling 802.1X authentication globally, by not entering a specific port‐string value, will enable  the EAP pass‐through feature. EAP pass‐through allows client authentication packets to be  forwarded unmodified through the switch to an upstream device. 

Examples
This example shows how to enable 802.1X:
A2(su)->set dot1x enable

This example shows how to reinitialize ge.1.2:
A2(rw)->set dot1x port init true ge.1.2

SecureStack A2 Configuration Guide

14-15

set dot1x auth-config

set dot1x auth-config
Use this command to configure 802.1X authentication.

Syntax
set dot1x auth-config {[authcontrolled-portcontrol {auto | forced-auth | forced-unauth}] [maxreq value] [quietperiod value] [reauthenabled {false | true}] [reauthperiod value] [servertimeout timeout] [supptimeout timeout] [txperiod value]} [port-string]

Parameters
authcontrolled‐ portcontrol  auto | forced‐auth |  forced‐unauth Specifies the 802.1X port control mode. • • • maxreq value auto – Set port control mode to auto controlled port control. This  is the default value. forced‐auth – Set port control mode to ForcedAuthorized  controlled port control. forced‐unauth – Set port control mode to ForcedUnauthorized  controlled port control.

Specifies the maximum number of authentication requests allowed  by the backend authentication state machine. Valid values are 1 – 10.  Default value is 2. Specifies the time (in seconds) following a failed authentication  before another attempt can be made by the authenticator PAE state  machine. Valid values are 0 – 65535. Default value is 60 seconds. Enables (true) or disables (false) reauthentication control of the  reauthentication timer state machine. Default value is false. Specifies the time lapse (in seconds) between attempts by the  reauthentication timer state machine to reauthenticate a port. Valid  values are 0 – 65535. Default value is 3600 seconds. Specifies a timeout period (in seconds) for the authentication server,  used by the backend authentication state machine. Valid values are 1  – 300. Default value is 30 seconds.  Specifies a timeout period (in seconds) for the authentication  supplicant used by the backend authentication state machine. Valid  values are 1 – 300. Default value is 30 seconds. Specifies the period (in seconds) which passes between authenticator  PAE state machine EAP transmissions. Valid values are 0 – 65535.  Default value is 30 seconds.  (Optional) Limits the configuration of desired settings to specified  port(s). For a detailed description of possible port‐string values, refer  to “Port String Syntax Used in the CLI” on page 4‐2.

quietperiod value

reauthenabled false |  true reauthperiod value

servertimeout timeout

supptimeout timeout

txperiod value

port‐string

Defaults
If port‐string is not specified, authentication parameters will be set on all ports.

Mode
Switch command, read‐write.

14-16

Security Configuration

clear dot1x auth-config

Examples
This example shows how to enable reauthentication control on ports fe.1.1‐3:
A2(su)->set dot1x auth-config reauthenabled true fe.1.1-3

This example shows how to set the 802.1X quiet period to 120 seconds on ports fe.1.1‐3:
A2(su)->set dot1x auth-config quietperiod 120 fe.1.1-3

clear dot1x auth-config
Use this command to reset 802.1X authentication parameters to default values on one or more  ports.

Syntax
clear dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod] [reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod] [portstring]

Parameters
authcontrolled‐ portcontrol maxreq quietperiod reauthenabled  reauthperiod  servertimeout supptimeout  txperiod  port‐string (Optional) Resets the 802.1X port control mode to auto. (Optional) Resets the maximum requests value to 2. (Optional) Resets the quiet period value to 60 seconds. (Optional) Resets the reauthentication control state to disabled (false). (Optional) Resets the reauthentication period value to 3600 seconds. (Optional) Resets the server timeout value to 30 seconds. (Optional) Resets the authentication supplicant timeout value to 30  seconds. (Optional) Resets the transmission period value to 30 seconds. (Optional) Resets settings on specific port(s). For a detailed description of  possible port‐string values, refer to “Port String Syntax Used in the CLI” on  page 4‐2.

Defaults
If no parameters are specified, all authentication parameters will be reset. If port‐string is not specified, parameters will be set on all ports.

Mode
Switch command, read‐write.

Examples
This example shows how to reset the 802.1X port control mode to auto on all ports:
A2(su)->clear dot1x auth-config authcontrolled-portcontrol

SecureStack A2 Configuration Guide

14-17

show eapol

This example shows how to reset reauthentication control to disabled on ports fe.1.1‐3:
A2(su)->clear dot1x auth-config reauthenabled fe.1.1-3

This example shows how to reset the 802.1X quiet period to 60 seconds on ports fe.1.1‐3:
A2(su)->clear dot1x auth-config quietperiod fe.1.1-3

show eapol
Use this command to display EAPOL status or settings for one or more ports. 

Syntax
show eapol [port-string]

Parameters
port‐string (Optional) Displays EAPOL status for specific port(s). For a detailed  description of possible port‐string values, refer to “Port String Syntax Used  in the CLI” on page 4‐2.

Defaults
If port‐string is not specified, only EAPOL enable status will be displayed.

Mode
Switch command, read‐only.

Example
This example shows how to display EAPOL status for ports fe.1.1‐3:
A2(su)->show eapol fe.1.1-3 EAPOL is disabled. Port -------fe.1.1 fe.1.2 fe.1.3 Authentication State -------------------Initialize Initialize Initialize Authentication Mode -------------------Auto Auto Auto

Table 14‐2 provides an explanation of the command output. For details on using the set eapol  command to enable the protocol and assign an authentication mode, refer to “set eapol” on  page 14‐20.

14-18

Security Configuration

show eapol

Table 14-2
Output Port

show eapol Output Details
What It Displays... Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 4-2. Current EAPOL authentication state for each port. Possible internal states for the authenticator (switch) are: • initialize: A port is in the initialize state when:

Authentication State

– – –

authentication is disabled, authentication is enabled and the port is not linked, or authentication is enabled and the port is linked. (In this case very little time is spent in this state, it immediately transitions to the connecting state, via disconnected.

• disconnected: The port passes through this state on its way to connected whenever the port is reinitialized, via link state change, reauthentication failure, or management intervention. • connecting: While in this state, the authenticator sends request/ID messages to the end user. • authenticating: The port enters this state from connecting after receiving a response/ID from the end user. It remains in this state until the entire authentication exchange between the end user and the authentication server completes. • authenticated: The port enters this state from authenticating state after the exchange completes with a favorable result. It remains in this state until linkdown, logoff, or until a reauthentication begins. • aborting: The port enters this state from authenticating when any event occurs that interrupts the login exchange. • held: After any login failure the port remains in this state for the number of seconds equal to quietPeriod (can be set using MIB). • forceAuth: Management is allowing normal, unsecured switching on this port. • forceUnauth: Management is preventing any frames from being forwarded to or from this port. Authentication Mode Mode enabling network access for each port. Modes include: • Auto: Frames are forwarded according to the authentication state of each port. • Forced Authorized Mode: Meant to disable authentication on a port. It is intended for ports that support ISLs and devices that cannot authenticate, such as printers and file servers. If a default policy is applied to the port via the policy profile MIB, then frames are forwarded according to the configuration set by that policy, otherwise frames are forwarded according to the current configuration for that port. Authentication using 802.1X is not possible on a port in this mode. • Forced Unauthorized Mode: All frames received on the port are discarded by a filter. Authentication using 802.1X is not possible on a port in this mode.

SecureStack A2 Configuration Guide

14-19

 refer to Table 14‐2. Specifies the authentication mode as: • auto ‐ Auto authorization mode.1. which disables authentication  on the port.  forced‐unauth ‐ Forced unauthorized mode.set eapol set eapol Use this command to enable or disable EAPOL port‐based user authentication with the RADIUS  server and to set the authentication mode for one or more ports. Mode Switch command. • • port‐string Specifies the port(s) on which to set EAPOL parameters. forced‐auth ‐ Forced authorized mode.1: A2(su)->set eapol auth-mode forced-auth fe. This is the default mode and will  forward frames according to the authentication state of the port. refer to “Port String Syntax Used  in the CLI” on page 4‐2. For  details on this mode. Syntax set eapol [enable | disable] [auth-mode {auto | forced-auth | forced-unauth} port-string Parameters enable | disable auth‐mode auto |  forced‐auth |  forced‐unauth Enables or disables EAPOL. Defaults None.1. For a detailed  description of possible port‐string values. which filters and discards  all frames received on the port. read‐write. Examples This example shows how to enable EAPOL: A2(su)->set eapol enable This example shows how to enable EAPOL with forced authorized mode on port fe.1 14-20 Security Configuration .

 read‐write. Defaults If auth‐mode is not specified.1. If port‐string is not specified. For a detailed  description of possible port‐string values. Mode Switch command. refer to “Port String Syntax Used  in the CLI” on page 4‐2.  Syntax clear eapol [auth-mode] [port-string] Parameters auth‐mode port‐string (Optional) Globally clears the EAPOL authentication mode.clear eapol clear eapol Use this command to globally clear the EAPOL authentication mode. all EAPOL settings will be cleared.3: A2(su)->clear eapol auth-mode ge. Specifies the port(s) on which to clear EAPOL parameters. Example This example shows how to clear the EAPOL authentication mode for port ge.3 SecureStack A2 Configuration Guide 14-21 .1. or to clear settings for one or  more ports. settings will be cleared for all ports.

 This authentication method allows  the device to authenticate source MAC addresses in an exchange with an authentication server.. if required. Commands The commands needed to review. disable. 14-23 14-24 14-25 14-26 14-26 14-27 14-27 14-28 14-28 14-29 14-29 14-30 14-30 14-31 14-32 14-32 14-33 14-22 Security Configuration . the switch applies the associated policy  rules.. enable. show macauthentication show macauthentication session set macauthentication set macauthentication password clear macauthentication password set macauthentication port set macauthentication portinitialize set macauthentication portquietperiod clear macauthentication portquietperiod set macauthentication macinitialize set macauthentication reauthentication set macauthentication portreauthenticate set macauthentication macreauthenticate set macauthentication reauthperiod clear macauthentication reauthperiod set macauthentication significant-bits clear macauthentication significant-bits Refer to page. If accepted. The backend client uses the MAC address stored  password. You can specify a mask to apply to MAC addresses when authenticating users through a RADIUS  server (see “set macauthentication significant‐bits” on page 14‐32). as credentials for an authentication attempt.Configuring MAC Authentication Configuring MAC Authentication Purpose To review. and configure MAC authentication are listed  below: For information about. a string  representing an access policy may be returned. The most common use of  significant bit masks is for authentication of all MAC addresses for a specific vendor. enable and configure MAC authentication.. disable.  The authenticator (switch) selects a source MAC seen on a MAC‐authentication enabled port and  submits it to a backend client for authentication.. If present.

2. read‐only. Set using the set macauthentication command as described in “set macauthentication” on page 14-25.5 ge.show macauthentication show macauthentication Use this command to display MAC authentication information for one or more ports. Mode Switch command. Set using the set macauthentication password command as described in “set macauthentication password” on page 14-26. Example This example shows how to display MAC authentication information for ge..7 ge.2.1 ge. Whether MAC authentication is globally enabled or disabled.2.3 ge. User password associated with MAC authentication on the device.8 Port State -------disabled disabled disabled disabled disabled disabled disabled disabled Reauth Period ---------3600 3600 3600 3600 3600 3600 3600 3600 Auth Allowed -------1 1 1 1 1 1 1 1 Auth Allocated --------1 1 1 1 1 1 1 1 Reauthentications ----------------disabled disabled disabled disabled disabled disabled disabled disabled Table 14‐3 provides an explanation of the command output.2.2.6 ge.2.2.. Syntax show macauthentication [port-string] Parameters port‐string (Optional) Displays MAC authentication information for specific port(s).48 Port ------ge. MAC authentication information will be displayed for all ports. refer to “Port String  Syntax Used in the CLI” on page 4‐2.4 ge. Table 14-3 Output MAC authentication show macauthentication Output Details What It Displays.2.enabled MAC user password: .2.2 ge.2.1-8 MAC authentication: . MAC user password SecureStack A2 Configuration Guide 14-23 .NOPASSWORD Port username significant bits .  For a detailed description of possible port‐string values.  Defaults If port‐string is not specified.1 through 8: A2(su)->show macauthentication ge.

. Syntax show macauthentication session Parameters None.show macauthentication session Table 14-3 Output show macauthentication Output Details (Continued) What It Displays. Default is 1 and cannot be reset Whether or not reauthentication is enabled or disabled on this port. Port designation. Whether or not MAC authentication is enabled or disabled on this port.e. authentication server timeout) causes the next attempt to start once again with a full MAC authentication.---------. refer to “Port String Syntax Used in the CLI” on page 4-2. Number of significant bits in the MAC addresses to be used starting with the left-most bit of the vendor portion of the MAC address.. (i. Reauthentication period for this port. read‐only. MAC session information will be displayed for all MAC  authentication ports.------------Reauthentications ----------------- 14-24 Security Configuration . The significant portion of the MAC address is sent as a user-name credential when the primary attempt to authenticate the full MAC address fails. Default is 1 and cannot be reset.. New sessions display the correct period. Port username significant bits Port Port State Reauth Period Auth Allowed Auth Allocated Reauthentications show macauthentication session Use this command to display the active MAC authenticated sessions. Defaults If port‐string is not specified. Number of concurrent authentications supported on this port. Default value of 48 can be changed with the set macauthentication significant-bits command. Set using the set macauthentication reauthentication command (page 14-29). Example This example shows how to display MAC session information: A2(su)->show macauthentication session Port MAC Address Duration Reauth Period --------------------. For a detailed description of possible port-string values. Default value of 30 can be changed using the set macauthentication reauthperiod command (page 14-31). Maximum number of MAC authentications permitted on this port. Usage Changing the Reauth Period with the set macauthentication reauthperiod command does not  affect current sessions. Mode Switch command. Any other failure to authenticate the full address.

Whether or not reauthentication is enabled or disabled on this port. Defaults None. set using the set macauthentication reauthperiod command described in “set macauthentication reauthperiod” on page 14-31. Reauthentication period for this port. Reauthentications set macauthentication Use this command to globally enable or disable MAC authentication. Set using the set macauthentication reauthentication command described in “set macauthentication reauthentication” on page 14-29. MAC address associated with the session. For a detailed description of possible port-string values.00:52:31 3600 disabled Table 14‐4 provides an explanation of the command output.. Example This example shows how to globally enable MAC authentication: A2(su)->set macauthentication enable SecureStack A2 Configuration Guide 14-25 . read‐write.1.. refer to “Port String Syntax Used in the CLI” on page 4-2. Mode Switch command.2 00:60:97:b5:4c:07 0.set macauthentication ge. Table 14-4 Output Port MAC Address Duration Reauth Period show macauthentication session Output Details What It Displays. Port designation. Time this session has been active. Syntax set macauthentication {enable | disable} Parameters enable | disable Globally enables or disables MAC authentication.

Defaults None. read‐write. Syntax clear macauthentication password Parameters None. read‐write. Defaults None. Example This example shows how to clear the MAC authentication password: A2(su)->clear macauthentication password 14-26 Security Configuration . Mode Switch command. Example This example shows how to set the MAC authentication password to “macauth”: A2(su)->set macauthentication password macauth clear macauthentication password Use this command to clear the MAC authentication password. Mode Switch command. Syntax set macauthentication password password Parameters password Specifies a text string MAC authentication password.set macauthentication password set macauthentication password Use this command to set a MAC authentication password.

Syntax set macauthentication portinitialize port-string Parameters port‐string Specifies the MAC authentication port(s) to re‐initialize. refer to “Port String  Syntax Used in the CLI” on page 4‐2. read‐write. MAC authentication is globally disabled and disabled on all ports. Usage Enabling port(s) for MAC authentication requires globally enabling MAC authentication on the  switch as described in “set macauthentication” on page 14‐25. Syntax set macauthentication port {enable | disable} port-string Parameters enable | disable port‐string Enables or disables MAC authentication. Example This example shows how to enable MAC authentication on ge. By default. Specifies port(s) on which to enable or disable MAC authentication.1-5 set macauthentication portinitialize Use this command to force one or more MAC authentication ports to re‐initialize and remove any  currently active sessions on those ports.  Defaults None. Mode Switch command. For a detailed  description of possible port‐string values. SecureStack A2 Configuration Guide 14-27 . refer to “Port String Syntax Used  in the CLI” on page 4‐2.2.set macauthentication port set macauthentication port Use this command to enable or disable one or more ports for MAC authentication.2. read‐write. and then enabling it on a port‐by‐ port basis. For a  detailed description of possible port‐string values. Mode Switch command.1 though 5: A2(su)->set macauthentication port enable ge.  Defaults None.

 For a detailed  description of possible port‐string values. Example This example sets port 1 to wait 5 seconds after a failed authentication attempt before a new  attempt can be made: A2(su)->set macauthentication portquietperiod 5 ge. For a  detailed description of possible port‐string values.1 through 5 to initialize: A2(su)->set macauthentication portinitialize ge.1 clear macauthentication portquietperiod This sets the quiet period back to the default value.1-5 set macauthentication portquietperiod This sets the number of seconds following a failed authentication before another attempt may be  made on the port.set macauthentication portquietperiod Example This example shows how to force ge. refer to “Port String  Syntax Used in the CLI” on page 4‐2.2.2.  Defaults None. Syntax clear macauthentication portquietperiod [port-string] Parameters port‐string (Optional) Specifies the ports for which the quiet period is to be reset. 14-28 Security Configuration .  Defaults If a port‐string is not specified then all ports will be set to the default port quiet period. read‐write. Mode Switch command. Syntax set macauthentication portquietperiod time port-string Parameters time port‐string Period in seconds to wait after a failed authentication Specifies the ports for which the quit period is to be applied.1. refer to “Port String Syntax Used  in the CLI” on page 4‐2.

  Defaults None. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to re‐initialize: A2(su)->set macauthentication macinitialize 00-60-97-b5-4c-07 set macauthentication reauthentication Use this command to enable or disable reauthentication of all currently authenticated MAC  addresses on one or more ports. SecureStack A2 Configuration Guide 14-29 . Specifies port(s) on which to enable or disable MAC reauthentication. Example This example resets the default quit period on port 1: A2(su)->clear macauthentication portquietperiod ge. Mode Switch command. For a  detailed description of possible port‐string values. Syntax set macauthentication macinitialize mac-addr Parameters mac‐addr Specifies the MAC address of the session to re‐initialize. Syntax set macauthentication reauthentication {enable | disable} port-string Parameters enable | disable port‐string Enables or disables MAC reauthentication.1 set macauthentication macinitialize Use this command to force a current MAC authentication session to re‐initialize and remove the  session.set macauthentication macinitialize Mode Switch command. read‐write. read‐write.1. Defaults None.

 read‐write.4. Syntax set macauthentication macreauthenticate mac-addr Parameters mac‐addr Specifies the MAC address of the session to reauthenticate.1 though 5: A2(su)->set macauthentication reauthentication enable ge. 14-30 Security Configuration . refer to “Port String Syntax Used  in the CLI” on page 4‐2.1-5 set macauthentication portreauthenticate Use this command to force an immediate reauthentication of the currently active sessions on one  or more MAC authentication ports. For a detailed  description of possible port‐string values. read‐write. read‐write. Syntax set macauthentication portreauthenticate port-string Parameters port‐string Specifies MAC authentication port(s) to be reauthenticated. Mode Switch command.1-5 set macauthentication macreauthenticate Use this command to force an immediate reauthentication of a MAC address.1 though 5 to reauthenticate: A2(su)->set macauthentication portreauthentication ge. Example This example shows how to force ge.set macauthentication portreauthenticate Mode Switch command. Mode Switch command.2. Defaults None.4.  Defaults None.2. Example This example shows how to enable MAC reauthentication on ge.

Syntax set macauthentication reauthperiod time port-string Parameters time port‐string Specifies the number of seconds between reauthentication attempts. This is the time lapse  between attempts to reauthenticate any current MAC address authenticated to a port.  Defaults None. Mode Switch command. New sessions will use the correct period. Example This example shows how to set the MAC reauthentication period to 7200 seconds (2 hours) on  ge.set macauthentication reauthperiod Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to reauthenticate: A2(su)->set macauthentication macreauthenticate 00-60-97-b5-4c-07 set macauthentication reauthperiod Use this command to set the MAC reauthentication period (in seconds).2. For a  detailed description of possible port‐string values.2. read‐write. Usage Changing the Reauth Period with the set macauthentication reauthperiod command does not  affect current sessions. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Valid  values are 1 ‐ 4294967295.1 through 5: A2(su)->set macauthentication reauthperiod 7200 ge.1-5 SecureStack A2 Configuration Guide 14-31 . Specifies the port(s) on which to set the MAC reauthentication period.

 read‐write. Syntax set macauthentication significant-bits number Parameters number Specifies the number of significant bits to be used for authentication. read‐write. Defaults None. the reauthentication period will be cleared on all ports. Usage This command allows you to specify a mask to apply to MAC addresses when authenticating  users through a RADIUS server. the switch will apply the mask and  14-32 Security Configuration . and if a significant bit mask  has been configured (other than 48) with this command. If access is denied. The most common use of significant bit masks is for  authentication of all MAC addresses for a specific vendor. the MAC address of a user attempting to log  in is sent to the RADIUS server as the user name. For a  detailed description of possible port‐string values.  Defaults If port‐string is not specified. refer to “Port String  Syntax Used in the CLI” on page 4‐2. Syntax clear macauthentication reauthperiod [port-string] Parameters port‐string (Optional) Clears the MAC reauthentication period on specific port(s). Mode Switch command. Example This example shows how to globally clear the MAC reauthentication period: A2(su)->clear macauthentication reauthperiod set macauthentication significant-bits Use this command to set the number of significant bits of the MAC address to use for  authentication.clear macauthentication reauthperiod clear macauthentication reauthperiod Use this command to clear the MAC reauthentication period on one or more ports. On SecureStack switches using MAC authentication. Mode Switch command.

  Example This example sets the MAC authentication significant bits mask to 24. Syntax clear macauthentication significant-bits Parameters None. To use a significant bits mask for authentication of devices by a particular vendor. if a user with MAC address of 00‐ 16‐CF‐12‐34‐56 is denied access. the switch will apply the  mask and resend a MAC address of 00‐16‐CF‐12‐00‐00 to the RADIUS server. Example This example resets the MAC authentication significant bits to 48. A2(su)->clear macauthentication significant-bits SecureStack A2 Configuration Guide 14-33 . specify a 24 bit  mask. to mask out everything except the vendor portion of the MAC address. Defaults None. A2(su)->set macauthentication significant-bits 24 clear macauthentication significant-bits Use this command to reset the number of significant bits of the MAC address to use for  authentication to the default of 48. and a 32 bit mask has been configured. Mode Switch command.clear macauthentication significant-bits resend the masked address to the RADIUS server. read‐write. For example.

 In order for multiple authentication to function on the device. and configure multiple authentication are listed  below: For information about. 14-35 14-36 14-36 14-37 14-37 14-38 14-39 14-39 14-40 14-34 Security Configuration . multiple authentication types allows users to authenticate using up to two  methods on the same port. disable. enable....  Multiple authentication mode must be globally enabled on the device using the set multiauth  mode command.1X) must be enabled globally and  configured appropriately on the desired ports with its corresponding command set described in  this chapter.Configuring Multiple Authentication Methods Configuring Multiple Authentication Methods About Multiple Authentication Types When enabled. Commands The commands needed to review. show multiauth set multiauth mode clear multiauth mode set multiauth precedence clear multiauth precedence show multiauth port set multiauth port clear multiauth port show multiauth station Refer to page. each  possible method of authentication (MAC authentication.. 802.

 read‐only. Example This example shows how to display multiple authentication system configuration: A2(rw)->show multiauth Multiple authentication system configuration ------------------------------------------------Supported types : dot1x. mac SecureStack A2 Configuration Guide 14-35 . Mode Switch command. mac Admin precedence Operational precedence : dot1x. Defaults None. Syntax show multiauth Parameters None. mac Maximum number of users : 192 Current number of users : 0 System mode : multi Default precedence : dot1x.show multiauth show multiauth Use this command to display multiple authentication system configuration.

1x  authentication. or to strictly adhere to 802. read‐write.1X Authentication” on page 14‐11 and  “Configuring MAC Authentication” on page 14‐22. Syntax clear multiauth mode Parameters None.1X authentication be enabled globally.set multiauth mode set multiauth mode Use this command to set the system authentication mode to allow multiple authenticators  simultaneously (802. Example This example shows how to enable simultaneous multiple authentications: A2(rw)->set multiauth mode multi clear multiauth mode Use this command to clear the system authentication mode.1x authentication before normal traffic  (anything other than authentication traffic) can be forwarded. 14-36 Security Configuration .1x and  MAC Authentication) on a port. This is the default mode. Mode Switch command.1x and MAC Authentication) on a single port. Defaults None. Syntax set multiauth mode {multi | strict} Parameters multi  strict Allow the system to use multiple authenticators simultaneously (802. and  configured appropriately on the desired ports according to their corresponding command sets  described in this chapter. read‐write. Mode Switch command. Refer to “Configuring 802. Usage Multiauth multi mode requires that MAC and 802. Defaults None. User must authenticate using 802.

SecureStack A2 Configuration Guide 14-37 . Usage When a user is successfully authenticated by more than one method at the same time. Mode Switch command.set multiauth precedence Example This example shows how to clear the system authentication mode: A2(rw)->clear multiauth mode set multiauth precedence Use this command to set the system’s multiple authentication administrative precedence. Defaults None. the  precedence of the authentication methods will determine which RADIUS‐returned filter ID will be  processed and result in an applied traffic policy profile. Syntax clear multiauth precedence Parameters None.1X authentication. Sets precedence for MAC authentication. read‐write. Syntax set multiauth precedence {[dot1x] [mac]} Parameters dot1x mac Sets precedence for 802. Example This example shows how to set precedence for MAC authentication: A2(rw)->set multiauth precedence mac dot1x clear multiauth precedence Use this command to clear the system’s multiple authentication administrative precedence. read‐write. Defaults None. Mode Switch command.

1-4 Port Max users -----------.show multiauth port Example This example shows how to clear the multiple authentication precedence: A2(rw)->clear multiauth precedence show multiauth port Use this command to display multiple authentication properties for one or more ports. Example This example shows how to display multiple authentication information for ports ge.3.1 auth-opt 2 ge.3. Syntax show multiauth port [port-string] Parameters port‐string (Optional) Displays multiple authentication information for specific port(s).1‐4: A2(rw)->show multiauth port ge. Mode Switch command.3.4 auth-opt 2 Mode Allowed users ---------1 1 1 1 Current users ---------0 0 0 0 14-38 Security Configuration .---------ge. Defaults If port‐string is not specified.3.3 auth-opt 2 ge. read‐only. multiple authentication information will be displayed for all ports.3.2 auth-opt 2 ge.-----------.3.

set multiauth port set multiauth port Use this command to set multiple authentication properties for one or more ports. Currently.1x  authentication fails. Defaults None. read‐write. • • • numusers  numusers port‐string Specifies the number of users allowed authentication on port(s). SecureStack A2 Configuration Guide 14-39 . Specifies the port(s) on which to set multiple authentication properties. Syntax set multiauth port mode {auth-opt | auth-reqd | force-auth | force-unauth} | numusers numusers port-string Parameters mode  auth‐opt |  auth‐reqd |  force‐auth |  force‐unauth Specifies the port(s)’ multiple authentication mode as: • auth‐opt — Authentication optional (“non‐strict” behavior). or if 802. the port will allow traffic to be forwarded  according to the defined default VLAN. Specifies the port or ports on which to clear multiple authentication  properties.14: A2(rw)->set multiauth port mode auth-reqd ge.14 clear multiauth port Use this command to clear multiple authentication properties for one or more ports. Syntax clear multiauth port {mode | numusers} port-string Parameters mode numusers  port‐string Clears the specified port’s multiple authentication mode.1x.3.  valid values are 1 or 2. If a user  does not attempt to authenticate using 802. Mode Switch command. force‐unauth — Authentication disabled. auth‐reqd — Authentication is required.3. Clears the value set for the number of users allowed authentication on the  specified port. force‐auth — Authentication considered. Example This example shows how to set the port multiple authentication mode to required on ge.

3. read‐write.14 show multiauth station Use this command to display multiple authentication station (end user) entries.14 This example shows how to clear the number of users on port ge.20 fe.16 multiauth station Address type Address -----------.14: A2(rw)->clear multiauth port mode ge. Example This example shows how to display multiple authentication station entries. Syntax show multiauth station [mac address] [port port-string] Parameters mac address port port‐string (Optional) Displays multiple authentication station entries for specific MAC  address(es). Defaults If no options are specified. Examples This example shows how to clear the port multiple authentication mode on port ge. In this case.show multiauth station Defaults None.3. multiple authentication station entries will be displayed for all MAC  addresses and ports.14: A2(rw)->clear multiauth port numusers ge. two end  user MAC addresses are shown: A2(rw)->show Port -----------fe.-----------------------mac 00-10-a4-9e-24-87 mac 00-b0-d0-e5-0c-d0 Syntax 14-40 Security Configuration . Mode Switch command.3. read‐only.2. (Optional) Displays multiple authentication station entries for specific  port(s).1. Mode Switch command.3.

 However. set vlanauthorization set vlanauthorization egress clear vlanauthorization show vlanauthorization Refer to page. 14-42 14-42 14-43 14-44 SecureStack A2 Configuration Guide 14-41 ..” The RADIUS server typically indicates the desired VLAN by including tunnel attributes within  the Access‐Accept.Configuring VLAN Authorization (RFC 3580) Configuring VLAN Authorization (RFC 3580) Purpose Please see section 3‐31 of RFC 3580 for details on configuring a RADIUS server to return the  desired tunnel attributes. “.. defined in [IEEE8021Q]... the IEEE 802. the following tunnel attributes are used: • • • Tunnel‐Type=VLAN (13) Tunnel‐Medium‐Type=802 Tunnel‐Private‐Group‐ID=VLANID Commands The commands used to configure RADIUS tunnel attributes are listed below. it may be desirable to allow a port to be placed into a  particular Virtual LAN (VLAN). For information about...1X Authenticator may also provide a hint as to the  VLAN to be assigned to the Supplicant by including Tunnel attributes within the Access‐Request. based on the result of the  authentication. For use in VLAN assignment. From RFC 3580.

 read‐write.1x authenticated ports for the  VLANs returned in the RADIUS authorization filter id string.set vlanauthorization set vlanauthorization Enable or disable the use of the RADIUS VLAN tunnel attribute to put a port into a particular  VLAN based on the result of authentication. refer to “Port String Syntax Used in the CLI” on page 4‐2. Mode Switch command. Defaults VLAN authentication is disabled by default. refer to “Port String Syntax  Used in the CLI” on page 4‐2.* This example shows how to disable VLAN authentication for all Fast Ethernet ports on stack  unit 3: A2(rw)-> set vlanauthorization disable fe.* set vlanauthorization egress Controls the modification of the current VLAN egress list of 802. to which this command will apply. Examples This example shows how to enable VLAN authentication for all Fast Ethernet ports: A2(rw)-> set vlanauthorization enable fe. For a detailed  description of possible port‐string values. The authenticating port will be added to the current untagged egress for  the VLAN‐ID returned (default). Syntax set vlanauthorization egress {none | tagged | untagged} port-string Parameters none tagged untagged port‐string No egress manipulation will be made. Syntax set vlanauthorization {enable | disable} [port-string] Parameters enable | disable port‐string Enables or disables vlan authorization/tunnel attributes (Optional) Specifies which ports to enable or disable the use of VLAN  tunnel attributes/authorization.3. The authenticating port will be added to the current tagged egress for the  VLAN‐ID returned. 14-42 Security Configuration .*. For a detailed description of possible port‐ string values. The port or list of ports.

3. the action will be a global  setting.  egress untagged. refer to  “Port String Syntax Used in the CLI” on page 4‐2.* SecureStack A2 Configuration Guide 14-43 . 4.3-5. If no port string is entered. Mode Switch command. read‐write. Example This example shows how to enable the insertion of the RADIUS assigned VLAN to an 802. A2(rw)->set vlanauthorization egress tagged ge. administrative egress is set to untagged.1q tag  for all outbound frames for ports 10 through 15 on unit number 3. Mode Switch command. Defaults If no port string is entered. Syntax clear vlanauthorization [port-string] Parameters port‐string (Optional) Specifies which ports are to be restored to default  configuration.clear vlanauthorization Defaults By default. read‐write. Example This example show how to clear VLAN authorization for all ports on slots 3.10-15 clear vlanauthorization Use this command to return port(s) to the default configuration of VLAN authorization disabled. all ports across the stack will be reset to default configuration with  VLAN authorization disabled and egress frames untagged. For a detailed description of possible port‐string values. and 5: A2(rw)->clear vlanauthorization ge.

14-44 Security Configuration . Mode Switch command. Syntax show vlanauthorization [port-string] Parameters port‐string (Optional) Displays VLAN authentication status for the specified ports.1 status ------enabled administrative egress ------------------------untagged operational egress --------------------none vlan id -------0 Table 14‐5 provides an explanation of command output. read‐only. If authentication has succeeded. then the global status of the setting is displayed. displays the VLAN id assigned for egress.show vlanauthorization show vlanauthorization Displays the VLAN authentication status and configuration information for the specified ports.1 port ----fe. refer to “Port  String Syntax Used in the CLI” on page 4‐2. If  no port string is entered. Port identification Port status as assigned by set vlanauthorization command Port status as assigned by the set vlanauthorization egress command If authentication has succeeded..  For a detailed description of possible port‐string values. Defaults If no port string is entered.1. Table 14-5 Output port status administrative egress operational egress vlan id show vlanauthorization Output Details What It Displays.. displays the assigned VLAN id for ingress. For details on enabling and assigning  protocol and egress attributes.1. the status for all ports will be displayed. Example This command shows how to display VLAN authorization status for Fast Ethernet port 1 on  unit 1: A2(rw)-> show vlanauthorization fe. refer to “set vlanauthorization” on page 14‐42 and “set  vlanauthorization egress” on page 14‐42.

  The static method is defined to be statically provisioning a MAC‐port lock using the set maclock  create command. MAC locking is an excellent security tool as it prevents MAC spoofing  on configured ports. and configure MAC locking. enable.  Commands For information about. The first arrival method  is defined to be locking the first n number of MACs which arrive on a port configured with MAC  locking enabled. In the meantime the system administrator would be receiving a maclock trap notification. show maclock show maclock stations set maclock enable set maclock disable set maclock clear maclock set maclock static clear maclock static set maclock firstarrival clear maclock firstarrival set maclock move set maclock trap Refer to page.. MAC locking would make it more difficult for a hacker to send packets into  the network because the hacker would have to change their MAC address and move to another  port. disable.. the  switch discards all subsequent frames not containing the configured source addresses. There are two methods of locking a MAC to a port: first arrival and static. The maximum number of static MAC addresses allowed for MAC locking on a  port can be configured with the set maclock static command.. When source MAC addresses are received on specified ports. MACs are unlocked as a result of: • • A link down event When MAC locking is disabled on a port When properly configured. The only  frames forwarded on a “locked” port are those with the “locked” MAC address(es) for that port.Configuring MAC Locking Configuring MAC Locking This feature locks a MAC address to one or more ports. The value n is configured with the set maclock firstarrival command. Also if a MAC were to be secured by something like Dragon Dynamic  Intrusion Detection.. You can configure the switch to issue a violation trap if a packet arrives with a source MAC  address different from any of the currently locked MAC addresses for that port. Purpose To review. 14-46 14-47 14-48 14-49 14-49 14-50 14-51 14-51 14-52 14-53 14-53 14-54 SecureStack A2 Configuration Guide 14-45 . preventing connection of unauthorized  devices through the port(s).

Most recent MAC address(es) violating the maximum static and first arrival value(s) set for the port. Table 14-6 Output Port Number Port Status show maclock Output Details What It Displays. For details on setting this status.1.show maclock show maclock Use this command to display the status of MAC locking on one or more ports. For a detailed description of possible port-string values. MAC locking is globally disabled by default.--------------. Example This example shows how to display MAC locking information for ge. For a  detailed description of possible port‐string values. Trap Status Max Static Allocated Max FirstArrival Allocated Violating MAC Address 14-46 Security Configuration .  Defaults If port‐string is not specified.. read‐only. refer to “Port String  Syntax Used in the CLI” on page 4‐2.. The maximum end station MAC addresses allowed locked to the port.--------------disabled 20 1 00:a0:c9:39:5c:b4 Table 14‐6 provides an explanation of the command output.---------. refer to “set maclock static” on page 14-51. For details on enabling MAC locking on the switch and on one or more ports. Port designation. refer to “set maclock trap” on page 14-54. refer to “Port String Syntax Used in the CLI” on page 4-2.1.1.1. refer to “set maclock enable” on page 14-48 and “set maclock” on page 14-49.1 MAC locking is globally enabled Port Number ------ge. MAC locking status will be displayed for all ports. Syntax show maclock [port-string] Parameters port‐string (Optional) Displays MAC locking status for specified port(s). The maximum static MAC addresses allowed locked to the port. For details on setting this value. refer to “set maclock firstarrival” on page 14-52. For details on setting this value.1 Port Status ------enabled Trap Max Static Max FirstArrival Violating Status Allocated Allocated MAC Address -------. Whether MAC lock trap messaging is enabled or disabled on the port. Whether MAC locking is enabled or disabled on the port.  A2(su)->show maclock ge. Mode Switch command.

-----------------------------fe. SecureStack A2 Configuration Guide 14-47 .2. Mode Switch command. For a  detailed description of possible port‐string values.7 00:a0:c9:39:1f:11 active State -------------first arrival static Table 14‐7 provides an explanation of the command output. MAC address of the end station(s) locked to the port. Whether the end station locked to the port is a first arrival or static connection. (Optional) Displays MAC locking information about static (management  defined) end stations connected to MAC locked ports.2. Example This example shows how to display MAC locking information for the end stations connected to all  Fast Ethernet ports in unit 2:  A2(su)->show maclock stations fe..* Port Number MAC Address Status -----------.  Defaults If no parameters are specified.1 00:a0:c9:39:5c:b4 active fe.2.show maclock stations show maclock stations Use this command to display MAC locking information about end stations connected to the  switch. Table 14-7 Output Port Number MAC address Status State show maclock stations Output Details What It Displays. Port designation. read‐only. MAC locking information will be displayed for all end stations. For a detailed description of possible port-string values. refer to “Port String  Syntax Used in the CLI” on page 4‐2. refer to “Port String Syntax Used in the CLI” on page 4-2. Syntax show maclock stations [firstarrival | static] [port-string] Parameters firstarrival  static  port‐string (Optional) Displays MAC locking information about end stations first  connected to MAC locked ports. Whether the end stations are active or inactive.. (Optional) Displays end station information for specified port(s).

Mode Switch command.2. Configuring one or more ports for MAC  locking requires globally enabling it on the device and then enabling it on the desired ports. MAC locking will be enabled on all ports.  Syntax set maclock enable [port‐string] Parameters port‐string (Optional) Enables MAC locking on specific port(s).3 14-48 Security Configuration . Usage When enabled and configured for a specific MAC address and port string. refer to “Port String Syntax Used  in the CLI” on page 4‐2. MAC locking is disabled by default at device startup.  Defaults If port‐string is not specified. read‐write. this locks a port so that  only one end station address is allowed to participate in frame relay.3:  A2(su)->set maclock enable fe.set maclock enable set maclock enable Use this command to enable MAC locking on one or more ports. Example This example shows how to enable MAC locking on fe. For a detailed  description of possible port‐string values.2.

SecureStack A2 Configuration Guide 14-49 . Create automatically enables MAC locking between the  specified MAC address and port. read‐write.   Syntax set maclock mac-address port-string {create | enable | disable} Parameters mac‐address port‐string Specifies the MAC address for which MAC locking will be created.3:  A2(su)->set maclock disable fe. Mode Switch command. MAC locking will be disabled on all ports.  enabled or disabled. refer to “Port String Syntax Used  in the CLI” on page 4‐2. Specifies the port on which to create. refer to “Port String Syntax Used in the CLI” on page 4‐2. enable or disable MAC locking for  the specified MAC.3 set maclock Use this command to create a static MAC address‐to‐port locking.  Establishes a MAC locking association between the specified MAC  address and port.2.  Defaults If port‐string is not specified.  Syntax set maclock disable [port-string] Parameters port‐string (Optional) Disables MAC locking on specific port(s). create enable | disable Defaults None. Enables or disables MAC locking between the specified MAC address and  port. For a detailed description of possible port‐string  values. Example This example shows how to disable MAC locking on fe. and to enable or disable MAC  locking for the specified MAC address and port.set maclock disable set maclock disable Use this command to disable MAC locking on one or more ports. For a detailed  description of possible port‐string values.2.

Usage The MAC address that is cleared will no longer be able to communicate on the port unless the first  arrival limit has been set to a value greater than 0 and this limit has not yet been met. then user B will not be able to communicate on the port. Example This example shows how to remove a MAC from the list of static MACs allowed to communicate  on port ge.3. For example. but only has  7 entries. If user A’s MAC is  removed from the static MAC address list and the first arrival limit has been set to 10. Specifies the port on which to clear the MAC address. read‐write.clear maclock Mode Switch command. Mode Switch command.2:  A2(rw)->clear maclock 0e-03-ef-d8-44-55 ge. read‐write.3. For a detailed  description of possible port‐string values.2 create clear maclock Use this command to remove a static MAC address to port locking entry. Example This example shows how to create a MAC locking association between MAC address 0e‐03‐ef‐d8‐ 44‐55 and port ge. Usage Configuring one or more ports for MAC locking requires globally enabling it on the switch first  using the set maclock enable command as described in “set maclock enable” on page 14‐48.3. user A will become the 8th entry and allowed to communicate on the port.2 14-50 Security Configuration . refer to “Port String Syntax Used  in the CLI” on page 4‐2.2:  A2(rw)->set maclock 0e-03-ef-d8-44-55 ge.  Syntax clear maclock mac-address port-string Parameters mac‐address port‐string Specifies the MAC address that will be removed from the list of static  MACs allowed to communicate on the port.3.  Defaults None. if user B’s MAC is removed from the static MAC address list and the first arrival  limit has been set to 0.

Mode Switch command.3. Valid values are 0 to 20.set maclock static set maclock static Use this command to set the maximum number of static MAC addresses allowed per port. value Defaults None. For a detailed description of possible port‐string values. Defaults None.1 2 clear maclock static Use this command to reset the number of static MAC addresses allowed per port to the default  value of 20. SecureStack A2 Configuration Guide 14-51 . Mode Switch command. refer to  “Port String Syntax Used in the CLI” on page 4‐2. For a detailed description of possible port‐string values.  Syntax set maclock static port-string value Parameters port‐string Specifies the port on which to set the maximum number of static MACs  allowed. read‐write. Syntax clear maclock static port-string Parameters port‐string Specifies the port on which to reset number of static MAC addresses  allowed. Example This example shows how to set the maximum number of allowable static MACs to 2 on ge.1:  A2(rw)->set maclock static ge. Specifies the maximum number of static MAC addresses allowed per  port. refer to  “Port String Syntax Used in the CLI” on page 4‐2. read‐write.3. Static  MACs are administratively defined.

 read‐write.2.2.set maclock firstarrival Example This example shows how to reset the number of allowable static MACs on fe.  Specifies the number of first arrival end station MAC addresses to be  allowed connections to the port. Example This example shows how to restrict MAC locking to 6 MAC addresses on fe.  Syntax set maclock firstarrival port-string value Parameters port‐string Specifies the port on which to limit MAC locking.2. Valid values are 0 to 600.3 6 14-52 Security Configuration .  but will still protect against connecting multiple devices on a single port and will protect against  MAC address spoofing.2. If you wish to have only statically set MACs. refer to “Port String Syntax Used  in the CLI” on page 4‐2. set a port’s first arrival limit to 0. This feature is beneficial if you  have roaming users—the first arrival count will be reset every time a user moves to another port. Mode Switch command. For a detailed  description of possible port‐string values.3:  A2(su)->set maclock firstarrival fe.3:  A2(rw)->clear maclock static fe.3 set maclock firstarrival Use this command to restrict MAC locking on a port to a maximum number of end station  addresses first connected to that port. value Defaults None. Usage The maclock first arrival count resets when the link goes down.

 if you set the maximum number of  static MACs to 2 with the set maclock static command.  Syntax clear maclock firstarrival port-string Parameters port‐string Specifies the port on which to reset the first arrival value. For example.3 set maclock move Use this command to move all current first arrival MACs to static entries. For a detailed  description of possible port‐string values. Usage If there are more first arrival MACs than the allowed maximum static MACs. read‐write.  Defaults None. and then executed the set maclock move  command. even though there were five MACs in the first arrival table. For a detailed description of possible port‐string values. only the two most recent  MAC entries would be moved to static entries. Example This example shows how to reset MAC first arrivals on fe.  refer to “Port String Syntax Used in the CLI” on page 4‐2. read‐write. then only the latest  first arrival MACs will be moved to static entries.3:  A2(su)->clear maclock firstarrival fe.2.  SecureStack A2 Configuration Guide 14-53 .  Syntax set maclock move port-string Parameters port‐string Specifies the port on which MAC will be moved from first arrival MACs  to static entries.clear maclock firstarrival clear maclock firstarrival Use this command to reset the number of first arrival MAC addresses allowed per port to the  default value of 600.2. Mode Switch command. refer to “Port String Syntax Used  in the CLI” on page 4‐2.  Defaults None. Mode Switch command.

2.  Enables or disables MAC lock trap messaging. this feature authorizes the switch to send an SNMP trap message if an end station  is connected that exceeds the maximum values configured using the set maclock firstarrival and  set maclock static commands.3 enable 14-54 Security Configuration . Violating MAC addresses are dropped from the device’s routing  table. Mode Switch command.  Syntax set maclock trap port-string {enable | disable} Parameters port‐string Specifies the port on which MAC lock trap messaging will be enabled or  disabled.1-40 set maclock trap Use this command to enable or disable MAC lock trap messaging.set maclock trap Example This example shows how to move all current first arrival MACs to static entries on ports ge. Example This example shows how to enable MAC lock trap messaging on fe.2. refer to  “Port String Syntax Used in the CLI” on page 4‐2.3.3:  A2(su)->set maclock trap fe.1‐40:  A2(rw)->set maclock move ge. enable | disable Defaults None.3. read‐write. Usage When enabled. For a detailed description of possible port‐string values.

. enable. Mode Switch command. read‐only. Defaults None. Example This example shows how to display SSH status on the switch: A2(su)->show ssh status SSH Server status: Disabled SecureStack A2 Configuration Guide 14-55 . 14-55 14-56 14-56 show ssh status Use this command to display the current status of SSH on the switch...Configuring Secure Shell (SSH) Configuring Secure Shell (SSH) Purpose To review. and configure the Secure Shell (SSH) protocol. which provides secure  Telnet.. show ssh status set ssh set ssh hostkey Refer to page. disable.  Commands The commands used to review and configure SSH are listed below: For information about. Syntax show ssh status Parameters None.

 read‐write. or reinitializes the SSH server. Reinitializes the SSH server. the SSH  server is disabled. Syntax set ssh hostkey [reinitialize] Parameters reinitialize (Optional) Reinitializes the server host authentication keys. Example This example shows how to disable SSH: A2(su)->set ssh disable set ssh hostkey Use this command to set or reinitialize new SSH authentication keys. Syntax set ssh {enable | disable | reinitialize} Parameters enable | disable reinitialize Enables or disables SSH.set ssh set ssh Use this command to enable. Mode Switch command. Example This example shows how to regenerate SSH keys: A2(su)->set ssh hostkey reinitialize 14-56 Security Configuration . By default.  Mode Switch command. the user must supply SSH authentication key values. Defaults None. disable or reinitialize SSH server on the switch. Defaults If reinitialize is not specified. read‐write.

 DIP (destination IP address)  rules. where highest priority has precedence.15 10.  The ACLs can be MAC. and give it a name. To configure an ACL on the SecureStack A2: 1. only exact matches are  made.  A maximum of 20 rules may be contained in a single ACL. A maximum of 20 rules may be bound to a port. set access-list name {permit | deny} {src-address | any} {dest-address | any} 3. but when addresses are specified.  A maximum of two ACLs can be applied to a port. IP.0. 2. The any wildcard is supported. Layer 2 ACLs can be bound to ports only. but  the total number of rules for all ACLs cannot exceed 20.1. called rules.5 deny 10. The SecureStack A2 supports access control lists that can  filter ingressing frames based on IP or MAC address. For example: set access-list {mac | ip} name Create the rules for the ACL.0.8 any permit any 10.0.  There is no implicit deny for the access control lists.0.  Table 14-8 ACL Type MAC SA DA exact MAC SA exact DA any MAC SA any DA exact IP SIP DIP exact IP SIP exact DIP any IP SIP any DIP exact IP SIP any DIP any MAC SA any DA any ACL Rule Precedence Priority Level 14 13 12 11 10 9 8 7 Example permit 00-01-01-00-00-01 00-01-02-00-00-23 deny 00:01:01:00:00:05 any deny any 00:01:01:00:00:01 deny 10. set access-list name port-string SecureStack A2 Configuration Guide 14-57 . Apply the ACL to the desired port or ports.  Each ACL has to be defined as either a MAC or IP type of list.Configuring Layer 2 Access Control Lists Configuring Layer 2 Access Control Lists Layer 2 access control lists (ACLs) are essentially Layer 2/Layer 3 filters implemented at Layer 2  (the SecureStack A2 is a Layer 2 switch). Only one rule match can occur on a port. and each type of list can contain  only one type of rules—MAC lists can contain MAC SA (source address). Each ACL is composed of a sequential list of  permit and deny conditions. Multiple ACLs can be bound to one port.   Precedence is then based on Table 14‐8. DA (destination  address) rules and IP lists can contain IP SIP (source IP address). Create the access control list.22 deny any any deny any any  The following conditions apply to Layer 2 access control lists: • • • • • • • Up to 35 access control lists can be configured per system (A2 stack). or both. as a MAC or IP type of list.1.1.1.

. read‐write. You can filter packets based on  MAC addresses or on IP addresses. Examples The example creates an access list named “mymaclist” that will accept rules based on MAC source  and destination addresses. A2(rw)-> set access-list mac mymaclist This example creates an access list named “myiplist” that will accept rules based on IP source and  destination addresses. Specify the name of the access list. set access-list (create list) set access-list (create rules) set access-list (ports) show access-list show access-list ports clear access-list Refer to page. Syntax set access-list {mac | ip} name Parameters mac | ip name Specify the type of access list to create.. The name can be a string up to 31  alpha‐numeric characters in length. 14-58 14-59 14-60 14-60 14-61 14-62 set access-list (create list) Use this command to create an access control list of a given type. Mode Switch mode.  A2(rw)-> set access-list ip myiplist 14-58 Security Configuration .. An access list must be created  first. before rules can be added to it.set access-list (create list) Commands For information about.. Defaults None. and must start with a letter.

0 to any destination address.  When an IP access list is being configured. a specific source address  must be a MAC address entered using hyphens or colons. Specify the type of rule.1. a specific source address  must be an IP address in dotted decimal format.set access-list (create rules) set access-list (create rules) Use this command to add permit and deny rules to an existing access control list. The access list must  have been created before it can have rules added to it.  Defaults None. When a MAC access list is being configured. src‐address | any Specify the source address to be matched.168. Mode Switch command. Deny rules cause packets matching the specified source and destination  addresses to be dropped.  dest‐address | any Specify the destination address to be matched.0 any This example adds a deny rule to the MAC access list named “mymaclist. read‐write. or specify that any  destination address will match.” The rule permits packets  from the source address of 192. A2(rw)-> set access-list mymaclist deny any 00-01-22-33-44-55 SecureStack A2 Configuration Guide 14-59 .1.  When an IP access list is being configured.” The rule drops packets  from any source address destined for the MAC address 00:01:22:33:44:55. A2(rw)-> set access-list myiplist permit 192. Syntax set access-list name {permit | deny} {src-address | any} {dest-address | any} Parameters name permit | deny Specify the name of the access list to be configured. a specific destination address  must be an IP address in dotted decimal format. When a MAC access list is being configured. Examples This example adds a permit rule to the IP access list named “myiplist.168. Permit rules allow forwarding of any packets  matching the specified source and destination addresses. a specific destination  address must be a MAC address entered using hyphens or colons. or specify that any source  address will match.

1. Usage A maximum of two ACLs can be bound to any given port. Example This example displays information about all configured access lists. Mode Switch command.set access-list (ports) set access-list (ports) Use this command to bind an access list to one or more ports. Defaults None. information about all configured access lists is displayed. The information  displayed includes the rules configured for the access list and the ports to which the access list was  bound.1 through fe.1.1-3 show access-list Use this command to display information about one or all configured access lists. 14-60 Security Configuration . read‐write. Syntax show access-list [name] Parameters name (Optional) Specify the name of the access control list to be displayed. Specify the port or ports to which the access list is to be bound.1.3.  Example This example binds the access list named “myipacl” to ports fe. Mode Switch command. read‐only. Syntax set access-list name port-string Parameters name port‐string Specify the name of the access control list to be bound. A2(rw)-> set access-list myipacl fe. The ACLs can be of the same type or  mixed type (MAC and IP). Defaults If no access list name is entered.

A2(ro)-> show access-list ports Port string ----------fe.30. Examples This example displays all port–access list associations in the system.1.20.0 any ip permit 20.2.20. Syntax show access-list ports [port-string] Parameters port‐string (Optional) Display the access list associated with the specified ports.2.10.1. all port–access‐list associations are displayed.1-3 Access-list: myipacl ip permit 10. Defaults If no ports are specified.1.1 fe. read‐only.1 Access-list ----------IPACL1 IPACL3 SecureStack A2 Configuration Guide 14-61 .30.1-2 show access-list ports Use this command to display port–access list associations.0 any ip deny 30.3 Access-list ----------myipacl myipacl mymacacl mymacacl mymacacl This example displays all the ACLs associated with port fe.10.1.2.show access-list ports A2(ro)-> show access-list Access-list: mymacacl mac permit 00:00:11:22:33:44 any mac permit 00:01:44:55:66:01 any mac deny any 00:01:22:33:44:55 ports fe.10.1.2 fe. A2(ro)-> show access-list ports Port string ----------fe.1 10.1.2 fe. Mode Switch command.2.10.0 ports fe.1 fe.

Mode Switch command.clear access-list clear access-list Use this command to remove (delete) an access list from the system.1 This example deletes the access list named “myipacl. or to unbind an access list  from one or more ports. Defaults If no ports are specified. A2(rw)-> clear access-list mymacacl fe.2. read‐write.1. Examples This example unbinds the access list named “mymacacl” from the port fe.” A2(rw)-> clear access-list myipacl 14-62 Security Configuration . Syntax clear access-list name [port-string] Parameters name port‐string Specify the name of the access list. the access list is deleted from the system.2. (Optional) Unbind the specified access list from the specified port or  ports.

1p 9-1 802. described 1-6 factory installed 1-2 DHCP server. enabling on ports 4-22 F Flow Control 4-19 Forbidden VLAN port 7-15 N Name setting for a VLAN 7-6 setting for the system 3-23 Network Management addresses and routes 11-17 monitoring switch events and status 11-12 Node Alias 11-31 NVRAM clearing 3-58 C CDP Discovery Protocol 3-49 Class of Service 9-1 Clearing NVRAM 3-58 CLI closing 3-55 scrolling screens 1-8 starting 1-5 Command History Buffer 11-12. 3-22 Help keyword lookups 1-7 Host VLAN 7-20 P Password aging 3-6 history 3-6 set new 3-4 setting the login 3-4 Ping 11-14 Port Mirroring 4-25 Port Priority configuring 9-2 Port String syntax used in the CLI 4-2 Port Trunking 4-28 Port(s) alias 4-9 assignment scheme 4-2 auto-negotiation and advertised ability 4-15 broadcast suppression 4-22 counters.1Q 7-1 802. see Differentiated Services L Line Editing Commands 1-9 Lockout set system 3-7 Logging 11-1 Login administratively configured 1-6 default 1-6 setting accounts 3-2 via Telnet 1-5 A access control lists (ACLs) 14-57 Advertised Ability 4-15 Alias node 11-31 Authentication EAPOL 14-20 MAC 14-22 RADIUS server 14-5.1w 6-1 802. See also CLI Configuration clearing switch parameters 3-58 Configuration Files copying 3-45 deleting 3-45 displaying 3-43 executing 3-44 show running config 3-45 Contexts (SNMP) 5-3 Copying Configuration or Image Files 3-45 Cost Spanning Tree port 6-38 G Getting Help xxvi GVRP enabling and disabling 7-27 purpose of 7-23 timer 7-28 H Hardware show system 3-13. 14-15 EAPOL 14-20 B banner motd 3-21 Baud Rate 3-27 Broadcast suppression.1s 6-1 802. setting 4-10 Index-1 I ICMP 11-14 IGMP 10-1 enabling and disabling 10-2 Image File copying 3-45 downloading 3-32 Ingress Filtering 7-8. 14-20 Differentiated Services adding classes to policies 8-12 assigning policies to service ports 8-17 configuring policies 8-10 creating classes and matching conditions 8-3 deleting classes 8-5 deleting policies 8-12 displaying class information 8-4 displaying status information 8-3 globally enabling or disabling 8-2 marking packets 8-13 matching classes to conditions 8-6 setting policing styles for policies 8-14 Diffserv.1D 6-1 802. 11-13 Command Line Interface. reviewing statistics 4-6 duplex mode. managing in switch mode 11-17 D Defaults CLI behavior. configuring 13-1 J Jumbo Frame Support 4-13 K Keyword Lookups 1-7 .Index Numerics 802.1x 14-5. 7-11 IP routes. 14-9 SSH 14-56 Auto-negotiation 4-15 M MAC Addresses displaying 11-20 MAC Authentication 14-22 MAC Locking 14-45 maximum static entries 14-51 static 14-51 Management VLAN 7-1 motd 3-21 Multicast Filtering 10-1 Multiple Spanning Tree Protocol (MSTP) 6-1 E EAP pass-through 14-2.

14-44 creating static 7-5 dynamic egress 7-19 egress lists 7-14. configuring 4-21 MAC lock 14-48 priority. 14-9 Rapid Spanning Tree Protocol (RSTP) 6-1 Rate Limiting 9-12 Related Manuals xxiv Reset 3-57 RFC 3580 14-41 U User Accounts default 1-6 setting 3-2 S Scrolling Screens 1-8 Secure Shell (SSH) 14-55 enabling 14-56 regenerating new keys 14-56 Security methods. configuring 3-28 Priority to Transmit Queue Mapping 9-5 Prompt set 3-20 System Information displaying basic 3-12 setting basic 3-9 T Technical Support xxvi Telnet disconnecting 11-15 enabling in switch mode 3-38 Terminal Settings 3-24 TFTP downloading firmware upgrades via 3-32 Timeout CLI. configuring 9-2 speed.flow control 4-19 link traps. overview of 14-1 Serial Port downloading upgrades via 3-32 show system utilization cpu 3-14 SNMP access rights 5-16 accessing in router mode 5-3 enabling on the switch 5-18 MIB views 5-20 notification parameters 5-33 notify filters 5-33 security models and levels 5-2 statistics 5-4 target addresses 5-29 target parameters 5-25 trap configuration example 5-41 users. configuring 2-4 VLANs assigning ingress filtering 7-11 assigning port VLAN IDs 7-8 authentication 14-41. 14-42 enabling GVRP 7-23 forbidden ports 7-15 host. setting 7-20 ingress filtering 7-8 naming 7-6 RADIUS 14-41 secure management. setting 4-10 status. 3-59 WebView SSL 3-61 Index-2 . system 3-26 RADIUS 14-5 Trap SNMP configuration example 5-41 Tunnel Attributes RFC 3580 RADIUS attributes 14-41 R RADIUS 14-3 realm 14-5 RADIUS server 14-5. creating 7-1 W WebView 1-2. reviewing 4-4 Power over Ethernet (PoE). groups and communities 5-8 SNTP 11-24 Spanning Tree 6-1 backup root 6-21 bridge parameters 6-3 features 6-2 port parameters 6-32 Rapid Spanning Tree Protocol (RSTP) 6-1 SSL WebView 3-61 stacks installing units 2-2 operation 2-1 virtual switch configuration 2-4 Syslog 11-1 V Version Information 3-22 virtual switch.