ECS4150 Series
Software Releasev1.3.0.9

CL I Re fe re nce G ui d e

www.edge-core.com

CLI R ef er enc e G u ide
ECS4150-28T

L2+/L3 Lite Gigabit Ethernet Switch
with 24 1000BASE-T RJ-45 ports
and 4 10G SFP+ ports

ECS4150-28P

L2+/L3 Lite Gigabit Ethernet PoE Switch
with 24 1000BASE-T RJ-45 PoE ports
and 4 10G SFP+ ports

ECS4150-28F-I

L2+/L3 Lite Gigabit Ethernet Switch
with 24 100/1000M SFP ports
4 10/100/1000M RJ-45/SFP combo ports
and 4 1/10G SFP+ ports

ECS4150-54T

L2+/L3 Lite Gigabit Ethernet Switch
with 48 1000BASE-T RJ-45 ports
and 6 25G SFP28 ports

ECS4150-54P

L2+/L3 Lite Gigabit Ethernet PoE Switch
with 48 1000BASE-T RJ-45 PoE ports
and 6 25G SFP28 ports

E012024-CS-R04

How to Use This Guide

This guide includes detailed information on the switch software, including how to
operate and use the management functions of the switch. To deploy this switch
effectively and ensure trouble-free operation, you should first read the relevant
sections in this guide so that you are familiar with all of its software features.

Who Should Read This This guide is for network administrators who are responsible for operating and
Guide? maintaining network equipment. The guide assumes a basic working knowledge ofLANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).

How This Guide is This guide describes the switch’s command line interface (CLI). For more detailed
Organized information on the switch’s key features or information about the web browser
management interface refer to the Web Management Guide.
The guide includes these sections: Section I “Getting Started” — Includes information on initial configuration.
 Section II “Command Line Interface” — Includes all management options

available through the CLI.

 Section III “Appendices” — Includes information on troubleshooting switch

management access.

Related This guide focuses on switch software configuration through the CLI.
Documentation

For information on how to manage the switch through the Web management
interface, see the following guide:
Web Management Guide
For information on how to install the switch, see the following guide:
Quick Start Guide
For all safety information and regulatory statements, see the following documents:
Quick Start Guide
Safety and Regulatory Information– 3 –How to Use This Guide

Conventions The following conventions are used throughout this guide to show information:
Note: Emphasizes important information or calls your attention to related features
or instructions.

Caution: Alerts you to a potential hazard that could cause loss of data, or damage
the system or equipment.

Documentation This documentation is provided for general information purposes only. If any
Notice product feature details in this documentation conflict with the product datasheet,refer to the datasheet for the latest information.

Revision History This section summarizes the changes in each revision of this guide.
Revision

Date

Change Description

v1.3.0.9

01/2024

Code update for bug fixes

v1.3.0.8

11/2023

Added:
 Support for ECS4150-28F-I
 "MVR for IPv6" on page 775
 "CFM Commands" on page 825
 "Configuring Excluded VLANs" on page 612
 "switchport dot1q-tunnel vlan-double-tag cvid" on page 587
 "show dot1q-tunnel vlan-double-tag" on page 589
Updated: "show access-list tcam-utilization" on page 115
 "show running-config" on page 118
 "show log" on page 156
 "discard" on page 417
 "port-channel load-balance" on page 449
 "switchport allowed vlan" on page 574
 "switchport dot1q-tunnel service match cvid" on page 584
 "show dot1q-tunnel service" on page 587
 "show dot1q-tunnel" on page 588– 4 –How to Use This Guide

Revision

Date

Change Description

v1.2.0.6

07/2023

Added:
Support for ECS4150-54T and ECS4150-54P
 "Cloud Management" on page 98
 "fec" on page 420
Updated: "media-type" on page 419
 "show dot1q-tunnel" on page 588
 "power inline maximum allocation" on page 468
 "show power inline status" on page 470
Removed: ip igmp snooping priority

v1.1.0.9

03/2023

Initial release– 5 –How to Use This Guide– 6 –Contents

Section I

How to Use This Guide

3

Contents

7

Tables43

Getting Started

49

1 Initial Switch Configuration

51

Connecting to the Switch

51

Configuration Options

51

Connecting to the Console Port

52

Logging Onto the Command Line Interface

53

Setting Passwords

53

Remote Connections

54

Configuring the Switch for Remote Management

55

Using the Network Interface

55

Setting an IP Address

55

Configuring the Switch for Cloud Management

60

Enabling SNMP Management Access

61

Managing System Files

63

Upgrading the Operation Code64

Saving or Restoring Configuration Settings

65

Automatic Installation of Operation Code and Configuration Settings

66

Downloading Operation Code from a File Server

66

Specifying a DHCP Client Identifier

69

Downloading a Configuration File and Other Parameters from a DHCP Server

70

Setting the System Clock72

Setting the Time Manually73

Configuring SNTP

73
– 7 –

Contents

Configuring NTP

Section II

74

Command Line Interface

75

2 Using the Command Line Interface

77

Accessing the CLI

77

Console Connection

77

Telnet Connection

78

Entering Commands

79

Keywords and Arguments

79

Minimum Abbreviation

79

Command Completion

79

Getting Help on Commands

80

Partial Keyword Lookup

82

Negating the Effect of Commands

82

Using Command History

82

Understanding Command Modes

82

Exec Commands

83

Configuration Commands

84

Command Line Processing

85

Showing Status Information

86

CLI Command Groups

87

3 General Commands

89

prompt89

reload (Global Configuration)90

enable

91

quit

92

show history

92

configure93

disable94

reload (Privileged Exec)

94

show reload

95

end

95

exit

95
– 8 –

Contents

4 System Management Commands

97

Cloud Management

98

mgmt

98

mgmt loglevel99

mgmt setoption

99

mgmt property

101

mgmt upgrade

101

show mgmt status

102

show mgmt version

102

show mgmt log

102

show mgmt option

103

Device Designation

104

hostname

104

Banner Information

105

banner configure105

banner configure company

107

banner configure dc-power-info107

banner configure department

108

banner configure equipment-info

109

banner configure equipment-location

109

banner configure ip-lan

110banner configure lp-number

111

banner configure manager-info

111

banner configure mux

112banner configure note

113

show banner

113

System Status

114

show access-list tcam-utilization

115

show memory

116

show process cpu

116

show process cpu guard

117

show process cpu task

118

show running-config

118

show startup-config

120

– 9 –

Contents

show system

121

show tech-support

122

show users

123

show version

123

show watchdog

124

watchdog software

124

Fan Control

125

fan-speed force-full
Frame Size

125
125

jumbo frame

125File Management

126

General Commands

128boot system

128

copy

129

delete

133

dir

133

umount usbdisk

134

whichboot135

Automatic Code Upgrade Commands

136

upgrade opcode auto

136

upgrade opcode path137

upgrade opcode reload

138

show upgrade

138

TFTP Configuration Commands

139

ip tftp retry139

ip tftp timeout

139

show ip tftp

140

Line

140
line

141

databits

142

exec-timeout

142

login

143

parity144

password

145

password-thresh

145– 10 –

Contents

silent-time

146

speed

147

stopbits

147

timeout login response

148

disconnect

149

terminal

149

show line

150

Event Logging

151

logging command

151

logging facility

152

logging history

152

logging host153

logging level154

logging on

155

logging trap155

clear log

156

show log

156

show logging

157

SMTP Alerts

159

logging sendmail

159

logging sendmail destination-email

160

logging sendmail host160

logging sendmail level161

logging sendmail source-email

162

show logging sendmail

162

Time

163

SNTP Commands

164

sntp client

164

sntp poll165

sntp server

165

show sntp

166

NTP Commands

166

ntp authenticate

166

ntp authentication-key

167

ntp client168– 11 –

Contents

ntp server

169

show ntp

170

show ntp status

170

show ntp statistics peer

170

show ntp peer-status

171

Manual Configuration Commands

172

clock summer-time (date)172

clock summer-time (predefined)

173

clock summer-time (recurring)174

clock timezone

175

clock timezone-predefined176

calendar set

179

show calendar

179

Time Range

180

time-range

180

absolute

181

periodic

182

show time-range

183

Switch Clustering

183

cluster184

cluster commander

185

cluster ip-pool

186

cluster member

186

rcommand187

show cluster

188

show cluster members

188

show cluster candidates

188

Dying Gasp

189

dying-gasp

189

show dying-gasp status

190

show dying-gasp packets

190

5 SNMP Commands

191

General SNMP Commands
snmp-server

193
193

– 12 –

Contents

snmp-server community

193

snmp-server contact

194

snmp-server location

195

show snmp

195

SNMP Target Host Commands

196

snmp-server enable traps

196

snmp-server host197

snmp-server enable port-traps link-up-down

199

snmp-server enable port-traps mac-notification

200

show snmp-server enable port-traps

200

SNMPv3 Commands

201

snmp-server engine-id

201

snmp-server group202

snmp-server user203

snmp-server view

205

show snmp engine-id

206

show snmp group

207

show snmp user

208

show snmp view209

Notification Log Commands

209

nlm

209

snmp-server notify-filter

210

show nlm oper-status

212

show snmp notify-filter

212

Additional Trap Commands

212

memory212

process cpu

213

process cpu guard

214

6 Remote Monitoring Commands

217

rmon alarm

218

rmon event219

rmon collection history

220rmon collection rmon1

221

show rmon alarms

222– 13 –

Contents

show rmon events

222show rmon history

223

show rmon statistics

223

7 Flow Sampling Commands

225

sflow owner

226

sflow polling instance227

sflow sampling instance228

show sflow

229

8 Authentication Commands

231

User Accounts and Privilege Levels

232

enable password

232

username

233

privilege

234

show privilege

235

Authentication Sequence236

authentication enable236

authentication login

237

RADIUS Client

238

radius-server acct-port

238

radius-server auth-port239

radius-server host239

radius-server key

240

radius-server encrypted-key

241

radius-server retransmit

241

radius-server timeout

242

show radius-server

242

TACACS+ Client

243

tacacs-server host243

tacacs-server key

244

tacacs-server encrypted-key

245

tacacs-server port

245

tacacs-server retransmit

246tacacs-server timeout

246

show tacacs-server247– 14 –

Contents

AAA

247
aaa accounting commands

248

aaa accounting dot1x

249

aaa accounting exec

250

aaa accounting update251

aaa authorization commands

251

aaa authorization exec

252

aaa group server

253

server253

accounting dot1x

254

accounting commands

255

accounting exec

255

authorization commands

256

authorization exec

256

show accounting

257

show authorization

258

Web Server259

ip http authentication259

ip http port

260

ip http server260

ip http secure-port

261

ip http secure-server

261

Telnet Server263

ip telnet max-sessions263

ip telnet port

264

ip telnet server

264

telnet (client)265

show ip telnet

265

Secure Shell266

ip ssh authentication-retries268

ip ssh server269

ip ssh timeout

269

delete public-key

270

ip ssh crypto host-key generate270

ip ssh crypto zeroize271– 15 –

Contents

ip ssh save host-key

272

show ip ssh

272

show public-key

273

show ssh273

802.1X Port Authentication

274

General Commands

275

dot1x default

275

dot1x eapol-pass-through276

dot1x system-auth-control

276

Authenticator Commands

277

dot1x intrusion-action277

dot1x max-reauth-req

278

dot1x max-req

278

dot1x operation-mode279

dot1x port-control

280

dot1x re-authentication

280

dot1x timeout quiet-period281

dot1x timeout re-authperiod281

dot1x timeout supp-timeout282

dot1x timeout tx-period282

dot1x re-authenticate

283

Supplicant Commands

284

dot1x identity profile284

dot1x max-start284

dot1x pae supplicant

285

dot1x timeout auth-period286

dot1x timeout held-period286

dot1x timeout start-period

287

Information Display Commands

287

show dot1x

287

Management IP Filter

290

management

290

show management

291

PPPoE Intermediate Agent292

pppoe intermediate-agent– 16 –

293

Contents

pppoe intermediate-agent format-type

293

pppoe intermediate-agent port-enable294

pppoe intermediate-agent port-format-type295

pppoe intermediate-agent port-format-type remote-id-delimiter

296

pppoe intermediate-agent trust

297

pppoe intermediate-agent vendor-tag strip

297

clear pppoe intermediate-agent statistics

298

show pppoe intermediate-agent info

298

show pppoe intermediate-agent statistics

299

9 General Security Measures
Port Security

301
302

mac-learning302

port security

303

port security mac-address sticky

305

port security mac-address-as-permanent

305

show port security

306

Network Access (MAC Address Authentication)

308

network-access aging

309

network-access mac-filter

310

mac-authentication reauth-time

311

network-access dynamic-qos

311

network-access dynamic-vlan

312

network-access guest-vlan

313

network-access link-detection

314

network-access link-detection link-down

314

network-access link-detection link-up

315

network-access link-detection link-up-down

316

network-access max-mac-count316

network-access mode mac-authentication

317

network-access port-mac-filter

318

mac-authentication intrusion-action

319

mac-authentication max-mac-count319

clear network-access

320

show network-access

320– 17 –

Contents

show network-access mac-address-table321

show network-access mac-filter

322

Web Authentication323

web-auth login-attempts

324

web-auth quiet-period324

web-auth session-timeout

325

web-auth system-auth-control

325

web-auth326

web-auth re-authenticate (Port)326

web-auth re-authenticate (IP)327

show web-auth327

show web-auth interface

328

show web-auth summary

328

DHCPv4 Snooping329

ip dhcp snooping330

ip dhcp snooping information option332

ip dhcp snooping information option encode no-subtype333

ip dhcp snooping information option remote-id334

ip dhcp snooping information option tr101 board-id335

ip dhcp snooping information policy336

ip dhcp snooping verify mac-address336

ip dhcp snooping vlan337

ip dhcp snooping information option circuit-id338

ip dhcp snooping max-number

340

ip dhcp snooping trust

340

clear ip dhcp snooping binding

341

clear ip dhcp snooping database flash

341

ip dhcp snooping database flash

342

show ip dhcp snooping

342

show ip dhcp snooping binding

343

DHCPv6 Snooping343

ipv6 dhcp snooping344

ipv6 dhcp snooping option remote-id346

ipv6 dhcp snooping option remote-id policy

347

ipv6 dhcp snooping vlan348

– 18 –

Contents

ipv6 dhcp snooping max-binding349

ipv6 dhcp snooping trust349

clear ipv6 dhcp snooping binding

350

clear ipv6 dhcp snooping statistics

351

show ipv6 dhcp snooping

351

show ipv6 dhcp snooping binding

352

show ipv6 dhcp snooping statistics

352

IPv4 Source Guard353

ip source-guard binding353

ip source-guard355

ip source-guard max-binding357

ip source-guard mode

358

clear ip source-guard binding blocked

359

show ip source-guard

359

show ip source-guard binding360

IPv6 Source Guard361

ipv6 source-guard binding361

ipv6 source-guard363

ipv6 source-guard max-binding364

show ipv6 source-guard

365

show ipv6 source-guard binding

366

ARP Inspection366

ip arp inspection367

ip arp inspection filter368

ip arp inspection log-buffer logs369

ip arp inspection validate370

ip arp inspection vlan371

ip arp inspection limit372

ip arp inspection trust

372

show ip arp inspection configuration

373

show ip arp inspection interface

373

show ip arp inspection log

374

show ip arp inspection statistics

374

show ip arp inspection vlan

375

Denial of Service Protection– 19 –

375

Contents

dos-protection echo-chargen376

dos-protection smurf

376

dos-protection tcp-flooding

377

dos-protection tcp-null-scan377

dos-protection tcp-syn-fin-scan378

dos-protection tcp-udp-port-zero378

dos-protection tcp-xmas-scan379

dos-protection udp-flooding379

dos-protection win-nuke

380

show dos-protection

380

Port-based Traffic Segmentation381

traffic-segmentation381

traffic-segmentation session

383

traffic-segmentation uplink/downlink

383

traffic-segmentation uplink-to-uplink384

show traffic-segmentation

385

10 Access Control Lists

387

IPv4 ACLs

387

access-list ip

388

permit, deny (Standard IP ACL)

388

permit, deny (Extended IPv4 ACL)389

ip access-group392

show ip access-group393

show ip access-list

393

IPv6 ACLs

394

access-list ipv6

394

permit, deny (Standard IPv6 ACL)

395

permit, deny (Extended IPv6 ACL)

396

ipv6 access-group398

show ipv6 access-group399

show ipv6 access-list

399

MAC ACLs

400

access-list mac

400

permit, deny (MAC ACL)401

– 20 –

Contents

mac access-group405

show mac access-group405

show mac access-list

406

ARP ACLs

406

access-list arp

406

permit, deny (ARP ACL)

407

show access-list arp

408

ACL Information

409

clear access-list hardware counters409

show access-group

410

show access-list

410

11 Interface Commands

413

Interface Configuration

415

interface

415

alias

415

capabilities

416

description

417

discard417

flowcontrol

418

history419

media-type

419

fec

420

negotiation

421

shutdown

421

speed-duplex

422

clear counters423

show discard

423

show interfaces brief

424

show interfaces counters425

show interfaces history

429

show interfaces status

431

show interfaces switchport

432

Transceiver Threshold Configuration

434

transceiver-monitor– 21 –

434

Contents

transceiver-threshold-auto

434

transceiver-threshold current

435

transceiver-threshold rx-power

436

transceiver-threshold temperature

437

transceiver-threshold tx-power

438

transceiver-threshold voltage

439

show interfaces transceiver440

show interfaces transceiver-threshold

441

Cable Diagnostics

442

test cable-diagnostics

442

test loop internal

443

show cable-diagnostics

443

show loop internal444Power Savings

445

power-save445

show power-save446

12 Link Aggregation Commands

447

Manual Configuration Commands

449

port-channel load-balance449

channel-group450

Dynamic Configuration Commands

451

lacp

451

lacp actor/partner mode (Ethernet Interface)452

lacp admin-key (Ethernet Interface)453

lacp port-priority454

lacp system-priority

455

lacp admin-key (Port Channel)

455

lacp timeout

456

Trunk Status Display Commands

457

show lacp457

show port-channel load-balance

460

MLAG Commands

461

mlag

462

mlag domain peer-link

462– 22 –

Contents

mlag group member

463

show mlag

465

show mlag group465

show mlag domain

465

13 Power over Ethernet Commands

467

power inline

467

power inline maximum allocation468

power inline priority

469

show power inline status

470

show power inline time-range

471

show power mainpower472

14 Port Mirroring Commands

473

Local Port Mirroring Commands

473

port monitor

473

show port monitor

475

RSPAN Mirroring Commands

476

rspan source

478

rspan destination479

rspan remote vlan

480

no rspan session

481

show rspan482

15 Congestion Control Commands

483

Rate Limit Commands

483

rate-limit

484

Storm Control Commands

485

switchport packet-rate

485

Automatic Traffic Control Commands

486

Threshold Commands

489

auto-traffic-control apply-timer

489

auto-traffic-control release-timer

490

auto-traffic-control

491

auto-traffic-control action491

auto-traffic-control alarm-clear-threshold492– 23 –

Contents

auto-traffic-control alarm-fire-threshold493

auto-traffic-control auto-control-release494

auto-traffic-control control-release

495

SNMP Trap Commands

495

snmp-server enable port-traps atc broadcast-alarm-clear495

snmp-server enable port-traps atc broadcast-alarm-fire496

snmp-server enable port-traps atc broadcast-control-apply

496

snmp-server enable port-traps atc broadcast-control-release497

snmp-server enable port-traps atc multicast-alarm-clear497

snmp-server enable port-traps atc multicast-alarm-fire498

snmp-server enable port-traps atc multicast-control-apply

498

snmp-server enable port-traps atc multicast-control-release499

ATC Display Commands

499

show auto-traffic-control

499

show auto-traffic-control interface

500

16 Loopback Detection Commands

501

loopback-detection

502

loopback-detection action

502

loopback-detection recover-time503

loopback-detection transmit-interval

504

loopback detection trap504

loopback-detection release505

show loopback-detection505

17 UniDirectional Link Detection Commands

507

udld detection-interval

507

udld message-interval508

udld recovery

509

udld recovery-interval509

udld aggressive

510

udld port

511

show udld

512

18 Address Table Commands

515

mac-address-table aging-time– 24 –

515

Contents

mac-address-table hash-lookup-depth

516

mac-address-table static

516

clear mac-address-table dynamic

518

show mac-address-table519

show mac-address-table aging-time

520

show mac-address-table count520

show mac-address-table hash-lookup-depth

521

19 Smart Pair Commands

523

Smart Pair Concept523

smart-pair523

smart-pair restore

524

primary-port

525

backup-port

526

wtr-delay

527

show smart-pair

527

20 TWAMP Commands

529

twamp reflector529

twamp reflector refwait

530

show twamp reflector

530

21 Spanning Tree Commands

531

spanning-tree532

spanning-tree cisco-prestandard

533

spanning-tree forward-time533

spanning-tree hello-time534

spanning-tree max-age

535

spanning-tree mode

535

spanning-tree mst configuration

537

spanning-tree pathcost method

537

spanning-tree priority

538

spanning-tree system-bpdu-flooding

539

spanning-tree tc-prop539

spanning-tree transmission-limit

540

max-hops

541– 25 –

Contents

mst priority541

mst vlan

542

name

543

revision

543

spanning-tree bpdu-filter

544

spanning-tree bpdu-guard

545

spanning-tree cost546

spanning-tree edge-port547

spanning-tree link-type548

spanning-tree loopback-detection

549

spanning-tree loopback-detection action

549

spanning-tree loopback-detection release-mode

550

spanning-tree loopback-detection trap551

spanning-tree restricted-tcn

551

spanning-tree mst cost552

spanning-tree mst port-priority

553

spanning-tree port-bpdu-flooding

553

spanning-tree port-priority554

spanning-tree root-guard

555

spanning-tree spanning-disabled556

spanning-tree tc-prop-stop556

spanning-tree loopback-detection release557

spanning-tree protocol-migration

557

show spanning-tree

558

show spanning-tree mst configuration

560

show spanning-tree tc-prop

561

22 VLAN Commands

563

GVRP and Bridge Extension Commands

564

bridge-ext gvrp

564

garp timer

565

switchport forbidden vlan

566

switchport gvrp

567

show bridge-ext

567

show garp timer

568– 26 –

Contents

show gvrp configuration

569

Editing VLAN Groups

570

vlan database

570

vlan

571

Configuring VLAN Interfaces

572

interface vlan572

switchport acceptable-frame-types

573

switchport allowed vlan574

switchport ingress-filtering575

switchport mode

576

switchport native vlan

577

vlan-trunking

578

Displaying VLAN Information

579

show vlan

579

Configuring IEEE 802.1Q Tunneling580

dot1q-tunnel system-tunnel-control581

dot1q-tunnel tpid582

switchport dot1q-tunnel mode583

switchport dot1q-tunnel priority map

584

switchport dot1q-tunnel service match cvid584

switchport dot1q-tunnel vlan-double-tag cvid

587

show dot1q-tunnel service

587

show dot1q-tunnel

588

show dot1q-tunnel vlan-double-tag

589

Configuring L2PT Tunneling590

l2protocol-tunnel tunnel-dmac

590

switchport l2protocol-tunnel

593

show l2protocol-tunnel

593

Configuring VLAN Translation

594

switchport vlan-translation

594

show vlan-translation

596

Configuring Protocol-based VLANs

596

protocol-vlan protocol-group (Configuring Groups)

598

protocol-vlan protocol-group (Configuring Interfaces)

598

show protocol-vlan protocol-group599– 27 –

Contents

show interfaces protocol-vlan protocol-group600

Configuring IP Subnet VLANs

601

subnet-vlan

601

show subnet-vlan

602

Configuring MAC Based VLANs

603

mac-vlan603

show mac-vlan

604

Configuring Voice VLANs

605

voice vlan605

voice vlan aging

606

voice vlan mac-address

607

switchport voice vlan

608

switchport voice vlan priority

609

switchport voice vlan rule609

switchport voice vlan security

610

show voice vlan

611

Configuring Excluded VLANs

612

excluded-vlan

612

show excluded-vlan

613

23 ERPS Commands

615

erps

617

erps node-id618

erps vlan-group619

erps ring619

erps instance620

ring-port

621

exclusion-vlan622

enable (ring)622

enable (instance)623

meg-level623

control-vlan

624

rpl owner625

rpl neighbor626

wtr-timer627– 28 –

Contents

guard-timer

627

holdoff-timer

628

major-ring629

propagate-tc

629

bpdu-tcn-notify

630

non-revertive

630

raps-def-mac

634

raps-without-vc

635

version637

inclusion-vlan

638

physical-ring639

erps forced-switch

639

erps manual-switch

641

erps clear

643

clear erps statistics

643

show erps statistics

644

show erps

645

24 Class of Service Commands

649

Priority Commands (Layer 2)649

queue mode

650

queue weight651

switchport priority default

652

show queue mode

653

show queue weight653

Priority Commands (Layer 3 and 4)654

qos map phb-queue654

qos map cos-dscp655

qos map dscp-mutation657

qos map ip-prec-dscp

658

qos map trust-mode

659

show qos map cos-dscp

660

show qos map dscp-mutation

661

show qos map ip-prec-dscp

661

show qos map phb-queue662– 29 –

Contents

show qos map trust-mode

663

25 Quality of Service Commands

665

class-map

666

description

667

match

668

rename669

policy-map

670

class

670

police flow671

police srtcm-color

673

police trtcm-color

675

set cos677

set ip dscp

678

set phb679

service-policy

680

show class-map

680

show policy-map

681

show policy-map interface

682

26 Control Plane Commands

683

control-plane683

service-policy

684

show policy-map control-plane

684

27 Multicast Filtering Commands
IGMP Snooping

687
687

ip igmp snooping689

ip igmp snooping mrouter-forward-mode dynamic690

ip igmp snooping proxy-reporting690

ip igmp snooping report-suppression691

ip igmp snooping querier692

ip igmp snooping router-alert-option-check692

ip igmp snooping router-port-expire-time693

ip igmp snooping tcn-flood693

ip igmp snooping tcn-query-solicit

695– 30 –

Contents

ip igmp snooping unregistered-data-flood695

ip igmp snooping unsolicited-report-interval

696

ip igmp snooping version697

ip igmp snooping version-exclusive697

ip igmp snooping vlan general-query-suppression698

ip igmp snooping vlan immediate-leave699

ip igmp snooping vlan last-memb-query-count700

ip igmp snooping vlan last-memb-query-intvl

700

ip igmp snooping vlan mrd

701

ip igmp snooping vlan proxy-address702

ip igmp snooping vlan query-interval

703

ip igmp snooping vlan query-resp-intvl

704

ip igmp snooping vlan static

705

clear ip igmp snooping groups dynamic

705

clear ip igmp snooping statistics

706

show ip igmp snooping

706

show ip igmp snooping group707

show ip igmp snooping mrouter708

show ip igmp snooping statistics

709

Static Multicast Routing

712

ip igmp snooping vlan mrouter
IGMP Filtering and Throttling

712
713

ip igmp filter (Global Configuration)714

ip igmp profile

715

permit, deny

715

range

716

ip igmp authentication716

ip igmp filter (Interface Configuration)718

ip igmp max-groups719

ip igmp max-groups action

720

ip igmp query-drop

720

ip multicast-data-drop

721

show ip igmp authentication

721

show ip igmp filter

722

show ip igmp profile723– 31 –

Contents

show ip igmp query-drop

723

show ip igmp throttle interface

724

show ip multicast-data-drop

725

MLD Snooping

725

ipv6 mld snooping

727

ipv6 mld snooping proxy-reporting

727

ipv6 mld snooping querier

728

ipv6 mld snooping query-interval

728

ipv6 mld snooping query-max-response-time729

ipv6 mld snooping robustness729

ipv6 mld snooping router-port-expire-time730

ipv6 mld snooping unknown-multicast mode731

ipv6 mld snooping unsolicited-report-interval

731

ipv6 mld snooping version732

ipv6 mld snooping vlan immediate-leave732

ipv6 mld snooping vlan mrouter733

ipv6 mld snooping vlan static734

clear ipv6 mld snooping groups dynamic

735

clear ipv6 mld snooping statistics

735

show ipv6 mld snooping736

show ipv6 mld snooping group

737

show ipv6 mld snooping group source-list

737

show ipv6 mld snooping mrouter738

show ipv6 mld snooping statistics

739

MLD Filtering and Throttling743

ipv6 mld filter (Global Configuration)743

ipv6 mld profile

744

permit, deny

745

range

745

ipv6 mld filter (Interface Configuration)746

ipv6 mld max-groups

747

ipv6 mld max-groups action

747

ipv6 mld query-drop748

ipv6 multicast-data-drop

749

show ipv6 mld filter749– 32 –

Contents

show ipv6 mld profile

750

show ipv6 mld query-drop

750

show ipv6 mld throttle interface

751

MVR for IPv4

752

mvr

753

mvr associated-profile753

mvr domain754

mvr profile755

mvr proxy-query-interval755

mvr proxy-switching756

mvr robustness-value757

mvr source-port-mode

758

mvr upstream-source-ip759

mvr vlan759

mvr immediate-leave760

mvr type

761

mvr vlan group762

clear mvr groups dynamic

763

clear mvr statistics

764

show mvr

764

show mvr associated-profile

765

show mvr interface

766

show mvr members

767show mvr profile769

show mvr statistics

769

MVR for IPv6775

mvr6 associated-profile776

mvr6 domain776

mvr6 profile

777

mvr6 proxy-query-interval

778

mvr6 proxy-switching779

mvr6 robustness-value

780

mvr6 source-port-mode dynamic

781

mvr6 upstream-source-ip

781

mvr6 vlan782– 33 –

Contents

mvr6 immediate-leave783

mvr6 type784

mvr6 vlan group785

clear mvr6 groups dynamic

786

clear mvr6 statistics

786

show mvr6

787

show mvr6 associated-profile

788

show mvr6 interface

789

show mvr6 members

789

show mvr6 domain

791

show mvr6 profile

792

show mvr6 statistics

793

28 LLDP Commands

799

lldp

801

lldp holdtime-multiplier801

lldp med-fast-start-count802

lldp notification-interval

802lldp refresh-interval

803

lldp reinit-delay803

lldp tx-delay804

lldp admin-status805

lldp basic-tlv management-ip-address805

lldp basic-tlv management-ipv6-address

806

lldp basic-tlv port-description

807

lldp basic-tlv system-capabilities

807

lldp basic-tlv system-description

808

lldp basic-tlv system-name808

lldp dot1-tlv proto-ident809

lldp dot1-tlv proto-vid

809

lldp dot1-tlv pvid

810

lldp dot1-tlv vlan-name810

lldp dot3-tlv link-agg

811

lldp dot3-tlv mac-phy

811

lldp dot3-tlv max-frame812– 34 –

Contents

lldp dot3-tlv poe

812

lldp med-location civic-addr813

lldp med-notification815

lldp med-tlv ext-poe

815

lldp med-tlv inventory816

lldp med-tlv location817

lldp med-tlv med-cap

817

lldp med-tlv network-policy

818

lldp notification

818

show lldp config

819

show lldp info local-device

820

show lldp info remote-device

821

show lldp info statistics

823

29 CFM Commands

825

Defining CFM Structures828

ethernet cfm ais level828

ethernet cfm ais ma829

ethernet cfm ais period

830

ethernet cfm ais suppress alarm

830

ethernet cfm domain

831

ethernet cfm enable833

ma index name834

ma index name-format

835

ethernet cfm mep

836

ethernet cfm port-enable

837

clear ethernet cfm ais mpid

837

show ethernet cfm configuration

838

show ethernet cfm md

840

show ethernet cfm ma

840

show ethernet cfm maintenance-points local

841

show ethernet cfm maintenance-points local detail mep

842

show ethernet cfm maintenance-points remote detail

843

Continuity Check Operations
ethernet cfm cc ma interval– 35 –

845
845

Contents

ethernet cfm cc enable846

snmp-server enable traps ethernet cfm cc

847

mep archive-hold-time

848

clear ethernet cfm maintenance-points remote848

clear ethernet cfm errors

849

show ethernet cfm errors

850

Cross Check Operations

851

ethernet cfm mep crosscheck start-delay851

snmp-server enable traps ethernet cfm crosscheck851

mep crosscheck mpid852

ethernet cfm mep crosscheck853

show ethernet cfm maintenance-points remote crosscheck854

Link Trace Operations

854

ethernet cfm linktrace cache854

ethernet cfm linktrace cache hold-time855

ethernet cfm linktrace cache size

856

ethernet cfm linktrace857

clear ethernet cfm linktrace-cache858

show ethernet cfm linktrace-cache

858

Loopback Operations

859

ethernet cfm loopback

859

Fault Generator Operations

861

mep fault-notify alarm-time

861

mep fault-notify lowest-priority

861

mep fault-notify reset-time863

show ethernet cfm fault-notify-generator

863

Delay Measure Operations
ethernet cfm delay-measure two-way

30 OAM Commands

864
864

867

efm oam868

efm oam critical-link-event868

efm oam link-monitor frame869

efm oam link-monitor frame threshold870

efm oam link-monitor frame window

870– 36 –

Contents

efm oam mode

871

clear efm oam counters872

clear efm oam event-log

872

efm oam remote-loopback873

efm oam remote-loopback test

874

show efm oam counters interface

875

show efm oam event-log interface

875

show efm oam remote-loopback interface

877

show efm oam status interface

877

show efm oam status remote interface

878

31 Domain Name Service Commands
DNS Commands

879
880

ip domain-list

880

ip domain-lookup881

ip domain-name882

ip host882

ip name-server883

ipv6 host884

clear dns cache

885show dns

885show dns cache

885show hosts

886

Multicast DNS Commands

887

ip mdns

887

show ip mdns

887

32 DHCP Commands

889

DHCP Client

889

DHCP for IPv4890

ip dhcp dynamic-provision890

ip dhcp client class-id

891

ip dhcp inform893

ip dhcp restart client894

show ip dhcp dynamic-provision894– 37 –

Contents

DHCP for IPv6

895

ipv6 dhcp client rapid-commit vlan

895

ipv6 dhcp restart client vlan

895

ipv6 dhcp dynamic-provision

897

show ipv6 dhcp duid

897

show ipv6 dhcp vlan

898

show ipv6 dhcp dynamic-provision

898

DHCP Relay

899

Global DHCP Relay settings899

ip dhcp relay server899

ip dhcp restart relay

900

show ip dhcp relay

901

L3 DHCP Relay Option Settings

902

ip dhcp relay information option902

ip dhcp relay information option encode no-subtype902

ip dhcp relay information option remote-id903

ip dhcp relay information policy

903

DHCP Relay for IPv6

904

ipv6 dhcp relay destination

904

show ipv6 dhcp relay destination

906

DHCP Server906

ip dhcp excluded-address907

ip dhcp pool907

service dhcp908

bootfile909

client-identifier

909

default-router910

dns-server911

domain-name911

hardware-address

912

host

912

lease

914

netbios-name-server

914

netbios-node-type

915

network916– 38 –

Contents

next-server

917

option917

clear ip dhcp binding

918

show ip dhcp binding919

show ip dhcp

919

show ip dhcp pool

919

33 IP Interface Commands

921

IPv4 Interface

921

Basic IPv4 Configuration922

ip address922

ip default-gateway

924

show ip interface

925

show ip traffic

925

traceroute

926

ping

927

ARP Configuration

929

arp

929

arp timeout930

ip proxy-arp

931

clear arp-cache931

show arp

932

IPv6 Interface

932

Interface Address Configuration and Utilities

934

ipv6 default-gateway934

ipv6 address935

ipv6 address autoconfig

936

ipv6 address dhcp938

ipv6 address eui-64

939

ipv6 address link-local

941

ipv6 enable942

ipv6 mtu

943

show ipv6 interface

944

show ipv6 mtu

946

show ipv6 traffic947– 39 –

Contents

clear ipv6 traffic

951

ping6

952

traceroute6

953

Neighbor Discovery

954

ipv6 hop-limit

954

ipv6 neighbor955

ipv6 nd dad attempts

956

ipv6 nd managed-config-flag

958

ipv6 nd other-config-flag

958

ipv6 nd ns-interval959

ipv6 nd raguard

960

show ipv6 nd raguard

961

ipv6 nd reachable-time962

ipv6 nd prefix962

ipv6 nd ra interval

964

ipv6 nd ra lifetime965

ipv6 nd ra router-preference965

ipv6 nd ra suppress

966

clear ipv6 neighbors

967

show ipv6 neighbors

967

show ipv6 nd prefix

968

ND Snooping

969

ipv6 nd snooping

970

ipv6 nd snooping auto-detect971

ipv6 nd snooping auto-detect retransmit count972

ipv6 nd snooping auto-detect retransmit interval

973

ipv6 nd snooping prefix timeout

973

ipv6 nd snooping max-binding974

ipv6 nd snooping trust974

clear ipv6 nd snooping binding

975

clear ipv6 nd snooping prefix

975

show ipv6 nd snooping

976

show ipv6 nd snooping binding

976

show ipv6 nd snooping prefix977– 40 –

Contents

34 IP Routing Commands
Global Routing Configuration

Section III

979
979

IPv4 Commands

980

ip route

980

show ip route981

show ip host-route982

show ip route database983

show ip route summary

983

show ip traffic

984

IPv6 Commands

985

ipv6 route985

show ipv6 route986

Appendices989

A Troubleshooting

991

Problems Accessing the Management Interface

991

Using System Logs

992

B License Information

993

The GNU General Public License

993

List of Commands

997– 41 –

Contents– 42 –

Tables

Table 1: DHCP Options 60, 66 and 67 Statements

71

Table 2: DHCPv6 Options 59 and 60 Statements

71

Table 3: DHCP Options 55 and 124 Statements

71

Table 4: General Command Modes

83

Table 5: Configuration Command Modes

85

Table 6: Keystroke Commands

85

Table 7: Command Group Index

87

Table 8: General Commands

89

Table 9: System Management Commands

97

Table 10: Cloud Management Commands

98

Table 11: Cloud Management Agent Options

100

Table 12: Device Designation Commands

104

Table 13: Banner Commands

105

Table 14: System Status Commands

114

Table 15: show access-list tcam-utilization - display description

115

Table 16: show process cpu guard - display description

117

Table 17:

show system – display description

121

Table 18: show version – display description

124

Table 19: Fan Control Commands

125

Table 20: Frame Size Commands

125

Table 21: Flash/File Commands

127

Table 22: File Directory Information

134

Table 23: Line Commands

140

Table 24: Event Logging Commands

151

Table 25: Logging Levels

153

Table 26: show logging flash/ram - display description

158

Table 27: show logging trap - display description

159

Table 28: Event Logging Commands

159

Table 29: Time Commands

163– 43 –

Tables

Table 30: Predefined Summer-Time Parameters

174

Table 31: Time Range Commands

180

Table 32: Switch Cluster Commands

183

Table 33: Dying-Gasp Commands

189

Table 34: SNMP Commands

191

Table 35: show snmp engine-id - display description

206

Table 36: show snmp group - display description

207

Table 37: show snmp user - display description

208

Table 38: show snmp view - display description

209

Table 39: RMON Commands

217

Table 40: sFlow Commands

225

Table 41: Authentication Commands

231

Table 42: User Access Commands

232

Table 43: Default Login Settings

234

Table 44: Authentication Sequence Commands

236

Table 45: RADIUS Client Commands

238

Table 46: TACACS+ Client Commands

243

Table 47: AAA Commands

247

Table 48: Web Server Commands

259

Table 49: HTTPS System Support

262

Table 50: Telnet Server Commands

263

Table 51: Secure Shell Commands

266

Table 52: show ssh - display description

274

Table 53: 802.1X Port Authentication Commands

274

Table 54: Management IP Filter Commands

290

Table 55: PPPoE Intermediate Agent Commands

292

Table 56: show pppoe intermediate-agent statistics - display description

300

Table 57: General Security Commands

301

Table 58: Management IP Filter Commands

302

Table 59: show port security - display description

307

Table 60: Network Access Commands

308

Table 61: Dynamic QoS Profiles

312

Table 62: Web Authentication

323

Table 63: DHCP Snooping Commands

329

Table 64: Option 82 information333– 44 –

Tables

Table 65: Option 82 information

339

Table 66: DHCP Snooping Commands

343

Table 67: IPv4 Source Guard Commands

353

Table 68: IPv6 Source Guard Commands

361

Table 69: ARP Inspection Commands

367

Table 70: DoS Protection Commands

375

Table 71: Commands for Configuring Traffic Segmentation

381

Table 72: Traffic Segmentation Forwarding

382

Table 73: Access Control List Commands

387

Table 74: IPv4 ACL Commands

387

Table 75: IPv6 ACL Commands

394

Table 76: MAC ACL Commands

400

Table 77: ARP ACL Commands

406

Table 78: ACL Information Commands

409

Table 79: Interface Commands

413

Table 80: show interfaces counters - display description

426

Table 81: show interfaces switchport - display description

433

Table 82: Link Aggregation Commands

447

Table 83: show lacp counters - display description

458

Table 84: show lacp internal - display description

458

Table 85: show lacp neighbors - display description

459

Table 86: show lacp sysid - display description

460

Table 87: PoE Commands

467

Table 88: Maximum PoE Based on PD Classification

469

Table 89: show power inline status - display description

471

Table 90: show power mainpower - display description

472

Table 91: Port Mirroring Commands

473

Table 92: Mirror Port Commands

473

Table 93: RSPAN Commands

476

Table 94: Congestion Control Commands

483

Table 95: Rate Limit Commands

483

Table 96: Rate Limit Commands

485

Table 97: ATC Commands

486

Table 98: Loopback Detection Commands

501

Table 99: UniDirectional Link Detection Commands

507– 45 –

Tables

Table 100: show udld - display description

512

Table 101: Address Table Commands

515

Table 102: Address Table Commands

523

Table 103: TWAMP Commands

529

Table 104: Spanning Tree Commands

531

Table 105: Recommended STA Path Cost Range

546

Table 106: Default STA Path Costs

546

Table 107: VLAN Commands

563

Table 108: GVRP and Bridge Extension Commands

564

Table 109: show bridge-ext - display description

568

Table 110: Commands for Editing VLAN Groups

570

Table 111: Commands for Configuring VLAN Interfaces

572

Table 112: Commands for Displaying VLAN Information

579

Table 113:802.1Q Tunneling Commands

580

Table 114:

L2 Protocol Tunnel Commands

590

Table 115: VLAN Translation Commands

594

Table 116: Protocol-based VLAN Commands

597

Table 117: IP Subnet VLAN Commands

601

Table 118: MAC Based VLAN Commands

603

Table 119: Voice VLAN Commands

605

Table 120: Excluded VLAN Commands

612

Table 121: ERPS Commands

615

Table 122: ERPS Request/State Priority

640

Table 123: show erps statistics - detailed display description

645

Table 124: show erps r ing - summary display description

646

Table 125: Priority Commands

649

Table 126: Priority Commands (Layer 2)

649

Table 127: Priority Commands (Layer 3 and 4)

654

Table 128: Mapping Internal Per-hop Behavior to Hardware Queues

654

Table 129: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence

655

Table 130: Default Mapping of DSCP Values to Internal PHB/Drop Values

657

Table 131: Default Mapping of IP Precedence to Internal PHB/Drop Values

658

Table 132: Quality of Service Commands

665

Table 133: Control Plane Commands

683

Table 134: Multicast Filtering Commands

687– 46 –

Tables

Table 135: IGMP Snooping Commands

687

Table 136: show ip igmp snooping statistics input - display description

710

Table 137: show ip igmp snooping statistics output - display description

710

Table 138: show ip igmp snooping statistics vlan query - display description

711

Table 139: Static Multicast Interface Commands

712

Table 140: IGMP Filtering and Throttling Commands

713

Table 141: IGMP Authentication RADIUS Attribute Value Pairs

717

Table 142: MLD Snooping Commands

726

Table 143: show ipv6 MLD snooping statistics input - display description

739

Table 144: show ipv6 MLD snooping statistics output - display description

740

Table 145: show ipv6 MLD snooping statistics query - display description

741

Table 146: show ipv6 MLD snooping statistics summary - display description

742

Table 147: MLD Filtering and Throttling Commands

743

Table 148: Multicast VLAN Registration for IPv4 Commands

752

Table 149: show mvr - display description

765

Table 150: show mvr interface - display description

766

Table 151: show mvr members - display description

768

Table 152: show mvr statistics input - display description

770

Table 153: show mvr statistics output - display description

770

Table 154: show mvr statistics query - display description

771

Table 155: show mvr statistics summary interface - display description

772

Table 156: show mvr statistics summary interface mvr vlan - description

773

Table 157: Multicast VLAN Registration for IPv6 Commands

775

Table 158: show mvr6 - display description

787

Table 159: show mvr6 interface - display description

789

Table 160: show mvr6 members - display description

792

Table 161: show mvr6 statistics input - display description

794

Table 162: show mvr6 statistics output - display description

794

Table 163: show mvr6 statistics query - display description

795

Table 164: show mvr6 statistics summary interface - display description

795

Table 165: show mvr6 statistics summary interface mvr vlan - description

797

Table 166: LLDP Commands

799

Table 167: LLDP MED Location CA Types

814

Table 168: CFM Commands

825

Table 169: show ethernet cfm configuration traps - display description

839– 47 –

Tables

Table 170: show ethernet cfm maintenance-points local detail mep - display

843

Table 171: show ethernet cfm maintenance-points remote detail - display

844

Table 172: show ethernet cfm errors - display description

850

Table 173: show ethernet cfm linktrace-cache - display description

858

Table 174: Remote MEP Priority Levels

862

Table 175: MEP Defect Descriptions

862

Table 176: show fault-notify-generator - display description

864

Table 177: OAM Commands

867

Table 178: Address Table Commands

879

Table 179: show dns cache - display description

886

Table 180: show hosts - display description

886

Table 181: DHCP Commands

889

Table 182: DHCP Client Commands

889

Table 183: Options 60, 66 and 67 Statements

892

Table 184: Options 55 and 124 Statements

892

Table 185: DHCP Relay Commands

899

Table 186: DHCP Server Commands

906

Table 187: IP Interface Commands

921

Table 188: IPv4 Interface Commands

921

Table 189: Basic IP Configuration Commands

922

Table 190: Address Resolution Protocol Commands

929

Table 191: IPv6 Configuration Commands

932

Table 192: show ipv6 interface - display description

945

Table 193: show ipv6 mtu - display description

947

Table 194: show ipv6 traffic - display description

948

Table 195: show ipv6 neighbors - display description

967

Table 196: ND Snooping Commands

969

Table 188: IP Routing Commands

979

Table 189: Global Routing Configuration Commands

979

Table 190: show ip host-route - display description

983

Table 191: Troubleshooting Chart

991– 48 –

Section I
Getting Started
This section describes how to configure the switch for management access throughthe web interface or SNMP.
This section includes these chapters:
 "Initial Switch Configuration" on page 51– 49 –

Section I | Getting Started– 50 –

1

Initial Switch Configuration

This chapter includes information on connecting to the switch and basic
configuration procedures.

Connecting to the Switch
The switch includes a built-in network management agent. The agent offers avariety of management options, including SNMP, RMON and a web-based interface.
A PC may also be connected directly to the switch for configuration and monitoring
via a command line interface (CLI).
Note: An IPv4 address for the primary network interface (VLAN 1) is set to an initial
192.168.2.10 by default. To change this address, see “Setting an IP Address” onpage 55.

Configuration Options The switch’s HTTP web agent allows you to configure switch parameters, monitor
port connections, and display statistics using a standard web browser such as
Internet Explorer 9+, Mozilla Firefox 52+, Google Chrome 54+, or Opera 41+, ormore recent versions. The switch’s web management interface can be accessedfrom any computer attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial
console port on the switch, or remotely by a Telnet connection over the network.
The switch’s management agent also supports SNMP (Simple Network
Management Protocol). This SNMP agent permits the switch to be managed fromany system in the network using network management software.
The switch’s web interface, console interface, and SNMP agent allow you to
perform the following management functions: Set user names and passwords Set an IP interface for any VLAN
 Configure SNMP parameters
 Enable/disable any port
 Set the speed/duplex mode for any port
 Configure the bandwidth of any port by limiting input or output rates– 51 –

Chapter 1 | Initial Switch Configuration
Connecting to the Switch
 Control port access through IEEE 802.1X security or static address filtering Filter packets using Access Control Lists (ACLs)
 Configure up to 4094 IEEE 802.1Q VLANs
 Enable GVRP automatic VLAN registration
 Configure IP routing for unicast traffic Configure IGMP multicast filtering Upload and download system firmware or configuration files via HTTP (using

the web interface) or FTP/SFTP/TFTP (using the command line or web interface) Configure Spanning Tree parameters Configure Class of Service (CoS) priority queuing Configure static or LACP trunks (up to 28)
 Enable port mirroring Set storm control on any port for excessive broadcast, multicast, or unknown

unicast traffic

 Display system information and statistics

Connecting to the The switch provides an RS-232 serial port that enables a connection to a PC or
Console Port terminal for monitoring and configuring the switch. A null-modem console cable isprovided with the switch.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program
to the switch. You can use the console cable provided with this package, or use anull-modem cable that complies with the wiring assignments shown in the
Installation Guide.
To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC runningterminal emulation software, and tighten the captive retaining screws on the
DB-9 connector.

2. Connect the other end of the cable to the RJ-45 serial port on the switch.
3. Make sure the terminal emulation software is set as follows:

Select the appropriate serial port (COM port 1 or COM port 2).



Set the baud rate to 115200 bps.

Set the data format to 8 data bits, 1 stop bit, and no parity.



Set flow control to none.



Set the emulation mode to VT100.



When using HyperTerminal, select Terminal keys, not Windows keys.

– 52 –

Chapter 1 | Initial Switch Configuration
Connecting to the Switch

4. Power on the switch.
After the system completes the boot cycle, the logon screen appears.

Logging Onto the The CLI program provides two different command levels — normal access level
Command Line (Normal Exec) and privileged access level (Privileged Exec). The commands
Interface available at the Normal Exec level are a limited subset of those available at thePrivileged Exec level and allow you to only display information and use basic
utilities. To fully configure the switch parameters, you must access the CLI at thePrivileged Exec level.
Access to both CLI levels are controlled by user names and passwords. The switch
has a default user name and password for each level. To log into the CLI at thePrivileged Exec level using the default user name and password, perform thesesteps:

1. To initiate your console connection, press <Enter>. The “User Access
Verification” procedure starts.

2. At the User Name prompt, enter “admin.”3. At the Password prompt, also enter “admin.” (The password characters are notdisplayed on the console screen.)

4. The session is opened and the CLI displays the “Console#” prompt indicating
you have access at the Privileged Exec level.

Setting Passwords If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record
them and put them in a safe place.
Passwords can consist of up to 32 alphanumeric characters and are case sensitive.
To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name and password “admin”
to access the Privileged Exec level.

2. Type “configure” and press <Enter>.
3. Type “username guest password 0 password,” for the Normal Exec level, where
password is your new password. Press <Enter>.

– 53 –

Chapter 1 | Initial Switch Configuration
Connecting to the Switch

4. Type “username admin password 0 password,” for the Privileged Exec level,
where password is your new password. Press <Enter>.

Username: admin
Password:
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Console#configure
Console(config)#username guest password 0 [password]
Console(config)#username admin password 0 [password]
Console(config)#

Note: This manual covers the ECS4150-28T, ECS4150-28P, ECS4150-28F-I, ECS415054T, and ECS4150-54P Gigabit Ethernet switches. Other than the difference in thenumber of ports and the support for PoE on the ECS4150-28P and ECS4150-54P,
there are no significant differences.

Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you mustfirst configure the network interface with a valid IPv4 or IPv6 address. The default
network interface is VLAN 1 which includes all switch ports.

When configuring the network interface, the IP address, subnet mask, and default
gateway may all be set using a console connection, or DHCP protocol as describedin the following sections.
An IPv4 address for the primary network interface is set to an initial 192.168.2.10 bydefault. To manually configure this address or enable dynamic address assignment
via DHCP, see “Setting an IP Address” on page 55.
After configuring the switch’s IP parameters, you can access the onboard
configuration program from anywhere within the attached network. The onboard
configuration program can be accessed using Telnet or SSH from any computerattached to the network. The switch can also be managed by any computer using a
web browser (Internet Explorer 9, Mozilla Firefox 52, Google Chrome 54, orOpera 41, or more recent versions), or from a network computer using SNMP
network management software.
Note: This switch supports eight Telnet sessions or SSH sessions.
Note: Any VLAN group can be assigned an IP interface address (page 55) for
managing the switch.
The onboard program only provides access to basic configuration functions. To
access the full range of SNMP management functions, you must use SNMP-based
network management software.
– 54 –

Chapter 1 | Initial Switch Configuration
Configuring the Switch for Remote Management

Configuring the Switch for Remote Management
Using the Network The switch can be managed through the operational network, known as in-band
Interface management. Because in-band management traffic is mixed in with operational

network traffic, it is subject to all of the filtering rules usually applied to a standard
network ports such as ACLs and VLAN tagging. In-band network management canbe accessed through a connection to any network port.

Setting an IP Address You must establish IP address information for a switch to obtain management
access through the network. This can be done in either of the following ways:

 Manual — You have to input the information, including IP address and subnet

mask. If your management station is not in the same IP subnet as the switch,
you will also need to specify the default gateway router. To configure thisdevice as the default gateway, use the ip default-gateway command.

 Dynamic — The switch can send IPv4 configuration requests to BOOTP or

DHCP address allocation servers on the network, or automatically generate aunique IPv6 host address based on the local subnet address prefix received inrouter advertisement messages. An IPv6 link local address for use in a local
network can also be dynamically generated as described in “Obtaining an IPv6
Address” on page 60.

Manual Configuration
You can manually assign an IP address to the switch. You may also need to specify adefault gateway that resides between this device and management stations thatexist on another network segment. Valid IPv4 addresses consist of four decimal
numbers, 0 to 255, separated by periods. Anything other than this format will not
be accepted by the CLI program.
Note: The default IPv4 address and subnet mask for VLAN 1 is 192.168.2.10
255.255.255.0, with no defined default gateway.
Assigning an IPv4 Address
Before you can assign an IP address to the switch, you must obtain the following
information from your network administrator:
 IP address for the switch
 Network mask for this network
 Default gateway for the network– 55 –

Chapter 1 | Initial Switch Configuration
Configuring the Switch for Remote Management
To assign an IPv4 address to the switch, complete the following steps

1. From the Global Configuration mode prompt, type “interface vlan 1” to accessthe interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP

address and “netmask” is the network mask for the network. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.
4. To set the IP address of the default gateway for the network to which the switch
belongs, type “ip default-gateway gateway,” where “gateway” is the IP addressof the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.5 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 192.168.1.254

Assigning an IPv6 AddressThis section describes how to configure a “link local” address for connectivity
within the local subnet only, and also how to configure a “global unicast” address,
including a network prefix for use on a multi-segment network and the hostportion of the address.
An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One
double colon may be used to indicate the appropriate number of zeros required tofill the undefined fields. For detailed information on the other ways to assign IPv6
addresses, see “IPv6 Interface” on page 932.
Link Local Address — All link-local addresses must be configured with a prefix inthe range of FE80~FEBF. Remember that this address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet only. Also, if
the switch detects that the address you configured conflicts with that in use byanother device on the subnet, it will stop using the address in question, andautomatically generate a link local address that does not conflict with any otherdevices on the local subnet.
To configure an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to accessthe interface-configuration mode. Press <Enter>.

– 56 –

Chapter 1 | Initial Switch Configuration
Configuring the Switch for Remote Management

2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimalvalues for the ipv6-address similar to that shown in the example, followed by
the “link-local” command parameter. Then press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700 link-local
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):(None)
Joined group address(es):ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Address for Multi-segment Network — Before you can assign an IPv6 address to theswitch that will be used to connect to a multi-segment network, you must obtainthe following information from your network administrator:
 Prefix for this network
 IP address for the switch
 Default gateway for the network

For networks that encompass several different subnets, you must define the full
address, including a network prefix and the host address for the switch. You canspecify either the full IPv6 address, or the IPv6 address and prefix length. The prefix
length for an IPv6 network is the number of bits (from the left) of the prefix thatform the network address, and is expressed as a decimal number. For example, all
IPv6 addresses that start with the first byte of 73 (hexadecimal) could be expressed
as 73:0:0:0:0:0:0:0/8 or 73::/8.
To generate an IPv6 global unicast address for the switch, complete the following
steps:

1. From the global configuration mode prompt, type “interface vlan 1” to accessthe interface-configuration mode. Press <Enter>.

2. From the interface prompt, type “ipv6 address ipv6-address” or “ipv6 address

ipv6-address/prefix-length,” where “prefix-length” indicates the address bits
used to form the network portion of the address. (The network address starts– 57 –

Chapter 1 | Initial Switch Configuration
Configuring the Switch for Remote Managementfrom the left of the prefix and should encompass some of the ipv6-address
bits.) The remaining bits are assigned to the host interface. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.
4. To set the IP address of the IPv6 default gateway for the network to which theswitch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the
IPv6 address of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:DB8:2222:7272::/64
Console(config-if)#exit
Console(config)#ipv6 default-gateway 2001:DB8:2222:7272::254
Console(config)end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):2001:db8:2222:7272::/64, subnet is 2001:db8:2222:7272::/64[TEN][INVALID][INVAL
ID]
Joined group address(es):ff02::1:ff00:0
ff02::1:ff11:6700
ff02::1:2
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#show ipv6 default-gateway
IPv6 default gateway 2001:db8:2222:7272::254
Console#Dynamic Configuration
Obtaining an IPv4 Address
If you select the “bootp” or “dhcp” option, the system will immediately start
broadcasting service requests. IP will be enabled but will not function until a
BOOTP or DHCP reply has been received. Requests are broadcast every few minutes
using exponential backoff until IP configuration information is obtained from a
BOOTP or DHCP server. BOOTP and DHCP values can include the IP address, subnet
mask, and default gateway. If the DHCP/BOOTP server is slow to respond, you may
need to use the “ip dhcp restart client” command to re-start broadcasting service
requests.
Note that the “ip dhcp restart client” command can also be used to start
broadcasting service requests for all VLANs configured to obtain address
assignments through BOOTP or DHCP. It may be necessary to use this command– 58 –

Chapter 1 | Initial Switch Configuration
Configuring the Switch for Remote Management
when DHCP is configured on a VLAN, and the member ports which were previously
shut down are now enabled.
If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then theswitch will start broadcasting service requests as soon as it is powered on.
To automatically configure the switch by communicating with BOOTP or DHCP
address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to accessthe interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following
commands:
To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.



To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.
4. Wait a few minutes, and then check the IP configuration settings by typing the“show ip interface” command. Press <Enter>.

5. Then save your configuration changes by typing “copy running-config startupconfig.” Enter the startup file name and press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address dhcp
Console(config-if)#end
Console#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is 00-E0-0C-00-00-FD
Index: 1001, MTU: 1500
Address Mode is DHCP
IP Address: 192.168.0.4 Mask: 255.255.255.0
Proxy ARP is disabled
DHCP Client Vendor Class ID (text): ECS4150-28P
DHCP Relay Server:
Console#copy running-config startup-config
Startup configuration file name []: startup\Write to FLASH Programming.
\Write to FLASH finish.
Success.

– 59 –

Chapter 1 | Initial Switch Configuration
Configuring the Switch for Cloud Management
Obtaining an IPv6 Address
Link Local Address — There are several ways to configure IPv6 addresses. The
simplest method is to automatically generate a “link local” address (identified by anaddress prefix in the range of FE80~FEBF). This address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet.
To generate an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to accessthe interface-configuration mode. Press <Enter>.

2. Type “ipv6 enable” and press <Enter>.
Console(config)#interface vlan 1
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::2e0:cff:fe00:fd%1/64
Global unicast address(es):2001:db8:2222:7272::/64, subnet is 2001:db8:2222:7272::/64
Joined group address(es):ff02::1:ff00:0
ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Configuring the Switch for Cloud Management
The Edgecore ecCLOUD Controller is a cloud-based network service available fromanywhere through a web-browser interface. The switch can be managed by theecCLOUD controller once you have set up an account and registered the device on
the system.
By default, the cloud management agent is disabled on the switch. Setting thecloud management agent to enabled allows the switch to be managed through theecCLOUD system after the next reboot.
To enable the cloud management agent, log into the CLI and use the mgmt enablecommand from the Global Config level. Then reboot the switch to initiate
communications with the ecCLOUD controller.

– 60 –

Chapter 1 | Initial Switch Configuration
Enabling SNMP Management Access

Username: admin
Password:
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Console#configure
Console(config)#mgmt enable
Console(config)#exit
Console#reload
System will be restarted, continue <y/n>? y

For more information on cloud management configuration, see “Cloud
Management” on page 98.

Enabling SNMP Management Access
The switch can be configured to accept management commands from Simple
Network Management Protocol (SNMP) applications such as Edgecore ECView Pro.
You can configure the switch to respond to SNMP requests or generate SNMP traps.
When SNMP management stations send requests to the switch (either to return
information or to set a parameter), the switch provides the requested data or sets
the specified parameter. The switch can also be configured to send information to
SNMP managers (without being requested by the managers) through trap
messages, which inform the manager that certain events have occurred.
The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients.
To provide management access for version 1 or 2c clients, you must specify acommunity string. The switch provides a default MIB View (i.e., an SNMPv3
construct) for the default “public” community string that provides read access tothe entire MIB tree, and a default view for the “private” community string thatprovides read/write access to the entire MIB tree. However, you may assign newviews to version 1 or 2c community strings that suit your specific security
requirements (see snmp-server view command).

Community Strings (for SNMP version 1 and 2c clients)
Community strings are used to control management access to SNMP version 1 and2c stations, as well as to authorize SNMP stations to receive trap messages from theswitch. You therefore need to assign community strings to specified users, and set
the access level.
The default strings are:
 public - with read-only access. Authorized management stations are only able

to retrieve MIB objects.

– 61 –

Chapter 1 | Initial Switch Configuration
Enabling SNMP Management Access private - with read/write access. Authorized management stations are able toboth retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it isrecommended that you change the default community strings.
To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type “snmpserver community string mode,” where “string” is the community access stringand “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that thedefault mode is read only.)

2. To remove an existing string, simply type “no snmp-server community string,”
where “string” is the community access string to remove. Press <Enter>.

Console(config)#snmp-server community admin rw
Console(config)#snmp-server community private
Console(config)#

Note: If you do not intend to support access to SNMP version 1 and 2c clients, werecommend that you delete both of the default community strings. If there are nocommunity strings, then SNMP management access from SNMP v1 and v2c clientsis disabled.

Trap Receivers
You can also specify SNMP stations that are to receive traps from the switch. To
configure a trap receiver, use the “snmp-server host” command. From thePrivileged Exec level global configuration mode prompt, type:“snmp-server host host-address community-string [version {1 | 2c | 3 {auth |noauth | priv}}]”
where “host-address” is the IP address for the trap receiver, “community-string”
specifies access rights for a version 1/2c host, or is the user name of a version 3 host,“version” indicates the SNMP client version, and “auth | noauth | priv” means thatauthentication, no authentication, or authentication and privacy is used for v3
clients. Then press <Enter>. For a more detailed description of these parameters,
see the snmp-server host command. The following example creates a trap host foreach type of SNMP client.
Console(config)#snmp-server host 10.1.19.23 batman
Console(config)#snmp-server host 10.1.19.98 robin version 2c
Console(config)#snmp-server host 10.1.19.34 barbie version 3 authConsole(config)#– 62 –

Chapter 1 | Initial Switch Configuration
Managing System Files

Configuring Access for SNMP Version 3 Clients
To configure management access for SNMPv3 clients, you need to first create aview that defines the portions of MIB that the client can read or write, assign theview to a group, and then assign the user to a group. The following example creates
one view called “mib-2” that includes the entire MIB-2 tree branch, and thenanother view that includes the IEEE 802.1d bridge MIB. It assigns these respective
read and read/write views to a group call “r&d” and specifies group authentication
via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that
MD5 will be used for authentication, provides the password “greenpeace” forauthentication, and the password “einstien” for encryption.
Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included
Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included
Console(config)#snmp-server group r&d v3 auth read mib-2 write 802.1d
Console(config)#snmp-server user steve r&d v3 auth md5 greenpeace priv des56
einstien
Console(config)#

For a more detailed explanation on how to configure the switch for access from
SNMP v3 clients, refer to “SNMP Commands” on page 191 or to the Web
Management Guide.

Managing System Files
The switch’s flash memory supports three types of system files that can be
managed by the CLI program, the web interface, or SNMP. The switch’s file systemallows files to be uploaded and downloaded, copied, deleted, and set as a start-up
file.
The types of files are:
 Configuration — This file type stores system configuration information and iscreated when configuration settings are saved. Saved configuration files can beselected as a system start-up file or can be uploaded via FTP/SFTP/SCP/TFTP toa server for backup. The file named “Factory_Default_Config.cfg” contains all
the system default settings and cannot be deleted from the system. If thesystem is booted with the factory default settings, the switch will also create afile named “startup1.cfg” that contains system settings for switch initialization,
including information about the unit identifier, and MAC address for the switch.
The configuration settings from the factory defaults configuration file arecopied to this file, which is then used to boot the switch. See “Saving or
Restoring Configuration Settings” on page 65 for more information.

 Operation Code — System software that is executed after boot-up, also

known as run-time code. This code runs the switch operations and provides the
CLI and web management interfaces.

– 63 –

Chapter 1 | Initial Switch Configuration
Managing System Files Diagnostic Code — Software that is run during system boot-up, also known as

POST (Power On Self-Test).

Note: The Boot ROM and Loader cannot be uploaded or downloaded from the
FTP/SFTP/SCP/TFTP server. You must follow the instructions in the release notes for
new firmware, or contact your distributor for help.
Due to the size limit of the flash memory, the switch supports only two operation
code files. However, you can have as many diagnostic code files and configuration
files as available flash memory space allows. The available flash memory can bechecked by using the dir command.
In the system flash memory, one file of each type must be set as the start-up file.
During a system boot, the diagnostic and operation code files set as the start-up file
are run, and then the start-up configuration file is loaded.
Note that configuration files should be downloaded using a file name that reflects
the contents or usage of the file settings. If you download directly to the runningconfig, the system will reboot, and the settings will have to be copied from therunning-config to a permanent file.

Upgrading the The following example shows how to download new firmware to the switch andOperation Code activate it. The TFTP server could be any standards-compliant server running on

Windows or Linux. When downloading from an FTP server, the logon interface willprompt for a user name and password configured on the remote server. Note that“anonymous” is set as the default user name.
File names on the switch are case-sensitive. The destination file name should notcontain slashes (\ or /), and the maximum length for file names is 32 characters forfiles on the switch or 128 characters for files on the server. (Valid characters: A-Z,
a-z, 0-9, “.”, “-”)Console#copy tftp file
TFTP server IP address: 192.168.2.243
Choose file type:
1. config; 2. opcode: 2
Source file name: runtime.bix
Destination file name: runtime.bix
Flash programming started.
Flash programming completed.
Success.
Console#config
Console(config)#boot system opcode:runtime.bix
Success.
Console(config)#exit
Console#dir
File Name
Type
Startup Modified Time
Size (bytes)---------------------------- ------- ------- ------------------- -----------Unit 1:
runtime_v1.1.0.8.bix
OpCode N
2023-01-17 01:19:41
51,894,508
runtime.bix
OpCode Y
2023-02-07 14:40:05
51,893,948
Factory_Default_Config.cfg
Config N
2023-01-17 01:09:16
455– 64 –

Chapter 1 | Initial Switch Configuration
Managing System Files

startup1.cfg
Config Y
2023-02-17 07:39:01
1,673---------------------------------------------------------------------------Free space for compressed user config files:
58,925,056
Total space:
165,584,896
Console#Saving or Restoring Configuration commands only modify the running configuration file and are not
Configuration saved when the switch is rebooted. To save all your configuration changes in
Settings nonvolatile storage, you must copy the running configuration file to the start-up
configuration file using the “copy” command.

New startup configuration files must have a name specified. File names on theswitch are case-sensitive, can be from 1 to 31 characters, must not contain slashes(\ or /), and the leading letter of the file name must not be a period (.). (Validcharacters: A-Z, a-z, 0-9, “.”, “-”, “_”)
There can be more than one user-defined configuration file saved in the switch’s
flash memory, but only one is designated as the “startup” file that is loaded when
the switch boots. The copy running-config startup-config command always sets
the new file as the startup file. To select a previously saved configuration file, use
the boot system config:<filename> command.
The maximum number of saved configuration files depends on available flash
memory. The amount of available flash memory can be checked by using the dir
command.
To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config startupconfig” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.
Console#copy running-config startup-config
Startup configuration file name []: startup\Write to FLASH Programming.
\Write to FLASH finish.
Success.
Console#To restore configuration settings from a backup server, enter the following
command:

1. From the Privileged Exec mode prompt, type “copy tftp startup-config” andpress <Enter>.

2. Enter the address of the TFTP server. Press <Enter>.
– 65 –

Chapter 1 | Initial Switch Configuration
Automatic Installation of Operation Code and Configuration Settings

3. Enter the name of the startup file stored on the server. Press <Enter>.
4. Enter the name for the startup file on the switch. Press <Enter>.
Console#copy tftp startup-config
TFTP server IP address: 192.168.0.4
Source configuration file name: startup-rd.cfg
Startup configuration file name [startup1.cfg]:
Success.
Console#Automatic Installation of Operation Code and Configuration Settings
Downloading Automatic Operation Code Upgrade can automatically download an operation
Operation Code code file when a file newer than the currently installed one is discovered on the filefrom a File Server server. After the file is transferred from the server and successfully written to the filesystem, it is automatically set as the startup file, and the switch is rebooted.

Usage Guidelines
 If this feature is enabled, the switch searches the defined URL once during thebootup sequence.
 FTP (port 21) and TFTP (port 69) are both supported. Note that the TCP/UDP

port bindings cannot be modified to support servers listening on non-standard
ports.

 The host portion of the upgrade file location URL must be a valid IPv4 IP

address. DNS host names are not recognized. Valid IP addresses consist of four
numbers, 0 to 255, separated by periods.

 The path to the directory must also be defined. If the file is stored in the root

directory for the FTP/TFTP service, then use the “/” to indicate this (e.g.,
ftp://192.168.0.1/).

 The file name must not be included in the upgrade file location URL. The filename of the code stored on the remote server must be ECS4150.bix (using
lower case letters as indicated).

 The FTP connection is made with PASV mode enabled. PASV mode is needed totraverse some fire walls, even if FTP traffic is not blocked. PASV mode cannot bedisabled.

 The switch-based search function is case-insensitive in that it will accept a filename in upper or lower case (i.e., the switch will accept ECS4150.BIX from theserver even though ECS4150.bix was requested). However, keep in mind that– 66 –

Chapter 1 | Initial Switch Configuration
Automatic Installation of Operation Code and Configuration Settings
the file systems of many operating systems such as Unix and most Unix-likesystems (FreeBSD, NetBSD, OpenBSD, and most Linux distributions, etc.) arecase-sensitive, meaning that two files in the same directory, ecs4150.bix and
ECS4150.BIX are considered to be unique files. Thus, if the upgrade file is stored
as ECS4150.BIX (or even Ecs4150.bix) on a case-sensitive server, then the switch(requesting ECS4150.BIX) will not be upgraded because the server does notrecognize the requested file name and the stored file name as being equal. A
notable exception in the list of case-sensitive Unix-like operating systems is
Mac OS X, which by default is case-insensitive. Please check the documentation
for your server’s operating system if you are unsure of its file system’s behavior.
 Note that the switch itself does not distinguish between upper and lower-casefile names, and only checks to see if the file stored on the server is more recent
than the current runtime image.

 If two operation code image files are already stored on the switch’s file system,

then the non-startup image is deleted before the upgrade image is transferred.

 The automatic upgrade process will take place in the background without

impeding normal operations (data switching, etc.) of the switch.

 During the automatic search and transfer process, the administrator cannot

transfer or update another operation code image, configuration file, public key,or HTTPS certificate (i.e., no other concurrent file management operations are
possible).

 The upgrade operation code image is set as the startup image after it has beensuccessfully written to the file system.

 The switch will send an SNMP trap and make a log entry upon all upgrade

successes and failures.

 The switch will immediately restart after the upgrade file is successfully written

to the file system and set as the startup image.

To enable automatic upgrade, enter the following commands:

1. Specify the TFTP or FTP server to check for new operation code.
When specifying a TFTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:tftp://192.168.0.1[/filedir]/When specifying an FTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:
ftp://[username[:password@]]192.168.0.1[/filedir]/If the user name is omitted, “anonymous” will be used for the connection. If
the password is omitted a null string (“”) will be used for the connection.

– 67 –

Chapter 1 | Initial Switch Configuration
Automatic Installation of Operation Code and Configuration Settings
If no user name nor password is required for the connection, then the “@”character cannot be used in the path name.
This shows how to specify a TFTP server where new code is stored.
Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#

This shows how to specify an FTP server where new code is stored.
Console(config)#upgrade opcode path ftp://site9:billy@192.168.0.1/sm24/
Console(config)#

2. Set the switch to automatically reboot and load the new code after the opcode
upgrade is completed.

Console(config)#upgrade opcode reload
Console(config)#

3. Set the switch to automatically upgrade the current operational code when a

new version is detected on the server. When the switch starts up and automatic
image upgrade is enabled by this command, the switch will follow these steps
when it boots up:

a. It will search for a new version of the image at the location specified byupgrade opcode path command. The name for the new image stored on
the FTP/SFTP/SCP/TFTP server must be ECS4150.bix. If the switch detects acode version newer than the one currently in use, it will download the newimage. If two code images are already stored in the switch, the image not
set to start up the system will be overwritten by the new version.

b. After the image has been downloaded, the switch will send a trap message
to log whether or not the upgrade operation was successful.

c. It sets the new version as the startup image.
d. It then restarts the system to start using the new image.
Console(config)#upgrade opcode auto
Console(config)#

4. Display the automatic upgrade settings.

– 68 –

Chapter 1 | Initial Switch Configuration
Automatic Installation of Operation Code and Configuration Settings

Console#show upgrade
Auto Image Upgrade Global Settings:
Status: Enabled
Reload Status : Enabled
Path:
File Name : ECS4150.bix
Console#The following shows an example of the upgrade process.

...
Automatic Upgrade is looking for a new image
New image detected: current version V1.1.0.8; new version V1.1.0.9
Image upgrade in progress
Downloading new image
Flash programming started
Flash programming completed
Success
The switch will now restart...

Specifying a DHCP DHCP servers index their database of address bindings using the client’s Media
Client Identifier Access Control (MAC) Address or a unique client identifier. The client identifier isused to identify the vendor class and configuration of the switch to the DHCP
server, which then uses this information to decide on how to service the client or
the type of information to return.
DHCP client Identifier (Option 60) is used by DHCP clients to specify their unique
identifier. The client identifier is optional and can be specified while configuring
DHCP on the primary network interface. DHCP Option 60 is disabled by default.
The general framework for this DHCP option is set out in RFC 2132 (Option 60). This
information is used to convey configuration settings or other identification
information about a client, but the specific string to use should be supplied by yourservice provider or network administrator. Options 60 (vendor-class-identifier), 66(tftp-server-name) and 67 (bootfile-name) statements can be added to the server
daemon’s configuration file as described in the following section.
If the DHCP server has an index entry for a switch requesting service, it should reply
with the TFTP server name and boot file name. Note that the vendor class identifier
can be formatted in either text or hexadecimal, but the format used by both theclient and server must be the same.
Console#config
Console(config)#vlan database
Console(config-vlan)#vlan 2
Console(config-vlan)#exit
Console(config)#interface vlan 2– 69 –

Chapter 1 | Initial Switch Configuration
Downloading a Configuration File and Other Parameters from a DHCP Server
Console(config-if)#ip dhcp client class-id hex 0000e8666572
Console(config-if)#Downloading a Configuration File and Other Parameters from a DHCP Server
Information passed on to the switch from a DHCP server may also include a
configuration file to be downloaded and the TFTP servers where that file can beaccessed, as well as other parameters. If the Factory Default Configuration file isused to provision the switch at startup, in addition to requesting IP configuration
settings from the DHCP server, it will also ask for the name of a bootup
configuration file and TFTP servers where that file is stored.
If the switch receives information that allows it to download the remote bootup file,
it will save this file to a local buffer, and then restart the provision process.
Note the following DHCP client behavior: To enable dynamic provisioning via a DHCP server, this feature must be

enabled using the ip dhcp dynamic-provision or ipv6 dhcp dynamic-provisioncommand.

 The bootup configuration file received from a (TFTP or HTTP) server is stored on

the switch with the original file name. If this file name already exists in theswitch, the file is overwritten.

 If the name of the bootup configuration file is the same as the Factory Default

Configuration file, the download procedure will be terminated, and the switch
will not send any further DHCP client requests.

 If the switch fails to download the bootup configuration file based on

information passed by the DHCP server, it will not send any further DHCP client
requests.

 If the switch does not receive a DHCP response prior to completing the bootup

process, it will continue to send a DHCP client request once a minute. These
requests will only be terminated if the switch’s address is manually configured,
but will resume if the address mode is set back to DHCP.

– 70 –

Chapter 1 | Initial Switch Configuration
Downloading a Configuration File and Other Parameters from a DHCP Server
To successfully transmit a bootup configuration file to the switch, the DHCP
daemon (using a Linux based system for this example) must be configured with thefollowing information:
 For IPv4 DHCP, options 60, 66 and 67 statements can be added to the daemon’s

configuration file.

Table 1: DHCP Options 60, 66 and 67 Statements
OptionStatement
KeywordParameter

60

vendor-class-identifiera string indicating the vendor class identifier

66

tftp-server-namea string indicating the tftp server name67

bootfile-namea string indicating the bootfile name For DHCPv6, options 59 and 60 statements can be added to the daemon’s

configuration file.

Table 2: DHCPv6 Options 59 and 60 Statements
OptionStatement
KeywordParameter

59

OPT_BOOTFILE_URL

a string indicating the bootfile location (mustconform to RFC3986)

60

OPT_BOOTFILE_PARAM

multiple UTF-8 ([RFC3629]) strings that specify
parameters for the boot file By default, IPv4 DHCP option 66/67 parameters are not carried in a DHCP server

reply. To ask for a DHCP reply with option 66/67 information, the DHCP client
request sent by this switch includes a “parameter request list” asking for thisinformation. Besides these items, the client request also includes a “vendor
class identifier” that allows the DHCP server to identify the device, and selectthe appropriate configuration file for download. This information is included in
Options 55 and 124.
Table 3: DHCP Options 55 and 124 Statements
OptionStatement
KeywordParameter55

dhcp-parameter-request-lista list of parameters, separated by a comma ', '124

vendor-class-identifiera string indicating the vendor class identifier

The following configuration example is provided for a Linux-based IPv4 DHCP
daemon (dhcpd.conf file). In the “Vendor class” section, the server will always send
Option 66 and 67 to tell the switch to download the “test” configuration file fromserver 192.168.255.101.

– 71 –

Chapter 1 | Initial Switch Configuration
Setting the System Clockddns-update-style ad-hoc;default-lease-time 600;
max-lease-time 7200;
log-facility local7;server-name "Server1";
Server-identifier 192.168.255.250;#option 66, 67
option space dynamicProvision code width 1 length 1 hash size 2;
option dynamicProvision.tftp-server-name code 66 = text;
option dynamicProvision.bootfile-name code 67 = text;
subnet 192.168.255.0 netmask 255.255.255.0 {range 192.168.255.160 192.168.255.200;
option routers 192.168.255.101;
option tftp-server-name "192.168.255.100"; #Default Option 66
option bootfile-name "bootfile";#Default Option 67}
class "Option66,67_1" {#DHCP Option 60 Vendor classtwo
match if option vendor-class-identifier = "ECS4150-28P";
option tftp-server-name "192.168.255.101";
option bootfile-name "test";}

Note: Use “ECS4150-28T,” “ECS4150-28P,” “ECS4150-28F-I,” “ECS4150-54T,” or“ECS4150-54P” for the vendor-class-identifier in the dhcpd.conf file.

Setting the System Clock
Simple Network Time Protocol (SNTP) or Network Time Protocol (NTP) can be used
to set the switch’s internal clock based on periodic updates from a time server.
Maintaining an accurate time on the switch enables the system log to record
meaningful dates and times for event entries. You can also manually set the clock. If
the clock is not set manually or via SNTP or NTP, the switch will only record the timefrom the factory default set at the last bootup.
When the SNTP client is enabled, the switch periodically sends a request for a time
update to a configured time server. You can configure up to three time server IP
addresses. The switch will attempt to poll each server in the configured sequence.
The switch also supports the following time settings:
 Time Zone – You can specify the offset from Coordinated Universal Time (UTC),

also known as Greenwich Mean Time (GMT).

– 72 –

Chapter 1 | Initial Switch Configuration
Setting the System Clock Summer Time/Daylight Saving Time (DST) – In some regions, the time shifts by

one hour in the fall and spring. The switch supports manual entry for one-timeor recurring clock shifts.

Setting the Time To manually set the clock to 14:11:36, April 1st, 2013, enter this command.
Manually
Console#calendar set 14 11 36 1 April 2013
Console#To set the time zone, enter a command similar to the following.
Console(config)#clock timezone Japan hours 8 after-UTC
Console(config)#

To set the time shift for summer time, enter a command similar to the following.
Console(config)#clock summer-time SUMMER date 2 april 2013 0 0 30 june 2013 00Console(config)#

To display the clock configuration settings, enter the following command.
Console#show calendar
Current TimeTime Zone
Summer Time

: Jul 28 00:54:20 2015
: Japan, 08:00: SUMMER, offset 60 minutes
Apr 2 2013 00:00 to Jun 30 2015 00:00
Summer Time in Effect : Yes
Console#Configuring SNTP Setting the clock based on an SNTP server can provide more accurate clock

synchronization across network switches than manually-configured time. To
configure SNTP, set the switch as an SNTP client, and then set the polling interval,and specify a time server as shown in the following example.
Console(config)#sntp client
Console(config)#sntp poll 60
Console(config)#sntp server 10.1.0.19
Console(config)#exit
Console#show sntp
Current Time: Apr 2 16:06:07 2013
Poll Interval : 60 seconds
Current Mode
: Unicast
SNTP Status: Enabled
SNTP Server: 10.1.0.19
Current Server : 10.1.0.19
Console#– 73 –

Chapter 1 | Initial Switch Configuration
Setting the System Clock

Configuring NTP Requesting the time from a an NTP server is the most secure method. You canenable NTP authentication to ensure that reliable updates are received from only
authorized NTP servers. The authentication keys and their associated key number
must be centrally managed and manually distributed to NTP servers and clients.
The key numbers and key values must match on both the server and client.
When more than one time server is configured, the client will poll all of the time
servers, and compare the responses to determine the most reliable and accurate
time update for the switch.
To configure NTP time synchronization, enter commands similar to the following.
Console(config)#ntp client
Console(config)#ntp authentication-key 45 md5 thisiskey45
Console(config)#ntp authenticate
Console(config)#ntp server 192.168.3.20
Console(config)#ntp server 192.168.3.21
Console(config)#ntp server 192.168.5.23 key 19
Console(config)#exit
Console#show ntp
Current Time: Apr 29 13:57:32 2011
Polling: 1024 seconds
Current Mode
: unicastNTP Status: Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server: 192.168.0.88
Port: 123
Last Update Time
: Mar 12 02:41:01 2013 UTC
NTP Server 192.168.0.88 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.4.22 version 3 key 19
NTP Authentication Key 19 md5 42V68751663T6K11P2J307210R885
Current Time: Apr 2 16:28:34 2013
Polling: 1024 seconds
Current Mode
: unicastNTP Status: Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server: 192.168.5.23
Port: 0Last Update Time: Apr 2 16:00:00 2013 UTC
NTP Server 192.168.3.20 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.5.23 version 3 key 19
NTP Authentication Key 45 md5 2662T75S5658RU5424180034777
Console#– 74 –

Section II
Command Line Interface
This section provides a detailed description of the Command Line Interface, alongwith examples for all of the commands.
This section includes these chapters:
 “Using the Command Line Interface” on page 77
 “General Commands” on page 89
 “System Management Commands” on page 97
 “SNMP Commands” on page 191
 “Remote Monitoring Commands” on page 217
 “Flow Sampling Commands” on page 225
 “Authentication Commands” on page 231
 “General Security Measures” on page 301
 “Access Control Lists” on page 387
 “Interface Commands” on page 413
 “Link Aggregation Commands” on page 447
 “Power over Ethernet Commands” on page 467
 “Port Mirroring Commands” on page 473
 “Congestion Control Commands” on page 483
 “Loopback Detection Commands” on page 501
 “UniDirectional Link Detection Commands” on page 507– 75 –

Section II | Command Line Interface

 “Address Table Commands” on page 515
 “TWAMP Commands” on page 529
 “Spanning Tree Commands” on page 531
 “VLAN Commands” on page 563
 “ERPS Commands” on page 615
 “Class of Service Commands” on page 649
 “Quality of Service Commands” on page 665
 “Control Plane Commands” on page 683
 “Multicast Filtering Commands” on page 687
 “LLDP Commands” on page 799
 “CFM Commands” on page 825
 “OAM Commands” on page 867
 “Domain Name Service Commands” on page 879
 “DHCP Commands” on page 889
 “IP Interface Commands” on page 921
 “IP Routing Commands” on page 979– 76 –

2

Using the Command LineInterfaceThis chapter describes how to use the Command Line Interface (CLI).

Accessing the CLI
When accessing the management interface for the switch over a direct connection
to the server’s console port, or via a Telnet or Secure Shell connection (SSH), theswitch can be managed by entering command keywords and parameters at the
prompt. Using the switch's command-line interface (CLI) is very similar to enteringcommands on a UNIX system.

Console Connection To access the switch through the console port, perform these steps:
1. At the console prompt, enter the user name and password. (The default usernames are “admin” and “guest” with corresponding passwords of “admin” and“guest.”) When the administrator user name and password is entered, the CLI
displays the “Console#” prompt and enters privileged access mode
(i.e., Privileged Exec). But when the guest user name and password is entered,
the CLI displays the “Console>” prompt and enters normal access mode
(i.e., Normal Exec).

2. Enter the necessary commands to complete your desired tasks.
3. When finished, exit the session with the “quit” or “exit” command.
After connecting to the system through the console port, the login screen displays:
User Access Verification
Username: admin
Password:
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Console#– 77 –

Chapter 2 | Using the Command Line Interface
Accessing the CLI

Telnet Connection Telnet operates over the IP transport protocol. In this environment, yourmanagement station and any network device you want to manage over the
network must have a valid IP address. Valid IP addresses consist of four numbers, 0
to 255, separated by periods. Each address consists of a network portion and hostportion. For example, the IP address assigned to this switch, 10.1.0.1, consists of a
network portion (10.1.0) and a host portion (1).
Note: An IPv4 address for the primary network interface (VLAN 1) is set to an initial
192.168.2.10 by default.
To access the switch through a Telnet session, you must first set the IP address for
the Master unit, and set the default gateway if you are managing the switch from adifferent IP subnet. For example,
Console(config)#interface vlan 1
Console(config-if)#ip address 10.1.0.254 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 10.1.0.254
Console(config)#

If your corporate network is connected to another network outside your office or to
the Internet, you need to apply for a registered IP address. However, if you areattached to an isolated network, then you can use any IP address that matches the
network segment to which you are attached.
After you configure the switch with an IP address, you can open a Telnet session by
performing these steps:

1. From the remote host, enter the Telnet command and the IP address or hostname of the device you want to access.

2. At the prompt, enter the user name and system password. The CLI will display

the “Vty-n#” prompt for the administrator to show that you are using privileged
access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you
are using normal access mode (i.e., Normal Exec), where n indicates the numberof the current Telnet session.

3. Enter the necessary commands to complete your desired tasks.
4. When finished, exit the session with the “quit” or “exit” command.
After entering the Telnet command, the login screen displays:
Username: admin
Password:
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].

– 78 –

Chapter 2 | Using the Command Line Interface

Entering Commands

Vty-1#

Note: You can open up to eight sessions to the device via Telnet or SSH.

Entering Commands
This section describes how to enter CLI commands.

Keywords and A CLI command is a series of keywords and arguments. Keywords identify a
Arguments command, and arguments specify configuration parameters. For example, in thecommand “show interfaces status ethernet 1/5,” show interfaces and status are
keywords, ethernet is an argument that specifies the interface type, and 1/5
specifies the unit/port.
You can enter commands as follows: To enter a simple command, enter the command keyword.
 To enter multiple commands, enter each command in the required order. For

example, to enable Privileged Exec command mode, and display the startup
configuration, enter the following commands. The default password “super” isused to change from Normal Exec to Privileged Exec mode:
Console>enable
Password:
Console#show startup-config

 To enter commands that require parameters, enter the required parameters

after the command keyword. For example, to set a password for theadministrator, enter:
Console(config)#username admin password 0 smith

Minimum The CLI will accept a minimum number of characters that uniquely identify aAbbreviation command. For example, the command “configure” can be entered as con. If an
entry is ambiguous, the system will prompt for further input.

Command If you terminate input with a Tab key, the CLI will print the remaining characters of aCompletion partial keyword up to the point of ambiguity. In the “logging history” example,
typing log followed by a tab will result in printing the command up to “logging.”– 79 –

Chapter 2 | Using the Command Line Interface
Entering Commands

Getting Help You can display a brief description of the help system by entering the help
on Commands command. You can also display command syntax by using the “?” character to list
keywords or parameters.

Showing Commands
If you enter a “?” at the command prompt, the system will display the first level of
keywords or command groups. You can also display a list of valid keywords for a
specific command. For example, the command “show system ?” displays a list of
possible show commands:
Console#show ?
access-groupaccess-list
accounting
arp
authorization
auto-traffic-control
bannerbridge-ext
cable-diagnostics
calendarclass-map
clusterdebug
discarddns
dos-protection
dot1q-tunnel
dot1x
dying-gasp
efm
erps
garp
gvrp
history
hostsinterfaces
ip
ipv6
l2protocol-tunnel
lacp
line
lldp
log
loggingloop
loopback-detection
mac
mac-address-table
mac-vlanmanagement
memorymlag
mvr
network-access
nlm
ntp
policy-map
port
port-channel

Access groups
Access lists
Uses the specified accounting list
Information of ARP cache
Information of authorization
Auto traffic control information
Banner info
Bridge extension information
Shows the information of cable diagnostics
Date and time information
Displays class maps
Display cluster
State of each debugging option
Discard packet
DNS information
Shows the system dos-protection summary information
dot1q-tunnel
802.1X content
Dying gasp information
Ethernet First Mile feature
Displays ERPS configuration
GARP properties
GVRP interface information
Shows history information
Host information
Shows interface information
IP information
IPv6 information
Layer 2 protocol tunneling configuration
LACP statistics
TTY line information
LLDP
Log records
Logging settingShows the information of loopback
Shows loopback detection information
MAC access list
Configuration of the address table
MAC-based VLAN information
Shows management information
Memory utilization
Displays MLAG information
multicast vlan registration
Shows the entries of the secure port.
Show notification log
Network Time Protocol configuration
Displays policy maps
Port characteristics
Port channel information– 80 –

Chapter 2 | Using the Command Line Interface

Entering Commands

power
power-save
pppoe
privilege
process
protocol-vlan
public-key
qos
queue
radius-server
reloadrmon
rspan
running-config
sflow
smart-pair
snmp

Shows powerShows the power saving information
Displays PPPoE configuration
Shows current privilege level
Device process
Protocol-VLAN information
Public key information
Quality of Service
Priority queue information
RADIUS server information
Shows the reload settings
Remote monitoring information
Display status of the current RSPAN configuration
Information on the running configuration
Shows the sflow information
Displays backup port information
Simple Network Management Protocol configuration andstatistics
snmp-server
Displays SNMP server configuration
sntp
Simple Network Time Protocol configuration
spanning-tree
Spanning-tree configuration
ssh
Secure shell server connections
startup-config
Startup system configuration
subnet-vlan
IP subnet-based VLAN information
systemSystem information
tacacs-server
TACACS server information
tech-support
Technical information
time-range
Time range
traffic-segmentation Traffic segmentation information
twamp
TWAMP configuration, statistics and session information
udld
Displays UDLD information
upgradeShows upgrade information
users
Information about users logged inversion
System hardware and software versions
vlan
Shows virtual LAN settingsvlan-translation
VLAN translation information
voice
Shows the voice VLAN information
watchdog
Displays watchdog status
web-auth
Shows web authentication configuration
Console#show

The command “show interfaces ?” will display the following information:
Console#show interfaces ?
briefShows brief interface description
counters
Interface counters information
history
Historical sample of interface counters information
protocol-vlan
Protocol-VLAN information
statusShows interface status
switchport
Shows interface switchport informationtransceiverInterface of transceiver informationtransceiver-threshold Interface of transceiver-threshold information
Console#– 81 –

Chapter 2 | Using the Command Line Interface
Entering Commands
Show commands which display more than one page of information (e.g., showrunning-config) pause and require you to press the [Space] bar to continue
displaying one more page, the [Enter] key to display one more line, or the [a] key todisplay the rest of the information without stopping. You can press any other key toterminate the display.

Partial Keyword If you terminate a partial keyword with a question mark, alternatives that match the
Lookup initial letters are provided. (Remember not to leave a space between the commandand question mark.) For example “s?” shows all the keywords starting with “s.”Console#show s?
sflow
smart-pairspanning-tree
Console#show s

ssh

snmp

snmp-server

sntp

startup-config

subnet-vlan

systemNegating the Effect of For many configuration commands you can enter the prefix keyword “no” to cancel
Commands the effect of a command or reset the configuration to the default value. For
example, the logging command will log system messages to a host server. To
disable logging, specify the no logging command. This guide describes thenegation effect for all applicable commands.

Using Command The CLI maintains a history of commands that have been entered. You can scroll
History back through the history of commands by pressing the up arrow key. Anycommand displayed in the history list can be executed again, or first modified andthen executed.
Using the show history command displays a longer list of recently executedcommands.

Understanding The command set is divided into Exec and Configuration classes. Exec commands
Command Modes generally display information on system status or clear statistical counters.

Configuration commands, on the other hand, modify interface parameters or
enable certain switching functions. These classes are further divided into different
modes. Available commands depend on the selected mode. You can always enter aquestion mark “?” at the prompt to display a list of the commands available for thecurrent mode. The command classes and associated modes are displayed in thefollowing table:– 82 –

Chapter 2 | Using the Command Line Interface

Entering Commands

Table 4: General Command Modes
Class

Mode

Exec

NormalPrivileged

Configuration

Global*Access Control List
Class Map
DHCP
IGMP Profile
InterfaceLine
Multiple Spanning Tree
Policy Map
Time Range
VLAN Database* You must be in Privileged Exec mode to access the Global configuration mode.
You must be in Global Configuration mode to access any of the other configuration modes.

Exec Commands When you open a new console session on the switch with the user name andpassword “guest,” the system enters the Normal Exec command mode (or guestmode), displaying the “Console>” command prompt. Only a limited number of thecommands are available in this mode. You can access all commands only from thePrivileged Exec command mode (or administrator mode). To access Privilege Execmode, open a new console session with the user name and password “admin.” Thesystem will now display the “Console#” command prompt. You can also enter
Privileged Exec mode from within Normal Exec mode, by entering the enablecommand, followed by the privileged level password “super.”
To enter Privileged Exec mode, enter the following user names and passwords:
Username: admin
Password: [admin login password]
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Console#Username: guest
Password: [guest login password]
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Console>enable
Password: [privileged level password]
Console#– 83 –

Chapter 2 | Using the Command Line Interface
Entering Commands

Configuration Configuration commands are privileged level commands used to modify switch
Commands settings. These commands modify the running configuration only and are notsaved when the switch is rebooted. To store the running configuration in nonvolatile storage, use the copy running-config startup-config command.

The configuration commands are organized into different modes: Global Configuration - These commands modify the system level configuration,and include commands such as hostname and snmp-server community.

 Access Control List Configuration - These commands are used for packet

filtering.

 Class Map Configuration - Creates a DiffServ class map for a specified traffictype.

 DHCP Configuration - These commands are used to configure the DHCP server.
 IGMP Profile - Sets a profile group and enters IGMP filter profile configurationmode.

 Interface Configuration - These commands modify the port configuration suchas speed-duplex and negotiation.

 Line Configuration - These commands modify the console port and Telnet

configuration, and include command such as parity and databits.

 Multiple Spanning Tree Configuration - These commands configure settings forthe selected multiple spanning tree instance.

 Policy Map Configuration - Creates a DiffServ policy map for multiple interfaces.
 Time Range - Sets a time range for use by other functions, such as AccessControl Lists.

 VLAN Configuration - Includes the command to create VLAN groups.

To enter the Global Configuration mode, enter the command configure in
Privileged Exec mode. The system prompt will change to “Console(config)#” which
gives you access privilege to all Global Configuration commands.
Console#configure
Console(config)#– 84 –

Chapter 2 | Using the Command Line Interface

Entering Commands

To enter the other modes, at the configuration prompt type one of the following
commands. Use the exit or end command to return to the Privileged Exec mode.
Table 5: Configuration Command Modes
Mode

CommandPromptPage

Access Control access-list arp
List
access-list ip standard
access-list ip extended
access-list ipv6 standard
access-list ipv6 extended
access-list mac

Console(config-arp-acl)
Console(config-std-acl)
Console(config-ext-acl)
Console(config-std-ipv6-acl)
Console(config-ext-ipv6-acl)
Console(config-mac-acl)

406
388
388
394
394
400

Class Map

class-map

Console(config-cmap)

666

Interfaceinterface {ethernet port | port-channel id | Console(config-if )vlan id}

415

Line

line {console | vty}

Console(config-line)

141

MSTP

spanning-tree mst-configuration

Console(config-mstp)

537

Policy Map

policy-map

Console(config-pmap)

670

Control Plane

control-plane

Console(config-cp)

683

Time Range

time-range

Console(config-time-range)

180

VLAN

vlan database

Console(config-vlan)

570

For example, you can use the following commands to enter interface configurationmode, and then return to Privileged Exec mode
Console(config)#interface ethernet 1/5.
.
.
Console(config-if)#exit
Console(config)#

Command Line Commands are not case sensitive. You can abbreviate commands and parameters
Processing as long as they contain enough letters to differentiate them from any othercurrently available commands or parameters. You can use the Tab key to complete
partial commands, or enter a partial command followed by the “?” character todisplay a list of possible matches. You can also use the following editing keystrokes
for command-line processing:Table 6: Keystroke Commands
Keystroke

Function

Ctrl-A

Shifts cursor to start of command line.

Ctrl-B

Shifts cursor to the left one character.

Ctrl-C

Terminates the current task and displays the command prompt.

Ctrl-E

Shifts cursor to end of command line.

– 85 –

Chapter 2 | Using the Command Line Interface
Entering Commands
Table 6: Keystroke Commands (Continued)
Keystroke

Function

Ctrl-F

Shifts cursor to the right one character.

Ctrl-K

Deletes all characters from the cursor to the end of the line.

Ctrl-L

Repeats current command line on a new line.

Ctrl-NEnters the next command line in the history buffer.

Ctrl-PEnters the last command.

Ctrl-R

Repeats current command line on a new line.

Ctrl-U

Deletes from the cursor to the beginning of the line.

Ctrl-W

Deletes the last word typed.

Esc-B

Moves the cursor back one word.

Esc-D

Deletes from the cursor to the end of the word.

Esc-F

Moves the cursor forward one word.

Delete key orbackspace key

Erases a mistake when entering a command.

Showing Status There are various “show” commands which display configuration settings or the
Information status of specified processes. Many of these commands will not display any
information unless the switch is properly configured, and in some cases theinterface to which a command applies is up.

For example, if a static router port is configured, the corresponding show command
will not display any information unless IGMP snooping is enabled, and the link forthe static router port is up.
Console#configure
Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11
Console(config)#end
Console#show ip igmp snooping mrouter
VLAN M'cast Router Ports Type---- ------------------- ------Console#configure
Console(config)#ip igmp snooping
Console(config)#end
Console#show ip igmp snooping mrouter
VLAN M'cast Router Ports Type---- ------------------- ------1
Eth 1/11
StaticConsole#– 86 –

Chapter 2 | Using the Command Line Interface
CLI Command Groups

CLI Command Groups
The system commands can be broken down into the functional groups shown
below.
Table 7: Command Group Index
Command Group

Description

Page

General

Basic commands for entering privileged access mode,
restarting the system, or quitting the CLI

89

System Management

Display and setting of system information, basic modes of97
operation, maximum frame size, file management, console
port and telnet settings, system logs, SMTP alerts, the system
clock, and switch clustering

Simple Network
Management Protocol

Activates authentication failure traps; configures community 191
access strings, and trap receivers

Remote Monitoring

Supports statistics, history, alarm and event groups

217

Flow Sampling

Used with a remote sFlow Collector to provide an accurate,detailed and real-time overview of the types and levels of
traffic present on the network

225

User Authentication

Configures user names and passwords, command privilege
levels, logon access using local or remote authentication,
management access through the web server, Telnet serverand Secure Shell; as well as port security, IEEE 802.1X port
access control, and restricted access based on specified IP
addresses

231

General Security Measures

Segregates traffic for clients attached to common data ports; 301
and prevents unauthorized access by configuring valid staticor dynamic addresses, MAC address authentication, filtering
DHCP requests and replies, and discarding invalid ARP
responses

Access Control List

Provides filtering for IPv4 frames (based on address, protocol, 387
TCP/UDP port number or TCP control code), IPv6 frames(based on address, DSCP traffic class, or next header), or nonIP frames (based on MAC address or Ethernet type)Interface

Configures the connection parameters for all Ethernet ports,
aggregated links, and VLANs

413

Link Aggregation

Statically groups multiple ports into a single logical trunk;configures Link Aggregation Control Protocol for port trunks

447

Power over Ethernet*

Configures power output for connected devices

467

Mirror Port

Mirrors data to another port for analysis without affecting the 473
data passing through or the performance of the monitored
port

Congestion Control

Sets the input/output rate limits, traffic storm thresholds, and 483
thresholds for broadcast and multicast storms which can beused to trigger configured rate limits or to shut down a port.

Loopback Detection

Detects general loopback conditions caused by hardware
problems or faulty protocol settings

Address Table

Configures the address table for filtering specified addresses, 515
displays current entries, clears the table, or sets the aging time

Spanning Tree

Configures Spanning Tree settings for the switch– 87 –

501

531

Chapter 2 | Using the Command Line Interface
CLI Command Groups
Table 7: Command Group Index (Continued)
Command Group

Description

Page

ERPS

Configures Ethernet Ring Protection Switching for increased
availability of Ethernet rings commonly used in service
provider networks

615

VLANs

Configures VLAN settings, and defines port membership for
VLAN groups; also enables or configures private VLANs,
protocol VLANs, voice VLANs, and QinQ tunneling

563

Class of Service

Sets port priority for untagged frames, selects strict priority or 649
weighted round robin, relative weight for each priority queue,
also sets priority for DSCP

Quality of Service

Configures Differentiated Services

665

Control Plane

Configures a QoS policy for the control-plane interface

683

Multicast Filtering

Configures IGMP multicast filtering, query, profile, and proxy 687
parameters; specifies ports attached to a multicast router; also
configures multicast VLAN registration, and IPv6 MLD
snooping

Link Layer Discovery
ProtocolConfigures LLDP settings to enable information discovery
about neighbor devices

Connectivity Fault
Management

Configures connectivity monitoring using continuity check825
messages, fault verification through loopback messages, andfault isolation by examining end-to-end connections
between Provider or Customer Edge devices

OAM

Configures Operations, Administration and Maintenance867
remote management tools required to monitor and maintainthe links to subscriber CPEs

Domain Name Service

Configures DNS services.

879

Dynamic Host
Configuration Protocol

Configures DHCP client, relay and server functions

889

IP Interface

Configures IP address for the switch interfaces; also
configures ARP parameters

921

IP Routing

Configures static and dynamic unicast routing

979

799

* ECS4150-28P and ECS4150-54P

The access mode shown in the following tables is indicated by these abbreviations:
ACL (Access Control List Configuration)
CM (Class Map Configuration)
CP (Control Plane Interface Configuration)
ERPS (Ethernet Ring Protection Switching Configuration)
GC (Global Configuration)
IC (Interface Configuration)
IPC (IGMP Profile Configuration)
LC (Line Configuration)
MST (Multiple Spanning Tree)NE (Normal Exec)
PE (Privileged Exec)
PM (Policy Map Configuration)
VC (VLAN Database Configuration)– 88 –

3

General Commands

The general commands are used to control the command access mode,
configuration mode, and other basic functions.
Table 8: General Commands
CommandFunctionModepromptCustomizes the CLI prompt

GC

reloadRestarts the system at a specified time, after a specified delay, or at a GC
periodic interval

enableActivates privileged mode

NE

quit

Exits a CLI session

NE, PEshow history

Shows the command history buffer

NE, PEconfigure

Activates global configuration modePEdisableReturns to normal mode from privileged modePE

reloadRestarts the system immediately

PEshow reload

Displays the current reload settings, and the time at which nextscheduled reload will take place

PE

end

Returns to Privileged Exec modeany config.
mode

exit

Returns to the previous configuration mode, or exits the CLI

any mode

prompt This command customizes the CLI prompt. Use the no form to restore the default
prompt.
Syntaxprompt string
no prompt
string - Any alphanumeric string to use for the CLI prompt.
(Maximum length: 32 characters)
Default Setting
ConsoleCommand Mode
Global Configuration– 89 –

Chapter 3 | General Commands

Command Usage
This command can be used to set the command line prompt as shown in theexample below. Using the no form of either command will restore the default
command line prompt.
ExampleConsole(config)#prompt RD2
RD2(config)#

reload This command restarts the system at a specified time, after a specified delay, or at a

(Global Configuration) periodic interval. You can reboot the system immediately, or you can configure theswitch to reset after a specified amount of time. Use the cancel option to remove a
configured setting.
Syntaxreload {at hour minute [{month day | day month} [year]] |in {hour hours | minute minutes | hour hours minute minutes} |regulary hour minute [period {daily | weekly day-of-week |monthly day-of-month}] | cancel [at | in | regulary]}
reload at - A specified time at which to reload the switch.
hour - The hour at which to reload. (Range: 0-23)
minute - The minute at which to reload. (Range: 0-59)
month - The month at which to reload. (january ... december)day - The day of the month at which to reload. (Range: 1-31)
year - The year at which to reload. (Range: 1970-2037)
reload in - An interval after which to reload the switch.
hours - The number of hours, combined with the minutes, before theswitch resets. (Range: 0-576)
minutes - The number of minutes, combined with the hours, before theswitch resets. (Range: 0-34560)
reload regulary - A periodic interval at which to reload the switch.
hour - The hour at which to reload. (Range: 0-23)
minute - The minute at which to reload. (Range: 0-59)
day-of-week - Day of the week at which to reload.
(Range: monday ... saturday)
day-of-month - Day of the month at which to reload. (Range: 1-31)
reload cancel - Cancels the specified reload option.
Default SettingNone– 90 –

Chapter 3 | General Commands

Command Mode
Privileged Exec, Global Configuration
Command Usage This command resets the entire system.
 Any combination of reload options may be specified. If the same option is re-specified, the previous setting will be overwritten.

 When the system is restarted, it will always run the Power-On Self-Test. It will

also retain all configuration information stored in non-volatile memory by the
copy running-config startup-config command (See “copy” on page 129).

ExampleThis example shows how to reset the switch after 30 minutes:
Console(config)#reload in minute 30****** --- Rebooting at January 1 02:10:43 2016 --***Are you sure to reboot the system at the specified time? <y/n>enable This command activates Privileged Exec mode. In privileged mode, additionalcommands are available, and certain commands display additional information.
See “Understanding Command Modes” on page 82.
Syntaxenable [level]
level - Privilege level to log into the device.
The device has two predefined privilege levels: 0: Normal Exec,
15: Privileged Exec. Enter level 15 to access Privileged Exec mode.
Default Setting
Level 15
Command Mode
Normal Exec
Command Usage “super” is the default password required to change the command mode from
Normal Exec to Privileged Exec. (To set this password, see the enable password
command.) The “#” character is appended to the end of the prompt to indicate that thesystem is in privileged access mode.

– 91 –

Chapter 3 | General Commands

ExampleConsole>enable
Password: [privileged level password]
Console#Related Commands
disable (94)enable password (232)quit This command exits the configuration program.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
The quit and exit commands can both exit the configuration program.
ExampleThis example shows how to quit a CLI session:
Console#quit
Press ENTER to start session
User Access Verification
Username:show history This command shows the contents of the command history buffer.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
The history buffer size is fixed at 10 Execution commands and 10 Configurationcommands.

– 92 –

Chapter 3 | General Commands

ExampleIn this example, the show history command lists the contents of the command
history buffer:
Console#show history
Execution command history:
2 config
1 show history
Configuration command history:
4 interface vlan 1
3 exit2 interface vlan 1
1 end
Console#The ! command repeats commands from the Execution command history bufferwhen you are in Normal Exec or Privileged Exec Mode, and commands from theConfiguration command history buffer when you are in any of the configuration
modes. In this example, the !2 command repeats the second command in the
Execution history buffer (config).
Console#!2
Console#config
Console(config)#

configure This command activates Global Configuration mode. You must enter this mode tomodify any settings on the switch. You must also enter Global Configuration modeprior to enabling some of the other configuration modes, such as Interface
Configuration, Line Configuration, and VLAN Database Configuration. See“Understanding Command Modes” on page 82.
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#configure
Console(config)#

Related Commandsend (95)– 93 –

Chapter 3 | General Commands

disable This command returns to Normal Exec mode from privileged mode. In normal

access mode, you can only display basic information on the switch's configuration
or Ethernet statistics. To gain access to all commands, you must use the privileged
mode. See “Understanding Command Modes” on page 82.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
The “>” character is appended to the end of the prompt to indicate that the system
is in normal access mode.
ExampleConsole#disable
Console>Related Commands
enable (91)

reload (Privileged Exec) This command restarts the system.
Note: When the system is restarted, it will always run the Power-On Self-Test. It will
also retain all configuration information stored in non-volatile memory by the copy
running-config startup-config command.

Default Setting
None
Command Mode
Privileged Exec
Command Usage
This command resets the entire system.
ExampleThis example shows how to reset the switch:
Console#reload
System will be restarted, continue <y/n>? y– 94 –

Chapter 3 | General Commands

show reload This command displays the current reload settings, and the time at which nextscheduled reload will take place.
Command Mode
Privileged Exec
ExampleConsole#show reload
Reloading switch in time:

0 hours 29 minutes.

The switch will be rebooted at January 1 02:11:50 2015.
Remaining Time: 0 days, 0 hours, 29 minutes, 52 seconds.
Console#end This command returns to Privileged Exec mode.
Default Setting
None
Command Mode
Global Configuration, Interface Configuration, Line Configuration, VLAN Database
Configuration, and Multiple Spanning Tree Configuration.
ExampleThis example shows how to return to the Privileged Exec mode from the Interface
Configuration mode:
Console(config-if)#end
Console#exit This command returns to the previous configuration mode or exits theconfiguration program.
Default Setting
None
Command ModeAny

– 95 –

Chapter 3 | General Commands

ExampleThis example shows how to return to the Privileged Exec mode from the Global
Configuration mode, and then quit the CLI session:
Console(config)#exit
Console#exit
Press ENTER to start session
User Access Verification
Username:– 96 –

4

System Management
Commands
The system management commands are used to control system logs, passwords,
user names, management options, and display or configure a variety of othersystem information.
Table 9: System Management Commands
Command Group

Function

Cloud Management

Configures the switch for management from the ecCLOUD system

Device Designation

Configures information that uniquely identifies this switch

Banner Information

Configures administrative contact, device identification and location

System Status

Displays system configuration, active managers, and version
information

Fan Control

Forces fans to full speed

Frame Size

Enables support for jumbo framesFile Management

Manages code image or switch configuration files

Line

Sets communication parameters for the serial port, including baud rateand console time-out

Event Logging

Controls logging of error messages

SMTP Alerts

Configures SMTP email alerts

Time (System Clock)Sets the system clock automatically via NTP/SNTP server or manuallyTime Range

Sets a time range for use by other functions, such as Access Control Lists

Switch Clustering

Configures management of multiple devices via a single IP address

Dying Gasp

Configures dying gasp messages when the device looses power– 97 –

Chapter 4 | System Management Commands
Cloud Management

Cloud Management
This section describes commands used to configure the cloud management agent
on the switch for management through ecCLOUD.
Table 10: Cloud Management Commands
CommandFunction

Mode

mgmt

Enables or disables cloud management for the switchGC

mgmt loglevel

Sets the minimum level for logging messages

GC

mgmt setoption

Sets various options for the cloud management agent

GC

mgmt property

Sets cloud management settings to default values

GC

mgmt upgradeUpgrades the cloud management agent code on theswitchPEshow mgmt status

Displays the cloud management agent statusPE

show mgmt version

Displays the cloud management agent code version

PEshow mgmt log

Displays log messages from the cloud management agent PE

show mgmt option

Displays the cloud management agent configuration
optionsPE

mgmt This command enables or disables the cloud management agent for the switch.
Syntaxmgmt {enable | disable}
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Setting the cloud management agent to enabled allows the switch to be
managed through the ecCLOUD system after the next reboot. By default, thecloud management agent is disabled.
 After setting the cloud management agent to enabled or disabled, it requires areboot of the switch to take effect.

ExampleConsole(config)#mgmt enable
Console(config)#– 98 –

Chapter 4 | System Management Commands

Cloud Management

mgmt loglevel This command sets the minimum level for cloud management agent logging
messages. Use the no form to reset to the default level.
Syntaxmgmt loglevel levelno mgmt loglevel
level - The minimum logging level. (Options: trace, debug, info, warn, error)
Default Setting
InfoCommand Mode
Global Configuration
Command Usage The logging levels from minimum severity to maximum severity are: Trace,
Debug, Info, Warn, Error.
 This command configures messages logged by the cloud management agent

based on severity. Messages from the configured level up to the maximum
level are logged. Therefore, if Info is the configured level, all messages for Info,
Warn, and Error are logged.

ExampleConsole(config)#mgmt loglevel info
Console(config)#

mgmt setoption This command sets options for the cloud management agent. Use the no form todelete the specified option.
Syntaxmgmt setoption option
no mgmt setoption option
option - The option to set in the format “option name=value”.
Default Setting
None
Command Mode
Global Configuration
Command Usage This command configures cloud management agent settings that are used incommunications between the switch and the ecCLOUD controller.
– 99 –

Chapter 4 | System Management Commands
Cloud Management
 The following table lists all the cloud management agent options.

Table 11: Cloud Management Agent Options
Name

Type

Required

Default

Notes

acn.settings.latitudedecimalno0

Latitude of device.

acn.settings.longitudedecimalno0

Longitude of device.

acn.settings.namestringyes“IgniteNet”(depends on brand)

Device’s name used with the controller.

acn.mgmt.enabledbooleanno0

Whether or not to enable mgmtd agent. Used byexternal process which runs the actual mgmtd.

acn.mgmt.loglevel

stringno“info”

Various logging levels for mgmtd. Possible
values in lowering order: error, warn, info, debug,trace.

acn.mgmt.hb_interval

int

no

60

Heartbeat message sending interval.

acn.mgmt.hb_ack_timeout

int

no

57

Heartbeat acknowledgement timeout (toconsider connection problem is present)

acn.mgmt.hb_retry_count

int

no

3

How many times to try and send a heartbeat
without a received acknowledgment.

acn.mgmt.status_interval

int

no

300

How often to send events/client data/etc.

acn.mgmt.status_min_offset

int

no

0

Minimum time delay value for randomized offset
for sending first status message.

acn.mgmt.status_max_offset

int

no

60

Maximum time delay value for randomized
offset for sending first status message.

acn.mgmt.response_repetitions

int

no

120

How many response repetitions to send to theController (for live data, like graphs).

acn.mgmt.response_interval

int

no

3

Interval between subsequent repetitions.

acn.mgmt.fw_update_interval

int

no

5

Firmware update delay after receiving
appropriate task.

acn.mgmt.fw_download_retries

int

no

10

Count of firmware download retries.

acn.mgmt.mac_tbl_interval

int

no

300

How often to send the MAC address table.

acn.mgmt.registration_inverval

int

no

60

Interval between registration attempts (if fails).

acn.mgmt.restart_interval

int

no

86400

(Temporary) interval between mgmtd restarts tofree leaked memory.

acn.mgmt.task_expiry_interval

int

no

3600

Interval to check for expired tasks.

acn.mgmt.task_expiry_time

int

no

86400

Time after which task is considered to be
expired.

acn.mgmt.acn.register.port

CS listno5222,443

Can contain multiple port values: 5222,443 forexample. When more ports are present, mgmtd
on first connection failure retries with the next
port in the list.

acn.mgmt.os_time_tolerance

int

no

240

Maximum time difference between device OStime and cloud time to tolerate. If difference isbigger, mgmtd sets OS time to the controller'svalue.

acn.mgmt.dev_ca_off

int

no

0

Set this value to 1 to bypass SSL certificatescheck against registration service and XMPP
server. Not to be used outside development
scope.

acn.register.statebooleanyes

0Registration state: 0 = unreg, 1 = registered– 100 –

Chapter 4 | System Management Commands

Cloud Management

Table 11: Cloud Management Agent Options (Continued)
Name

Type

Required

Default

Notes

acn.register.url

stringyes

https://regsvc.igniten Registration URL.
et.com/registeracn.register.login

stringdepends(empty)This is the xmpp username - it will ONLY be set
after a successful registration.

acn.register.pass

stringdepends(empty)This is the xmpp password - it will ONLY be set
after a successful registration.

acn.register.hoststringdepends(empty)This is the xmpp server - it will ONLY be set after
a successful registration.

ExampleConsole(config)#mgmt setoption acn.mgmt.status_interval=600
Console(config)#

mgmt property This command sets the cloud management agent properties to their default values.
Syntaxmgmt property default
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#mgmt property default
Console(config)#

mgmt upgrade This command upgrades the cloud management agent software from a file on a
TFTP server.
Syntaxmgmt upgrade {file-url}
file-url - The path to a tar.gz archive file on a TFTP server in the format:
tftp://<ip>/<folder>/<file>
Default Setting
None
Command Mode
Privileged Exec– 101 –

Chapter 4 | System Management Commands
Cloud Management
Command Usage
The upgrade software file must be contained in a tar.gz archive file and include an
MD5 checksum.
ExampleConsole#mgmt upgrade tftp://192.168.1.9/download/mgmt.tar.gz
Console#show mgmt status This command displays the status of the cloud management agent.
Syntaxshow mgmt status
Command Mode
Privileged Exec
ExampleConsole#show mgmt status
Console#show mgmt version This command displays the version of the cloud management agent.
Syntaxshow mgmt version
Command Mode
Privileged Exec
ExampleConsole#show mgmt version
Mgmtd version: 1.4.3-16868
Console#show mgmt log This command displays the cloud management agent log messages.
Syntaxshow mgmt log
Command Mode
Privileged Exec– 102 –

Chapter 4 | System Management Commands

Cloud Management

ExampleConsole#show mgmt log
Mgmtd log:
2020-10-26 10:19:38 [info]: calling arg: result: true; nil
2020-10-26 10:19:38 [info]: Starting mgmtd
2020-10-26 10:19:38 [info]: No default route, but uptime: 3907
2020-10-26 10:19:39 [info]: flash read
2020-10-26 10:19:39 [info]: Starting registration process
2020-10-26 10:19:39 [info]: mgmtd status set to UNREGISTERED
2020-10-26 10:19:39 [info]: Sending registration request
2020-10-26 10:19:39 [info]: HTTPS: nil, host or service not provided, or not
known, nil, nil
2020-10-26 10:19:39 [info]: mgmtd status set to REG_FAILED
2020-10-26 10:19:39 [error]: Error: Unable to contact registration service!
(Empty response)
Console#show mgmt option This command displays the cloud management agent options.
Syntaxshow mgmt option
Command Mode
Privileged Exec
ExampleConsole#show mgmt option
Mgmtd Option:acn.mgmt=acn
acn.mgmt.loglevel=info
acn.mgmt.enabled=0
acn.register=registeracn.register.state=0
acn.register.url=https://regsvc.ignitenet.com/registeracn.settings.longitude=0
acn.settings.latitude=0
acn.settings.name=IgniteNet-Switch
Console#– 103 –

Chapter 4 | System Management Commands
Device Designation

Device Designation
This section describes commands used to configure information that uniquely
identifies the switch.
Table 12: Device Designation Commands
CommandFunctionModehostname

Specifies the host name for the switchGC

snmp-server contact

Sets the system contact stringGC

snmp-server location

Sets the system location stringGC

hostname This command specifies or modifies the host name for this device. Use the no form
to restore the default host name.
Syntaxhostname nameno hostname
name - The name of this host. (Maximum length: 255 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage The host name specified by this command is displayed by the show systemcommand and on the Show > System web page.

ExampleConsole(config)#hostname RD#1
Console(config)#– 104 –

Chapter 4 | System Management Commands

Banner Information

Banner Information
These commands are used to configure and manage administrative information
about the switch, its exact data center location, details of the electrical and network
circuits that supply the switch, as well as contact information for the network
administrator and system manager. This information is only available via the CLI
and is automatically displayed before login as soon as a console or telnet
connection has been established.
Table 13: Banner Commands
CommandFunctionModebanner configure

Configures the banner information that is displayed before GC
loginbanner configure company Configures the Company information that is displayed bybannerGCbanner configure
dc-power-info

Configures the DC Power information that is displayed bybannerGCbanner configure
department

Configures the Department information that is displayedby bannerGCbanner configure
equipment-info

Configures the Equipment information that is displayed by GC
bannerbanner configure
equipment-location

Configures the Equipment Location information that isdisplayed by banner

banner configure ip-lan

Configures the IP and LAN information that is displayed by GC
bannerbanner configure
lp-number

Configures the LP Number information that is displayed by GC
bannerGCbanner configure manager- Configures the Manager contact information that is
info
displayed by bannerGCbanner configure mux

Configures the MUX information that is displayed bybannerGCbanner configure note

Configures miscellaneous information that is displayed by GC
banner under the Notes headingshow banner

Displays all banner informationPEbanner configure This command is used to interactively specify administrative information for thisdevice.

Syntaxbanner configure
Default SettingNone– 105 –

Chapter 4 | System Management Commands
Banner Information
Command Mode
Global Configuration
Command Usage
The administrator can batch-input all details for the switch with one command.
When the administrator finishes typing the company name and presses the enter
key, the script prompts for the next piece of information, and so on, until all
information has been entered. Pressing enter without inputting information at any
prompt during the script’s operation will leave the field empty. Spaces can be usedduring script mode because pressing the enter key signifies the end of data input.
The delete and left-arrow keys terminate the script. The use of the backspace key
during script mode is not supported. If, for example, a mistake is made in thecompany name, it can be corrected with the banner configure company
command.
ExampleConsole(config)#banner configure
Company: Edgecore Networks
Responsible department: R&D Dept
Name and telephone to Contact the management people
Manager1 name: Sr. Network Admin
phone number: 123-555-1212
Manager2 name: Jr. Network Admin
phone number: 123-555-1213
Manager3 name: Night-shift Net Admin / Janitor
phone number: 123-555-1214
The physical location of the equipment.
City and street address: 12 Straight St. Motown, Zimbabwe
Information about this equipment:
Manufacturer: Edgecore Networks
ID: 123_unique_id_number
Floor: 2
Row: 7
Rack: 29
Shelf in this rack: 8
Information about DC power supply.
Floor: 2
Row: 7
Rack: 25
Electrical circuit: : ec-177743209-xb
Number of LP:12
Position of the equipment in the MUX:1/23
IP LAN:192.168.1.1
Note: This is a random note about this managed switch and can containmiscellaneous information.
Console(config)#– 106 –

Chapter 4 | System Management Commands

Banner Informationbanner configure This command is used to configure company information displayed in the banner.
company Use the no form to remove the company name from the banner display.
Syntaxbanner configure company nameno banner configure company
name - The name of the company. (Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure company commandinterprets spaces as data input boundaries. The use of underscores ( _ ) or otherunobtrusive non-letter characters is suggested for situations where white space isnecessary for clarity.
ExampleConsole(config)#banner configure company Big-Ben
Console(config)#banner configure This command is use to configure DC power information displayed in the banner.
dc-power-info Use the no form to restore the default setting.
Syntaxbanner configure dc-power-info floor floor-id row row-id rack rack-id
electrical-circuit ec-id
no banner configure dc-power-info [floor | row | rack | electrical-circuit]floor-id - The floor number.
row-id - The row number.
rack-id - The rack number.
ec-id - The electrical circuit ID.
Maximum length of each parameter: 32 characters
Default Setting
None
Command Mode
Global Configuration– 107 –

Chapter 4 | System Management Commands
Banner Information
Command Usage
Input strings cannot contain spaces. The banner configure dc-power-infocommand interprets spaces as data input boundaries. The use of underscores ( _ )or other unobtrusive non-letter characters is suggested for situations where whitespace is necessary for clarity.
ExampleConsole(config)#banner configure dc-power-info floor 3 row 15 rack 24
electrical-circuit 48v-id_3.15.24.2
Console(config)#banner configure This command is used to configure the department information displayed in thedepartment banner. Use the no form to restore the default setting.
Syntaxbanner configure department dept-nameno banner configure department
dept-name - The name of the department.
(Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure departmentcommand interprets spaces as data input boundaries. The use of underscores ( _ )or other unobtrusive non-letter characters is suggested for situations where whitespace is necessary for clarity.
ExampleConsole(config)#banner configure department R&D
Console(config)#– 108 –

Chapter 4 | System Management Commands

Banner Informationbanner configure This command is used to configure the equipment information displayed in theequipment-info banner. Use the no form to restore the default setting.
Syntaxbanner configure equipment-info manufacturer-id mfr-id floor floor-id
row row-id rack rack-id shelf-rack sr-id manufacturer mfr-nameno banner configure equipment-info [floor | manufacturer | manufacturerid | rack | row | shelf-rack]mfr-id - The name of the device model number.
floor-id - The floor number.
row-id - The row number.
rack-id - The rack number.
sr-id - The shelf number in the rack.
mfr-name - The name of the device manufacturer.
Maximum length of each parameter: 32 characters
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure equipment-infocommand interprets spaces as data input boundaries. The use of underscores ( _ )or other unobtrusive non-letter characters is suggested for situations where whitespace is necessary for clarity.
ExampleConsole(config)#banner configure equipment-info manufacturer-id ECS4150-28P
floor 3 row 10 rack 15 shelf-rack 12 manufacturer Edgecore
Console(config)#banner configure This command is used to configure the equipment location information displayed
equipment-location in the banner. Use the no form to restore the default setting.
Syntaxbanner configure equipment-location location
no banner configure equipment-location
location - The address location of the device.
(Maximum length: 32 characters)– 109 –

Chapter 4 | System Management Commands
Banner Information
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure equipment-locationcommand interprets spaces as data input boundaries. The use of underscores ( _ )or other unobtrusive non-letter characters is suggested for situations where whitespace is necessary for clarity.
ExampleConsole(config)#banner configure equipment-location
710_Network_Path,_Indianapolis
Console(config)#banner configure This command is used to configure the device IP address and subnet mask
ip-lan information displayed in the banner. Use the no form to restore the default setting.
Syntaxbanner configure ip-lan ip-mask
no banner configure ip-lan
ip-mask - The IP address and subnet mask of the device.
(Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure ip-lan commandinterprets spaces as data input boundaries. The use of underscores ( _ ) or otherunobtrusive non-letter characters is suggested for situations where white space isnecessary for clarity.
ExampleConsole(config)#banner configure ip-lan 192.168.1.1/255.255.255.0
Console(config)#– 110 –

Chapter 4 | System Management Commands

Banner Informationbanner configure This command is used to configure the LP number information displayed in the
lp-number banner. Use the no form to restore the default setting.
Syntaxbanner configure lp-number lp-num
no banner configure lp-number
lp-num - The LP number. (Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure lp-number commandinterprets spaces as data input boundaries. The use of underscores ( _ ) or otherunobtrusive non-letter characters is suggested for situations where white space isnecessary for clarity.
ExampleConsole(config)#banner configure lp-number 12
Console(config)#banner configure This command is used to configure the manager contact information displayed inmanager-info the banner. Use the no form to restore the default setting.
Syntaxbanner configure manager-infoname mgr1-name phone-number mgr1-number[name2 mgr2-name phone-number mgr2-number |name3 mgr3-name phone-number mgr3-number]no banner configure manager-info [name1 | name2 | name3]
mgr1-name - The name of the first manager.
mgr1-number - The phone number of the first manager.
mgr2-name - The name of the second manager.
mgr2-number - The phone number of the second manager.
mgr3-name - The name of the third manager.
mgr3-number - The phone number of the third manager.
Maximum length of each parameter: 32 characters– 111 –

Chapter 4 | System Management Commands
Banner Information
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure manager-infocommand interprets spaces as data input boundaries. The use of underscores ( _ )or other unobtrusive non-letter characters is suggested for situations where whitespace is necessary for clarity.
ExampleConsole(config)#banner configure manager-info name Albert_Einstein phonenumber 123-555-1212 name2 Lamar phone-number 123-555-1219
Console(config)#banner configure mux This command is used to configure the mux information displayed in the banner.
Use the no form to restore the default setting.
Syntaxbanner configure mux muxinfo
no banner configure mux
muxinfo - The circuit and PVC to which the switch is connected. (Maximum
length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure mux commandinterprets spaces as data input boundaries. The use of underscores ( _ ) or otherunobtrusive non-letter characters is suggested for situations where white space isnecessary for clarity.
ExampleConsole(config)#banner configure mux telco-8734212kx_PVC-1/23
Console(config)#– 112 –

Chapter 4 | System Management Commands

Banner Informationbanner configure note This command is used to configure the note displayed in the banner. Use the noform to restore the default setting.
Syntaxbanner configure note note-info
no banner configure notenote-info - Miscellaneous information that does not fit the other bannercategories, or any other information of importance to users of the switch
CLI. (Maximum length: 150 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
Input strings cannot contain spaces. The banner configure note commandinterprets spaces as data input boundaries. The use of underscores ( _ ) or otherunobtrusive non-letter characters is suggested for situations where white space isnecessary for clarity.
ExampleConsole(config)#banner configure note !!!!!ROUTINE_MAINTENANCE_firmwareupgrade_0100-0500_GMT-0500_20071022!!!!!_20min_network_impact_expected
Console(config)#show banner This command displays all banner information.
Command Mode
Privileged Exec
ExampleConsole#show banner
EdgecoreWARNING - MONITORED ACTIONS AND ACCESSES
R&D
Albert_Einstein - 123-555-1212
Lamar - 123-555-1219
Station's information:
710_Network_Path,_Indianapolis
ECS4150-28P
Floor / Row / Rack / Sub-Rack
3/ 10 / 15 / 12

– 113 –

Chapter 4 | System Management Commands
System Status
DC power supply:Power Source A: Floor / Row / Rack / Electrical circuit
3/ 15 / 24 / 48v-id_3.15.24.2
Number of LP: 12
Position MUX: telco-8734212kx_PVC-1/23
IP LAN: 192.168.1.1/255.255.255.0
Note: !!!!!ROUTINE_MAINTENANCE_firmware-upgrade_0100-0500_GMT0500_20071022!!!!!_20min_network_
Console#System Status
This section describes commands used to display system information.
Table 14: System Status Commands
CommandFunctionModeshow access-list
tcam-utilization

Shows utilization parameters for TCAM

PE

show memory

Shows memory utilization parametersPEshow process cpu

Shows CPU utilization parametersPEshow process cpu guard

Shows the CPU utilization watermark and thresholdNE

show process cpu task

Shows CPU utilization per processPEshow running-config

Displays the configuration data currently in use

PEshow startup-config

Displays the contents of the configuration file (stored in
flash memory) that is used to start up the systemPEshow system

Displays system information

NE, PEshow tech-support

Displays a detailed list of system settings designed to help PE
technical support resolve configuration or functional
problems

show users

Shows all active console and Telnet sessions, including user NE, PE
name, idle time, and IP address of Telnet clientsshow version

Displays version information for the system

NE, PEshow watchdog

Shows if watchdog debugging is enabledPEwatchdog software

Monitors key processes, and automatically reboots thesystem if any of these processes are not responding
correctlyPE– 114 –

Chapter 4 | System Management Commands

System Statusshow access-list This command shows utilization parameters for TCAM (Ternary Content
tcam-utilization Addressable Memory), including the number policy control entries in use, and thenumber of free entries.
Command Mode
Privileged Exec
Command Usage
Policy control entries (PCEs) are used by various system functions which rely on
rule-based searches, including Access Control Lists (ACLs), IP Source Guard filter
rules, Quality of Service (QoS) processes, or traps.
For example, when binding an ACL to a port, each rule in an ACL will use two PCEs;
and when setting an IP Source Guard filter rule for a port, the system will also use
two PCEs.
ExampleConsole#show access-list tcam-utilization
Pool capability code:
AM - MAC ACL, A4 - IPv4 ACL, A6S - IPv6 Standard ACL,
A6E - IPv6 extended ACL, DM - MAC diffServ, D4 - IPv4 diffServ,
D6S - IPv6 standard diffServ, D6E - IPv6 extended diffServ,AEM - Egress MAC ACL, AE4 - Egress IPv4 ACL,
AE6S - Egress IPv6 standard ACL, AE6E - Egress IPv6 extended ACL,
DEM - Egress MAC diffServ, DE4 - Egress IPv4 diffServ,
DE6S - Egress IPv6 standard diffServ,
DE6E - Egress IPv6 extended diffServ, W - Web authentication,
I - IP source guard, I6 - IPv6 source guard, C - CPU interface,
L - Link local, Reserved - Reserved, ALL - All supported function,
Unit Device Pool Total Used Free Capability---- ------ ---- ----- ----- ----- ---------------------------------------1
0
0
512
30
482 ALL
100512
0482 EXCLUDED_VLAN
Console#Table 15: show access-list tcam-utilization - display description
Field

Description

Pool Capability Code

Abbreviation for processes shown in the TCAM List.

Unit

Stack unit identifier.

DeviceMemory chip used for indicated pools.

Pool

Rule slice (or call group). Each slice has a fixed number of rules that areused for the specified features.

Total

The maximum number of policy control entries allocated to the each
pool.

Used

The number of policy control entries used by the operating system.

Free

The number of policy control entries available for use.

Capability

The processes assigned to each pool.

– 115 –

Chapter 4 | System Management Commands
System Statusshow memory This command shows memory utilization parameters, and alarm thresholds.
Command Mode
Normal Exec, Privileged Exec
Command Usage
This command shows the amount of memory currently free for use, the amount ofmemory allocated to active processes, the total amount of system memory, and thealarm thresholds.
ExampleConsole#show memory
Status Bytes%------ ---------- --Free541569024 50
Used532172800 50
Total 1073741824
Alarm Configuration
Rising Threshold
Falling Threshold

: 90%
: 70%

Console#Related Commands
memory (212)show process cpu This command shows the CPU utilization parameters, alarm status, and alarm
thresholds.

Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show process cpu
CPU Utilization in the past 5 seconds : 24%
CPU Utilization in the past 60 seconds
Average Utilization: 24%
Maximum Utilization: 25%
Alarm Status
Current Alarm Status: Off
Last Alarm Start Time: Dec 31 00:00:19 2000
Last Alarm Duration Time : 15 seconds
Alarm Configuration
Rising Threshold
Falling Threshold

: 90%
: 70%

Console#– 116 –

Chapter 4 | System Management Commands

System Status

Related Commands
process cpu (213)show process cpu This command shows the CPU utilization watermark and threshold settings.
guard
Command Mode

Normal Exec, Privileged Exec

ExampleConsole#show process cpu guard
CPU Guard Configuration
Status: DisabledHigh Watermark: 90%
Low Watermark: 70%
Maximum Threshold : 500 packets per second
Minimum Threshold : 50 packets per second
Trap Status: Disabled
CPU Guard Operation
Current Threshold : 500 packets per second
Console#Table 16: show process cpu guard - display description
Field

Description

CPU Guard Configuration
StatusShows if CPU Guard has been enabled.

High Watermark

If the percentage of CPU usage time is higher than the high-watermark,the switch stops packet flow to the CPU (allowing it to catch up withpackets already in the buffer) until usage time falls below the low
watermark.

Low Watermark

If packet flow has been stopped after exceeding the high watermark,normal flow will be restored after usage falls beneath the low
watermark.

Maximum Threshold

If the number of packets being processed by the CPU is higher than the
maximum threshold, the switch stops packet flow to the CPU (allowing
it to catch up with packets already in the buffer) until the number ofpackets being processed falls below the minimum threshold.

Minimum ThresholdIf packet flow has been stopped after exceeding the maximum
threshold, normal flow will be restored after usage falls beneath theminimum threshold.

Trap Status

Shows if an alarm message will be generated when utilization exceeds
the high watermark or exceeds the maximum threshold.

CPU Guard Operation
Current ThresholdShows the configured threshold in packets per second.

Related Commands
process cpu guard (214)– 117 –

Chapter 4 | System Management Commands
System Statusshow process cpu task This command shows the CPU utilization per process.
Command Mode
Privileged Exec
ExampleConsole#show process cpu task
Task
Util (%) Avg (%) Max (%)--------------- -------- -------- -------AMTRL3
0.00
0.00
0.00
AMTRL3_GROUP
0.00
0.00
0.00
AMTR_ASIC_COM
0.00
0.00
0.00
APP_PROTOCOL_GR
0.00
0.00
0.00
APP_PROTOCOL_PR
0.00
0.00
0.09
AUTH_GROUP
0.00
0.00
0.00
AUTH_PROC
0.00
0.00
0.00
CFGDB_TD
0.09
0.04
0.19
CLITASK0
0.09
0.04
0.10
.
.
.
Console#show running-config This command displays the configuration information currently in use.
Syntaxshow running-config [interface interface | key-words]
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id (Range: 1-4094)
key-words - One of the following key words that identify a feature:acl, aclaccessgroup, autotrafficcontr, cfm, controlplane,createtrunk, dai, dhcpsnooping, dns, dot1x, dyinggasp, erps,
ethernet, excludedvlan, heartbeat, heartbeat, http, igmpfilter,
igmpsooping, ipaddress, ipv4dhcpdynamic, ipv6, ipv6dhcp,
ipv6dhcpdynamic, ipv6dhcpsnooping, ipv6ndsnooping, l3global,
lbd, line, lldp, loopback, macaddresstable, macvlan,managementip, mdns, mlag, mldsnooping, mvr, mvr6, netaccess,
ntp, pppoeia, privilegelevel, protocolvlan, qos, qosclassmap,– 118 –

Chapter 4 | System Management Commands

System Status

qosglobalmap, qospolicymap, reload, remoteauthaaa, rmon,
rspan, smartpair, smtp, snmp, sourceguard, spanningtreemstp,
spanningtreestp, spanningtreexstp, ssh, subnetvlan, syslog,
system, tftp, timerange, trafficseg, trunk, twampglobal, udld,
userauth, vdslglobal, vlan, vlandatabase, voicevlan, webauth
Command Mode
Privileged Exec
Command Usage Use the interface keyword to display configuration data for the specified
interface.
 Use this command in conjunction with the show startup-config command tocompare the information in running memory to the information stored in nonvolatile memory.

 This command displays settings for key command modes. Each mode group is

separated by “!” symbols, and includes the configuration mode command, andcorresponding commands. This command displays the following information:











MAC address for
SNMP community strings
Users (names, access levels, and encrypted passwords)
VLAN database (VLAN ID, name and state)
VLAN configuration settings for each interface
Multiple spanning tree instances (name and interfaces)
IP address configured for VLANs
Spanning tree settings
Interface settings
Any configured settings for the console port and Telnet

 For security reasons, user passwords are only displayed in encrypted format.

ExampleConsole#show running-config!<stackingDB>00</stackingDB>!<stackingMac>01_00-e0-0c-00-00-fd_03</stackingMac>!
snmp-server community public rosnmp-server community private rw!
enable password 7 1b3231655cebb7a1f783eddf27d254ca!
vlan database
VLAN 1 name DefaultVlan media ethernet!
spanning-tree mst configuration!
interface ethernet 1/1
no negotiation...
interface ethernet 1/18
no negotiation– 119 –

Chapter 4 | System Management Commands
System Status!
interface vlan 1
ip address dhcp!
interface vlan 1!
line console!
line vty!
end!
Console#Related Commands
show startup-config (120)show startup-config This command displays the configuration file stored in non-volatile memory that isused to start up the system.
Command Mode
Privileged Exec
Command Usage Use this command in conjunction with the show running-config command tocompare the information in running memory to the information stored in nonvolatile memory.
 This command displays settings for key command modes. Each mode group is

separated by “!” symbols, and includes the configuration mode command, andcorresponding commands. This command displays the following information:










MAC address for
SNMP community strings
SNMP trap authentication
Users (names and access levels)
VLAN database (VLAN ID, name and state)
Multiple spanning tree instances (name and interfaces)
Interface settings and VLAN configuration settings for each interface
IP address for VLANs
Any configured settings for the console port and Telnet

ExampleRefer to the example for the running configuration file.
Related Commands
show running-config (118)– 120 –

Chapter 4 | System Management Commands

System Statusshow system This command displays system information.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show system
System Description : ECS4150-28P
System OID String : 1.3.6.1.4.1.259.10.1.55.102
System Information
System Up Time: 0 days, 5 hours, 7 minutes, and 47.78 seconds
System Name:
System Location:
System Contact:
MAC Address (Unit 1): E4-9D-73-1B-5E-00
Web Server: Enabled
Web Server Port: 80
Web Secure Server: Enabled
Web Secure Server Port : 443
Telnet Server: Enabled
Telnet Server Port: 23
Jumbo Frame: Disabled
System Fan:
Force Fan Speed Full
: Disabled
Unit 1
Fan 1: Ok
Fan 1 speed: 7796 rpm
System Temperature:
Unit 1
Temperature 1: 33 degrees
Console#Table 17: show system – display description
Parameter

Description

System Description

Brief description of device type.

System OID String

MIB II object ID for switch’s network management subsystem.

System Up Time

Length of time the management agent has been up.

System Name

Name assigned to the switch system.

System Location

Specifies the system location.

System Contact

Administrator responsible for the system.

MAC Address

MAC address assigned to this switch.

Web Server/PortShows administrative status of web server and UDP port number.

Web Secure Server/PortShows administrative status of secure web server and UDP port
number.

– 121 –

Chapter 4 | System Management Commands
System Status
Table 17: show system – display description (Continued)
Parameter

Description

Telnet Server/PortShows administrative status of Telnet server and TCP port number.

Jumbo Frame

Shows if jumbo frames are enabled or disabled.

show tech-support This command displays a detailed list of system settings designed to help technicalsupport resolve configuration or functional problems.
Command Mode
Privileged Exec
Command Usage
This command generates a long list of information including detailed system andinterface settings. It is therefore advisable to direct the output to a file using any
suitable output capture function provided with your terminal emulation program.
ExampleUser Access Verification
Username: admin
Password:
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Vty-2#show tech-support
dir:File Name
Type
Startup Modified Time
Size (bytes)---------------------------- ------- ------- ------------------- -----------Unit 1:
runtime.bix
OpCode Y
2023-02-07 14:40:05
51,893,948
Factory_Default_Config.cfg
Config N
2023-01-17 01:09:16
455
startup1.cfg
Config Y
2023-02-17 07:39:01
1,673---------------------------------------------------------------------------Free space for compressed user config files:
109,490,176
Total space:
165,584,896
show arp:
ARP Cache Timeout: 1200 (seconds)
IP Address
MAC Address
TypeInterface--------------- ----------------- --------- ----------192.168.2.99
F0-79-59-8F-2B-FE dynamic
VLAN 1
Total entry : 1
show interfaces brief:
Interface Name
StatusPVID Pri Speed/Duplex Type
Trunk--------- ----------------- --------- ---- --- ------------- ------------ ----Eth 1/ 1
Up
1
0 Auto-1000full 1000BASE-T
None
Eth 1/ 2
Up
1
0 Auto1000BASE-T
None
Eth 1/ 3Up
1
0 Auto1000BASE-T
None
Eth 1/ 4
Up1
0 Auto1000BASE-T
None
Eth 1/ 5Up1
0 Auto1000BASE-T
None– 122 –

Chapter 4 | System Management Commands

System Status...

show users Shows all active console and Telnet sessions, including user name, idle time, and IP
address of Telnet client.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
The session used to execute this command is indicated by a “*” symbol next to theLine (i.e., session) index number.
ExampleConsole#show users
User Name Accounts:
User Name
Privilege Public-Key-------------------- ---------- --------------admin
15 Noneguest
0 NoneOnline Users:Line
Session ID User Name
Idle Time (h:m:s) Remote IP Addr--------- ---------- -------------------- ----------------- ----------------*Console
0 admin0:00:01
Web Online Users:
Line
User Name
Idle Time (h:m:s)Remote IP Addr---------- -------------------- -------------------- -------------------Console#

show version This command displays hardware and software version information for the system.
Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show version
Serial Number: EC2253000014
Hardware Version: R01
Number of Ports: 28
Main Power Status
: Up
Role
: Master
Loader Version: 0.0.1.8
Linux Kernel Version: 4.14.76-19.0.0
Operation Code Version : 1.3.0.9– 123 –

Chapter 4 | System Management Commands
System Status

Console#Table 18: show version – display description
Parameter

Description

Serial Number

The serial number of the switch.

Hardware Version

Hardware version of the main board.

Number of Ports

Number of built-in ports.

Main Power Status

Displays the status of the main power supply.

Role

Shows that this switch is operating as Master or Slave.

Loader Version

Version number of loader code.

Linux Kernel Version

Version number of Linux kernel.

Operation Code Version

Version number of runtime code.

show watchdog This command shows if watchdog debugging is enabled.
Command Mode
Privileged Exec
ExampleConsole#show watchdog
Software Watchdog Information
Status :EnabledAutoReload :EnabledConsole#watchdog software This command monitors key processes, and automatically reboots the system if anyof these processes are not responding correctly.
Syntaxwatchdog software {disable | enable}
Default Setting
Disabled
Command Mode
Privileged Exec
ExampleConsole#watchdog software disable
Console#– 124 –

Chapter 4 | System Management Commands

Fan Control

Fan Control
This section describes the command used to force fan speed.
Table 19: Fan Control Commands
CommandFunctionModefan-speed force-fullForces fans to full speed

GCshow system

Shows if full fan speed is enabled

NE, PE

fan-speed force-full This command sets all fans to full speed. Use the no form to reset the fans to normal
operating speed.
Syntax[no] fan-speed force-full
Default Setting
Normal speed
Command Mode
Global Configuration
ExampleConsole(config)#fan-speed force-fullConsole(config)#

Frame Size
This section describes commands used to configure the Ethernet frame size on theswitch.
Table 20: Frame Size Commands
CommandFunctionModejumbo frame

Enables support for jumbo frames

GC

jumbo frame This command enables support for layer 2 jumbo frames for Gigabit and 10 Gigabit
Ethernet ports. Use the no form to disable it.
Syntax[no] jumbo frame– 125 –

Chapter 4 | System Management Commands
File Management
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage This switch provides more efficient throughput for large sequential datatransfers by supporting layer 2 jumbo frames on Gigabit and 10 Gigabit
Ethernet ports or trunks up to 10240 bytes. Compared to standard Ethernet
frames that run only up to 1.5 KB, using jumbo frames significantly reduces the
per-packet overhead required to process protocol encapsulation fields.
 To use jumbo frames, both the source and destination end nodes (such as acomputer or server) must support this feature. Also, when the connection is
operating at full duplex, all switches in the network between the two end
nodes must be able to accept the extended frame size. And for half-duplex
connections, all devices in the collision domain would need to support jumbo
frames.

 The current setting for jumbo frames can be displayed with the show systemcommand.

ExampleConsole(config)#jumbo frame
Console(config)#

Related Commands
show system (121)show ipv6 mtu (946)File Management
Managing Firmware
Firmware can be uploaded and downloaded to or from an FTP/FTPS/SFTP/SCP/
TFTP server. By saving runtime code to a file on an FTP/FTPS/SFTP/SCP/TFTP server,that file can later be downloaded to the switch to restore operation. The switch canalso be set to use new firmware without overwriting the previous version.
When downloading runtime code, the destination file name can be specified toreplace the current image, or the file can be first downloaded using a different
name from the current runtime code file, and then the new file set as the startup
file.

– 126 –

Chapter 4 | System Management Commands

File Management

Saving or Restoring Configuration Settings
Configuration settings can be uploaded and downloaded to and from an FTP/FTPS/
SFTP/SCP/TFTP server. The configuration file can be later downloaded to restore
switch settings.
The configuration file can be downloaded under a new file name and then set as
the startup file, or the current startup configuration file can be specified as thedestination file to directly replace it. Note that the file “Factory_Default_Config.cfg”
can be copied to the FTP/FTPS/SFTP/SCP/TFTP server, but cannot be used as thedestination on the switch.
Table 21: Flash/File Commands
CommandFunctionModeboot system

Specifies the file or image used to start up the system

GC

copy

Copies a code image or a switch configuration to or fromflash memory or an FTP/SFTP/SCP/TFTP serverPEdeleteDeletes a file or code image

PE

dir

Displays a list of files in flash memoryPEumount usbdisk

Prepares the USB memory device to be safely removed

PE

whichbootDisplays the files booted

PE

General Commands

Automatic Code Upgrade Commands
upgrade opcode auto

Automatically upgrades the current image when a newversion is detected on the indicated server

GC

upgrade opcode path

Specifies an FTP/SFTP/SCP/TFTP server and directory inwhich the new opcode is storedGC

upgrade opcode reload

Reloads the switch automatically after the opcode upgrade GC
is completedshow upgradeShows the opcode upgrade configuration settings.

PE

TFTP Configuration Commands
ip tftp retry

Specifies the number of times the switch can retrytransmitting a request to a TFTP server

ip tftp timeout

Specifies the time the switch can wait for a response from a GC
TFTP server before retransmitting a request or timing out
for the last retry

show ip tftp

Displays information about TFTP settings– 127 –GCPE

Chapter 4 | System Management Commands
File Management
General Commands

boot system This command specifies the file or image used to start up the system.
Syntaxboot system {boot-rom | config | opcode}: filenameboot-rom* - Boot ROM.
config* - Configuration file.
opcode* - Run-time operation code.
filename - Name of configuration file or code image.
* The colon (:) is required.
Default Setting
None
Command Mode
Global Configuration
Command Usage
 A colon (:) is required after the specified file type.
 If the file contains an error, it cannot be set as the default file.

ExampleConsole(config)#boot system config: startup
Console(config)#

Related Commandsdir (133)
whichboot (135)– 128 –

Chapter 4 | System Management Commands

File Management

copy This command moves (upload/download) a code image or configuration file

between the switch’s flash memory and an FTP/FTPS/SCP/SFTP/TFTP server. Whenyou save the system code or configuration settings to a file on an FTP/FTPS/SCP/
SFTP/TFTP server, that file can later be downloaded to the switch to restore system
operation. The success of the file transfer depends on the accessibility of the FTP/
FTPS/SCP/SFTP/TFTP server and the quality of the network connection.
Syntaxcopy file {file | ftp | ftps | running-config | scp | sftp | startup-config | tftp |unit | usbdisk}
copy ftp {add-to-running-config | file | https-certificate | public-key |running-config | startup-config}
copy running-config {file | ftp | ftps | sftp | startup-config | tftp}
copy startup-config {file | ftp | ftps | running-config | sftp | tftp}
copy tftp {add-to-running-config | file | https-certificate | public-key |running-config | startup-config}
add-to-running-config - Keyword that adds the settings listed in thespecified file to the running configuration.
file - Keyword that allows you to copy to/from a file.
ftp - Keyword that allows you to copy to/from an FTP server.
ftps - Keyword that allows you to copy to/from an FTPS server.
https-certificate - Keyword that allows you to copy the HTTPS secure site
certificate.
public-key - Keyword that allows you to copy a SSH key from a TFTP server.
(See “Secure Shell” on page 266.)
running-config - Keyword that allows you to copy to/from the current
running configuration.
scp - Keyword that copies a file to or from an SCP server.
sftp - Keyword that copies a file to or from an SFTP server.
startup-config - The configuration used for system initialization.
tftp - Keyword that allows you to copy to/from a TFTP server.
unit - Keyword that copies a file to/from a device unit.
usbdisk - Keyword that copies a file to/from a USB device.

Default Setting
None
Command Mode
Privileged Exec

– 129 –

Chapter 4 | System Management Commands
File Management
Command Usage The system prompts for data required to complete the copy command.
 The destination file name should not contain slashes (\ or /), and the maximum

length for file names is 32 characters for files on the switch or 127 characters forfiles on the server. (Valid characters: A-Z, a-z, 0-9, “.”, “-”) The switch supports only two operation code files, but the maximum numberof user-defined configuration files is 16.

 You can use “Factory_Default_Config.cfg” as the source to copy from thefactory default configuration file, but you cannot use it as the destination.

 To replace the startup configuration, you must use startup-config as thedestination.

 The Boot ROM and Loader cannot be uploaded or downloaded from the FTP/

FTPS/SCP/SFTP/TFTP server. You must follow the instructions in the release
notes for new firmware, or contact your distributor for help.

 For information on specifying an https-certificate, see “Replacing the Default

Secure-site Certificate” in the Web Management Guide. For information on
configuring the switch to use HTTPS for a secure connection, see the ip httpsecure-server command.

 The reload command will not be accepted during copy operations to flash

memory.

 When logging into an FTP server, the interface prompts for a user name andpassword configured on the remote server. Note that “anonymous” is set as thedefault user name.

 When logging into a remote SFTP/FTPS server, the interface prompts for a username and password configured on the remote server. If this is a first timeconnection, the system checks to see if the public key offered by the servermatches one stored locally. If not, the server’s public key will be copied to the
local system.

 Secure Shell FTP (SFTP) provides a method of transferring files between two

network devices over an SSH2-secured connection. SFTP functions similar to
Secure Copy (SCP), using SSH for user authentication and data encryption.
Although the underlying premises of SFTP are similar to SCP, it requires some
additional steps to verify the protocol versions and perform security checks.
SFTP connection setup includes verification of the DSS signature, creation ofsession keys, creation of client-server and server-client ciphers, SSH key
exchange, and user authentication. An SFTP channel is then opened, the SFTP
protocol version compatibility verified, and SFTP finally initialized.

 The reload command will not be accepted during copy operations to flash

memory.

– 130 –

Chapter 4 | System Management Commands

File Management

ExampleThe following example shows how to download new firmware from a TFTP server:
Console#copy tftp file
TFTP server ip address: 10.1.0.19
Choose file type:
1. config: 2. opcode: 2
Source file name: m360.bix
Destination file name: m360.bix\Write to FLASH Programming.
-Write to FLASH finish.
Success.
Console#The following example shows how to upload the configuration settings to a file on
the TFTP server:
Console#copy file tftp
Choose file type:
1. config: 2. opcode: 1
Source file name: startup
TFTP server ip address: 10.1.0.99
Destination file name: startup.01
TFTP completed.
Success.
Console#The following example shows how to copy the running configuration to a startup
file.
Console#copy running-config filedestination file name: startup
Write to FLASH Programming.
\Write to FLASH finish.
Success.
Console#The following example shows how to download a configuration file:
Console#copy tftp startup-config
TFTP server ip address: 10.1.0.99
Source configuration file name: startup.01
Startup configuration file name [startup]:
Write to FLASH Programming.
\Write to FLASH finish.
Success.
Console#– 131 –

Chapter 4 | System Management Commands
File Management
This example shows how to copy a secure-site certificate from an TFTP server. It
then reboots the switch to activate the certificate:
Console#copy tftp https-certificate
TFTP server ip address: 10.1.0.19
Source certificate file name: SS-certificate
Source private file name: SS-private
Private password: ********
Success.
Console#reload
System will be restarted, continue <y/n>? yThis example shows how to copy a public-key used by SSH from an TFTP server.
Note that public key authentication via SSH is only supported for users configured
locally on the switch.
Console#copy tftp public-key
TFTP server IP address: 192.168.1.19
Source public-key file name: steve.pub
Username: steve
TFTP Download
Success.
Write to FLASH Programming.
Success.
Console#This example shows how to copy a file to an FTP server.
Console#copy ftp file
FTP server IP address: 169.254.1.11
User[anonymous]: admin
Password[]: *****
Choose file type:
1. config: 2. opcode: 2
Source file name: BLANC.BIX
Destination file name: BLANC.BIX
Console#This example shows how to copy a file from an SFTP server. Note that the public key
offered by the server is not found on the local system, but is saved locally after theuser selects to continue the copy operation.
Console#copy sftp file
SFTP server IP address: 192.168.0.110
User [Anonymous]: admin
Password:Choose file type:
1. config; 2. opcode: 1
Source file name: startup2.cfg
Destination file name: startup2.cfg– 132 –

Chapter 4 | System Management Commands

File Management

Success.
Console#delete This command deletes a file or image.
Syntaxdelete {file name filename | https-certificate | public-key username}file - Keyword that allows you to delete a file.
name - Keyword indicating a file.
filename - Name of configuration file or code image.
https-certificate - Keyword that allows you to delete the HTTPS secure site
certificate. You must reboot the switch to load the default certificate.
public-key - Keyword that allows you to delete a SSH key on the switch.
(See “Secure Shell” on page 266.)
username – Name of an SSH user. (Range: 1-8 characters)
Default Setting
None
Command Mode
Privileged Exec
Command Usage If the file type is used for system startup, then this file cannot be deleted.
 “Factory_Default_Config.cfg” cannot be deleted.

ExampleThis example shows how to delete the test2.cfg configuration file from flash
memory.
Console#delete file name test2.cfg
Console#Related Commandsdir (133)
delete public-key (270)

dir This command displays a list of files in flash memory.
Syntaxdir [unit:] {boot-rom | config: | opcode: | usbdisk} [filename]}– 133 –

Chapter 4 | System Management Commands
File Management
unit - Unit identifier. (Range: 1)
boot-rom - Boot ROM (or diagnostic) image file.
config - Switch configuration file.
opcode - Run-time operation code image file.
usbdisk - Installed USB device file.
filename - Name of configuration file or code image. If this file exists but
contains errors, information on this file cannot be shown.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
If you enter the command dir without any parameters, the system displays all files.
File information is shown below:
Table 22: File Directory Information
Column Heading

Description

File Name

The name of the file.

Type

File types: Operation Code, and Config file.

StartupShows if this file is used when the system is started.

Modify Time

The date and time the file was last modified.

Size

The length of the file in bytes.

ExampleThe following example shows how to display all file information:
Console#dir
File Name
Type
Startup Modified Time
Size (bytes)------------------------------ ------- ------- ------------------- -----------Unit 1:
runtime.bix
OpCode Y
2023-02-07 14:40:05
51,893,948
Factory_Default_Config.cfg
Config N
2023-01-17 01:09:16
455
startup1.cfg
Config Y
2023-02-17 07:39:01
1,673------------------------------------------------------------------------------Free space for compressed user config files:
109,490,176
Total space:
165,584,896
Console#umount usbdisk This command prepares the USB memory device to be safely removed from theswitch.

– 134 –

Chapter 4 | System Management Commands

File Management

Syntaxumount usbdisk
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Before disconnecting a USB memory device, you must unmount it first. This issimilar to “Safely Remove Hardware” in Windows where the device will notunmount until all data transfers have been finished.
ExampleConsole#umount usbdisk
You can safely remove your usbdisk.
Console#whichboot This command displays which files were booted when the system powered up.
SyntaxwhichbootDefault Setting
None
Command Mode
Privileged Exec
ExampleThis example shows the information displayed by the whichboot command. See
the table under the dir command for a description of the file information displayedby this command.
Console#whichboot
File Name
Type
Startup Modified Time
Size (bytes)------------------------------ ------- ------- ------------------- -----------Unit 1:
runtime.bix
OpCode Y
2023-02-07 14:40:05
51,893,948
startup1.cfg
Config Y
2023-02-17 07:39:01
1,673
Console#– 135 –

Chapter 4 | System Management Commands
File Management
Automatic Code Upgrade Commands

upgrade opcode auto This command automatically upgrades the current operational code when a newversion is detected on the server indicated by the upgrade opcode path command.
Use the no form of this command to restore the default setting.
Syntax[no] upgrade opcode auto
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage This command is used to enable or disable automatic upgrade of theoperational code. When the switch starts up and automatic image upgrade isenabled by this command, the switch will follow these steps when it boots up:

1. It will search for a new version of the image at the location specified byupgrade opcode path command. The name for the new image stored on
the TFTP server must be ECS4150.bix. If the switch detects a code version
newer than the one currently in use, it will download the new image. If twocode images are already stored in the switch, the image not set to start up
the system will be overwritten by the new version.

2. After the image has been downloaded, the switch will send a trap message
to log whether or not the upgrade operation was successful.

3. It sets the new version as the startup image.
4. It then restarts the system to start using the new image.
 Any changes made to the default setting can be displayed with the showrunning-config or show startup-config commands.

ExampleConsole(config)#upgrade opcode auto
Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#– 136 –

Chapter 4 | System Management Commands

File Management

If a new image is found at the specified location, the following type of messages
will be displayed during bootup.
.
.
.
Automatic Upgrade is looking for a new image
New image detected: current version 1.1.0.8; new version 1.1.0.9
Image upgrade in progress
The switch will restart after upgrade succeeds
Downloading new image
Flash programming started
Flash programming completed
The switch will now restart.
.
.

upgrade opcode path This command specifies an TFTP server and directory in which the new opcode isstored. Use the no form of this command to clear the current setting.
Syntax
upgrade opcode path opcode-dir-url
no upgrade opcode path
opcode-dir-url - The location of the new code.
Default Setting
None
Command Mode
Global Configuration
Command Usage This command is used in conjunction with the upgrade opcode auto command

to facilitate automatic upgrade of new operational code stored at the location
indicated by this command.

 The name for the new image stored on the TFTP server must be ECS4150.bix.

However, note that file name is not to be included in this command.

 When specifying a TFTP server, the following syntax must be used, where filedirindicates the path to the directory containing the new image:tftp://192.168.0.1[/filedir]/ When specifying an FTP server, the following syntax must be used, where filedirindicates the path to the directory containing the new image:
ftp://[username[:password@]]192.168.0.1[/filedir]/If the user name is omitted, “anonymous” will be used for the connection. If thepassword is omitted a null string (“”) will be used for the connection.

– 137 –

Chapter 4 | System Management Commands
File Management
ExampleThis shows how to specify a TFTP server where new code is stored.
Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#

This shows how to specify an FTP server where new code is stored.
Console(config)#upgrade opcode path ftp://admin:billy@192.168.0.1/sm24/
Console(config)#

upgrade opcode This command reloads the switch automatically after the opcode upgrade isreload completed. Use the no form to disable this feature.
Syntax[no] upgrade opcode reload
Default Setting
Disabled
Command Mode
Global Configuration
ExampleThis shows how to specify a TFTP server where new code is stored.
Console(config)#upgrade opcode reload
Console(config)#show upgrade This command shows the opcode upgrade configuration settings.
Command Mode
Privileged Exec
ExampleConsole#show upgrade
Auto Image Upgrade Global Settings:
Status: Disabled
Reload Status : Disabled
Path:
File Name : ECS4150.bix
Console#– 138 –

Chapter 4 | System Management Commands

File Management

TFTP Configuration Commands

ip tftp retry This command specifies the number of times the switch can retry transmitting arequest to a TFTP server after waiting for the configured timeout period andreceiving no response. Use the no form to restore the default setting.
Syntax
ip tftp retry retries
no ip tftp retry
retries - The number of times the switch can resend a request to a TFTP
server before it aborts the connection. (Range: 1-16)
Default Setting
15
Command Mode
Global Configuration
ExampleConsole(config)#ip tftp retry 10
Console(config)#

ip tftp timeout This command specifies the time the switch can wait for a response from a TFTP

server before retransmitting a request or timing out for the last retry. Use the noform to restore the default setting.
Syntax
ip tftp timeout seconds
no ip tftp timeout
seconds - The the time the switch can wait for a response from a TFTP server
before retransmitting a request or timing out. (Range: 1-65535 seconds)
Default Setting
5 seconds
Command Mode
Global Configuration
ExampleConsole(config)#ip tftp timeout 10
Console(config)#– 139 –

Chapter 4 | System Management Commands

Lineshow ip tftp This command displays information about the TFTP settings configured on thisswitch.

Syntaxshow ip tftp
Command Mode
Privileged Exec
ExampleConsole#show ip tftp
TFTP Settings:
Retries : 15
Timeout : 5 seconds
Console#Line
You can access the onboard configuration program by attaching a VT100
compatible device to the server’s serial port. These commands are used to set
communication parameters for the serial port or Telnet (i.e., a virtual terminal).
Table 23: Line Commands
CommandFunctionline

Identifies a specific line for configuration and starts the line GC
configuration mode

accounting commands

Applies an accounting method to commands entered at
specific CLI privilege levels

LCaccounting exec

Applies an accounting method to local console, Telnet or
SSH connections

LCauthorization commands

Applies an authorization method to commands entered at LC
specific CLI privilege levels

authorization exec

Applies an authorization method to local console, Telnet or LC
SSH connections

databits*

Sets the number of data bits per character that areinterpreted and generated by hardware

exec-timeout

Sets the interval that the command interpreter waits until LC
user input is detected

login

Enables password checking at loginLC

parity*Defines the generation of a parity bitLCpassword

Specifies a password on a line

LC

password-thresh

Sets the password intrusion threshold, which limits thenumber of failed logon attempts

LC– 140 –Mode

LC

Chapter 4 | System Management Commands

Line

Table 23: Line Commands (Continued)
CommandFunctionModesilent-time*

Sets the amount of time the management console isinaccessible after the number of unsuccessful logon
attempts exceeds the threshold set by the passwordthresh commandLC

speed*

Sets the terminal baud rateLC

stopbits*

Sets the number of the stop bits transmitted per byteLC

timeout login response

Sets the interval that the system waits for a login attemptLCdisconnect

Terminates a line connectionPEterminal

Configures terminal settings, including escape-character,line length, terminal type, and widthPEshow line

Displays a terminal line's parameters

NE, PE* These commands only apply to the serial port.

line This command identifies a specific line for configuration, and to processsubsequent line configuration commands.
Syntaxline {console | vty}
console - Console terminal line.
vty - Virtual terminal for remote console access (i.e., Telnet).
Default Setting
There is no default line.
Command Mode
Global Configuration
Command Usage
Telnet is considered a virtual terminal connection and will be shown as “VTY” inscreen displays such as show users. However, the serial communication parameters(e.g., databits) do not affect Telnet connections.
ExampleTo enter console line mode, enter the following command:
Console(config)#line console
Console(config-line)#

Related Commands
show line (150)show users (123)– 141 –

Chapter 4 | System Management Commands

Line

databits This command sets the number of data bits per character that are interpreted andgenerated by the console port. Use the no form to restore the default value.
Syntaxdatabits {7 | 8}
no databits
7 - Seven data bits per character.
8 - Eight data bits per character.
Default Setting
8 data bits per character
Command ModeLine Configuration
Command Usage
The databits command can be used to mask the high bit on input from devices
that generate 7 data bits with parity. If parity is being generated, specify 7 data bits
per character. If no parity is required, specify 8 data bits per character.
ExampleTo specify 7 data bits, enter this command:
Console(config-line-console)#databits 7
Console(config-line-console)#

Related Commands
parity (144)exec-timeout This command sets the interval that the system waits until user input is detected.
Use the no form to restore the default.
Syntaxexec-timeout [seconds]
no exec-timeout
seconds - Integer that specifies the timeout interval.
(Range: 60 - 65535 seconds; 0: no timeout)
Default Setting
10 minutes
Command ModeLine Configuration– 142 –

Chapter 4 | System Management Commands

Line

Command Usage If user input is detected within the timeout interval, the session is kept open;otherwise the session is terminated.
 This command applies to both the local console and Telnet connections.
 The timeout for Telnet cannot be disabled.
 Using the command without specifying a timeout restores the default setting.

ExampleTo set the timeout to two minutes, enter this command:
Console(config-line-console)#exec-timeout 120
Console(config-line-console)#login This command enables password checking at login. Use the no form to disablepassword checking and allow connections without a password.
Syntaxlogin [local]
no loginlocal - Selects local password checking. Authentication is based on the username specified with the username command.
Default Setting
login local
Command ModeLine Configuration
Command Usage There are three authentication modes provided by the switch itself at login:

login selects authentication by a single global password as specified by the
password line configuration command. When using this method, themanagement interface starts in Normal Exec (NE) mode.

login local selects authentication via the user name and password
specified by the username command (i.e., default setting). When using thismethod, the management interface starts in Normal Exec (NE) or Privileged
Exec (PE) mode, depending on the user’s privilege level (0 or 15
respectively).

no login selects no authentication. When using this method, themanagement interface starts in Normal Exec (NE) mode.
– 143 –

Chapter 4 | System Management CommandsLine This command controls login authentication via the switch itself. To configureuser names and passwords for remote authentication servers, you must use the
RADIUS or TACACS software installed on those servers.

ExampleConsole(config-line-console)#login local
Console(config-line-console)#

Related Commands
username (233)
password (145)parity This command defines the generation of a parity bit. Use the no form to restore thedefault setting.
Syntaxparity {none | even | odd}
no parity
none - No parity
even - Even parity
odd - Odd parity
Default Setting
No parity
Command ModeLine Configuration
Command Usage
Communication protocols provided by devices such as terminals and modems
often require a specific parity bit setting.
ExampleTo specify no parity, enter this command:
Console(config-line-console)#parity none
Console(config-line-console)#– 144 –

Chapter 4 | System Management Commands

Line

password This command specifies the password for a line. Use the no form to remove thepassword.
Syntax
password {0 | 7} password
no password{0 | 7} - 0 means plain password, 7 means encrypted password
password - Character string that specifies the line password.
(Maximum length: 32 characters plain text or encrypted, case sensitive)
Default Setting
No password is specified.
Command ModeLine Configuration
Command Usage When a connection is started on a line with password protection, the systemprompts for the password. If you enter the correct password, the system shows
a prompt. You can use the password-thresh command to set the number oftimes a user can enter an incorrect password before the system terminates theline connection and returns the terminal to the idle state.
 The encrypted password is required for compatibility with legacy password

settings (i.e., plain text or encrypted) when reading the configuration file froman FTP/SFTP server during system bootup. There is no need for you to manuallyconfigure encrypted passwords.

ExampleConsole(config-line-console)#password 0 secret
Console(config-line-console)#

Related Commands
login (143)password-thresh (145)

password-thresh This command sets the password intrusion threshold which limits the number offailed logon attempts. Use the no form to remove the threshold value.
Syntax
password-thresh [threshold]no password-thresh
threshold - The number of allowed password attempts. (Range: 1-120; 0: nothreshold)– 145 –

Chapter 4 | System Management Commands

Line

Default Setting
The default value is three attempts.
Command ModeLine Configuration
Command Usage
When the logon attempt threshold is reached, the system interface becomes silent
for a specified amount of time before allowing the next logon attempt. (Use thesilent-time command to set this interval.) When this threshold is reached for Telnet,
the Telnet logon interface shuts down.
ExampleTo set the password threshold to five attempts, enter this command:
Console(config-line-console)#password-thresh 5
Console(config-line-console)#

Related Commands
silent-time (146)silent-time This command sets the amount of time the management console is inaccessible

after the number of unsuccessful logon attempts exceeds the threshold set by the
password-thresh command. Use the no form to remove the silent time value.

Syntaxsilent-time [seconds]
no silent-time
seconds - The number of seconds to disable console response.
(Range: 1-65535; 0 means disabled)
Default Setting
Disabled
Command ModeLine Configuration
ExampleTo set the silent time to 60 seconds, enter this command:
Console(config-line-console)#silent-time 60
Console(config-line-console)#– 146 –

Chapter 4 | System Management Commands

Line

Related Commands
password-thresh (145)

speed This command sets the terminal line’s baud rate. This command sets both thetransmit (to terminal) and receive (from terminal) speeds. Use the no form torestore the default setting.
Syntaxspeed bps
no speedbps - Baud rate in bits per second.
(Options: 9600, 19200, 38400, 57600, 115200 bps)
Default Setting
115200 bps
Command ModeLine Configuration
Command Usage
Set the speed to match the baud rate of the device connected to the serial port.
Some baud rates available on devices connected to the port might not be
supported. The system indicates if the speed you selected is not supported.
ExampleTo specify 57600 bps, enter this command:
Console(config-line-console)#speed 57600
Console(config-line-console)#

stopbits This command sets the number of the stop bits transmitted per byte. Use the noform to restore the default setting.
Syntaxstopbits {1 | 2}
no stopbits
1 - One stop bit
2 - Two stop bits
Default Setting
1 stop bit– 147 –

Chapter 4 | System Management Commands

Line

Command ModeLine Configuration
ExampleTo specify 2 stop bits, enter this command:
Console(config-line-console)#stopbits 2
Console(config-line-console)#

timeout login This command sets the interval that the system waits for a user to log into the CLI.
response Use the no form to restore the default setting.
Syntaxtimeout login response [seconds]
no timeout login response
seconds - Integer that specifies the timeout interval.
(Range: 10 - 300 seconds)
Default Setting
300 seconds
Command ModeLine Configuration
Command Usage If a login attempt is not detected within the timeout interval, the connection is
terminated for the session.
 This command applies to both the local console and Telnet connections.
 The timeout for Telnet cannot be disabled.
 Using the command without specifying a timeout restores the default setting.

ExampleTo set the timeout to two minutes, enter this command:
Console(config-line)#timeout login response 120
Console(config-line)#– 148 –

Chapter 4 | System Management Commands

Line

disconnect This command terminates an SSH, Telnet, or console connection.
Syntaxdisconnect session-id
session-id – The session identifier for an SSH, Telnet or console connection.
(Range: 0-8)
Command Mode
Privileged Exec
Command Usage
Specifying session identifier “0” will disconnect the console connection. Specifying
any other identifiers for an active session will disconnect an SSH or Telnet
connection.
ExampleConsole#disconnect 1
Console#Related Commands
show ssh (273)show users (123)terminal This command configures terminal settings, including escape-character, lines

displayed, terminal type, width, and command history. Use the no form with theappropriate keyword to restore the default setting.
Syntaxterminal {escape-character {ASCII-number | character} | history [size size] |length length | terminal-type {ansi-bbs | vt-100 | vt-102} | width width}
escape-character - The keyboard character used to escape from current
line input.
ASCII-number - ASCII decimal equivalent. (Range: 0-255)
character - Any valid keyboard character.
history - The number of lines stored in the command buffer, and recalledusing the arrow keys. (Range: 0-256)
length - The number of lines displayed on the screen. (Range: 24-200,
where 0 means not to pause)
terminal-type - The type of terminal emulation used.
ansi-bbs - ANSI-BBS
vt-100 - VT-100
vt-102 - VT-102– 149 –

Chapter 4 | System Management Commands

Linewidth - The number of character columns displayed on the terminal.
(Range: 80-300)
Default Setting
Escape Character: 27 (ASCII-number)
History: 10
Length: 24
Terminal Type: VT100
Width: 80
Command Mode
Privileged Exec
ExampleThis example sets the number of lines displayed by commands with lengthy output
such as show running-config to 48 lines.
Console#terminal length 48
Console#show line This command displays the terminal line’s parameters.
Syntaxshow line [console | vty]
console - Console terminal line.
vty - Virtual terminal for remote console access (i.e., Telnet).
Default SettingShows all lines
Command Mode
Normal Exec, Privileged Exec
ExampleTo show all lines, enter this command:
Console#show line
Terminal Configuration for this session:
Length
: 24
Width
: 80
History Size
: 10
Escape Character(ASCII-number) : 27
Terminal Type
: VT100
Console Configuration:
Password Threshold : 3 times
EXEC Timeout: 600 seconds
Login Timeout: 300 seconds– 150 –

Chapter 4 | System Management Commands

Event Logging

Silent Time
Baud Rate
Data Bits
ParityStop Bits: Disabled: 115200: 8: None: 1

VTY Configuration:
Password Threshold : 3 times
EXEC Timeout: 600 seconds
Login Timeout: 300 sec.
Silent Time
: Disabled
Console#Event Logging
This section describes commands used to configure event logging on the switch.
Table 24: Event Logging Commands
CommandFunctionMode

logging command

Stores CLI command execution records in syslog RAM and GC
flash

logging facility

Sets the facility type for remote logging of syslog messages GC

logging history

Limits syslog messages saved to switch memory based on GC
severity

logging host

Adds a syslog server host IP address that will receive
logging messages

GC

logging level

Sets the logging level for user login and log out

GC

logging onControls logging of error messages

GC

logging trap

Limits syslog messages saved to a remote server based on GC
severityclear log

Clears messages from the logging bufferPEshow log

Displays log messages

PEshow logging

Displays the state of logging

PE

logging command This command stores CLI command execution records in syslog RAM and flash. Use
the no form to disable this feature.
Syntax[no] logging command
Default Setting
Disabled
Command Mode
Global Configuration– 151 –

Chapter 4 | System Management Commands
Event Logging
Command Usage
The records stored include the commands executed from the CLI, commandexecution time and information about the CLI user including user name, userinterface (console, Telnet, SSH) and user IP address. The severity level for this record
type is 6 (see the logging facility command).
ExampleConsole(config)#logging facility 19
Console(config)#

logging facility This command sets the facility type for remote logging of syslog messages. Use theno form to return the type to the default.
Syntaxlogging facility typeno logging facility
type - A number that indicates the facility used by the syslog server todispatch log messages to an appropriate service. (Range: 16-23)
Default Setting
23
Command Mode
Global Configuration
Command Usage
The command specifies the facility type tag sent in syslog messages. (See RFC
3164.) This type has no effect on the kind of messages reported by the switch.
However, it may be used by the syslog server to sort messages or to store messages
in the corresponding database.
ExampleConsole(config)#logging facility 19
Console(config)#

logging history This command limits syslog messages saved to switch memory based on severity.
The no form returns the logging of syslog messages to the default level.
Syntaxlogging history {flash | ram} levelno logging history {flash | ram}
flash - Event history stored in flash memory (i.e., permanent memory).
– 152 –

Chapter 4 | System Management Commands

Event Logging

ram - Event history stored in temporary RAM (i.e., memory flushed on
power reset).
level - One of the levels listed below. Messages sent include the selectedlevel down to level 0. (Range: 0-7)
Table 25: Logging Levels
Level

Severity Name

Description

7

debugging

Debugging messages

6

informational

Informational messages only

5

notifications

Normal but significant condition, such as cold start

4

warnings

Warning conditions (e.g., return false, unexpected return)3

errorsError conditions (e.g., invalid input, default used)2

criticalCritical conditions (e.g., memory allocation, or free memory
error - resource exhausted)1

alertsImmediate action needed0

emergencies

System unusable

Default Setting
Flash: errors (level 3 - 0)
RAM: debugging (level 7 - 0)
Command Mode
Global Configuration
Command Usage
The message level specified for flash memory must be a higher priority (i.e.,
numerically lower) than that specified for RAM.
ExampleConsole(config)#logging history ram 0
Console(config)#

logging host This command adds a syslog server host IP address that will receive logging
messages. Use the no form to remove a syslog server host.
Syntaxlogging host host-ip-address [port udp-port]
no logging host host-ip-address
host-ip-address - The IPv4 or IPv6 address of a syslog server.
udp-port - UDP port number used by the remote server. (Range: 1-65535)– 153 –

Chapter 4 | System Management Commands
Event Logging
Default Setting
UPD Port: 514
Command Mode
Global Configuration
Command Usage Use this command more than once to build up a list of host IP addresses.
 The maximum number of host IP addresses allowed is five.

ExampleConsole(config)#logging host 10.1.0.3
Console(config)#

logging level This command sets the syslog logging severity level for user login and log out. Use
the no form to set the logging level to the default value.
Syntaxlogging level {user-login level | user-logout level}
no logging level {user-login | user-logout}user-login - Specifies the level to log when a user logs in.
user-logout - Specifies the level to log when a user logs out.
level - The syslog severity level to log (Range: 1-7)
Default Setting
6
Command Mode
Global Configuration
Command Usage
Logging severity levels are described in Table 25.
ExampleConsole(config)#logging level user-login 5
Console(config)#– 154 –

Chapter 4 | System Management Commands

Event Logging

logging on This command controls logging of error messages, sending debug or error
messages to a logging process. The no form disables the logging process.
Syntax[no] logging on
Default Setting
None
Command Mode
Global Configuration
Command Usage
The logging process controls error messages saved to switch memory or sent toremote syslog servers. You can use the logging history command to control thetype of error messages that are stored in memory. You can use the logging trap
command to control the type of error messages that are sent to specified syslog
servers.
ExampleConsole(config)#logging on
Console(config)#

Related Commands
logging history (152)
logging trap (155)clear log (156)

logging trap This command enables the logging of system messages to a remote server, or

limits the syslog messages saved to a remote server based on severity. Use thiscommand without a specified level to enable remote logging. Use the no form todisable remote logging.
Syntaxlogging trap [level level]
no logging trap [level]
level - One of the syslog severity levels listed in the table on page 152.
Messages sent include the selected level through level 0.

Default Setting
Disabled
Level 7
Command Mode
Global Configuration– 155 –

Chapter 4 | System Management Commands
Event Logging
Command Usage Using this command with a specified level enables remote logging and sets theminimum severity level to be saved.
 Using this command without a specified level also enables remote logging, but

restores the minimum severity level to the default.

ExampleConsole(config)#logging trap level 4
Console(config)#

clear log This command clears messages from the log buffer.
Syntaxclear log [flash | ram]
flash - Event history stored in flash memory (i.e., permanent memory).
ram - Event history stored in temporary RAM (i.e., memory flushed on
power reset).
Default Setting
Flash and RAM
Command Mode
Privileged Exec
ExampleConsole#clear log
Console#Related Commands
show log (156)show log This command displays the log messages stored in local memory.
Syntaxshow log {flash | ram} [word | login]– 156 –

Chapter 4 | System Management Commands

Event Logging

flash - Event history stored in flash memory (i.e., permanent memory).
ram - Event history stored in temporary RAM (i.e., memory flushed on
power reset).
word - Specifies query function information
login - Shows the contents of login buffers
Default Setting
None
Command Mode
Privileged Exec
Command Usage All log messages are retained in RAM and Flash after a warm restart (i.e., power
is reset through the command interface).
 All log messages are retained in Flash and purged from RAM after a cold restart(i.e., power is turned off and then on through the power source).

ExampleThe following example shows the event message stored in RAM.
Console#show log ram[1] 00:01:30 2001-01-01"VLAN 1 link-up notification."level: 6, module: 5, function: 1, and event no.: 1[0] 00:01:30 2001-01-01"Unit 1, Port 1 link-up notification."level: 6, module: 5, function: 1, and event no.: 1
Console#show logging This command displays the configuration settings for logging messages to local
switch memory, to an SMTP event handler, or to a remote syslog server.
Syntaxshow logging {level | flash | ram | sendmail | trap}– 157 –

Chapter 4 | System Management Commands
Event Logging
level - Displays logging levels for user login and log out.
flash - Displays settings for storing event messages in flash memory(i.e., permanent memory).
ram - Displays settings for storing event messages in temporary RAM(i.e., memory flushed on power reset).
sendmail - Displays settings for the SMTP event handler (page 162).
trap - Displays settings for the trap function.
Default Setting
None
Command Mode
Privileged Exec
ExampleThe following example shows that system logging is enabled, the message level for
flash memory is “errors” (i.e., default level 3 - 0), and the message level for RAM is“debugging” (i.e., default level 7 - 0).
Console#show logging flash
Global Configuration:
Syslog Logging: Enabled
Flash Logging Configuration:
History Logging in Flash : Level Errors (3)Console#show logging ram
Global Configuration:
Syslog Logging: Enabled
Ram Logging Configuration:
History Logging in RAM: Level Debugging (7)Console#Table 26: show logging flash/ram - display description
Field

Description

Syslog Logging

Shows if system logging has been enabled via the logging oncommand.

History Logging in FlashThe message level(s) reported based on the logging history command.

History Logging in RAM

The message level(s) reported based on the logging history command.

The following example displays settings for the trap function.
Console#show logging trap
Global Configuration:
Syslog Logging: Enabled
Remote Logging Configuration:
Status: Disabled
Facility Type: Local use 7 (23)– 158 –

Chapter 4 | System Management Commands
SMTP Alerts

Level Type
Console#: Debugging messages (7)Table 27: show logging trap - display description
Field

Description

Global Configuration
Syslog logging

Shows if system logging has been enabled via the logging oncommand.

Remote Logging Configuration
StatusShows if remote logging has been enabled via the logging trap
command.

Facility TypeThe facility type for remote logging of syslog messages as specified in
the logging facility command.

Level TypeThe severity threshold for syslog messages sent to a remote server as
specified in the logging trap command.

Related Commands
show logging sendmail (162)

SMTP Alerts
These commands configure SMTP event handling, and forwarding of alert
messages to the specified SMTP servers and email recipients.
Table 28: Event Logging Commands
CommandFunctionMode

logging sendmail

Enables SMTP event handlingGC

logging sendmail
destination-email

Email recipients of alert messages

GC

logging sendmail host

SMTP servers to receive alert messages

GC

logging sendmail level

Severity threshold used to trigger alert messages

GC

logging sendmail sourceemail

Email address used for “From” field of alert messages

GCshow logging sendmail

Displays SMTP event handler settingsPElogging sendmail This command enables SMTP event handling. Use the no form to disable thisfunction.
Syntax[no] logging sendmail– 159 –

Chapter 4 | System Management Commands

SMTP Alerts

Default Setting
EnabledCommand Mode
Global Configuration
ExampleConsole(config)#logging sendmail
Console(config)#

logging sendmail This command specifies the email recipients of alert messages. Use the no form todestination-email remove a recipient.
Syntax[no] logging sendmail destination-email email-addressemail-address - The source email address used in alert messages.
(Range: 1-41 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
You can specify up to five recipients for alert messages. However, you must enter aseparate command to specify each recipient.
ExampleConsole(config)#logging sendmail destination-email ted@this-company.com
Console(config)#

logging sendmail host This command specifies SMTP servers that will be sent alert messages. Use the noform to remove an SMTP server.
Syntax[no] logging sendmail host ip-address
ip-address - IPv4 address of an SMTP server that will be sent alert messages
for event handling.
Default SettingNone– 160 –

Chapter 4 | System Management Commands
SMTP Alerts

Command Mode
Global Configuration
Command Usage You can specify up to three SMTP servers for event handing. However, you mustenter a separate command to specify each server.
 To send email alerts, the switch first opens a connection, sends all the email

alerts waiting in the queue one by one, and finally closes the connection.

 To open a connection, the switch first selects the server that successfully sent

mail during the last connection, or the first server configured by this command.
If it fails to send mail, the switch selects the next server in the list and tries tosend mail again. If it still fails, the system will repeat the process at a periodic
interval. (A trap will be triggered if the switch cannot successfully open aconnection.)

ExampleConsole(config)#logging sendmail host 192.168.1.19
Console(config)#

logging sendmail level This command sets the severity threshold used to trigger alert messages. Use theno form to restore the default setting.
Syntaxlogging sendmail level levelno logging sendmail level
level - One of the system message levels (page 152). Messages sent include
the selected level down to level 0. (Range: 0-7; Default: 7)
Default Setting
Level 7
Command Mode
Global Configuration
Command Usage
The specified level indicates an event threshold. All events at this level or higher will
be sent to the configured email recipients. (For example, using Level 7 will report all
events from level 7 to level 0.)– 161 –

Chapter 4 | System Management Commands

SMTP Alerts

ExampleThis example will send email alerts for system errors from level 3 through 0.
Console(config)#logging sendmail level 3
Console(config)#

logging sendmail This command sets the email address used for the “From” field in alert messages.
source-email Use the no form to restore the default value.
Syntaxlogging sendmail source-email email-address
no logging sendmail source-email
email-address - The source email address used in alert messages.
(Range: 1-41 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
You may use an symbolic email address that identifies the switch, or the address ofan administrator responsible for the switch.
ExampleConsole(config)#logging sendmail source-email bill@this-company.com
Console(config)#show logging This command displays the settings for the SMTP event handler.
sendmail
Command Mode
Privileged Exec
ExampleConsole#show logging sendmail
SMTP Servers----------------------------------------------192.168.1.19
SMTP Minimum Severity Level: 7
SMTP Destination E-mail Addresses----------------------------------------------ted@this-company.com– 162 –

Chapter 4 | System Management Commands

Time

SMTP Source E-mail Address: bill@this-company.com
SMTP Status: Enabled
Console#Time
The system clock can be dynamically set by polling a set of specified time servers(NTP or SNTP). Maintaining an accurate time on the switch enables the system log
to record meaningful dates and times for event entries. If the clock is not set, theswitch will only record the time from the factory default set at the last bootup.
Table 29: Time Commands
CommandFunctionModesntp client

Accepts time from specified time servers

GC

sntp poll

Sets the interval at which the client polls for timeGC

sntp server

Specifies one or more time servers

GCshow sntp

Shows current SNTP configuration settingsPE

ntp authenticate

Enables authentication for NTP trafficGC

ntp authentication-key

Configures authentication keysGC

ntp client

Enables the NTP client for time updates from specified
serversGC

ntp server

Specifies NTP servers to poll for time updates

GC

show ntp

Shows current NTP configuration settingsPEshow ntp status

Shows the status of time updates

PEshow ntp statistics peerShows statistics from an NTP peerPEshow ntp peer-status

Shows the status of connections to NTP peers

PE

SNTP Commands

NTP Commands

Manual Configuration Commands
clock summer-time (date)

Configures summer time* for the switch’s internal clock

GC

clock summer-time(predefined)

Configures summer time* for the switch’s internal clock

GC

clock summer-time(recurring)

Configures summer time* for the switch’s internal clock

GC

clock timezone

Sets the time zone for the switch’s internal clock

GC

clock timezone-predefined Sets the time zone for the switch’s internal clock from a list GC
of predefined time zones
calendar set

Sets the system date and timePE

show calendar

Displays the current date and time setting

NE, PE– 163 –

Chapter 4 | System Management Commands

Time* Daylight savings time.

SNTP Commands

sntp client This command enables SNTP client requests for time synchronization from NTP or
SNTP time servers specified with the sntp server command. Use the no form todisable SNTP client requests.
Syntax[no] sntp client
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage The time acquired from time servers is used to record accurate dates and times
for log events. Without SNTP, the switch only records the time starting from thefactory default set at the last bootup (e.g., Dec 31 07:32:04 2014).
 This command enables client time requests to time servers specified via thesntp server command. It issues time synchronization requests based on theinterval set via the sntp poll command.

ExampleConsole(config)#sntp server 10.1.0.19
Console(config)#sntp poll 60
Console(config)#sntp client
Console(config)#end
Console#show sntp
Current Time: Dec 23 02:52:44 2015
Poll Interval: 60
Current Mode: Unicast
SNTP Status : Enabled
SNTP Server 137.92.140.80
Current Server: 137.92.140.80
Console#Related Commands
sntp server (165)
sntp poll (165)show sntp (166)– 164 –

Chapter 4 | System Management Commands

Timesntp poll This command sets the interval between sending time requests when the switch is
set to SNTP client mode. Use the no form to restore to the default.
Syntaxsntp poll seconds
no sntp pollseconds - Interval between time requests. (Range: 16-16384 seconds)
Default Setting
16 seconds
Command Mode
Global Configuration
ExampleConsole(config)#sntp poll 60
Console#Related Commands
sntp client (164)sntp server This command sets the IP address of the servers to which SNTP time requests areissued. Use the this command with no arguments to clear all time servers from thecurrent list. Use the no form to clear all time servers from the current list, or to clear
a specific server.
Syntaxsntp server [ip1 [ip2 [ip3]]]
no sntp server [ip1 [ip2 [ip3]]]
ip - IPv4 or IPv6 address of a time server (NTP or SNTP).
(Range: 1 - 3 addresses)

Default Setting
None
Command Mode
Global Configuration
Command Usage
This command specifies time servers from which the switch will poll for time
updates when set to SNTP client mode. The client will poll the time servers in theorder specified until a response is received. It issues time synchronization requests
based on the interval set via the sntp poll command.

– 165 –

Chapter 4 | System Management Commands

Time

ExampleConsole(config)#sntp server 10.1.0.19
Console#Related Commands
sntp client (164)sntp poll (165)show sntp (166)show sntp This command displays the current time and configuration settings for the SNTP
client, and indicates whether or not the local time has been properly updated.
Command Mode
Normal Exec, Privileged Exec
Command Usage
This command displays the current time, the poll interval used for sending timesynchronization requests, and the current SNTP mode (i.e., unicast).
ExampleConsole#show sntp
Current Time
: Nov 5 18:51:22 2015
Poll Interval : 16 seconds
Current Mode
: Unicast
SNTP Status: Enabled
SNTP Server: 137.92.140.80: 137.92.140.90: 137.92.140.99
Current Server : 137.92.140.80
Console#NTP Commands

ntp authenticate This command enables authentication for NTP client-server communications. Use
the no form to disable authentication.
Syntax[no] ntp authenticate
Default Setting
Disabled
Command Mode
Global Configuration– 166 –

Chapter 4 | System Management Commands

Time

Command Usage
You can enable NTP authentication to ensure that reliable updates are received
from only authorized NTP servers. The authentication keys and their associated key
number must be centrally managed and manually distributed to NTP servers andclients. The key numbers and key values must match on both the server and client.
ExampleConsole(config)#ntp authenticate
Console(config)#

Related Commands
ntp authentication-key (167)

ntp This command configures authentication keys and key numbers to use when NTP
authentication-key authentication is enabled. Use the no form of the command to clear a specificauthentication key or all keys from the current list.
Syntaxntp authentication-key number md5 key
no ntp authentication-key [number]number - The NTP authentication key ID number. (Range: 1-65533)
md5 - Specifies that authentication is provided by using the message
digest algorithm 5.
key - An MD5 authentication key string. The key string can be up to 32 casesensitive printable ASCII characters (no spaces).
Default Setting
None
Command Mode
Global Configuration
Command Usage The key number specifies a key value in the NTP authentication key list. Up to
255 keys can be configured on the switch. Re-enter this command for eachserver you want to configure.
 Note that NTP authentication key numbers and values must match on both theserver and client.

 NTP authentication is optional. When enabled with the ntp authenticate

command, you must also configure at least one key number using thiscommand.

– 167 –

Chapter 4 | System Management Commands

Time Use the no form of this command without an argument to clear all

authentication keys in the list.

ExampleConsole(config)#ntp authentication-key 45 md5 thisiskey45
Console(config)#

Related Commands
ntp authenticate (166)

ntp client This command enables NTP client requests for time synchronization from NTP time
servers specified with the ntp servers command. Use the no form to disable NTP
client requests.
Syntax[no] ntp client
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage The SNTP and NTP clients cannot be enabled at the same time. First disable the
SNTP client before using this command.
 The time acquired from time servers is used to record accurate dates and times

for log events. Without NTP, the switch only records the time starting from thefactory default set at the last bootup (e.g., Dec 10 16:04:43 2014).

 This command enables client time requests to time servers specified via thentp servers command. Once enabled the switch will issue timesynchronization requests periodically.

ExampleConsole(config)#ntp client
Console(config)#

Related Commands
sntp client (164)
ntp server (169)– 168 –

Chapter 4 | System Management Commands

Time

ntp server This command sets the IP addresses of the servers to which NTP time requests aresent to. Use the no form of the command to clear a specific time server or all servers
from the current list.
Syntaxntp server ip-address [key key-number]
no ntp server [ip-address]
ip-address - IP address of an NTP time server.
key-number - The number of an authentication key to use incommunications with the server. (Range: 1-65535)
Default Setting
Version number: 3
Command Mode
Global Configuration
Command Usage This command specifies time servers that the switch will poll for time updates

when set to NTP client mode. The client will poll all the time servers configured,
the responses received are filtered and compared to determine the mostreliable and accurate time update for the switch.

 You can configure up to 3 NTP servers on the switch. Re-enter this commandfor each server you want to configure.

 NTP authentication is optional. If enabled with the ntp authenticate

command, you must also configure at least one key number using the ntp
authentication-key command.

 Use the no form of this command without an argument to clear all configured

servers in the list.

ExampleConsole(config)#ntp server 192.168.3.20
Console(config)#ntp server 192.168.3.21
Console(config)#ntp server 192.168.5.23 key 19
Console(config)#

Related Commands
ntp client (168)show ntp peer-status (171)– 169 –

Chapter 4 | System Management Commands

Timeshow ntp This command displays the current time and configuration settings for the NTP

client, and indicates whether or not the local time has been properly updated froman NTP server.
Command Mode
Privileged Exec
Command Usage
This command displays the current time, the poll interval used for sending timesynchronization requests, and the current NTP mode (i.e., unicast).
ExampleConsole#show ntp
Current Time: Apr 29 13:57:32 2015
Polling Interval: 1024 seconds
Current Mode
: unicastNTP Status: Disabled
NTP Authenticate Status : Enabled
Last Update NTP Server: 0.0.0.0
Port: 0Last Update Time
: Jan 1 00:00:00 1970 UTC
NTP Server 192.168.3.20 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.4.22 version 3 key 19
NTP Authentication Key 19 md5 42V68751663T6K11P2J307210R885
Console#show ntp status This command displays the current status of received time updates from an NTP
peer.

Command Mode
Privileged Exec
ExampleConsole#show ntp status
System Peer
: 192.168.125.88
Leap Indicator : 11
Stratum: 14
Precision: 0.000001907349 seconds
Root Distance: 0.001160 seconds
Root Dispersion : 0.948900 seconds
Reference ID: 192.168.125.88
Reference Time : e0c697a3.6b04c19f Wed, Jul
Console#3 20192:55:31.418

show ntp statistics This command displays the statistics from an NTP peer.
peer
Syntaxshow ntp statistics peer {ip-address | ipv6-address | hostname}– 170 –

Chapter 4 | System Management Commands

Time

ip-address - IP address of an NTP peer.
ipv6-address - IPv6 address of an NTP peer.
hostname - Host name of an NTP peer.
Command Mode
Privileged Exec
ExampleConsole#show ntp statistics Peer 192.168.125.88
Remote Host
: 192.168.125.88
Local Interface: 192.168.125.138
Time Last Received: 223 seconds
Time Until Next Send : 772 seconds
Reachability Change : 229 seconds
Packets Sent
: 8
Packets Received: 8
Bad Authentication: 0
Bogus Origin: 0
Duplicate: 0
Bad Dispersion: 0
Bad Reference Time
: 0
Candidate Order: 6
Console#show ntp peer-status This command displays the status of connections to NTP peers.
Syntaxshow ntp peer-status [ip-address | ipv6-address | hostname]ip-address - IP address of an NTP time server.
ipv6-address - IPv6 address of an NTP time server.
hostname - Host name of an NTP time server.
Command Mode
Privileged Exec
ExampleConsole#show ntp peer-status* : system peer
Remote Host
Local Interface St Poll
Reach Delay
OffsetDispersion---------------- --------------- -- ------ ----- -------- -------- ---------1.1.1.1
0.0.0.0
161024
0 0.000000 0.00000 3.99217010
192.168.1.10
0.0.0.0
161024
0 0.000000 0.00000 3.99217010*192.168.125.88 192.168.125.138 131024
1 0.001160 -0.00011 0.96824998
Console#– 171 –

Chapter 4 | System Management Commands

Time

Manual Configuration Commands

clock summer-time This command sets the start, end, and offset times of summer time (daylight(date) savings time) for the switch on a one-time basis. Use the no form to disable
summer time.
Syntaxclock summer-time name date b-date b-month b-year b-hour b-minute e-datee-month e-year e-hour e-minute [offset]
no clock summer-time
name - Name of the time zone while summer time is in effect, usually anacronym. (Range: 1-30 characters)
b-date - Day of the month when summer time will begin. (Range: 1-31)
b-month - The month when summer time will begin. (Options: january |february | march | april | may | june | july | august | september | october| november | december)b-year- The year summer time will begin.
b-hour - The hour summer time will begin. (Range: 0-23 hours)b-minute - The minute summer time will begin. (Range: 0-59 minutes)
e-date - Day of the month when summer time will end. (Range: 1-31)
e-month - The month when summer time will end. (Options: january |february | march | april | may | june | july | august | september | october| november | december)e-year - The year summer time will end.
e-hour - The hour summer time will end. (Range: 0-23 hours)
e-minute - The minute summer time will end. (Range: 0-59 minutes)
offset - Summer time offset from the regular time zone, in minutes.
(Range: 1-120 minutes)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage In some countries or regions, clocks are adjusted through the summer months
so that afternoons have more daylight and mornings have less. This is known as
Summer Time, or Daylight Savings Time (DST). Typically, clocks are adjusted
forward one hour at the start of spring and then adjusted backward in autumn.
 This command sets the summer-time time zone relative to the currently

configured time zone. To specify a time corresponding to your local time when
– 172 –

Chapter 4 | System Management Commands

Timesummer time is in effect, you must indicate the number of minutes yoursummer-time time zone deviates from your regular time zone (that is, theoffset).
ExampleThe following example sets the 2014 Summer Time ahead by 60 minutes on March
9th and returns to normal time on November 2nd.
Console(config)#clock summer-time DEST date march 9 2014 01 59 november 2
2014 01 59 60
Console(config)#

Related Commands
show sntp (166)clock summer-time This command configures the summer time (daylight savings time) status and(predefined) settings for the switch using predefined configurations for several major regions in
the world. Use the no form to disable summer time.
Syntaxclock summer-time name predefined [australia | europe | new-zealand |usa]
no clock summer-time
name - Name of the timezone while summer time is in effect, usually anacronym. (Range: 1-30 characters)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage In some countries or regions, clocks are adjusted through the summer months
so that afternoons have more daylight and mornings have less. This is known as
Summer Time, or Daylight Savings Time (DST). Typically, clocks are adjusted
forward one hour at the start of spring and then adjusted backward in autumn.
 This command sets the summer-time time relative to the configured time zone.

To specify the time corresponding to your local time when summer time is ineffect, select the predefined summer-time time zone appropriate for yourlocation, or manually configure summer time if these predefined
configurations do not apply to your location (see clock summer-time (date) orclock summer-time (recurring).

– 173 –

Chapter 4 | System Management Commands

Time

Table 30: Predefined Summer-Time Parameters
RegionStart Time, Day,
Week, & Month

End Time, Day,
Week, & Month

Rel. Offset

Australia

00:00:00, Sunday,
Week 5 of October

23:59:59, Sunday,
Week 5 of March

60 minEurope00:00:00, Sunday,
Week 5 of March

23:59:59, Sunday,
Week 5 of October

60 minNew Zealand

00:00:00, Sunday,
Week 1 of October

23:59:59, Sunday,
Week 3 of March

60 minUSA

00:00:00, Sunday,
Week 2 of March

23:59:59, Sunday,
Week 1 of November

60 minExampleThe following example sets the Summer Time setting to use the predefinedsettings for the European region.
Console(config)#clock summer-time MESZ predefined europe
Console(config)#

Related Commands
show sntp (166)clock summer-time This command allows the user to manually configure the start, end, and offset(recurring) times of summer time (daylight savings time) for the switch on a recurring basis.
Use the no form to disable summer-time.
Syntaxclock summer-time name recurring b-week b-day b-month b-hour b-minute eweek e-day e-month e-hour e-minute [offset]
no clock summer-time
name - Name of the timezone while summer time is in effect, usually anacronym. (Range: 1-30 characters)
b-week - The week of the month when summer time will begin. (Range: 1-5)
b-day - The day of the week when summer time will begin. (Options:sunday | monday | tuesday | wednesday | thursday | friday | saturday)
b-month - The month when summer time will begin. (Options: january |february | march | april | may | june | july | august | september | october| november | december)b-hour - The hour when summer time will begin. (Range: 0-23 hours)b-minute - The minute when summer time will begin. (Range: 0-59 minutes)
e-week - The week of the month when summer time will end. (Range: 1-5)

– 174 –

Chapter 4 | System Management CommandsTimee-day - The day of the week summer time will end. (Options: sunday |monday | tuesday | wednesday | thursday | friday | saturday)
e-month - The month when summer time will end. (Options: january |february | march | april | may | june | july | august | september | october| november | december)e-hour - The hour when summer time will end. (Range: 0-23 hours)
e-minute - The minute when summer time will end. (Range: 0-59 minutes)
offset - Summer-time offset from the regular time zone, in minutes.
(Range: 1-120 minutes)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage In some countries or regions, clocks are adjusted through the summer months
so that afternoons have more daylight and mornings have less. This is known as
Summer Time, or Daylight Savings Time (DST). Typically, clocks are adjusted
forward one hour at the start of spring and then adjusted backward in autumn.
 This command sets the summer-time time zone relative to the currently

configured time zone. To display a time corresponding to your local time whensummer time is in effect, you must indicate the number of minutes yoursummer-time time zone deviates from your regular time zone (that is, theoffset).

ExampleThe following example sets a recurring 60 minute offset summer-time to begin on
the Friday of the 1st week of March at 01:59 hours and summer time to end on the
Saturday of the 2nd week of November at 01:59 hours.
Console(config)#clock summer-time MESZ recurring 1 friday march 01 59 3
saturday november 1 59 60
Console(config)#

Related Commands
show sntp (166)clock timezone This command sets the time zone for the switch’s internal clock.
Syntaxclock timezone name hour hours minute minutes{before-utc | after-utc}– 175 –

Chapter 4 | System Management Commands

Time

name - Name of timezone, usually an acronym. (Range: 1-30 characters)
hours - Number of hours before/after UTC. (Range: 0-12 hours before UTC,
0-13 hours after UTC)
minutes - Number of minutes before/after UTC. (Range: 0-59 minutes)
before-utc - Sets the local time zone before (east) of UTC.
after-utc - Sets the local time zone after (west) of UTC.
Default Setting
None
Command Mode
Global Configuration
Command Usage
This command sets the local time zone relative to the Coordinated Universal Time
(UTC, formerly Greenwich Mean Time or GMT), based on the earth’s prime meridian,zero degrees longitude. To display a time corresponding to your local time, youmust indicate the number of hours and minutes your time zone is east (before) or
west (after) of UTC.
ExampleConsole(config)#clock timezone Japan hours 8 minute 0 after-UTC
Console(config)#

Related Commands
show sntp (166)clock timezone- This command sets the time zone for the switch’s internal clock from a set ofpredefined predefined time zones.
Syntaxclock timezone-predefined timezone
timezone - Name of timezone as listed in the list in the command usage
section.
Default Setting
None
Command Mode
Global Configuration
Command Usage
This command sets the local time zone by selecting a pre-defined GMT zone with ageographical description.
– 176 –

Chapter 4 | System Management Commands

Time

Select one time zone from the following list to use as the timezone parameter withthe command:
GMT+0100-Amsterdam,Berlin,Bern,Rome,Stockholm,Vienna
GMT+0100-Belgrade,Bratislava,Budapest,Ljubljana,Prague
GMT+0100-Brussels,Copenhagen,Madrid,Paris
GMT+0100-Sarajevo,Skopje,Warsaw,Zagreb
GMT+0100-WestCentralAfrica
GMT+0200-Athens,Beirut,Istanbul,Minsk
GMT+0200-Bucharest
GMT+0200-Cairo
GMT+0200-Harare,Pretoria
GMT+0200-Helsinki,Kyiv,Riga,Sofia,Tallinn,Vilnius
GMT+0200-Jerusalem
GMT+0300-Baghdad
GMT+0300-Kuwait,Riyadh
GMT+0300-Moscow,St.Petersburg,Volgograd
GMT+0300-Nairobi
GMT+0330-Tehran
GMT+0400-Abu-Dhabi,Muscat
GMT+0400-Baku,Tbilisi,Yerevan
GMT+0430-Kabul
GMT+0500-Ekaterinburg
GMT+0500-Islamabad,Karachi,Tashkent
GMT+0530-Chennai,Calcuta,Mumbai,New-Delhi
GMT+0545-Kathmandu
GMT+0600-Almaty,Novosibirsk
GMT+0600-Astana,Dhaka
GMT+0600-Sri-Jayawardenepura
GMT+0630-Rangoon
GMT+0700-Bangkok,Hanoi,Jakarta
GMT+0700-Krasnoyarsk
GMT+0800-Beijing,Chongqing,Hong-Kong,Urumqi
GMT+0800-Irkutsk,Ulaan-Bataar
GMT+0800-Kuala-Lumpur,Singapore
GMT+0800-Perth
GMT+0800-Taipei
GMT+0900-Osaka,Sapporo,Tokyo
GMT+0900-Seoul
GMT+0900-Yakutsk
GMT+0930-Adelaide
GMT+0930-Darwin
GMT+1000-Brisbane
GMT+1000-Canberra,Melbourne,Sydney
GMT+1000-Guam,PortMoresby
GMT+1000-Hobart
GMT+1000-Vladivostok
GMT+1030-Lord-Howe-Island
GMT+1100-Magadan,Solomon-Is.,New-Caledonia
GMT+1130-Kingston
GMT+1200-Auckland,Wellington
GMT+1200-Fiji,Kamchatka,Marshall-Is
GMT+1245-Chatham-Island
GMT+1300-Nuku'alofa
GMT+1400-Kiritimati
GMT-0100-Azores
GMT-0100-Cape-Verde-Is
GMT-0200-Mid-Atlantic
GMT-0300-Brasilia– 177 –

Chapter 4 | System Management Commands

Time

GMT-0300-Buenos-Aires,Georgetown
GMT-0300-Greenland
GMT-0330-Newfoundland
GMT-0400-Atlantic-Time(Canada)
GMT-0400-Caracas,La-Paz
GMT-0400-Santiago
GMT-0500-Bogota,Lima,Quito
GMT-0500-Eastern-Time(US&Canada)
GMT-0500-Indiana(East)
GMT-0600-Central-America
GMT-0600-Central-Time(US&Canada)
GMT-0600-Guadalajara,Mexico-City,Monterrey
GMT-0600-Saskatchewan
GMT-0700-Arizona
GMT-0700-Chihuahua,La-Paz,Mazatlan
GMT-0700-Mountain-Time(US&Canada)
GMT-0800-Pacific-Time(US&Canada),Tijuana
GMT-0900-Alaska
GMT-0930-Taiohae
GMT-1000-Hawaii
GMT-1100-Midway-Island,Samoa
GMT-1200-International-Date-Line-West
GMT-Casablanca,Monrovia
GMT-Greenwich-Mean-Time-Dublin,Edinburgh,Lisbon,London

ExampleThis example sets the timezone to GMT+1030-Lord-Howe-Island and shows theresult.

Console(config)#clock timezone-predefined GMT+1030-Lord-Howe-Island
Console(config)#end
Console#show calendar
Current Time
: May 31 18:22:21 2018
Time Zone: GMT+1030-LordHoweIsland
Summer Time: Not configured
Summer Time in Effect : No
Console#– 178 –

Chapter 4 | System Management CommandsTime

calendar set This command sets the system clock. It may be used if there is no time server on
your network, or if you have not configured the switch to receive signals from atime server.
Syntaxcalendar set hour min sec {day month year | month day year}
hour - Hour in 24-hour format. (Range: 0 - 23)
min - Minute. (Range: 0 - 59)
sec - Second. (Range: 0 - 59)
day - Day of month. (Range: 1 - 31)
month - january | february | march | april | may | june | july | august |september | october | november | december
year - Year (4-digit). (Range: 1970 - 2037)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Note that when SNTP is enabled, the system clock cannot be manually configured.
ExampleThis example shows how to set the system clock to 15:12:34, February 1st, 2015.
Console#calendar set 15 12 34 1 February 2015
Console#show calendar This command displays the system clock.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show calendar
Current TimeTime Zone
Summer Time

: May 13 14:08:18 2014
: UTC, 08:00: Not configured– 179 –

Chapter 4 | System Management Commands

Time Range

Summer Time in Effect : No
Console#Time Range
This section describes the commands used to sets a time range for use by otherfunctions, such as Access Control Lists.
Table 31: Time Range Commands
CommandFunctionModetime-range

Specifies the name of a time range, and enters time range GC
configuration mode

absolute

Sets the absolute time range for the execution of acommandTR

periodic

Sets the time range for the periodic execution of acommandTRshow time-range

Shows configured time ranges.

PEtime-range This command specifies the name of a time range, and enters time range

configuration mode. Use the no form to remove a previously specified time range.
Syntax[no] time-range namename - Name of the time range. (Range: 1-32 characters)

Default Setting
None
Command Mode
Global Configuration
Command Usage This command sets a time range for use by other functions, such as AccessControl Lists.
 A maximum of eight rules can be configured for a time range.

ExampleConsole(config)#time-range r&d
Console(config-time-range)#

Related Commands
Access Control Lists (387)– 180 –

Chapter 4 | System Management Commands

Time Range

absolute This command sets the absolute time range for the execution of a command. Use
the no form to remove a previously specified time.
Syntaxabsolute start hour minute day month year
[end hour minutes day month year]
absolute end hour minutes day month year
no absolutehour - Hour in 24-hour format. (Range: 0-23)
minute - Minute. (Range: 0-59)
day - Day of month. (Range: 1-31)
month - january | february | march | april | may | june | july | august |september | october | november | december
year - Year (4-digit). (Range: 2013-2037)
Default Setting
None
Command Mode
Time Range Configuration
Command Usage If a time range is already configured, you must use the no form of thiscommand to remove the current entry prior to configuring a new time range.
 If both an absolute rule and one or more periodic rules are configured for thesame time range (i.e., named entry), that entry will only take effect if the current
time is within the absolute time range and one of the periodic time ranges.

ExampleThis example configures the time for the single occurrence of an event.
Console(config)#time-range r&d
Console(config-time-range)#absolute start 1 1 1 april 2009 end 2 1 1 april
2009
Console(config-time-range)#– 181 –

Chapter 4 | System Management Commands

Time Range

periodic This command sets the time range for the periodic execution of a command. Use
the no form to remove a previously specified time range.
Syntax[no] periodic {daily | friday | monday | saturday | sunday | thursday |tuesday | wednesday | weekdays | weekend} hour minute to {daily | friday |monday | saturday | sunday | thursday | tuesday | wednesday | weekdays| weekend | hour minute}daily - Daily
friday - Friday
monday - Monday
saturday - Saturday
sunday - Sunday
thursday - Thursday
tuesday - Tuesday
wednesday - Wednesday
weekdays - Weekdays
weekend - Weekends
hour - Hour in 24-hour format. (Range: 0-23)
minute - Minute. (Range: 0-59)
Default Setting
None
Command Mode
Time Range Configuration
Command Usage If a time range is already configured, you must use the no form of thiscommand to remove the current entry prior to configuring a new time range.
 If both an absolute rule and one or more periodic rules are configured for thesame time range (i.e., named entry), that entry will only take effect if the current
time is within the absolute time range and one of the periodic time ranges.

ExampleThis example configures a time range for the periodic occurrence of an event.
Console(config)#time-range sales
Console(config-time-range)#periodic daily 1 1 to 2 1
Console(config-time-range)#– 182 –

Chapter 4 | System Management Commands

Switch Clusteringshow time-range This command shows configured time ranges.
Syntaxshow time-range [name]name - Name of the time range. (Range: 1-32 characters)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show time-range r&d
Time-range r&d:
status: inactive
absolute start 01:01 01 April 2015
periodic
Daily 01:01 to
Daily 02:01
periodic
Daily 02:01 to
Daily 03:01
Console#Switch Clustering
Switch Clustering is a method of grouping switches together to enable centralized
management through a single unit. Switches that support clustering can begrouped together regardless of physical location or switch type, as long as they areconnected to the same local network.
Table 32: Switch Cluster Commands
CommandFunctionModecluster

Configures clustering on the switchGC

cluster commander

Configures the switch as a cluster CommanderGC

cluster ip-pool

Sets the cluster IP address pool for Members

GC

cluster member

Sets Candidate switches as cluster members

GCrcommand

Provides configuration access to Member switchesPEshow cluster

Displays the switch clustering statusPE

show cluster members

Displays current cluster Members

PEshow cluster candidates

Displays current cluster Candidates in the network

PE

Using Switch Clustering A switch cluster has a primary unit called the “Commander” which is used to

manage all other “Member” switches in the cluster. The management station– 183 –

Chapter 4 | System Management Commands
Switch Clustering
can use either Telnet or the web interface to communicate directly with theCommander through its IP address, and then use the Commander to manage
the Member switches through the cluster’s “internal” IP addresses.
 Clustered switches must be in the same Ethernet broadcast domain. In otherwords, clustering only functions for switches which can pass information
between the Commander and potential Candidates or active Members
through VLAN 4093.

 Once a switch has been configured to be a cluster Commander, it automaticallydiscovers other cluster-enabled switches in the network. These “Candidate”
switches only become cluster Members when manually selected by theadministrator through the management station.

 The cluster VLAN 4093 is not configured by default. Before using clustering,take the following actions to set up this VLAN:

1. Create VLAN 4093 (see “Editing VLAN Groups” on page 570).
2. Add the participating ports to this VLAN (see “Configuring VLAN Interfaces”
on page 572), and set them to hybrid mode, tagged members, PVID = 1,
and acceptable frame type = all.

Note: Cluster Member switches can be managed either through a Telnet
connection to the Commander, or through a web management connection to the
Commander. When using a console connection, from the Commander CLI prompt,
use the rcommand to connect to the Member switch.

cluster This command enables clustering on the switch. Use the no form to disable
clustering.
Syntax[no] cluster
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage To create a switch cluster, first be sure that clustering is enabled on the switch(the default is disabled), then set the switch as a Cluster Commander. Set a
Cluster IP Pool that does not conflict with any other IP subnets in the network.
Cluster IP addresses are assigned to switches when they become Members andare used for communication between Member switches and the Commander.

– 184 –

Chapter 4 | System Management Commands

Switch Clustering Switch clusters are limited to the same Ethernet broadcast domain.
 There can be up to 100 candidates and 36 member switches in one cluster.
 A switch can only be a Member of one cluster.
 Configured switch clusters are maintained across power resets and networkchanges.

ExampleConsole(config)#cluster
Console(config)#cluster commander This command enables the switch as a cluster Commander. Use the no form todisable the switch as cluster Commander.
Syntax[no] cluster commander
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Once a switch has been configured to be a cluster Commander, it automaticallydiscovers other cluster-enabled switches in the network. These “Candidate”
switches only become cluster Members when manually selected by theadministrator through the management station.
 Cluster Member switches can be managed through a Telnet connection to the

Commander. From the Commander CLI prompt, use the rcommand idcommand to connect to the Member switch.

ExampleConsole(config)#cluster commander
Console(config)#– 185 –

Chapter 4 | System Management Commands
Switch Clustering

cluster ip-pool This command sets the cluster IP address pool. Use the no form to reset to thedefault address.
Syntaxcluster ip-pool ip-addressno cluster ip-pool
ip-address - The base IP address for IP addresses assigned to cluster
Members. The IP address must start 10.x.x.x.
Default Setting
10.254.254.1
Command Mode
Global Configuration
Command Usage An “internal” IP address pool is used to assign IP addresses to Member switches

in the cluster. Internal cluster IP addresses are in the form 10.x.x.member-ID.
Only the base IP address of the pool needs to be set since Member IDs can only
be between 1 and 36.

 Set a Cluster IP Pool that does not conflict with addresses in the network IP

subnet. Cluster IP addresses are assigned to switches when they become
Members and are used for communication between Member switches and theCommander.

 You cannot change the cluster IP pool when the switch is currently in

Commander mode. Commander mode must first be disabled.

ExampleConsole(config)#cluster ip-pool 10.2.3.4
Console(config)#cluster member This command configures a Candidate switch as a cluster Member. Use the no form
to remove a Member switch from the cluster.
Syntaxcluster member mac-address mac-address id member-id
no cluster member id member-id
mac-address - The MAC address of the Candidate switch.
member-id - The ID number to assign to the Member switch. (Range: 1-36)
Default Setting
No Members– 186 –

Chapter 4 | System Management Commands

Switch Clustering

Command Mode
Global Configuration
Command Usage The maximum number of cluster Members is 36.
 The maximum number of cluster Candidates is 100.

ExampleConsole(config)#cluster member mac-address 00-12-34-56-78-9a id 5
Console(config)#rcommand This command provides access to a cluster Member CLI for configuration.
Syntaxrcommand id member-id
member-id - The ID number of the Member switch. (Range: 1-36)
Command Mode
Privileged Exec
Command Usage This command only operates through a Telnet connection to the Member
switch. Managing cluster Members using the local console CLI on theCommander is not supported.
 There is no need to enter the username and password for access to the Member

switch CLI.

ExampleConsole#rcommand id 1
CLI session with the ECS4150-28P is opened.
To end the CLI session, enter [Exit].
Vty-0#– 187 –

Chapter 4 | System Management Commands
Switch Clusteringshow cluster This command shows the switch clustering configuration.
Command Mode
Privileged Exec
ExampleConsole#show cluster
Role: commanderInterval Heartbeat: 30
Heartbeat Loss Count : 3 seconds
Number of Members: 1
Number of Candidates : 2
Console#show cluster members This command shows the current switch cluster members.
Command Mode
Privileged Exec
ExampleConsole#show cluster members
Cluster Members:
ID
: 1
Role
: Active member
IP Address : 10.254.254.2
MAC Address : 00-E0-0C-00-00-FE
Description : ECS4150-28T
Console#show cluster This command shows the discovered Candidate switches in the network.
candidates
Command Mode
Privileged Exec
ExampleConsole#show cluster candidates
Cluster Candidates:
Role
MAC Address
Description--------------- ----------------- ---------------------------------------Candidate join 00-E0-0C-00-00-FE ECS4150-28T
Candidate00-12-CF-0B-47-A0 ECS4150-28T
Console#– 188 –

Chapter 4 | System Management Commands

Dying Gasp

Dying Gasp
When the switch enters an unrecoverable condition, such as a power failure, it canbe configured to send “dying-gasp” notification messages to other devices.
Table 33: Dying-Gasp Commands
CommandFunctionModedying-gasp

Configures the type of dying-gasp message to sendGC

show dying-gasp status

Shows the dying-gasp configuration and statusPE

show dying-gasp packets

Shows the contents of the stored dying-gasp packetPEdying-gasp This command specifies the type of dying-gasp message to send when the switch

encounters an abrupt loss of power. Use the no form to restore the default setting.
Syntaxdying-gasp {efm-oam | snmp-trap ip-address | syslog ip-address | none}
no dying-gasp
efm-oam - Send an EFM-OAM dying-gasp packet.
snmp-trap - Send an SNMP trap packet to a specified receiver.
syslog - Send a Syslog dying-gasp packet to a specified server.
ip-address - The IPv4 or IPv6 host address.
none - Disables sending a dying-gasp message.
Default Setting
EFM-OAM
Command Mode
Global Configuration
Command Usage
When the notification type is EFM OAM, the switch uses the efm oam critical-linkevent dying-gasp command to enable the sending of an EFM OAM dying gasp
message on OAM-enabled ports.
ExampleConsole(config)#dying-gasp snmp-trap 10.2.3.4
Console(config)#– 189 –

Chapter 4 | System Management Commands

Dying Gaspshow dying-gasp This command shows the dying-gasp configuration and status.
statusCommand Mode
Privileged Exec
ExampleConsole#show dying-gasp status
Dying Gasp Configuration:
Notification Type : Syslog
Server IP Address : 192.168.1.1
Status:Update Timer : 30 seconds
Packet: Ready
Console#show dying-gasp This command shows the contents of the stored dying-gasp packet.
packets
Command Mode
Privileged Exec
ExampleConsole#show dying-gasp packets
Interface: Eth 1/1
Source MAC Address: 00-10-80-CC-22-01
Source IP Address: 192.168.1.1
Source Port Number: 1042
Destination MAC Address : 00-10-80-CC-22-02
Destination IP Address : 192.168.1.10
Destination Port Number : 162
Console#– 190 –

5

SNMP Commands

SNMP commands control access to this switch from management stations using
the Simple Network Management Protocol (SNMP), as well as the error types sent
to trap managers.
SNMP Version 3 also provides security features that cover message integrity,
authentication, and encryption; as well as controlling user access to specific areasof the MIB tree. To use SNMPv3, first set an SNMP engine ID (or accept the default),
specify read and write access views for the MIB tree, configure SNMP user groups
with the required security model (i.e., SNMP v1, v2c or v3) and security level (i.e.,
authentication and privacy), and then assign SNMP users to these groups, alongwith their specific authentication and privacy passwords.
Table 34: SNMP Commands
CommandFunctionModesnmp-server

Enables the SNMP agent

GC

snmp-server community

Sets up the community access string to permit access to
SNMP commands

GC

snmp-server contact

Sets the system contact stringGC

snmp-server location

Sets the system location stringGC

show snmp

Displays the status of SNMP communications

NE, PE

snmp-server enable traps

Enables the device to send SNMP traps (i.e., SNMP
notifications)GC

snmp-server hostSpecifies the recipient of an SNMP notification operationGC

snmp-server
enable port-traps
link-up-down

Enables the device to send SNMP traps (i.e., SNMP
notifications) when a link-up or link-down state change
occursIC

snmp-server
enable port-traps
mac-notification

Enables the device to send SNMP traps (i.e., SNMP
notifications) when a dynamic MAC address is added or
removedICshow snmp-server enableport-traps

Shows if SNMP traps are enabled or disabled for the
specified interfacesPEsnmp-server engine-id

Sets the SNMP engine ID

GC

snmp-server group

Adds an SNMP group, mapping users to viewsGC

snmp-server user

Adds a user to an SNMP groupGC

snmp-server view

Adds an SNMP view

GC

General SNMP Commands

SNMP Target Host Commands

SNMPv3 Engine Commands– 191 –

Chapter 5 | SNMP Commands

Table 34: SNMP Commands (Continued)
CommandFunctionModeshow snmp engine-id

Shows the SNMP engine IDPEshow snmp groupShows the SNMP groups

PEshow snmp user

Shows the SNMP users

PEshow snmp viewShows the SNMP views

PE

nlm

Enables the specified notification log

GC

snmp-server notify-filter

Creates a notification log and specifies the target hostGC

show nlm oper-status

Shows operation status of configured notification logs

PEshow snmp notify-filter

Displays the configured notification logs

PE

Notification Log Commands

ATC Trap Commands
snmp-server enable porttraps atc broadcast-alarmclear

Sends a trap when broadcast traffic falls beneath the lower IC (Port)
threshold after a storm control response has been
triggeredsnmp-server enable porttraps atc broadcast-alarmfire

Sends a trap when broadcast traffic exceeds the upper
threshold for automatic storm control

IC (Port)

snmp-server enable portSends a trap when broadcast traffic exceeds the upper
IC (Port)
traps atc broadcast-control- threshold for automatic storm control and the apply timer
apply
expires
snmp-server enable portSends a trap when broadcast traffic falls beneath the lower IC (Port)
traps atc broadcast-control- threshold after a storm control response has beenreleasetriggered and the release timer expires
snmp-server enable porttraps atc multicast-alarmclear

Sends a trap when multicast traffic falls beneath the lower IC (Port)
threshold after a storm control response has been
triggeredsnmp-server enable porttraps atc multicast-alarmfire

Sends a trap when multicast traffic exceeds the upper
threshold for automatic storm control

IC (Port)

snmp-server enable portSends a trap when multicast traffic exceeds the upper
IC (Port)
traps atc multicast-control- threshold for automatic storm control and the apply timer
apply
expires
snmp-server enable portSends a trap when multicast traffic falls beneath the lower IC (Port)
traps atc multicast-control- threshold after a storm control response has beenreleasetriggered and the release timer expires
Transceiver Power Threshold Trap Commands
transceiver-thresholdcurrent

Sends a trap when the transceiver current falls outside the IC (Port)
specified thresholds

transceiver-threshold
rx-powerSends a trap when the power level of the received signal
falls outside the specified thresholds

IC (Port)

transceiver-threshold
temperature

Sends a trap when the transceiver temperature falls
outside the specified thresholds

IC (Port)

transceiver-threshold
tx-powerSends a trap when the power level of the transmitted signal IC (Port)
power outside the specified thresholds

transceiver-thresholdvoltage

Sends a trap when the transceiver voltage falls outside the IC (Port)
specified thresholds– 192 –

Chapter 5 | SNMP Commands

Table 34: SNMP Commands (Continued)
CommandFunctionModememorySets the rising and falling threshold for the memory
utilization alarmGC

process cpu

Sets the rising and falling threshold for the CPU utilization GC
alarmprocess cpu guard

Sets the CPU utilization watermark and thresholdGC

show memory

Shows memory utilization parametersPEshow process cpu

Shows CPU utilization parameters

NE, PEshow process cpu guard

Shows the CPU utilization watermark and thresholdPE

show process cpu task

Shows CPU utilization per process

NE, PE

Additional Trap Commands

General SNMP Commands

snmp-server This command enables the SNMPv3 engine and services for all management clients(i.e., versions 1, 2c, 3). Use the no form to disable the server.
Syntax[no] snmp-server
Default Setting
EnabledCommand Mode
Global Configuration
ExampleConsole(config)#snmp-server
Console(config)#

snmp-server This command defines community access strings used to authorize management
community access by clients using SNMP v1 or v2c. Use the no form to remove the specified
community string.
Syntaxsnmp-server community string [ro | rw]
no snmp-server community string
string - Community string that acts like a password and permits access to
the SNMP protocol. (Maximum length: 32 characters, case sensitive;
Maximum number of strings: 5)– 193 –

Chapter 5 | SNMP Commands

ro - Specifies read-only access. Authorized management stations are only
able to retrieve MIB objects.
rw - Specifies read/write access. Authorized management stations are able
to both retrieve and modify MIB objects.
Default Setting
 public - Read-only access. Authorized management stations are only able toretrieve MIB objects.
 private - Read/write access. Authorized management stations are able to both
retrieve and modify MIB objects.
Command Mode
Global Configuration
ExampleConsole(config)#snmp-server community alpha rw
Console(config)#

snmp-server contact This command sets the system contact string. Use the no form to remove thesystem contact information.
Syntaxsnmp-server contact string
no snmp-server contact
string - String that describes the system contact information.
(Maximum length: 255 characters)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#snmp-server contact Paul
Console(config)#

Related Commands
snmp-server location (195)– 194 –

Chapter 5 | SNMP Commands

snmp-server location This command sets the system location string. Use the no form to remove thelocation string.
Syntaxsnmp-server location text
no snmp-server locationtext - String that describes the system location.
(Maximum length: 255 characters)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#snmp-server location WC-19
Console(config)#

Related Commands
snmp-server contact (194)show snmp This command can be used to check the status of SNMP communications.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
This command provides information on the community access strings, counters for
SNMP input and output protocol data units, and whether or not SNMP logging has
been enabled with the snmp-server enable traps command.
ExampleConsole#show snmp
SNMP Agent : Enabled
SNMP Traps :Authentication : Enabled
MAC-notification : Disabled
MAC-notification interval : 1 second(s)SNMP Communities :1. public, and the access level is read-only– 195 –

Chapter 5 | SNMP Commands

2. private, and the access level is read/write
0 SNMP packets input
0 Bad SNMP version errors
0 Unknown community name0 Illegal operation for community name supplied
0 Encoding errors
0 Number of requested variables
0 Number of altered variables
0 Get-request PDUs
0 Get-next PDUs
0 Set-request PDUs
0 SNMP packets output
0 Too big errors
0 No such name errors
0 Bad values errors
0 General errors
0 Response PDUs
0 Trap PDUs
SNMP Logging: Disabled
Console#SNMP Target Host Commands

snmp-server This command enables this device to send Simple Network Management Protocol
enable traps traps or informs (i.e., SNMP notifications). Use the no form to disable SNMP
notifications.
Syntax[no] snmp-server enable traps [authentication | mac-notification [interval
seconds]]
authentication - Keyword to issue authentication failure notifications.
mac-notification - Keyword to issue trap when a dynamic MAC address is
added or removed.
interval - Specifies the interval between issuing two consecutive traps.
(Range: 1-3600 seconds; Default: 1 second)
Default Setting
Issue authentication traps
Other traps are disabled
Command Mode
Global Configuration
Command Usage If you do not enter an snmp-server enable traps command, no notifications
controlled by this command are sent. In order to configure this device to send
SNMP notifications, you must enter at least one snmp-server enable traps
command. If you enter the command with no keywords, both authentication– 196 –

Chapter 5 | SNMP Commands

notifications are enabled. If you enter the command with a keyword, only the
notification type related to that keyword is enabled.
 The snmp-server enable traps command is used in conjunction with thesnmp-server host command. Use the snmp-server host command to specify
which host or hosts receive SNMP notifications. In order to send notifications,
you must configure at least one snmp-server host command.

 The authentication traps are legacy notifications, and therefore when used for

SNMP Version 3 hosts, they must be enabled in conjunction with thecorresponding entries in the Notify View assigned by the snmp-server groupcommand.

 Interface link-up and link-down traps can be configured using the snmp-server

enable port-traps link-up-down command.

ExampleConsole(config)#snmp-server enable traps authentication
Console(config)#

Related Commands
snmp-server host (197)snmp-server host This command specifies the recipient of a Simple Network Management Protocol
notification operation. Use the no form to remove the specified host.
Syntaxsnmp-server host host-addr [inform [retry retries | timeout seconds]]
community-string [version {1 | 2c | 3 {auth | noauth | priv} [udp-port port]}
no snmp-server host host-addr
host-addr - IPv4 or IPv6 address of the host (the targeted recipient).
(Maximum host addresses: 5 trap destination IP address entries)
inform - Notifications are sent as inform messages. Note that this option is
only available for version 2c and 3 hosts. (Default: traps are used)
retries - The maximum number of times to resend an inform message if
the recipient does not acknowledge receipt. (Range: 0-255; Default: 3)
seconds - The number of seconds to wait for an acknowledgment
before resending an inform message. (Range: 0-2147483647
centiseconds; Default: 1500 centiseconds)
community-string - Password-like community string sent with thenotification operation to SNMP V1 and V2c hosts. Although you can set thisstring using the snmp-server host command by itself, we recommend
defining it with the snmp-server community command prior to using thesnmp-server host command. (Maximum length: 32 characters)– 197 –

Chapter 5 | SNMP Commands

version - Specifies whether to send notifications as SNMP Version 1, 2c or 3
traps. (Range: 1, 2c, 3; Default: 1)
auth | noauth | priv - This group uses SNMPv3 with authentication, noauthentication, or with authentication and privacy. See “Simple
Network Management Protocol” in the Web Management Guide forfurther information about these authentication and encryption
options.
port - Host UDP port to use. (Range: 1-65535; Default: 162)
Default Setting
Host Address: None
Notification Type: Traps
SNMP Version: 1
UDP Port: 162
Command Mode
Global Configuration
Command Usage If you do not enter an snmp-server host command, no notifications are sent. In
order to configure the switch to send SNMP notifications, you must enter at
least one snmp-server host command. In order to enable multiple hosts, youmust issue a separate snmp-server host command for each host.
 The snmp-server host command is used in conjunction with the snmp-server

enable traps command. Use the snmp-server enable traps command to enable
the sending of traps or informs and to specify which SNMP notifications aresent globally. For a host to receive notifications, at least one snmp-server
enable traps command and the snmp-server host command for that hostmust be enabled.

 Some notification types cannot be controlled with the snmp-server

enable traps command. For example, some notification types are always
enabled.

 Notifications are issued by the switch as trap messages by default. The recipientof a trap message does not send a response to the switch. Traps are therefore
not as reliable as inform messages, which include a request for
acknowledgement of receipt. Informs can be used to ensure that criticalinformation is received by the host. However, note that informs consume more
system resources because they must be kept in memory until a response isreceived. Informs also add to network traffic. You should consider these effects
when deciding whether to issue notifications as traps or informs.
To send an inform to a SNMPv2c host, complete these steps:

1. Enable the SNMP agent (page 193).
2. Create a view with the required notification messages (page 205).
3. Create a group that includes the required notify view (page 202).
– 198 –

Chapter 5 | SNMP Commands

4. Allow the switch to send SNMP traps; i.e., notifications (page 196).
5. Specify the target host that will receive inform messages with thesnmp-server host command as described in this section.

To send an inform to a SNMPv3 host, complete these steps:

1. Enable the SNMP agent (page 193).
2. Create a remote SNMPv3 user to use in the message exchange process(page 203).

3. Create a view with the required notification messages (page 205).
4. Create a group that includes the required notify view (page 202).
5. Allow the switch to send SNMP traps; i.e., notifications (page 196).
6. Specify the target host that will receive inform messages with thesnmp-server host command as described in this section.

 The switch can send SNMP Version 1, 2c or 3 notifications to a host IP address,

depending on the SNMP version that the management station supports. If thesnmp-server host command does not specify the SNMP version, the default is
to send SNMP version 1 notifications.

 If you specify an SNMP Version 3 host, then the community string is interpreted

as an SNMP user name. The user name must first be defined with the snmpserver user command. Otherwise, an SNMPv3 group will be automaticallycreated by the snmp-server host command using the name of the specified
community string, and default settings for the read, write, and notify view.

ExampleConsole(config)#snmp-server host 10.1.19.23 batman
Console(config)#

Related Commands
snmp-server enable traps (196)snmp-server This command enables the device to send SNMP traps (i.e., SNMP notifications)enable port-traps when a link-up or link-down state change occurs. Use the no form to restore thelink-up-down default setting.
Syntax[no] snmp-server enable port-traps link-up-down
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)– 199 –

Chapter 5 | SNMP Commands

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps link-up-down
Console(config)#

snmp-server This command enables the device to send SNMP traps (i.e., SNMP notifications)enable port-traps when a dynamic MAC address is added or removed. Use the no form to restore themac-notification default setting.
Syntax[no] snmp-server enable port-traps mac-notification
mac-notification - Keyword to issue trap when a dynamic MAC address is
added or removed.
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This command can enable MAC authentication traps on the current interface only ifthey are also enabled at the global level with the snmp-server enable traps macauthentication command.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps mac-notification
Console(config)#show snmp-server This command shows if SNMP traps are enabled or disabled for the specified
enable port-traps interfaces.
Syntaxshow snmp-server enable port-traps interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)– 200 –

Chapter 5 | SNMP Commands

Command Mode
Privileged Exec

ExampleConsole#show snmp-server enable port-traps interface
Interface MAC Notification Trap--------- --------------------Eth 1/1
No
Eth 1/2
No
Eth
1/3
No
.
.
.

SNMPv3 Commands

snmp-server This command configures an identification string for the SNMPv3 engine. Use theengine-id no form to restore the default.
Syntaxsnmp-server engine-id {local | remote {ip-address}} engineid-string
no snmp-server engine-id {local | remote {ip-address}}
local - Specifies the SNMP engine on this switch.
remote - Specifies an SNMP engine on a remote device.
ip-address - IPv4 or IPv6 address of the remote device.
engineid-string - String identifying the engine ID. (Range: 9-64 hexadecimal
characters)
Default Setting
A unique engine ID is automatically generated by the switch based on its MAC
address.
Command Mode
Global Configuration
Command Usage An SNMP engine is an independent SNMP agent that resides either on thisswitch or on a remote device. This engine protects against message replay,
delay, and redirection. The engine ID is also used in combination with user
passwords to generate the security keys for authenticating and encrypting
SNMPv3 packets.
 A remote engine ID is required when using SNMPv3 informs. (See the snmp-

server host command.) The remote engine ID is used to compute the security
digest for authentication and encryption of packets passed between the switch
and a user on the remote host. SNMP passwords are localized using the engine
ID of the authoritative agent. For informs, the authoritative SNMP agent is the– 201 –

Chapter 5 | SNMP Commands

remote agent. You therefore need to configure the remote agent’s SNMP
engine ID before you can send proxy requests or informs to it.
 Trailing zeroes need not be entered to uniquely specify a engine ID. In otherwords, the value “0123456789” is equivalent to “0123456789” followed by 16
zeroes for a local engine ID.

 A local engine ID is automatically generated that is unique to the switch. This isreferred to as the default engine ID. If the local engine ID is deleted or changed,
all SNMP users will be cleared. You will need to reconfigure all existing users(page 203).

ExampleConsole(config)#snmp-server engine-id local 1234567890
Console(config)#snmp-server engine-id remote 192.168.1.19 9876543210
Console(config)#

Related Commands
snmp-server host (197)snmp-server group This command adds an SNMP group, mapping SNMP users to SNMP views. Use theno form to remove an SNMP group.
Syntaxsnmp-server group groupname{v1 | v2c | v3 {auth | noauth | priv}}[read readview] [write writeview] [notify notifyview]
no snmp-server group groupname
groupname - Name of an SNMP group. A maximum of 22 groups can be
configured. (Range: 1-32 characters)
v1 | v2c | v3 - Use SNMP version 1, 2c or 3.
auth | noauth | priv - This group uses SNMPv3 with authentication, noauthentication, or with authentication and privacy. See “Simple Network
Management Protocol” in the Web Management Guide for further
information about these authentication and encryption options.
readview - Defines the view for read access. (1-32 characters)
writeview - Defines the view for write access. (1-32 characters)
notifyview - Defines the view for notifications. (1-32 characters)
Default Setting
Default groups: public1 (read only), private2 (read/write)
readview - Every object belonging to the Internet OID space (1).
writeview - Nothing is defined.
notifyview - Nothing is defined.
– 202 –

Chapter 5 | SNMP Commands

Command Mode
Global Configuration
Command Usage A group sets the access policy for the assigned users.
 When authentication is selected, the MD5 or SHA algorithm is used as specified

in the snmp-server user command.

 When privacy is selected, the DES 56-bit algorithm is used for data encryption.
 For additional information on the notification messages supported by thisswitch, see the table for “Supported Notification Messages” in the Web
Management Guide. Also, note that the authentication, link-up and link-down
messages are legacy traps and must therefore be enabled in conjunction withthe snmp-server enable traps command.

ExampleConsole(config)#snmp-server group r&d v3 auth write daily
Console(config)#

snmp-server user This command adds a user to an SNMP group, restricting the user to a specific

SNMP Read, Write, or Notify View. Use the no form to remove a user from an SNMP
group.
Syntaxsnmp-server user username groupname{v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password [priv {3des |aes128 | aes192 | aes256 | des56} priv-password]]
snmp-server user username groupname remote ip-address{v3 [encrypted] [auth {md5 | sha} auth-password [priv {3des | aes128 |aes192 | aes256 | des56} priv-password]]
no snmp-server user username {v1 | v2c | v3 | remote ip-address v3}
username - Name of user connecting to the SNMP agent. A maximum of 22
groups can be configured. (Range: 1-32 characters)groupname - Name of an SNMP group to which the user is assigned.
(Range: 1-32 characters)
remote - Specifies an SNMP engine on a remote device.
ip-address - IPv4 address of the remote device.
v1 | v2c | v3 - Use SNMP version 1, 2c or 3.
encrypted - Accepts the password as encrypted input.
1. No view is defined.
2. Maps to the defaultview.

– 203 –

Chapter 5 | SNMP Commands

auth - Uses SNMPv3 with authentication.
md5 | sha - Uses MD5 or SHA authentication.
auth-password - Authentication password. Enter as plain text if theencrypted option is not used. Otherwise, enter an encrypted password.
(Range: 8-32 characters for unencrypted password.)
If the encrypted option is selected, enter an encrypted password.
(Range: 32 characters for MD5 encrypted password, 40 characters for SHA
encrypted password)priv - Uses SNMPv3 with privacy.
3des - Uses SNMPv3 with privacy with 3DES (168-bit) encryption.
aes128 - Uses SNMPv3 with privacy with AES128 encryption.
aes192 - Uses SNMPv3 with privacy with AES192 encryption.
aes256 - Uses SNMPv3 with privacy with AES256 encryption.
des56 - Uses SNMPv3 with privacy with DES56 encryption.
priv-password - Privacy password. Enter as plain text if the encrypted
option is not used. Otherwise, enter an encrypted password.
(Range: 8-32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage Local users (i.e., the command does not specify a remote engine identifier)must be configured to authorize management access for SNMPv3 clients, or to
identify the source of SNMPv3 trap messages sent from the local switch.
 Remote users (i.e., the command specifies a remote engine identifier) must be

configured to identify the source of SNMPv3 inform messages sent from thelocal switch.

 The SNMP engine ID is used to compute the authentication/privacy digests

from the password. You should therefore configure the engine ID with thesnmp-server engine-id command before using this configuration command.

 Before you configure a remote user, use the snmp-server engine-id commandto specify the engine ID for the remote device where the user resides. Then use
the snmp-server user command to specify the user and the IP address for the
remote device where the user resides. The remote agent’s SNMP engine ID isused to compute authentication/privacy digests from the user’s password. If theremote engine ID is not first configured, the snmp-server user commandspecifying a remote user will fail.

– 204 –

Chapter 5 | SNMP Commands

 SNMP passwords are localized using the engine ID of the authoritative agent.

For informs, the authoritative SNMP agent is the remote agent. You therefore
need to configure the remote agent’s SNMP engine ID before you can send
proxy requests or informs to it.

ExampleConsole(config)#snmp-server user steve r&d v3 auth md5 greenpeace priv des56
einstien
Console(config)#snmp-server engine-id remote 192.168.1.19 9876543210
Console(config)#snmp-server user mark r&d remote 192.168.1.19 v3 auth md5
greenpeace priv des56 einstien
Console(config)#

snmp-server view This command adds an SNMP view which controls user access to the MIB. Use theno form to remove an SNMP view.
Syntaxsnmp-server view view-name oid-tree {included | excluded}
no snmp-server view view-nameview-name - Name of an SNMP view. A maximum of 32 views can be
configured. (Range: 1-32 characters)
oid-tree - Object identifier of a branch within the MIB tree. Wild cards can beused to mask a specific portion of the OID string. (Refer to the examples.)included - Defines an included view.
excluded - Defines an excluded view.
Default Setting
defaultview (includes access to the entire MIB tree)
Command Mode
Global Configuration
Command Usage Views are used in the snmp-server group command to restrict user access to
specified portions of the MIB tree.
 The predefined view “defaultview” includes access to the entire MIB tree.

ExamplesThis view includes MIB-2.
Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included
Console(config)#– 205 –

Chapter 5 | SNMP Commands

This view includes the MIB-2 interfaces table, ifDescr. The wild card is used to selectall the index values in the following table.
Console(config)#snmp-server view ifEntry.2 1.3.6.1.2.1.2.2.1.*.2 included
Console(config)#

This view includes the MIB-2 interfaces table, and the mask selects all index entries.
Console(config)#snmp-server view ifEntry.a 1.3.6.1.2.1.2.2.1.1.* included
Console(config)#show snmp engine-id This command shows the SNMP engine ID.
Command Mode
Privileged Exec
ExampleThis example shows the default engine ID.
Console#show snmp engine-id
Local SNMP EngineID: 8000002a8000000000e8666672
Local SNMP EngineBoots: 1
Remote SNMP Engine ID
80000000030004e2b316c54321
Console#IP address
192.168.1.19

Table 35: show snmp engine-id - display description
Field

Description

Local SNMP engineID

String identifying the engine ID.

Local SNMP engineBoots

The number of times that the engine has (re-)initialized since the snmp
EngineID was last configured.

Remote SNMP engineID

String identifying an engine ID on a remote device.

IP address

IP address of the device containing the corresponding remote SNMP
engine.

– 206 –

Chapter 5 | SNMP Commands

show snmp group This command shows information on SNMP groups. Four default groups areprovided – SNMPv1 read-only access and read/write access, and SNMPv2c readonly access and read/write access.
Command Mode
Privileged Exec
ExampleConsole#show snmp group
Group Name
: r&d
Security Model : v3
Security Level : Authentication and privacy
Read View: No readview specified
Write View
: No writeview specified
Notify View
: No notifyview specified
Storage Type: Nonvolatile
Row Status: Active
Group Name
: public
Security Model : v1
Read View: defaultview
Write View
: No writeview specified
Notify View
: No notifyview specified
Storage Type: Volatile
Row Status: Active
Group Name
: public
Security Model : v2c
Read View: defaultview
Write View
: No writeview specified
Notify View
: No notifyview specified
Storage Type: Volatile
Row Status: Active
Group Name
: private
Security Model : v1
Read View: defaultview
Write View
: defaultview
Notify View
: No notifyview specified
Storage Type: Volatile
Row Status: Active
Group Name
: private
Security Model : v2c
Read View: defaultview
Write View
: defaultview
Notify View
: No notifyview specified
Storage Type: Volatile
Row Status: Active
Console#Table 36: show snmp group - display description
Field

Description

Group Name

Name of an SNMP group.

Security Model

The SNMP version.

– 207 –

Chapter 5 | SNMP Commands

Table 36: show snmp group - display description (Continued)
Field

Description

Security Level

This associated security level can use SNMPv3 with authentication, noauthentication, or with authentication and privacy.

Read View

The associated read view.

Write View

The associated write view.

Notify View

The associated notify view.

Storage TypeThe storage type for this entry.

Row Status

The row status of this entry.

show snmp user This command shows information on SNMP users.
Command Mode
Privileged Exec
ExampleConsole#show snmp user
Engine ID: 800001030300e00c0000fd0000
User Name: steve
Group Name
: rd
Security Model: v1
Security Level: NoneAuthentication Protocol : None
Privacy Protocol: NoneStorage Type: Nonvolatile
Row Status: Active
SNMP remote user
Engine ID: 0000937564846450000
User Name: markGroup Name
: public
Security Model: v3
Security Level: Anthentication and privacy
Authentication Protocol : MD5
Privacy Protocol: DES56
Storage Type: Nonvolatile
Row Status: Active
Console#Table 37: show snmp user - display description
Field

Description

Engine ID

String identifying the engine ID.

User Name

Name of user connecting to the SNMP agent.

Group Name

Name of an SNMP group.

Security Model

The user security model: SNMP v1, v2c or v3.

Security Level

Indicates if authentication or encryption are used.

– 208 –

Chapter 5 | SNMP Commands

Table 37: show snmp user - display description (Continued)
Field

Description

Authentication Protocol

The authentication protocol used with SNMPv3.

Privacy Protocol

The privacy protocol used with SNMPv3.

Storage TypeThe storage type for this entry.

Row Status

The row status of this entry.

SNMP remote user

A user associated with an SNMP engine on a remote device.

show snmp view This command shows information on the SNMP views.
Command Mode
Privileged Exec
ExampleConsole#show snmp view
View Name: mib-2
Subtree OID: 1.2.2.3.6.2.1
View Type: included
Storage Type: permanent
Row Status: active
View Name: defaultview
Subtree OID : 1
View Type: included
Storage Type : volatile
Row Status: active
Console#Table 38: show snmp view - display description
Field

Description

View Name

Name of an SNMP view.

Subtree OID

A branch in the MIB tree.

View Type

Indicates if the view is included or excluded.

Storage TypeThe storage type for this entry.

Row Status

The row status of this entry.

Notification Log Commands

nlm This command enables or disables the specified notification log.
Syntax[no] nlm filter-namefilter-name - Notification log name. (Range: 1-32 characters)– 209 –

Chapter 5 | SNMP Commands

Default Setting
None
Command Mode
Global Configuration
Command Usage Notification logging is enabled by default, but will not start recording
information until a logging profile specified by the snmp-server notify-filter
command is enabled by the nlm command.
 Disabling logging with this command does not delete the entries stored in the

notification log.

ExampleThis example enables the notification log A1.
Console(config)#nlm A1
Console(config)#

snmp-server This command creates an SNMP notification log. Use the no form to remove thisnotify-filter log.
Syntax[no] snmp-server notify-filter profile-name remote ip-address
profile-name - Notification log profile name. (Range: 1-32 characters)
ip-address - IPv4 or IPv6 address of a remote device. The specified target
host must already have been configured using the snmp-server hostcommand.
Note: The notification log is stored locally. It is not sent to a remote device. This
remote host parameter is only required to complete mandatory fields in the SNMP
Notification MIB.

Default Setting
None
Command Mode
Global Configuration
Command Usage
 Systems that support SNMP often need a mechanism for recording Notification
information as a hedge against lost notifications, whether there are Traps orInforms that may exceed retransmission limits. The Notification Log MIB (NLM,– 210 –

Chapter 5 | SNMP Commands

RFC 3014) provides an infrastructure in which information from other MIBs may
be logged.
 Given the service provided by the NLM, individual MIBs can now bear lessresponsibility to record transient information associated with an event against
the possibility that the Notification message is lost, and applications can poll
the log to verify that they have not missed any important Notifications.

 If notification logging is not configured and enabled, when the switch reboots,some SNMP traps (such as warm start) cannot be logged.

 To avoid this problem, notification logging should be configured and enabledusing the snmp-server notify-filter command and nlm command, and thesecommands stored in the startup configuration file. Then when the switch
reboots, SNMP traps (such as warm start) can now be logged.

 When this command is executed, a notification log is created (with the default

parameters defined in RFC 3014). Notification logging is enabled by default(see the nlm command), but will not start recording information until a logging
profile specified with this command is enabled with the nlm command.

 Based on the default settings used in RFC 3014, a notification log can containup to 256 entries, and the entry aging time is 1440 minutes. Information
recorded in a notification log, and the entry aging time can only be configured
using SNMP from a network management station.

 When a trap host is created with the snmp-server host command, a default

notify filter will be created as shown in the example under the show snmp
notify-filter command.

ExampleThis example first creates an entry for a remote host, and then instructs the switch
to record this device as the remote host for the specified notification log.
Console(config)#snmp-server host 10.1.19.23 batman
Console(config)#snmp-server notify-filter A1 remote 10.1.19.23
Console#– 211 –

Chapter 5 | SNMP Commands

show nlm oper-status This command shows the operational status of configured notification logs.
Command Mode
Privileged Exec
ExampleConsole#show nlm oper-status
Filter Name: A1
Oper-Status: Operational
Console#show snmp This command displays the configured notification logs.
notify-filter
Command Mode
Privileged Exec
ExampleThis example displays the configured notification logs and associated target hosts.
Console#show snmp notify-filter
Filter profile name
IP address---------------------------- ---------------A1
10.1.19.23
Console#Additional Trap Commands

memory This command sets an SNMP trap based on configured thresholds for memory
utilization. Use the no form to restore the default setting.
Syntaxmemory {rising rising-threshold | falling falling-threshold}no memory {rising | falling}rising-threshold - Rising threshold for memory utilization alarm expressed inpercentage. (Range: 1-100)
falling-threshold - Falling threshold for memory utilization alarm expressedin percentage. (Range: 1-100)
Default Setting
Rising Threshold: 90%
Falling Threshold: 70%
Command Mode
Global Configuration– 212 –

Chapter 5 | SNMP Commands

Command Usage
Once the rising alarm threshold is exceeded, utilization must drop beneath thefalling threshold before the alarm is terminated, and then exceed the risingthreshold again before another alarm is triggered.
ExampleConsole(config)#memory rising 80
Console(config)#memory falling 60
Console#Related Commands
show memory (116)process cpu This command sets an SNMP trap based on configured thresholds for CPU
utilization. Use the no form to restore the default setting.
Syntax
process cpu {rising rising-threshold | falling falling-threshold}no process cpu {rising | falling}rising-threshold - Rising threshold for CPU utilization alarm expressed inpercentage. (Range: 1-100)
falling-threshold - Falling threshold for CPU utilization alarm expressed inpercentage. (Range: 1-100)
Default Setting
Rising Threshold: 90%
Falling Threshold: 70%
Command Mode
Global Configuration
Command Usage
Once the rising alarm threshold is exceeded, utilization must drop beneath thefalling threshold before the alarm is terminated, and then exceed the risingthreshold again before another alarm is triggered.
ExampleConsole(config)#process cpu rising 80
Console(config)#process cpu falling 60
Console#Related Commands
show process cpu (116)– 213 –

Chapter 5 | SNMP Commands

process cpu guard This command sets the CPU utilization high and low watermarks in percentage ofCPU time utilized and the CPU high and low thresholds in the number of packets
being processed per second. Use the no form of this command without any
parameters to restore all of the default settings, or with a specific parameter torestore the default setting for that item.
Syntax
process cpu guard [high-watermark high-watermark |low-watermark low-watermark | max-threshold max-threshold |min-threshold min-threshold | trap]
high-watermark - If the percentage of CPU usage time is higher than thehigh-watermark, the switch stops packet flow to the CPU (allowing it tocatch up with packets already in the buffer) until usage time falls below thelow watermark. (Range: 40-100%)
low-watermark - If packet flow has been stopped after exceeding the highwatermark, normal flow will be restored after usage falls beneath the low
watermark. (Range: 40-100%)
max-threshold - If the number of packets being processed per second by
the CPU is higher than the maximum threshold, the switch stops packet
flow to the CPU (allowing it to catch up with packets already in the buffer)
until the number of packets being processed falls below the minimum
threshold. (Range: 50-500 pps)
min-threshold - If packet flow has been stopped after exceeding the
maximum threshold, normal flow will be restored after usage falls beneaththe minimum threshold. (Range: 50-500 pps)
trap - If traps are enabled, the switch will send an alarm message if CPU
utilization exceeds the high watermark in percentage of CPU usage time orexceeds the maximum threshold in the number of packets being processedby the CPU.
Default Setting
Guard Status: DisabledHigh Watermark: 90%
Low Watermark: 70%
Maximum Threshold: 500 packets per second
Minimum Threshold: 50 packets per second
Trap Status: Disabled
Command Mode
Global Configuration
Command Usage Once the high watermark is exceeded, utilization must drop beneath the low
watermark before the alarm is terminated, and then exceed the highwatermark again before another alarm is triggered.

– 214 –

Chapter 5 | SNMP Commands

 Once the maximum threshold is exceeded, utilization must drop beneath theminimum threshold before the alarm is terminated, and then exceed the
maximum threshold again before another alarm is triggered.

ExampleConsole(config)#process cpu guard high-watermark 80
Console(config)#process cpu guard low-watermark 60
Console(config)#

Related Commands
show process cpu guard (117)– 215 –

Chapter 5 | SNMP Commands– 216 –

6

Remote Monitoring Commands

Remote Monitoring allows a remote device to collect information or respond to
specified events on an independent basis. This switch is an RMON-capable device
which can independently perform a wide range of tasks, significantly reducing
network management traffic. It can continuously run diagnostics and log
information on network performance. If an event is triggered, it can automaticallynotify the network administrator of a failure and provide historical information
about the event. If it cannot connect to the management agent, it will continue toperform any specified tasks and pass data back to the management station thenext time it is contacted.
This switch supports mini-RMON, which consists of the Statistics, History, Event andAlarm groups. When RMON is enabled, the system gradually builds up information
about its physical interfaces, storing this information in the relevant RMON
database group. A management agent then periodically communicates with theswitch using the SNMP protocol. However, if the switch encounters a critical event,it can automatically send a trap message to the management agent which can thenrespond to the event if so configured.
Table 39: RMON Commands
CommandFunctionModermon alarm

Sets threshold bounds for a monitored variableGC

rmon event

Creates a response event for an alarmGCrmon collection history

Periodically samples statisticsICrmon collection rmon1

Enables statistics collection

ICshow rmon alarms

Shows the settings for all configured alarms

PEshow rmon eventsShows the settings for all configured eventsPEshow rmon history

Shows the sampling parameters for each entry

PEshow rmon statistics

Shows the collected statistics

PE– 217 –

Chapter 6 | Remote Monitoring Commands

rmon alarm This command sets threshold bounds for a monitored variable. Use the no form to
remove an alarm.
Syntaxrmon alarm index variable interval {absolute | delta}
rising-threshold threshold [event-index] falling-threshold threshold[event-index] [owner name]no rmon alarm index
index – Index to this entry. (Range: 1-65535)
variable – The object identifier of the MIB variable to be sampled. Only
variables of the type etherStatsEntry.n.n may be sampled. Note that
etherStatsEntry.n uniquely defines the MIB variable, andetherStatsEntry.n.n defines the MIB variable, plus the etherStatsIndex. For
example, 1.3.6.1.2.1.16.1.1.1.6.1 denotes etherStatsBroadcastPkts, plus theetherStatsIndex of 1.
interval – The polling interval. (Range: 1-31622400 seconds)
absolute – The variable is compared directly to the thresholds at the end of
the sampling period.
delta – The last sample is subtracted from the current value and thedifference is then compared to the thresholds.
threshold – An alarm threshold for the sampled variable.
(Range: 0-2147483647)
event-index – The index of the event to use if an alarm is triggered. If there isno corresponding entry in the event control table, then no event will be
generated. (Range: 0-65535)
name – Name of the person who created this entry. (Range: 1-127
characters)
Default Setting
1.3.6.1.2.1.16.1.1.1.6.1 - 1.3.6.1.2.1.16.1.1.1.6.18/
Taking delta samples every 30 seconds, last value was 0
Rising threshold is 892800, assigned to event 0
Falling threshold is 446400, assigned to event 0
Command Mode
Global Configuration
Command Usage If an event is already defined for an index, the entry must be deleted before anychanges can be made with this command.
 If the current value is greater than or equal to the rising threshold, and the last

sample value was less than this threshold, then an alarm will be generated.
After a rising event has been generated, another such event will not be– 218 –

Chapter 6 | Remote Monitoring Commands

generated until the sampled value has fallen below the rising threshold,reaches the falling threshold, and again moves back up to the rising threshold.
 If the current value is less than or equal to the falling threshold, and the last

sample value was greater than this threshold, then an alarm will be generated.
After a falling event has been generated, another such event will not be
generated until the sampled value has risen above the falling threshold,reaches the rising threshold, and again moves back down to the failingthreshold.

ExampleConsole(config)#rmon alarm 1 1.3.6.1.2.1.16.1.1.1.6.1 15 deltarising-threshold 100 1 falling-threshold 30 1 owner mike
Console(config)#rmon event This command creates a response event for an alarm. Use the no form to remove an
event.

Syntaxrmon event index [log] | [trap community] | [description string] | [owner name]no rmon event index
index – Index to this entry. (Range: 1-65535)
log – Generates an RMON log entry when the event is triggered. Log
messages are processed based on the current configuration settings forevent logging (see “Event Logging” on page 151).
trap – Sends a trap message to all configured trap managers (see thesnmp-server host command).
community – A password-like community string sent with the trap
operation to SNMP v1 and v2c hosts. Although this string can be set using
the rmon event command by itself, it is recommended that the string be
defined using the snmp-server community command prior to using thermon event command. (Range: 1-32 characters)
string – A comment that describes this event. (Range: 1-127 characters)
name – Name of the person who created this entry.
(Range: 1-32 characters)
Default Setting
None
Command Mode
Global Configuration– 219 –

Chapter 6 | Remote Monitoring Commands

Command Usage If an event is already defined for an index, the entry must be deleted before anychanges can be made with this command.
 The specified events determine the action to take when an alarm triggers thisevent. The response to an alarm can include logging the alarm or sending amessage to a trap manager.

ExampleConsole(config)#rmon event 2 log description urgent owner mike
Console(config)#rmon collection This command periodically samples statistics on a physical interface. Use the no
history form to disable periodic sampling.
Syntaxrmon collection history controlEntry index[buckets number [interval seconds]] |[interval seconds] |[owner name [buckets number [interval seconds]]
no rmon collection history controlEntry index
index – Index to this entry. (Range: 1-65535)
number – The number of buckets requested for this entry. (Range: 1-65535)
seconds – The polling interval. (Range: 1-3600 seconds)
name – Name of the person who created this entry.
(Range: 1-32 characters)
Default Setting
1.3.6.1.2.1.16.1.1.1.6.1 - 1.3.6.1.2.1.16.1.1.1.6.18
Buckets: 50
Interval: 30 seconds for even numbered entries,
1800 seconds for odd numbered entries
Command Mode
Interface Configuration (Ethernet)
Command Usage By default, each index number equates to a port on the switch, but can bechanged to any number not currently in use.
 If periodic sampling is already enabled on an interface, the entry must be

deleted before any changes can be made with this command.

– 220 –

Chapter 6 | Remote Monitoring Commands

 The information collected for each sample includes:

input octets, packets, broadcast packets, multicast packets, undersize packets,
oversize packets, fragments, jabbers, CRC alignment errors, collisions, drop
events, and network utilization.
 The switch reserves two controlEntry index entries for each port. If a default

index entry is re-assigned to another port by this command, the showrunning-config command will display a message indicating that this index is
not available for the port to which is normally assigned.
For example, if control entry 15 is assigned to port 5 as shown below, the showrunning-config command will indicate that this entry is not available for port
8.
Console(config)#interface ethernet 1/5
Console(config-if)#rmon collection history controlEntry 15
Console(config-if)#end
Console#show running-config!
interface ethernet 1/5
rmon collection history controlEntry 15 buckets 50 interval 1800...
interface ethernet 1/8
no rmon collection history controlEntry 15

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#rmon collection history controlentry 21 owner mike buckets
24 interval 60
Console(config-if)#rmon collection This command enables the collection of statistics on a physical interface. Use thermon1 no form to disable statistics collection.
Syntaxrmon collection rmon1 controlEntry index [owner name]no rmon collection rmon1 controlEntry index
index – Index to this entry. (Range: 1-65535)
name – Name of the person who created this entry.
(Range: 1-32 characters)
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet)– 221 –

Chapter 6 | Remote Monitoring Commands

Command Usage By default, each index number equates to a port on the switch, but can bechanged to any number not currently in use.
 If statistics collection is already enabled on an interface, the entry must be

deleted before any changes can be made with this command.

 The information collected for each entry includes:

input octets, packets, broadcast packets, multicast packets, undersize packets,
oversize packets, fragments, jabbers, CRC alignment errors, collisions, drop
events, and packets of specified lengths
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#rmon collection rmon1 controlentry 1 owner mike
Console(config-if)#show rmon alarms This command shows the settings for all configured alarms.
Command Mode
Privileged Exec
ExampleConsole#show rmon alarms
Alarm 1 is valid, owned by
Monitors 1.3.6.1.2.1.16.1.1.1.6.1 every 30 seconds
Taking delta samples, last value was 0
Rising threshold is 892800, assigned to event 0
Falling threshold is 446400, assigned to event 0.
.
.

show rmon events This command shows the settings for all configured events.
Command Mode
Privileged Exec
ExampleConsole#show rmon events
Event 2 is valid, owned by mikeDescription is urgent
Event firing causes log and trap to community , last fired
Console#– 222 –

00:00:00

Chapter 6 | Remote Monitoring Commands

show rmon history This command shows the sampling parameters configured for each entry in thehistory group.

Command Mode
Privileged Exec
ExampleConsole#show rmon history
Entry 1 is valid, and owned by
Monitors 1.3.6.1.2.1.2.2.1.1.1 every 1800 seconds
Requested # of time intervals, ie buckets, is 8
Granted # of time intervals, ie buckets, is 8
Sample # 1 began measuring at 00:00:01
Received 77671 octets, 1077 packets,
61 broadcast and 978 multicast packets,
0 undersized and 0 oversized packets,
0 fragments and 0 jabbers packets,
0 CRC alignment errors and 0 collisions.
# of dropped packet events is 0
Network utilization is estimated at 0.
.
.

show rmon statistics This command shows the information collected for all configured entries in thestatistics group.

Command Mode
Privileged Exec
ExampleConsole#show rmon statistics
Interface 1 is valid, and owned by
Monitors 1.3.6.1.2.1.2.2.1.1.1 which has
Received 164289 octets, 2372 packets,
120 broadcast and 2211 multicast packets,
0 undersized and 0 oversized packets,
0 fragments and 0 jabbers,
0 CRC alignment errors and 0 collisions.
# of dropped packet events (due to lack of resources): 0# of packets received of length (in octets):
64: 2245, 65-127: 87, 128-255: 31,
256-511: 5, 512-1023: 2, 1024-1518: 2.
.
.

– 223 –

Chapter 6 | Remote Monitoring Commands– 224 –

7

Flow Sampling Commands

Flow sampling (sFlow) can be used with a remote sFlow Collector to provide an
accurate, detailed and real-time overview of the types and levels of traffic present
on the network. The sFlow Agent samples 1 out of n packets from all data
traversing the switch, re-encapsulates the samples as sFlow datagrams andtransmits them to the sFlow Collector. This sampling occurs at the internal
hardware level where all traffic is seen, whereas traditional probes only have apartial view of traffic as it is sampled at the monitored interface. Moreover, theprocessor and memory load imposed by the sFlow agent is minimal since local
analysis does not take place.
Note: The terms “collector”, “receiver” and “owner”, in the context of this chapter, allrefer to a remote server capable of receiving the sFlow datagrams generated by thesFlow agent of the switch.
Table 40: sFlow Commands
CommandFunctionModesflow owner

Creates an sFlow collector which the switch uses to send
samples to.

PEsflow polling instanceConfigures an sFlow polling data source that takes samples PE
periodically based on time.

sflow sampling instanceConfigures an sFlow sampling data source that samples
periodically based on a packet count.

PEshow sflow

Shows the global and interface settings for the sFlow
processPE– 225 –

Chapter 7 | Flow Sampling Commands

sflow owner This command creates an sFlow collector on the switch. Use the no form to remove
the sFlow receiver.
Syntaxsflow owner owner-name timeout timeout-value[destination {ipv4-address | ipv6-address}[max-datagram-size max-datagram-size] [version {v4 | v5}]
[port destination-udp-port ] [max-datagram-size max-datagram-size][version {v4 | v5}]][port destination-udp-port]
no sflow owner owner-nameowner-name - Name of the collector. (Range: 1-30 alphanumeric characters)
timeout-value - The length of time the sFlow interface is available to send
samples to a receiver, after which the owner and associated polling andsampling data source instances are removed from the configuration.
(Range: 30-10000000 seconds)
ipv4-address - IPv4 address of the sFlow collector. Valid IPv4 addresses
consist of four decimal numbers, 0 to 255, separated by periods.
ipv6-address - IPv6 address of the sFlow collector. An IPv6 address consistsof 8 colon-separated 16-bit hexadecimal values. One double colon may be
used to indicate the appropriate number of zeros required to fill the
undefined fields.
destination-udp-port - The UDP port on which the collector is listening forsFlow streams. (Range: 1-65535)
max-datagram-size - The maximum size of the sFlow datagram payload.
(Range: 200-1500 bytes)
version {v4 | v5} - Sends either v4 or v5 sFlow datagrams to the receiver.
Default Setting
No owner is configured
UDP Port: 6343
Version: v5
Maximum Datagram Size: 1400 bytes
Command Mode
Privileged Exec
Command Usage Use the sflow owner command to create an owner instance of an sFlow
collector. If the socket port, maximum datagram size, and datagram version are
not specified, then the default values are used.
 Once an owner is created, the sflow owner command can again be used tomodify the owner’s port number. All other parameter values for the owner will
be retained if the port is modified.
– 226 –

Chapter 7 | Flow Sampling Commands

 Use the no sflow owner command to remove the collector.
 When the sflow owner command is issued, it’s associated timeout value will

immediately begin to count down. Once the timeout value has reached zeroseconds, the sFlow owner and it’s associated sampling sources will be deleted
from the configuration.

ExampleThis example shows an sflow collector being created on the switch.
Console#sflow owner stat_server1 timeout 100 destination 192.168.220.225 port
22500 max-datagram-size 512 version v5
Console#This example shows how to modify the sFlow port number for an alreadyconfigured collector.
Console#sflow owner stat_server1 timeout 100 port 35100
Console#sflow polling instance This command enables an sFlow polling data source, for a specified interface, thatpolls periodically based on a specified time interval. Use the no form to remove thepolling data source instance from the switch’s sFlow configuration.
Syntaxsflow polling {interface interface} instance instance-id receiver owner-namepolling-interval seconds
no sflow polling {interface interface} instance instance-id
interface - The source from which the samples will be taken at specified
intervals and sent to a collector.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
instance-id - An instance ID used to identify the sampling source. (Range: 1)
owner-name - The associated receiver, to which the samples will be sent.
(Range: 1-30 alphanumeric characters)
polling-interval - The time interval at which the sFlow process adds
counter values to the sample datagram. (Range: 1-10000000 seconds)
Default Setting
No sFlow polling instance is configured.

– 227 –

Chapter 7 | Flow Sampling Commands

Command Mode
Privileged Exec
Command Usage
This command enables a polling data source and configures the interval at whichcounter values are added to the sample datagram.
ExampleThis example sets the polling interval to 10 seconds.
Console#sflow polling interface ethernet 1/9 instance 1 receiver owner1
polling-interval 10
Console#sflow sampling This command enables an sFlow data source instance for a specific interface that
instance takes samples periodically based on the number of packets processed. Use the noform to remove the sampling data source instance from the switch’s sFlow
configuration.
Syntaxsflow sampling {interface interface} instance instance-id receiver owner-namesampling-rate sample-rate[max-header-size max-header-size]no sflow sample {interface interface} instance instance-id
interface - The source from which the samples will be taken and sent to acollector.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
instance-id - An instance ID used to identify the sampling source. (Range: 1)
owner-name - The associated receiver, to which the samples will be sent.
(Range: 1-30 alphanumeric characters)
sample-rate - The packet sampling rate, or the number of packets out of
which one sample will be taken. (Range: 256-16777215 packets)
max-header-size - The maximum size of the sFlow datagram header.
(Range: 64-256 bytes)
Default Setting
No sFlow sampling instance id configured.
Maximum Header Size: 128 bytes
Command Mode
Privileged Exec
– 228 –

Chapter 7 | Flow Sampling Commands

ExampleThis example enables a sampling data source on Ethernet interface 1/1, an
associated receiver named “owner1”, and a sampling rate of one out of 100. The
maximum header size is also set to 200 bytes.
Console# sflow sampling interface ethernet 1/1 instance 1 receiver owner1
sampling-rate 100 max-header-size 200
Console#The following command removes a sampling data source from Ethernet interface
1/1.
Console# no sflow sampling interface ethernet 1/1 instance 1
Console#show sflow This command shows the global and interface settings for the sFlow process.
Syntaxshow sflow [owner owner-name | interface interface]owner-name - The associated receiver, to which the samples are sent.
(Range: 1-30 alphanumeric characters)interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show sflow interface ethernet 1/2
Receiver Owner Name
: stat1
Receiver Timeout: 99633 sec
Receiver Destination : 192.168.32.32
Receiver Socket Port : 6343
Maximum Datagram Size : 1400 bytes
Datagram Version: 4
Data Source
Sampling Instance ID
Sampling Rate
Maximum Header Size

: Eth 1/2
: 1
: 512
: 128 bytes

Console#– 229 –

Chapter 7 | Flow Sampling Commands– 230 –

8

Authentication Commands

You can configure this switch to authenticate users logging into the system for
management access using local or remote authentication methods. Port-based
authentication using IEEE 802.1X can also be configured to control either
management access to the uplink ports or client access3 to the data ports.
Table 41: Authentication Commands
Command Group

Function

User Accounts andPrivilege Levels

Configures the basic user names and passwords for management
access, and assigns a privilege level to specified command groups orindividual commands

Authentication Sequence

Defines logon authentication method and precedence

RADIUS Client

Configures settings for authentication via a RADIUS server

TACACS+ Client

Configures settings for authentication via a TACACS+ server

AAA

Configures authentication, authorization, and accounting for network
accessWeb Server

Enables management access via a web browser

Telnet Server

Enables management access via Telnet

Secure Shell

Provides secure replacement for Telnet

802.1X Port Authentication Configures host authentication on specific ports using 802.1X
Management IP Filter

Configures IP addresses that are allowed management access

PPPoE Intermediate Agent

Configures relay parameters required for sending authentication
messages between a client and broadband remote access servers

3. For other methods of controlling client access, see “General Security Measures” onpage 301.

– 231 –

Chapter 8 | Authentication Commands
User Accounts and Privilege Levels

User Accounts and Privilege Levels
The basic commands required for management access and assigning command
privilege levels are listed in this section. This switch also includes other options forpassword checking via the console or a Telnet connection (page 140), user
authentication via a remote authentication server (page 231), and host accessauthentication for specific ports (page 274).
Table 42: User Access Commands
CommandFunctionModeenable password

Sets a password to control access to the Privileged Exec
level

GC

username

Establishes a user name-based authentication system at
login

GC

privilege

Assigns a privilege level to specified command groups orindividual commands

GC

show privilege

Shows the privilege level for the current user, or theprivilege level for commands modified by the privilegecommandPEenable password After initially logging onto the system, you should set the Privileged Exec password.
Remember to record it in a safe place. This command controls access to thePrivileged Exec level from the Normal Exec level. Use the no form to reset thedefault password.
Syntaxenable password [level level] {0 | 7} password
no enable password [level level]
level level - Sets the command access privileges. Only Level 15 is available,
which provides full access to all commands. (Range: 0-15){0 | 7} - 0 means plain password, 7 means encrypted password.
password - Password for this privilege level.
(Maximum length: 32 characters plain text or encrypted, case sensitive)
Default Setting
The default is level 15.
The default password is “super”
Command Mode
Global Configuration– 232 –

Chapter 8 | Authentication Commands
User Accounts and Privilege Levels

Command Usage You cannot set a null password. You will have to enter a password to change thecommand mode from Normal Exec to Privileged Exec with the enablecommand.
 The encrypted password is required for compatibility with legacy password

settings (i.e., plain text or encrypted) when reading the configuration fileduring system bootup or when downloading the configuration file from an FTP
server. There is no need for you to manually configure encrypted passwords.

ExampleConsole(config)#enable password level 15 0 admin
Console(config)#

Related Commands
enable (91)authentication enable (236)username This command adds named users, requires authentication at login, specifies orchanges a user's password (or specify that no password is required), or specifies orchanges a user's access level. Use the no form to remove a user name.
Syntaxusername name {access-level level | nopassword | password {0 | 7} password}
no username namename - The name of the user. (Maximum length: 32 characters,case sensitive. Maximum users: 16)
The device has two predefined users, guest which is assigned privilege
level 0 (Normal Exec) and has access to a limited number of commands,
and admin which is assigned privilege level 15 and has full access to allcommands.
access-level level - Specifies command access privileges. (Range: 0-15)
Level 0, 8 and 15 are designed for users (guest), managers (network
maintenance), and administrators (top-level access). The other levels canbe used to configured specialized access profiles.
Level 0-7 provide the same default access privileges, all within Normal
Exec mode under the “Console>” command prompt.
Level 8-14 provide the same default access privileges, including
additional commands in Normal Exec mode, and a subset of commands
in Privileged Exec mode under the “Console#” command prompt.
Level 15 provides full access to all commands.
The privilege level associated with any command can be changed using
the privilege command.
– 233 –

Chapter 8 | Authentication Commands
User Accounts and Privilege Levels
Any privilege level can access all of the commands assigned to lower
privilege levels. For example, privilege level 8 can access all commands
assigned to privilege levels 7-0 according to default settings, and to any
other commands assigned to levels 7-0 using the privilege command.
nopassword - No password is required for this user to log in.
{0 | 7} - 0 means plain password, 7 means encrypted password.
password password - The authentication password for the user. (Maximum
length: 32 characters plain text or encrypted, case sensitive)
Default Setting
The default access level is 0 (Normal Exec).
The factory defaults for the user names and passwords are:Table 43: Default Login Settings
username

access-levelpassword

guest
admin

0
15

guest
admin

Command Mode
Global Configuration
Command Usage
The encrypted password is required for compatibility with legacy password
settings (i.e., plain text or encrypted) when reading the configuration file duringsystem bootup or when downloading the configuration file from an FTP server.
There is no need for you to manually configure encrypted passwords.
ExampleThis example shows how the set the access level and password for a user.
Console(config)#username bob access-level 15
Console(config)#username bob password 0 smith
Console(config)#

privilege This command assigns a privilege level to specified command groups or individualcommands. Use the no form to restore the default setting.
Syntaxprivilege mode [all] level level commandno privilege mode [all] commandmode - The configuration mode containing the specified command.
(See “Understanding Command Modes” on page 82 and “Configuration
Commands” on page 84.)

– 234 –

Chapter 8 | Authentication Commands
User Accounts and Privilege Levels

all - Modifies the privilege level for all subcommands under the specified
command.
level level - Specifies the privilege level for the specified command. Refer tothe default settings described for the access level parameter under theusername command. (Range: 0-15)
command - Specifies any command contained within the specified mode.
Default Setting
Privilege level 0 provides access to a limited number of the commands whichdisplay the current status of the switch, as well as several database clear and resetfunctions. Level 8 provides access to all display status and configurationcommands, except for those controlling various authentication and security
features. Level 15 provides full access to all commands.
Command Mode
Global Configuration
ExampleThis example sets the privilege level for the ping command to Privileged Exec.
Console(config)#privilege exec level 15 ping
Console(config)#show privilege This command shows the privilege level for the current user, or the privilege levelfor commands modified by the privilege command.
Syntaxshow privilege [command]command - Displays the privilege level for all commands modified by theprivilege command.
Command Mode
Privileged Exec
ExampleThis example shows the privilege level for any command modified by the privilegecommand.
Console#show privilege command
privilege line all level 0 accounting
privilege exec level 15 ping
Console(config)#– 235 –

Chapter 8 | Authentication Commands
Authentication Sequence

Authentication Sequence
Three authentication methods can be specified to authenticate users logging into
the system for management access. The commands in this section can be used todefine the authentication method and sequence.
Table 44: Authentication Sequence Commands
CommandFunctionMode

authentication enable

Defines the authentication method and precedence forcommand mode changeGCauthentication login

Defines logon authentication method and precedenceGCauthentication enable This command defines the authentication method and precedence to use whenchanging from Exec command mode to Privileged Exec command mode with theenable command. Use the no form to restore the default.
Syntaxauthentication enable {[local] [radius] [tacacs]}
no authentication enablelocal - Use local password only.
radius - Use RADIUS server password only.
tacacs - Use TACACS server password.
Default Setting
Local
Command Mode
Global Configuration
Command Usage RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,

while TCP offers a connection-oriented transport. Also, note that RADIUS
encrypts only the password in the access-request packet from the client to theserver, while TACACS+ encrypts the entire body of the packet.

 RADIUS and TACACS+ logon authentication assigns a specific privilege level foreach user name and password pair. The user name, password, and privilege
level must be configured on the authentication server.

 You can specify three authentication methods in a single command to indicate

the authentication sequence. For example, if you enter “authentication
enable radius tacacs local,” the user name and password on the RADIUS
server is verified first. If the RADIUS server is not available, then authentication– 236 –

Chapter 8 | Authentication Commands
Authentication Sequenceis attempted on the TACACS+ server. If the TACACS+ server is not available, thelocal user name and password is checked.
ExampleConsole(config)#authentication enable radius
Console(config)#

Related Commands
enable password - sets the password for changing command modes (232)authentication login This command defines the login authentication method and precedence. Use theno form to restore the default.
Syntaxauthentication login {[local] [radius] [tacacs]}
no authentication login
local - Use local password.
radius - Use RADIUS server password.
tacacs - Use TACACS server password.
Default Setting
Local
Command Mode
Global Configuration
Command Usage RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,

while TCP offers a connection-oriented transport. Also, note that RADIUS
encrypts only the password in the access-request packet from the client to theserver, while TACACS+ encrypts the entire body of the packet.

 RADIUS and TACACS+ logon authentication assigns a specific privilege level foreach user name and password pair. The user name, password, and privilege
level must be configured on the authentication server.

 You can specify three authentication methods in a single command to indicate

the authentication sequence. For example, if you enter “authentication login
radius tacacs local,” the user name and password on the RADIUS server isverified first. If the RADIUS server is not available, then authentication is
attempted on the TACACS+ server. If the TACACS+ server is not available, thelocal user name and password is checked.

– 237 –

Chapter 8 | Authentication Commands
RADIUS Client
ExampleConsole(config)#authentication login radius
Console(config)#

Related Commands
username - for setting the local user names and passwords (233)

RADIUS Client
Remote Authentication Dial-in User Service (RADIUS) is a logon authentication
protocol that uses software running on a central server to control access to RADIUSaware devices on the network. An authentication server contains a database ofmultiple user name/password pairs with associated privilege levels for each user orgroup that require management access to a switch.
Table 45: RADIUS Client Commands
CommandFunctionModeradius-server acct-port

Sets the RADIUS server network port

GC

radius-server auth-port

Sets the RADIUS server network port

GC

radius-server hostSpecifies the RADIUS serverGCradius-server key

Sets the RADIUS encryption key

GCradius-server encryptedkey

Sets the RADIUS encryption key sent in encrypted textGC

radius-server retransmit

Sets the number of retries

GCradius-server timeout

Sets the interval between sending authentication requests GC

show radius-serverShows the current RADIUS settingsPEradius-server This command sets the RADIUS server network port for accounting messages. Useacct-port the no form to restore the default.
Syntaxradius-server acct-port port-number
no radius-server acct-port
port-number - RADIUS server UDP port used for accounting messages.
(Range: 1-65535)
Default Setting
1813
Command Mode
Global Configuration– 238 –

Chapter 8 | Authentication Commands

RADIUS Client

ExampleConsole(config)#radius-server acct-port 181
Console(config)#

radius-server This command sets the RADIUS server network port. Use the no form to restore theauth-port default.
Syntaxradius-server auth-port port-number
no radius-server auth-port
port-number - RADIUS server UDP port used for authentication messages.
(Range: 1-65535)
Default Setting
1812
Command Mode
Global Configuration
ExampleConsole(config)#radius-server auth-port 181
Console(config)#

radius-server host This command specifies primary and backup RADIUS servers, and authentication

and accounting parameters that apply to each server. Use the no form to remove a
specified server, or to restore the default values.
Syntax[no] radius-server index host host-ip-address [acct-port acct-port] [authport auth-port] [key key] [retransmit retransmit] [timeout timeout]
index - Allows you to specify up to five servers. These servers are queried insequence until a server responds or the retransmit period expires.
host-ip-address - IP address of server.
acct-port - RADIUS server UDP port used for accounting messages.
(Range: 1-65535)
auth-port - RADIUS server UDP port used for authentication messages.
(Range: 1-65535)
key - Encryption key used to authenticate logon access for client. Enclose
any string containing blank spaces in double quotes.
(Maximum length: 48 characters)– 239 –

Chapter 8 | Authentication Commands
RADIUS Client
retransmit - Number of times the switch will try to authenticate logon
access via the RADIUS server. (Range: 1-5)
timeout - Number of seconds the switch waits for a reply before resending
a request. (Range: 1-10)
Default Settingauth-port - 1812
acct-port - 1813
timeout - 5 seconds
retransmit - 3
Command Mode
Global Configuration
ExampleConsole(config)#radius-server 1 host 192.168.1.20 auth-port 181 timeout 10
retransmit 5 key green
Console(config)#

radius-server key This command sets the RADIUS encryption key. Use the no form to restore thedefault.
Syntaxradius-server key key-string
no radius-server key
key-string - Encryption key used to authenticate logon access for client.
Enclose any string containing blank spaces in double quotes.
(Maximum length: 48 characters)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#radius-server key green
Console(config)#– 240 –

Chapter 8 | Authentication Commands

RADIUS Client

radius-server This command sets the RADIUS encryption key to be sent in encrypted text. Use theencrypted-key no form to restore the default.
Syntaxradius-server encrypted-key key-string
no radius-server key
key-string - Encryption key sent in encrypted text and used to authenticate
logon access for client. Enclose any character string using ASCII characters.
(Maximum length: 48 characters, Base64 coding format)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#radius-server encrypted-key Z3JlZW4=Console(config)#

radius-server This command sets the number of retries. Use the no form to restore the default.
retransmit
Syntaxradius-server retransmit number-of-retries
no radius-server retransmit
number-of-retries - Number of times the switch will try to authenticate
logon access via the RADIUS server. (Range: 1 - 5)
Default Setting
3
Command Mode
Global Configuration
ExampleConsole(config)#radius-server retransmit 5
Console(config)#– 241 –

Chapter 8 | Authentication Commands
RADIUS Client

radius-server timeout This command sets the interval between transmitting authentication requests to
the RADIUS server. Use the no form to restore the default.
Syntaxradius-server timeout number-of-seconds
no radius-server timeout
number-of-seconds - Number of seconds the switch waits for a reply before
resending a request. (Range: 1-10)
Default Setting
5
Command Mode
Global Configuration
ExampleConsole(config)#radius-server timeout 10
Console(config)#show radius-server This command displays the current settings for the RADIUS server.
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show radius-server
Remote RADIUS Server Configuration:
Global Settings:
Authentication Port Number : 1812
Accounting Port Number: 1813Retransmit Times: 3
Request Timeout: 5
Server 1:
Server IP Address: 192.168.1.1
Authentication Port Number : 1812
Accounting Port Number: 1813Retransmit Times: 2
Request Timeout: 5
RADIUS Server Group:Group Name
Member Index------------------------- -------------– 242 –

Chapter 8 | Authentication Commands

TACACS+ Client

radiusConsole#1

TACACS+ Client
Terminal Access Controller Access Control System (TACACS+) is a logon
authentication protocol that uses software running on a central server to control
access to TACACS-aware devices on the network. An authentication server contains
a database of multiple user name/password pairs with associated privilege levels
for each user or group that require management access to a switch.
Table 46: TACACS+ Client Commands
CommandFunctionModetacacs-server hostSpecifies the TACACS+ server and optional parameters

GC

tacacs-server key

Sets the TACACS+ encryption key

GCtacacs-server encryptedkey

Sets the TACACS+ encryption key sent in encrypted text

GCtacacs-server port

Specifies the TACACS+ server network portGCtacacs-server retransmit

Sets the number of retries

GCtacacs-server timeout

Sets the interval between sending authentication requests GC

show tacacs-serverShows the current TACACS+ settingsGCtacacs-server host This command specifies the TACACS+ server and other optional parameters. Use
the no form to remove the server, or to restore the default values.
Syntaxtacacs-server index host host-ip-address [key key] [port port-number][retransmit retransmit] [timeout timeout]
no tacacs-server index
index - The index for this server. (Range: 1-5)
host-ip-address - IPv4 or IPv6 address of a TACACS+ server.
key - Encryption key used to authenticate logon access for the client.
Enclose any string containing blank spaces in double quotes.
(Maximum length: 48 characters)
port-number - TACACS+ server TCP port used for authentication messages.
(Range: 1-65535)
retransmit - Number of times the switch will try to authenticate logon
access via the TACACS+ server. (Range: 1-5)
timeout - Number of seconds the switch waits for a reply before resending
a request. (Range: 1-10)– 243 –

Chapter 8 | Authentication Commands
TACACS+ Client
Default Setting
authentication port - 49timeout - 5 seconds
retransmit - 3
Command Mode
Global Configuration
ExampleConsole(config)#tacacs-server 1 host 192.168.1.25 port 181 timeout 10
retransmit 5 key green
Console(config)#tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore thedefault.
Syntaxtacacs-server key key-string
no tacacs-server key
key-string - Encryption key used to authenticate logon access for the client.
Enclose any string containing blank spaces in double quotes.
(Maximum length: 48 characters)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#tacacs-server key green
Console(config)#– 244 –

Chapter 8 | Authentication Commands

TACACS+ Clienttacacs-server This command sets the TACACS+ encryption key to be sent in encrypted text. Use
encrypted-key the no form to restore the default.
Syntaxtacacs-server encrypted-key key-string
no tacacs-server key
key-string - Encryption key sent in encrypted text and used to authenticate
logon access for client. Enclose any character string using ASCII characters.
(Maximum length: 48 characters, Base64 coding format)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#tacacs-server encrypted-key Z3JlZW4=Console(config)#tacacs-server port This command specifies the TACACS+ server network port. Use the no form torestore the default.
Syntaxtacacs-server port port-number
no tacacs-server port
port-number - TACACS+ server TCP port used for authentication messages.
(Range: 1-65535)
Default Setting
49
Command Mode
Global Configuration
ExampleConsole(config)#tacacs-server port 181
Console(config)#– 245 –

Chapter 8 | Authentication Commands
TACACS+ Clienttacacs-server This command sets the number of retries. Use the no form to restore the default.
retransmit
Syntaxtacacs-server retransmit number-of-retries
no tacacs-server retransmit
number-of-retries - Number of times the switch will try to authenticate
logon access via the TACACS+ server. (Range: 1 - 5)
Default Setting
3
Command Mode
Global Configuration
ExampleConsole(config)#tacacs-server retransmit 5
Console(config)#tacacs-server timeout This command sets the interval between transmitting authentication requests to
the TACACS+ server. Use the no form to restore the default.
Syntaxtacacs-server timeout number-of-seconds
no tacacs-server timeout
number-of-seconds - Number of seconds the switch waits for a reply before
resending a request. (Range: 1-10)
Default Setting
5
Command Mode
Global Configuration
ExampleConsole(config)#tacacs-server timeout 10
Console(config)#– 246 –

Chapter 8 | Authentication Commands

AAAshow tacacs-server This command displays the current settings for the TACACS+ server.
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show tacacs-server
Remote TACACS+ Server Configuration:
Global Settings:
Server Port Number : 49
Retransmit Times: 3
Timeout: 5Server 1:
Server IP Address : 10.11.12.13
Server Port Number : 49
Retransmit Times: 2
Timeout: 4
TACACS+ Server Group:Group Name
Member Index------------------------- ------------tacacs+
1
Console#AAA
The Authentication, Authorization, and Accounting (AAA) feature provides themain framework for configuring access control on the switch. The AAA functions
require the use of configured RADIUS or TACACS+ servers in the network.
Table 47: AAA Commands
CommandFunctionMode

aaa accounting commands

Enables accounting of Exec mode commands

GC

aaa accounting dot1x

Enables accounting of 802.1X services

GC

aaa accounting exec

Enables accounting of Exec services

GC

aaa accounting update

Enables periodoc updates to be sent to the accounting
serverGC

aaa authorization commands Enables accounting of Exec mode commands

GC

aaa authorization exec

Enables authorization of Exec sessionsGC

aaa group serverGroups security servers in to defined lists

GC

serverConfigures the IP address of a server in a group listSG

– 247 –

Chapter 8 | Authentication Commands

AAA

Table 47: AAA Commands (Continued)
CommandFunctionModeaccounting dot1x

Applies an accounting method to an interface for 802.1X
service requests

ICaccounting commands

Applies an accounting method to CLI commands enteredby a userLineaccounting exec

Applies an accounting method to local console, Telnet or
SSH connectionsLineauthorization commands

Applies an authorization method to CLI commands
entered by a userLineauthorization exec

Applies an authorization method to local console, Telnet or Line
SSH connections

show accounting

Displays all accounting information

PEshow authorization

Displays all authorization informationPE

aaa accounting This command enables the accounting of Exec mode commands. Use the no form
commands to disable the accounting service.
Syntaxaaa accounting commands level {default | method-name} start-stop group{tacacs+ | server-group}no aaa accounting commands level {default | method-name}level - The privilege level for executing commands. (Range: 0-15)
default - Specifies the default accounting method for service requests.
method-name - Specifies an accounting method for service requests.
(Range: 1-64 characters)
start-stop - Records accounting from starting point and stopping point.
group - Specifies the server group to use.
tacacs+ - Specifies all TACACS+ hosts configured with the tacacs-server
host command.
server-group - Specifies the name of a server group configured with the
aaa group server command. (Range: 1-64 characters)
Default Setting
Accounting is not enabled
No servers are specified
Command Mode
Global Configuration– 248 –

Chapter 8 | Authentication Commands

AAA

Command Usage The accounting of Exec mode commands is only supported by TACACS+
servers.
 Note that the default and method-name fields are only used to describe theaccounting method(s) configured on the specified TACACS+ server, and do not
actually send any information to the server about the methods to use.

ExampleConsole(config)#aaa accounting commands 15 default start-stop group tacacs+
Console(config)#

aaa accounting dot1x This command enables the accounting of requested 802.1X services for network
access. Use the no form to disable the accounting service.
Syntaxaaa accounting dot1x {default | method-name}start-stop group {radius | tacacs+ |server-group}no aaa accounting dot1x {default | method-name}default - Specifies the default accounting method for service requests.
method-name - Specifies an accounting method for service requests.
(Range: 1-64 characters)
start-stop - Records accounting from starting point and stopping point.
group - Specifies the server group to use.
radius - Specifies all RADIUS hosts configure with the radius-server
host command.
tacacs+ - Specifies all TACACS+ hosts configure with the tacacs-server
host command.
server-group - Specifies the name of a server group configured with the
aaa group server command. (Range: 1-64 characters)
Default Setting
Accounting is not enabled
No servers are specified
Command Mode
Global Configuration
Command Usage
Note that the default and method-name fields are only used to describe theaccounting method(s) configured on the specified RADIUS or TACACS+ servers, anddo not actually send any information to the servers about the methods to use.

– 249 –

Chapter 8 | Authentication Commands

AAA

ExampleConsole(config)#aaa accounting dot1x default start-stop group radius
Console(config)#

aaa accounting exec This command enables the accounting of requested Exec services for network
access. Use the no form to disable the accounting service.
Syntaxaaa accounting exec {default | method-name}start-stop group {radius | tacacs+ |server-group}no aaa accounting exec {default | method-name}default - Specifies the default accounting method for service requests.
method-name - Specifies an accounting method for service requests.
(Range: 1-64 characters)
start-stop - Records accounting from starting point and stopping point.
group - Specifies the server group to use.
radius - Specifies all RADIUS hosts configure with the radius-server
host command.
tacacs+ - Specifies all TACACS+ hosts configure with the tacacs-server
host command.
server-group - Specifies the name of a server group configured with the
aaa group server command. (Range: 1-64 characters)
Default Setting
Accounting is not enabled
No servers are specified
Command Mode
Global Configuration
Command Usage This command runs accounting for Exec service requests for the local console
and Telnet connections.
 Note that the default and method-name fields are only used to describe theaccounting method(s) configured on the specified RADIUS or TACACS+ servers,and do not actually send any information to the servers about the methods touse.

ExampleConsole(config)#aaa accounting exec default start-stop group tacacs+
Console(config)#– 250 –

Chapter 8 | Authentication Commands

AAA

aaa accounting This command enables the sending of periodic updates to the accounting server.
update Use the no form to disable accounting updates.
Syntaxaaa accounting update [periodic interval]
no aaa accounting update
interval - Sends an interim accounting record to the server at this interval.
(Range: 1-2147483647 minutes)
Default Setting
1 minute
Command Mode
Global Configuration
Command Usage When accounting updates are enabled, the switch issues periodic interim
accounting records for all users on the system.
 Using the command without specifying an interim interval enables updates,

but does not change the current interval setting.

ExampleConsole(config)#aaa accounting update periodic 30
Console(config)#

aaa authorization This command enables the authorization of Exec mode commands. Use the nocommands form to disable the authorization service.
Syntaxaaa authorization commands level {default | method-name} group {tacacs+ |server-group}no aaa authorization commands level {default | method-name}level - The privilege level for executing commands. (Range: 0-15)
default - Specifies the default authorization method for service requests.
method-name - Specifies an authorization method for service requests.
(Range: 1-64 characters)group - Specifies the server group to use.
tacacs+ - Specifies all TACACS+ hosts configured with the tacacs-server
host command.
server-group - Specifies the name of a server group configured with the
aaa group server command. (Range: 1-64 characters)– 251 –

Chapter 8 | Authentication Commands

AAA

Default Setting
Authorization is not enabled
No servers are specified
Command Mode
Global Configuration
Command Usage The authorization of Exec mode commands is only supported by TACACS+
servers.
 Note that the default and method-name fields are only used to describe theauthorization method(s) configured on the specified TACACS+ server, and do
not actually send any information to the server about the methods to use.

ExampleConsole(config)#aaa authorization commands 15 default group tacacs+
Console(config)#

aaa authorization exec This command enables the authorization for Exec access. Use the no form todisable the authorization service.
Syntaxaaa authorization exec {default | method-name}group {tacacs+ | server-group}no aaa authorization exec {default | method-name}default - Specifies the default authorization method for Exec access.
method-name - Specifies an authorization method for Exec access.
(Range: 1-64 characters)group - Specifies the server group to use.
tacacs+ - Specifies all TACACS+ hosts configured with the tacacs-server
host command.
server-group - Specifies the name of a server group configured with the
aaa group server command. (Range: 1-64 characters)
Default Setting
Authorization is not enabled
No servers are specified
Command Mode
Global Configuration– 252 –

Chapter 8 | Authentication Commands

AAA

Command Usage This command performs authorization to determine if a user is allowed to run
an Exec shell for local console, Telnet, or SSH connections.
 AAA authentication must be enabled before authorization is enabled.
 If this command is issued without a specified named method, the default

method list is applied to all interfaces or lines (where this authorization typeapplies), except those that have a named method explicitly defined.

ExampleConsole(config)#aaa authorization exec default group tacacs+
Console(config)#

aaa group server Use this command to name a group of security server hosts. To remove a servergroup from the configuration list, enter the no form of this command.
Syntax[no] aaa group server {radius | tacacs+} group-nameradius - Defines a RADIUS server group.
tacacs+ - Defines a TACACS+ server group.
group-name - A text string that names a security server group.
(Range: 1-64 characters)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#aaa group server radius tps
Console(config-sg-radius)#

server This command adds a security server to an AAA server group. Use the no form to
remove the associated server from the group.
Syntax[no] server {index | ip-address}
index - Specifies the server index. (Range: RADIUS 1-5, TACACS+ 1)
ip-address - Specifies the host IP address of a server.

– 253 –

Chapter 8 | Authentication Commands

AAA

Default Setting
None
Command Mode
Server Group Configuration
Command Usage When specifying the index for a RADIUS server, that server index must alreadybe defined by the radius-server host command.
 When specifying the index for a TACACS+ server, that server index must alreadybe defined by the tacacs-server host command.

ExampleConsole(config)#aaa group server radius tps
Console(config-sg-radius)#server 10.2.68.120
Console(config-sg-radius)#

accounting dot1x This command applies an accounting method for 802.1X service requests on aninterface. Use the no form to disable accounting on the interface.
Syntaxaccounting dot1x {default | list-name}no accounting dot1x
default - Specifies the default method list created with the aaa accounting
dot1x command.
list-name - Specifies a method list created with the aaa accounting dot1x
command.
Default Setting
None
Command Mode
Interface Configuration
ExampleConsole(config)#interface ethernet 1/2
Console(config-if)#accounting dot1x tps
Console(config-if)#– 254 –

Chapter 8 | Authentication Commands

AAAaccounting This command applies an accounting method to entered CLI commands. Use thecommands no form to disable accounting for entered CLI commands.
Syntaxaccounting commands level {default | list-name}no accounting commands level
level - The privilege level for executing commands. (Range: 0-15)
default - Specifies the default method list created with the aaa accounting
commands command.
list-name - Specifies a method list created with the aaa accounting
commands command.
Default Setting
None
Command ModeLine Configuration
ExampleConsole(config)#line console
Console(config-line)#accounting commands 15 default
Console(config-line)#accounting exec This command applies an accounting method to local console, Telnet or SSH
connections. Use the no form to disable accounting on the line.
Syntaxaccounting exec {default | list-name}no accounting exec
default - Specifies the default method list created with the aaa accounting
exec command.
list-name - Specifies a method list created with the aaa accounting exec
command.
Default Setting
None
Command ModeLine Configuration
ExampleConsole(config)#line console
Console(config-line)#accounting exec tps– 255 –

Chapter 8 | Authentication Commands

AAA

Console(config-line)#exit
Console(config)#line vty
Console(config-line)#accounting exec default
Console(config-line)#authorization This command applies an authorization method to entered CLI commands. Use thecommands no form to disable authorization for entered CLI commands.
Syntax
authorization commands level {default | list-name}no authorization commands level
level - The privilege level for executing commands. (Range: 0-15)
default - Specifies the default method list created with the aaa
authorization commands command.
list-name - Specifies a method list created with the aaa authorizationcommands command.
Default Setting
None
Command ModeLine Configuration
ExampleConsole(config)#line console
Console(config-line)#authorization commands 15 default
Console(config-line)#authorization exec This command applies an authorization method to local console, Telnet or SSH
connections. Use the no form to disable authorization on the line.
Syntax
authorization exec {default | list-name}no authorization exec
default - Specifies the default method list created with the aaa
authorization exec command.
list-name - Specifies a method list created with the aaa authorization exec
command.
Default SettingNone– 256 –

Chapter 8 | Authentication Commands

AAA

Command ModeLine Configuration
ExampleConsole(config)#line console
Console(config-line)#authorization exec tps
Console(config-line)#exit
Console(config)#line vty
Console(config-line)#authorization exec default
Console(config-line)#show accounting This command displays the current accounting settings per function and per port.
Syntaxshow accounting [commands [level]] |[[dot1x [statistics [username user-name | interface interface]] |exec [statistics] | statistics]
commands - Displays command accounting information.
level - Displays command accounting information for a specifiablecommand level.
dot1x - Displays dot1x accounting information.
exec - Displays Exec accounting records.
statistics - Displays accounting records.
user-name - Displays accounting records for a specifiable username.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show accounting
Accounting Type : dot1x
Method List
: defaultGroup List
: radiusInterface: Eth 1/1

– 257 –

Chapter 8 | Authentication Commands

AAA

Method List
Group List
Interface: tps: radius: Eth 1/2

Accounting Type : EXEC
Method List
: defaultGroup List
: tacacs+
Interface: vty
Accounting Type : Commands 0
Method List
: defaultGroup List
: tacacs+
Interface:.
.
.
Accounting Type : Commands 15
Method List
: defaultGroup List
: tacacs+
Interface:
Console#show authorization This command displays the current authorization settings per function and per
port.

Syntaxshow authorization [commands [level] | exec]
commands - Displays command authorization information.
level - Displays command authorization information for a specifiablecommand level.
exec - Displays Exec authorization records.
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show authorization
Authorization Type : EXEC
Method List
: defaultGroup List
: tacacs+
Interface: vty
Authorization Type : Commands 0
Method List
: defaultGroup List
: tacacs+
Interface:.
.
.
Authorization Type : Commands 15
Method List
: defaultGroup List
: tacacs+
Interface:– 258 –

Chapter 8 | Authentication Commands
Web Server

Console#Web ServerThis section describes commands used to configure web browser management
access to the switch.
Table 48: Web Server Commands
CommandFunctionMode

ip http authentication

Sets the method list for EXEC authorization of an EXEC
sessionGC

ip http port

Specifies the port to be used by the web browser interface GC

ip http server

Allows the switch to be monitored or configured from abrowserGC

ip http secure-port

Specifies the TCP port number for HTTPSGC

ip http secure-server

Enables HTTPS (HTTP/SSL) for encrypted communications GC

show authorization

Displays all authorization information

PEshow system

Displays system information

NE, PE

Note: Users are automatically logged off of the HTTP server or HTTPS server if no
input is detected for 300 seconds.

ip http authentication This command specifies the method list for EXEC authorization for starting an EXEC

session used by the web browser interface. Use the no form to use the default port.
Syntax
ip http authentication aaa exec-authorization {default | list-name}no ip http authentication aaa exec-authorization
default - Specifies the default method list used for authorization requests.
list-name - Specifies a method list created with the aaa authorizationcommands command.

Default Setting
None
Command Mode
Global Configuration– 259 –

Chapter 8 | Authentication Commands

Web Server

ExampleConsole(config)#ip http authentication aaa exec-authorization default
Console(config)#

Related Commands
aaa authorization commands (251)
ip http server (260)show system (121)

ip http port This command specifies the TCP port number used by the web browser interface.
Use the no form to use the default port.
Syntax
ip http port port-number
no ip http port
port-number - The TCP port to be used by the browser interface.
(Range: 1-65535)
Default Setting
80
Command Mode
Global Configuration
ExampleConsole(config)#ip http port 769
Console(config)#

Related Commands
ip http server (260)show system (121)

ip http server This command allows this device to be monitored or configured from a browser.
Use the no form to disable this function.
Syntax[no] ip http server
Default Setting
EnabledCommand Mode
Global Configuration– 260 –

Chapter 8 | Authentication Commands
Web Server

ExampleConsole(config)#ip http server
Console(config)#

Related Commands
ip http authentication (259)show system (121)

ip http secure-port This command specifies the TCP port number used for HTTPS connection to theswitch’s web interface. Use the no form to restore the default port.
Syntax
ip http secure-port port_number
no ip http secure-port
port_number – The TCP port used for HTTPS. (Range: 1-65535, except for
the following reserved ports: 1 and 25 - Linux kernel, 23 - Telnet, 80 - HTTP)
Default Setting
443
Command Mode
Global Configuration
Command Usage You cannot configure the HTTP and HTTPS servers to use the same port.
 If you change the HTTPS port number, clients attempting to connect to the

HTTPS server must specify the port number in the URL, in this format: https://device:port_number

ExampleConsole(config)#ip http secure-port 1000
Console(config)#

Related Commands
ip http secure-server (261)show system (121)

ip http secure-server This command enables the secure hypertext transfer protocol (HTTPS) over the

Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection)
to the switch’s web interface. Use the no form to disable this function.

– 261 –

Chapter 8 | Authentication Commands

Web Server

Syntax[no] ip http secure-server
Default Setting
EnabledCommand Mode
Global Configuration
Command Usage Both HTTP and HTTPS service can be enabled independently on the switch.
However, you cannot configure the HTTP and HTTPS servers to use the same
UDP port.
 If you enable HTTPS, you must indicate this in the URL that you specify in yourbrowser: https://device[:port_number] When you start HTTPS, the connection is established in this way:

The client authenticates the server using the server’s digital certificate.

The client and server negotiate a set of security protocols to use for theconnection.



The client and server generate session keys for encrypting and decryptingdata.

 The client and server establish a secure encrypted connection.

A padlock icon should appear in the status bar for Internet Explorer 9, Mozilla
Firefox 52, Google Chrome 54, or Opera 41, or more recent versions.
The following web browsers and operating systems currently support HTTPS:
Table 49: HTTPS System Support
Web Browser

Operating System

Internet Explorer 9 or later

Windows 7, 8, 10

Mozilla Firefox 52 or later

Windows 7, 8, 10, Linux

Google Chrome 54 or later

Windows 7, 8, 10

Opera 41 or later

Windows 7, 8, 10, Linux To specify a secure-site certificate, see “Replacing the Default Secure-site

Certificate” in the Web Management Guide. Also refer to the copy tftp httpscertificate command.

 Connection to the web interface is not supported for HTTPS using an IPv6 link

local address.

– 262 –

Chapter 8 | Authentication Commands

Telnet Server

ExampleConsole(config)#ip http secure-server
Console(config)#

Related Commands
ip http secure-port (261)
copy tftp https-certificate (129)show system (121)Telnet ServerThis section describes commands used to configure Telnet management access tothe switch.
Table 50: Telnet Server Commands
CommandFunctionMode

ip telnet max-sessions

Specifies the maximum number of Telnet sessions that can GC
simultaneously connect to this system

ip telnet port

Specifies the port to be used by the Telnet interfaceGC

ip telnet server

Allows the switch to be monitored or configured from
TelnetGC

telnet (client)

Accesses a remote device using a Telnet connection

PEshow ip telnet

Displays configuration settings for the Telnet serverPE

Note: This switch also supports a Telnet client function. A Telnet connection can bemade from this switch to another device by entering the telnet command at thePrivileged Exec configuration level.

ip telnet max-sessions This command specifies the maximum number of Telnet sessions that cansimultaneously connect to this system. Use the no from to restore the default
setting.
Syntaxip telnet max-sessions session-countno ip telnet max-sessions
session-count - The maximum number of allowed Telnet session.
(Range: 0-8)
Default Setting
8 sessions– 263 –

Chapter 8 | Authentication Commands

Telnet Server

Command Mode
Global Configuration
Command Usage
A maximum of eight sessions can be concurrently opened for Telnet and Secure
Shell (i.e., both Telnet and SSH share a maximum number of eight sessions).
ExampleConsole(config)#ip telnet max-sessions 1
Console(config)#

ip telnet port This command specifies the TCP port number used by the Telnet interface. Use theno form to use the default port.
Syntaxip telnet port port-number
no telnet port
port-number - The TCP port number to be used by the browser interface.
(Range: 1-65535)
Default Setting
23
Command Mode
Global Configuration
ExampleConsole(config)#ip telnet port 123
Console(config)#

ip telnet server This command allows this device to be monitored or configured from Telnet. Use
the no form to disable this function.
Syntax[no] ip telnet server
Default Setting
EnabledCommand Mode
Global Configuration– 264 –

Chapter 8 | Authentication Commands

Telnet Server

ExampleConsole(config)#ip telnet server
Console(config)#

telnet (client) This command accesses a remote device using a Telnet connection.
Syntaxtelnet host
host - IP address or alias of a remote device.
Command Mode
Privileged Exec
ExampleConsole#telnet 192.168.2.254
Connect To 192.168.2.254...
***************************************************************WARNING - MONITORED ACTIONS AND ACCESSES
User Access Verification
Username:
Console(config)#show ip telnet This command displays the configuration settings for the Telnet server.
Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show ip telnet
IP Telnet Configuration:
Telnet Status: Enabled
Telnet Service Port: 23
Telnet Max Session: 8
Console#– 265 –

Chapter 8 | Authentication Commands

Secure Shell

Secure Shell
This section describes the commands used to configure the SSH server. Note thatyou also need to install a SSH client on the management station when using thisprotocol to configure the switch.
Note: The switch supports only SSH Version 2.0 clients.
Table 51: Secure Shell Commands
CommandFunctionMode

ip sshauthentication-retries

Specifies the number of retries allowed by a clientGC

ip ssh server

Enables the SSH server on the switchGC

ip ssh timeout

Specifies the authentication timeout for the SSH serverGC

copy tftp public-key

Copies the user’s public key from a TFTP server to theswitchPEdelete public-key

Deletes the public key for the specified userPE

disconnect

Terminates a line connectionPE

ip ssh crypto
host-key generate

Generates the host keyPE

ip ssh crypto zeroize

Clears the host key from RAM

PE

ip ssh save host-key

Saves the host key from RAM to flash memoryPEshow ip ssh

Displays the status of the SSH server and the configured
values for authentication timeout and retries

PEshow public-key

Shows the public key for the specified user or for the hostPEshow ssh

Displays the status of current SSH sessions

PEshow users

Shows SSH users, including privilege level and public key
type

PE

Configuration Guidelines
The SSH server on this switch supports both password and public key
authentication. If password authentication is specified by the SSH client, then the
password can be authenticated either locally or via a RADIUS or TACACS+ remoteauthentication server, as specified by the authentication login command. If public
key authentication is specified by the client, then you must configure
authentication keys on both the client and the switch as described in the following
section. Note that regardless of whether you use public key or password
authentication, you still have to generate authentication keys on the switch andenable the SSH server.

– 266 –

Chapter 8 | Authentication Commands

Secure Shell

To use the SSH server, complete these steps:

1. Generate a Host Key Pair – Use the ip ssh crypto host-key generate command tocreate a host public/private key pair.

2. Provide Host Public Key to Clients – Many SSH client programs automaticallyimport the host public key during the initial connection setup with the switch.
Otherwise, you need to manually create a known hosts file on the management
station and place the host public key in it. An entry for a public key in the
known hosts file would appear similar to the following example:
10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254
15020245593199868544358361651999923329781766065830956
108259132128902337654680172627257141342876294130119619556678259566410486957427
888146206519417467729848654686157177393901647793559423035774130980227370877945
4524083971752646358058176716709574804776117

3. Import Client’s Public Key to the Switch – Use the copy tftp public-key

command to copy a file containing the public key for all the SSH client’s
granted management access to the switch. (Note that these clients must be
configured locally on the switch with the username command.) The clients aresubsequently authenticated using these keys. The current firmware only
accepts public key files based on standard UNIX format as shown in thefollowing example for an RSA key:
1024 35
134108168560989392104094492015542534763164192187295892114317388005553616163105
177594083868631109291232226828519254374603100937187721199696317813662774141689
851320491172048303392543241016379975923714490119380060902539484084827178194372
288402533115952134861022902978982721353267131629432532818915045306393916643
steve@192.168.1.19

4. Set the Optional Parameters – Set other optional parameters, including theauthentication timeout and the number of retries.

5. Enable SSH Service – Use the ip ssh server command to enable the SSH serveron the switch.

6. Authentication – One of the following authentication methods is employed:
Password Authentication (for SSH V2 Clients)

a. The client sends its password to the server.
b. The switch compares the client's password to those stored in memory.
c. If a match is found, the connection is allowed.
Note: To use SSH with only password authentication, the host public key must still
be given to the client, either during initial connection or manually entered into the
known host file. However, you do not need to configure the client's keys.

– 267 –

Chapter 8 | Authentication Commands

Secure Shell

Public Key Authentication – When an SSH client attempts to contact the switch,
the SSH server uses the host key pair to negotiate a session key and encryption
method. Only clients that have a private key corresponding to the public keys
stored on the switch can access it. The following exchanges take place during
this process:
Authenticating SSH v2 Clientsa. The client first queries the switch to determine if public key

authentication using a preferred algorithm is acceptable.
b. If the specified algorithm is supported by the switch, it notifies theclient to proceed with the authentication process. Otherwise, it
rejects the request.
c. The client sends a signature generated using the private key to theswitch.
d. When the server receives this message, it checks whether the
supplied key is acceptable for authentication, and if so, it then checks
whether the signature is correct. If both checks succeed, the client isauthenticated.
Note: The SSH server supports up to eight client sessions. The maximum numberof client sessions includes both current Telnet sessions and SSH sessions.
Note: The SSH server can be accessed using any configured IPv4 or IPv6 interface
address on the switch.

ip ssh This command configures the number of times the SSH server attempts toauthentication-retries reauthenticate a user. Use the no form to restore the default setting.
Syntax
ip ssh authentication-retries countno ip ssh authentication-retries
count – The number of authentication attempts permitted after which theinterface is reset. (Range: 1-5)
Default Setting
3
Command Mode
Global Configuration
ExampleConsole(config)#ip ssh authentication-retires 2
Console(config)#– 268 –

Chapter 8 | Authentication Commands

Secure Shell

Related Commands
show ip ssh (272)

ip ssh server This command enables the Secure Shell (SSH) server on this switch. Use the noform to disable this service.
Syntax[no] ip ssh server
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage The SSH server supports up to eight client sessions. The maximum number ofclient sessions includes both current Telnet sessions and SSH sessions.

 The SSH server uses RSA for key exchange when the client first establishes aconnection with the switch, and then negotiates with the client to select either
DES (56-bit) or 3DES (168-bit) for data encryption.

 You must generate RSA host keys before enabling the SSH server.

ExampleConsole#ip ssh crypto host-key generate
Console#configure
Console(config)#ip ssh server
Console(config)#

Related Commands
ip ssh crypto host-key generate (270)show ssh (273)

ip ssh timeout This command configures the timeout for the SSH server. Use the no form torestore the default setting.
Syntax
ip ssh timeout seconds
no ip ssh timeout
seconds – The timeout for client response during SSH negotiation.
(Range: 1-120)– 269 –

Chapter 8 | Authentication Commands

Secure Shell

Default Setting
120 seconds
Command Mode
Global Configuration
Command Usage
The timeout specifies the interval the switch will wait for a response from the client
during the SSH negotiation phase. Once an SSH session has been established, thetimeout for user input is controlled by the exec-timeout command for vty sessions.
ExampleConsole(config)#ip ssh timeout 60
Console(config)#

Related Commands
exec-timeout (142)show ip ssh (272)delete public-key This command deletes the specified user’s public key.
Syntaxdelete public-key username
username – Name of an SSH user. (Range: 1-8 characters)
Default Setting
Deletes the RSA key.
Command Mode
Privileged Exec
ExampleConsole#delete public-key admin
Console#ip ssh crypto This command generates the host key pair (i.e., public and private).
host-key generate
Syntax
ip ssh crypto host-key generate
Default Setting
Generates the RSA key pairs.

– 270 –

Chapter 8 | Authentication Commands

Secure Shell

Command Mode
Privileged Exec
Command Usage The switch uses RSA for SSHv2 clients.
 This command stores the host key pair in memory (i.e., RAM). Use the ip ssh

save host-key command to save the host key pair to flash memory.

 Some SSH client programs automatically add the public key to the known hosts

file as part of the configuration process. Otherwise, you must manually create aknown hosts file and place the host public key in it.

 The SSH server uses this host key to negotiate a session key and encryption

method with the client trying to connect to it.

ExampleConsole#ip ssh crypto host-key generate
Console#Related Commands
ip ssh crypto zeroize (271)
ip ssh save host-key (272)

ip ssh crypto zeroize This command clears the host key from memory (i.e. RAM).
Syntax
ip ssh crypto zeroize
Default Setting
Clears the RSA key.
Command Mode
Privileged Exec
Command Usage This command clears the host key from volatile memory (RAM). Use the no ip
ssh save host-key command to clear the host key from flash memory.
 The SSH server must be disabled before you can execute this command.

ExampleConsole#ip ssh crypto zeroize
Console#– 271 –

Chapter 8 | Authentication Commands

Secure Shell

Related Commands
ip ssh crypto host-key generate (270)
ip ssh save host-key (272)
no ip ssh server (269)

ip ssh save host-key This command saves the host key from RAM to flash memory.
Syntax
ip ssh save host-key
Default Setting
Saves the RSA key.
Command Mode
Privileged Exec
ExampleConsole#ip ssh save host-key
Console#Related Commands
ip ssh crypto host-key generate (270)show ip ssh This command displays the connection settings used when authenticating client
access to the SSH server.
Command Mode
Privileged Exec
ExampleConsole#show ip ssh
SSH Enabled - Version 2.0
Negotiation Timeout : 120 seconds; Authentication Retries : 3
Console#– 272 –

Chapter 8 | Authentication Commands

Secure Shellshow public-key This command shows the public key for the specified user or for the host.
Syntaxshow public-key [user [username]| host]username – Name of an SSH user. (Range: 1-32 characters)
Default SettingShows all public keys.
Command Mode
Privileged Exec
Command Usage
If no parameters are entered, all keys are displayed. If the user keyword is entered,but no user name is specified, then the public keys for all users are displayed.
ExampleConsole#show public-key host
Host:
RSA:
-----BEGIN RSA PUBLIC KEY----MIIBCgKCAQEAspl/UuyjRJzxtmsLQUc28rtCzK0zxV4SACwLE4jPdJacX7yIMgyD
P+6wcj6QhZ5LYTByYLtgZ8OpvhgcTcLbOPp/LWEgII+ntzUiJGIqgXgggZtWWsTp
XC9WXgHzknKAvfI0zk2Ec/x4ryvSlWazEb0ygnozDPc8ZRV2iST+nzAKSCb3Oii3
SmpGk/NOzFK4OK3ouX1692PfB64QSDXyi1BcmR0nMU943xC/F8JPtLKxQLiZSnSa
Ef1dcbOIXHKd7dedw4MauUhzDznIawAEu6R4d2HSjxDM9pOIio8he860+S8gpBSN
9kSgNXU7o3BarVvYZo2hPaEOLAFBv+tklQIDAQAB-----END RSA PUBLIC KEY----Console#

show ssh This command displays the current SSH server connections.
Command Mode
Privileged Exec
ExampleConsole#show ssh
Connection Version State1
2.0
Session-Started
Console#– 273 –

Username Encryption
admin
ctos aes128-cbc-hmac-md5
stoc aes128-cbc-hmac-md5

Chapter 8 | Authentication Commands
802.1X Port Authentication
Table 52: show ssh - display description
Field

Description

Connection

The session number. A total of eight SSH and Telnet sessions are allowed.

VersionThe Secure Shell version number.

State

The authentication negotiation state.
(Values: Negotiation-Started, Authentication-Started, Session-Started)

Username

The user name of the client.

802.1X Port Authentication
The switch supports IEEE 802.1X (dot1x) port-based access control that prevents
unauthorized access to the network by requiring users to first submit credentials
for authentication. Client authentication is controlled centrally by a RADIUS serverusing EAP (Extensible Authentication Protocol).
Table 53: 802.1X Port Authentication Commands
CommandFunctionMode

dot1x default

Resets all dot1x parameters to their default values

GC

dot1x eapol-pass-throughPasses EAPOL frames to all ports in STP forwarding state
when dot1x is globally disabledGC

dot1x system-auth-control

Enables dot1x globally on the switch.

GC

dot1x intrusion-action

Sets the port response to intrusion when authentication
fails

IC

dot1x max-reauth-req

Sets the maximum number of times that the switch sends IC
an EAP-request/identity frame to the client before
restarting the authentication process

dot1x max-req

Sets the maximum number of times that the switch
retransmits an EAP request/identity packet to the client
before it times out the authentication session

IC

dot1x operation-mode

Allows single or multiple hosts on an dot1x portIC

dot1x port-control

Sets dot1x mode for a port interface

IC

dot1x re-authentication

Enables re-authentication for all ports

IC

dot1x timeout quiet-period

Sets the time that a switch port waits after the Max Request ICCount has been exceeded before attempting to acquire a
new client

dot1x timeout re-authperiod

Sets the time period after which a connected client must
be re-authenticatedIC

dot1x timeout supp-timeout

Sets the interval for a supplicant to respondIC

dot1x timeout tx-period

Sets the time period during an authentication session that IC
the switch waits before re-transmitting an EAP packet

General Commands

Authenticator Commands– 274 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

Table 53: 802.1X Port Authentication Commands (Continued)
CommandFunctionMode

dot1x re-authenticate

Forces re-authentication on specific ports

PE

dot1x identity profile

Configures dot1x supplicant user name and password

GC

dot1x max-start

Sets the maximum number of times that a port supplicant IC
will send an EAP start frame to the client

dot1x pae supplicant

Enables dot1x supplicant mode on an interface

IC

dot1x timeout auth-period

Sets the time that a supplicant port waits for a response
from the authenticatorIC

dot1x timeout held-period

Sets the time a port waits after the maximum start counthas been exceeded before attempting to find anotherauthenticatorIC

dot1x timeout start-period

Sets the time that a supplicant port waits before resending IC
an EAPOL start frame to the authenticator

Supplicant Commands

Information Display Commands
show dot1x

Shows all dot1x related information

PE

General Commands

dot1x default This command sets all configurable dot1x authenticator global and port settings totheir default values.

Command Mode
Global Configuration
Command Usage
This command resets the following commands to their default settings:


dot1x system-auth-control



dot1x eapol-pass-through dot1x port-control
 dot1x port-control multi-host max-count dot1x operation-mode dot1x max-req dot1x timeout quiet-period dot1x timeout tx-period dot1x timeout re-authperiod dot1x timeout sup-timeout
 dot1x re-authentication
 dot1x intrusion-action– 275 –

Chapter 8 | Authentication Commands
802.1X Port Authentication
ExampleConsole(config)#dot1x default
Console(config)#

dot1x eapol-pass- This command passes EAPOL frames through to all ports in STP forwarding statethrough when dot1x is globally disabled. Use the no form to restore the default.
Syntax[no] dot1x eapol-pass-throughDefault Setting
Discards all EAPOL frames when dot1x is globally disabled
Command Mode
Global Configuration
Command Usage When this device is functioning as intermediate node in the network and does
not need to perform dot1x authentication, the dot1x eapol pass-throughcommand can be used to forward EAPOL frames from other switches on to theauthentication servers, thereby allowing the authentication process to still be
carried out by switches located on the edge of the network.
 When this device is functioning as an edge switch but does not require any

attached clients to be authenticated, the no dot1x eapol-pass-throughcommand can be used to discard unnecessary EAPOL traffic.

ExampleThis example instructs the switch to pass all EAPOL frame through to any ports in
STP forwarding state.
Console(config)#dot1x eapol-pass-throughConsole(config)#

dot1x system- This command enables IEEE 802.1X port authentication globally on the switch.
auth-control Use the no form to restore the default.
Syntax[no] dot1x system-auth-control
Default Setting
Disabled– 276 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

Command Mode
Global Configuration
ExampleConsole(config)#dot1x system-auth-control
Console(config)#

Authenticator Commands

dot1x intrusion-action This command sets the port’s response to a failed authentication, either to block all
traffic, or to assign all traffic for the port to a guest VLAN. Use the no form to reset
the default.
Syntax
dot1x intrusion-action {block-traffic | guest-vlan}
no dot1x intrusion-action
block-traffic - Blocks traffic on this port.
guest-vlan - Assigns the user to the Guest VLAN.
Default
block-traffic
Command Mode
Interface Configuration
Command Usage For guest VLAN assignment to be successful, the VLAN must be configured andset as active (see the vlan database command) and assigned as the guest VLAN
for the port (see the network-access guest-vlan command).
 A port can only be assigned to the guest VLAN in case of failed authentication,

if switchport mode is set to Hybrid.

ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x intrusion-action guest-vlan
Console(config-if)#– 277 –

Chapter 8 | Authentication Commands
802.1X Port Authentication

dot1x max-reauth-req This command sets the maximum number of times that the switch sends an EAPrequest/identity frame to the client before restarting the authentication process.
Use the no form to restore the default.
Syntax
dot1x max-reauth-req countno dot1x max-reauth-req
count – The maximum number of requests (Range: 1-10)
Default
2
Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x max-reauth-req 2
Console(config-if)#

dot1x max-req This command sets the maximum number of times the switch port will retransmit

an EAP request/identity packet to the client before it times out the authentication
session. Use the no form to restore the default.
Syntax
dot1x max-req countno dot1x max-req
count – The maximum number of requests (Range: 1-10)
Default
2
Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x max-req 2
Console(config-if)#– 278 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

dot1x This command allows hosts (clients) to connect to an 802.1X-authorized port. Use
operation-mode the no form with no keywords to restore the default to single host. Use the no form
with the multi-host max-count keywords to restore the default maximum count.
Syntax
dot1x operation-mode {single-host | multi-host [max-count count] | macbased-auth}no dot1x operation-mode [multi-host max-count]single-host – Allows only a single host to connect to this port.
multi-host – Allows multiple host to connect to this port.
max-count – Keyword for the maximum number of hosts.
count – The maximum number of hosts that can connect to a port.
(Range: 1-1024; Default: 5)
mac-based – Allows multiple hosts to connect to this port, with each hostneeding to be authenticated.
Default
Single-hostCommand Mode
Interface Configuration
Command Usage The “max-count” parameter specified by this command is only effective if the
dot1x mode is set to “auto” by the dot1x port-control command.
 In “multi-host” mode, only one host connected to a port needs to passauthentication for all other hosts to be granted network access. Similarly, a port
can become unauthorized for all hosts if one attached host fails reauthentication or sends an EAPOL logoff message.

 In “mac-based-auth” mode, each host connected to a port needs to passauthentication. The number of hosts allowed access to a port operating in thismode is limited only by the available space in the secure address table (i.e., up
to 1024 addresses).

ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x operation-mode multi-host max-count 10
Console(config-if)#– 279 –

Chapter 8 | Authentication Commands
802.1X Port Authentication

dot1x port-control This command sets the dot1x mode on a port interface. Use the no form to restore
the default.
Syntax
dot1x port-control {auto | force-authorized | force-unauthorized}
no dot1x port-control
auto – Requires a dot1x-aware connected client to be authorized by the
RADIUS server. Clients that are not dot1x-aware will be denied access.
force-authorized – Configures the port to grant access to all clients, either
dot1x-aware or otherwise.
force-unauthorized – Configures the port to deny access to all clients,
either dot1x-aware or otherwise.
Default
force-authorizedCommand Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x port-control auto
Console(config-if)#

dot1x This command enables periodic re-authentication for a specified port. Use the no
re-authentication form to disable re-authentication.
Syntax[no] dot1x re-authentication
Command Mode
Interface Configuration
Command Usage The re-authentication process verifies the connected client’s user ID andpassword on the RADIUS server. During re-authentication, the client remains
connected the network and the process is handled transparently by the dot1x
client software. Only if re-authentication fails is the port blocked.
 The connected client is re-authenticated after the interval specified by the

dot1x timeout re-authperiod command. The default is 3600 seconds.

– 280 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x re-authentication
Console(config-if)#

Related Commands
dot1x timeout re-authperiod (281)dot1x timeout This command sets the time that a switch port waits after the maximum request
quiet-period count (see page 278) has been exceeded before attempting to acquire a new client.
Use the no form to reset the default.
Syntax
dot1x timeout quiet-period seconds
no dot1x timeout quiet-period
seconds - The number of seconds. (Range: 1-65535)
Default
60 seconds
Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout quiet-period 350
Console(config-if)#

dot1x timeout This command sets the time period after which a connected client must be rere-authperiod authenticated. Use the no form of this command to reset the default.
Syntax
dot1x timeout re-authperiod seconds
no dot1x timeout re-authperiod
seconds - The number of seconds. (Range: 1-65535)
Default
3600 seconds
Command Mode
Interface Configuration– 281 –

Chapter 8 | Authentication Commands
802.1X Port Authentication
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout re-authperiod 300
Console(config-if)#

dot1x timeout This command sets the time that an interface on the switch waits for a response tosupp-timeout an EAP request from a client before re-transmitting an EAP packet. Use the no form
to reset to the default value.
Syntax
dot1x timeout supp-timeout seconds
no dot1x timeout supp-timeout
seconds - The number of seconds. (Range: 1-65535)
Default
30 seconds
Command Mode
Interface Configuration
Command Usage
This command sets the timeout for EAP-request frames other than EAP-request/
identity frames. If dot1x authentication is enabled on a port, the switch will initiate
authentication when the port link state comes up. It will send an EAP-request/
identity frame to the client to request its identity, followed by one or more requests
for authentication information. It may also send other EAP-request frames to theclient during an active connection as required for reauthentication.
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout supp-timeout 300
Console(config-if)#

dot1x timeout This command sets the time that an interface on the switch waits during an
tx-period authentication session before re-transmitting an EAP packet. Use the no form toreset to the default value.
Syntax
dot1x timeout tx-period seconds
no dot1x timeout tx-period
seconds - The number of seconds. (Range: 1-65535)– 282 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

Default
30 seconds
Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout tx-period 300
Console(config-if)#

dot1x re-authenticate This command forces re-authentication on all ports or a specific interface.
Syntax
dot1x re-authenticate [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
Command Usage
The re-authentication process verifies the connected client’s user ID and password
on the RADIUS server. During re-authentication, the client remains connected the
network and the process is handled transparently by the dot1x client software.
Only if re-authentication fails is the port blocked.
ExampleConsole#dot1x re-authenticate
Console#– 283 –

Chapter 8 | Authentication Commands
802.1X Port Authentication
Supplicant Commands

dot1x identity profile This command sets the dot1x supplicant user name and password. Use the no form
to delete the identity settings.
Syntax
dot1x identity profile {username username | password password |encrypted-password encrypted-pw}
no dot1x identity profile {username | password}
username - Specifies the supplicant user name. (Range: 1-8 characters)
password - Specifies the supplicant password. (Range: 1-8 characters)
encrypted-pw - Specifies the supplicant password in encrypted text.
(Range: 1-8 characters)
Default
No user name or password
Command Mode
Global Configuration
Command Usage
The global supplicant user name and password are used to identify this switch as asupplicant when responding to an MD5 challenge from the authenticator. These
parameters must be set when this switch passes client authentication requests toanother authenticator on the network (see the dot1x pae supplicant command.
ExampleConsole(config)#dot1x identity profile username steve
Console(config)#dot1x identity profile password excess
Console(config)#

dot1x max-start This command sets the maximum number of times that a port supplicant will send
an EAP start frame to the client before assuming that the client is 802.1X unaware.
Use the no form to restore the default value.
Syntax
dot1x max-start countno dot1x max-start
count - Specifies the maximum number of EAP start frames.
(Range: 1-65535)
Default3– 284 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x max-start 10
Console(config-if)#

dot1x pae supplicant This command enables dot1x supplicant mode on a port. Use the no form todisable dot1x supplicant mode on a port.
Syntax[no] dot1x pae supplicant
Default
Disabled
Command Mode
Interface Configuration
Command Usage When devices attached to a port must submit requests to anotherauthenticator on the network, configure the identity profile parameters (seedot1x identity profile command) which identify this switch as a supplicant, andenable dot1x supplicant mode for those ports which must authenticate clients
through a remote authenticator using this command. In this mode the port will
not respond to dot1x messages meant for an authenticator.
 This switch can be configured to serve as the authenticator on selected portsby setting the control mode to “auto” (see the dot1x port-control command),and as a supplicant on other ports by the setting the control mode to “forceauthorized” and enabling dot1x supplicant mode with this command.

 A port cannot be configured as a dot1x supplicant if it is a member of a trunk or

LACP is enabled on the port.

ExampleConsole(config)#interface ethernet 1/2
Console(config-if)#dot1x pae supplicant
Console(config-if)#– 285 –

Chapter 8 | Authentication Commands
802.1X Port Authentication

dot1x timeout This command sets the time that a supplicant port waits for a response from theauth-period authenticator. Use the no form to restore the default setting.
Syntax
dot1x timeout auth-period seconds
no dot1x timeout auth-period
seconds - The number of seconds. (Range: 1-65535)
Default
30 seconds
Command Mode
Interface Configuration
Command Usage
This command sets the time that the supplicant waits for a response from theauthenticator for packets other than EAPOL-Start.
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout auth-period 60
Console(config-if)#

dot1x timeout This command sets the time that a supplicant port waits before resending its
held-period credentials to find a new an authenticator. Use the no form to reset the default.
Syntax
dot1x timeout held-period seconds
no dot1x timeout held-period
seconds - The number of seconds. (Range: 1-65535)
Default
60 seconds
Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout held-period 120
Console(config-if)#– 286 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

dot1x timeout This command sets the time that a supplicant port waits before resending an
start-period EAPOL start frame to the authenticator. Use the no form to restore the default
setting.
Syntax
dot1x timeout start-period seconds
no dot1x timeout start-period
seconds - The number of seconds. (Range: 1-65535)
Default
30 seconds
Command Mode
Interface Configuration
ExampleConsole(config)#interface eth 1/2
Console(config-if)#dot1x timeout start-period 60
Console(config-if)#

Information Display Commands

show dot1x This command shows general port authentication related settings on the switch ora specific interface.
Syntaxshow dot1x [statistics] [interface interface]statistics - Displays dot1x status for each port.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
Command Usage
This command displays the following information:
 Global 802.1X Parameters – Shows whether or not 802.1X port authentication is

globally enabled on the switch (page 276).

– 287 –

Chapter 8 | Authentication Commands
802.1X Port Authentication
 Authenticator Parameters – Shows whether or not EAPOL pass-through is

enabled (page 276).

 Supplicant Parameters – Shows the supplicant user name used when the switch

responds to an MD5 challenge from an authenticator (page 284).

 802.1X Port Summary – Displays the port access control parameters for eachinterface that has enabled 802.1X, including the following items:Type – Administrative state for port access control (Enabled, Authenticator,
or Supplicant).
Operation Mode – Allows single or multiple hosts (page 279).
Control Mode – Dot1x port control mode (page 280).
Authorized – Authorization status (yes or n/a - not authorized).

 802.1X Port Details – Displays the port access control parameters for eachinterface, including the following items:














Reauthentication – Periodic re-authentication (page 280).
Reauth Period – Time after which a connected client must be reauthenticated (page 281).
Quiet Period – Time a port waits after Max Request Count is exceeded
before attempting to acquire a new client (page 281).
TX Period – Time a port waits during authentication session before retransmitting EAP packet (page 282).
Supplicant Timeout – Supplicant timeout.
Server Timeout – Server timeout. A RADIUS server must be set before thecorrect operational value of 10 seconds will be displayed in this field.
Reauth Max Retries – Maximum number of reauthentication attempts.
Max Request – Maximum number of times a port will retransmit an EAP
request/identity packet to the client before it times out the authentication
session (page 278).
Operation Mode– Shows if single or multiple hosts (clients) can connect toan 802.1X-authorized port.
Port Control–Shows the dot1x mode on a port as auto, force-authorized, orforce-unauthorized (page 280).
Intrusion Action– Shows the port response to intrusion whenauthentication fails (page 277).
Supplicant– MAC address of authorized client.

 Authenticator PAE State MachineState – Current state (including initialize, disconnected, connecting,authenticating, authenticated, aborting, held, force_authorized,
force_unauthorized).
Reauth Count– Number of times connecting state is re-entered.
Current Identifier– The integer (0-255) used by the Authenticator to identify
the current authentication session.

– 288 –

Chapter 8 | Authentication Commands

802.1X Port Authentication

 Backend State MachineState – Current state (including request, response, success, fail, timeout,idle, initialize).
Request Count– Number of EAP Request packets sent to the Supplicant
without receiving a response.
Identifier (Server)– Identifier carried in the most recent EAP Success, Failure
or Request packet received from the Authentication Server.

 Reauthentication State MachineState – Current state (including initialize, reauthenticate).
ExampleConsole#show dot1x
Global 802.1X Parameters
System Auth Control: Enabled

Authenticator Parameters:
EAPOL Pass Through: Disabled

Supplicant Parameters:
Identity Profile Username : steve
802.1X Port Summary
Port
Type
Operation Mode Control Mode
Authorized-------- ------------- -------------- ------------------ ---------Eth 1/ 1 Disabled
Single-Host
Force-AuthorizedYes
Eth 1/ 2 Disabled
Single-Host
Force-AuthorizedYes,,,
Eth 1/17 Disabled
Single-Host
Force-AuthorizedYes
Eth 1/18 Enabled
Single-Host
Auto
Yes
Console#show dot1x interface ethernet 1/5
802.1X Authenticator is enabled on port 1/5
Reauthentication: Enabled
Reauth Period: 3600 secondsQuiet Period: 60 seconds
TX Period: 30 seconds
Supplicant Timeout: 30 seconds
Server Timeout: 0 seconds
Reauth Max Retries: 2
Max Request: 2
Operation Mode
: Multi-hostPort Control: AutoIntrusion Action: Block traffic
Supplicant: 00-e0-29-94-34-65

Authenticator PAE State Machine
State: AuthenticatedReauth Count: 0
Current Identifier : 3
Backend State MachineState: IdleRequest Count: 0
Identifier(Server) : 2– 289 –

Chapter 8 | Authentication Commands
Management IP Filter
Reauthentication State Machine
State: Initialize
Console#Management IP Filter
This section describes commands used to configure IP management access to theswitch.
Table 54: Management IP Filter Commands
CommandFunctionModemanagement

Configures IP addresses that are allowed management
accessGC

show management

Displays the switch to be monitored or configured from abrowserPEmanagement This command specifies the client IP addresses that are allowed management

access to the switch through various protocols. A list of up to 15 IP addresses or IP
address groups can be specified. Use the no form to restore the default setting.
Syntax[no] management {all-client | http-client | snmp-client | telnet-client}
start-address [end-address]
all-client - Adds IP address(es) to all groups.
http-client - Adds IP address(es) to the web group.
snmp-client - Adds IP address(es) to the SNMP group.
telnet-client - Adds IP address(es) to the Telnet group.
start-address - A single IP address, or the starting address of a range.
end-address - The end address of a range.

Default Setting
All addresses
Command Mode
Global Configuration
Command Usage The management interfaces are open to all IP addresses by default. Once you
add an entry to a filter list, access to that interface is restricted to the specified
addresses.

– 290 –

Chapter 8 | Authentication Commands
Management IP Filter

 If anyone tries to access a management interface on the switch from an invalid

address, the switch will reject the connection, enter an event message in thesystem log, and send a trap message to the trap manager.

 IP address can be configured for SNMP, web, and Telnet access respectively.

Each of these groups can include up to five different sets of addresses, either
individual addresses or address ranges.

 When entering addresses for the same group (i.e., SNMP, web, or Telnet), theswitch will not accept overlapping address ranges. When entering addresses
for different groups, the switch will accept overlapping address ranges.

 You cannot delete an individual address from a specified range. You mustdelete the entire range, and re-enter the addresses.

 You can delete an address range just by specifying the start address, or by

specifying both the start address and end address.

ExampleThis example restricts management access to the indicated addresses.
Console(config)#management all-client 192.168.1.19
Console(config)#management all-client 192.168.1.25 192.168.1.30
Console#show management This command displays the client IP addresses that are allowed management
access to the switch through various protocols.
Syntaxshow management {all-client | http-client | snmp-client | telnet-client}
all-client - Displays IP addresses for all groups.
http-client - Displays IP addresses for the web group.
snmp-client - Displays IP addresses for the SNMP group.
telnet-client - Displays IP addresses for the Telnet group.
Command Mode
Privileged Exec
ExampleConsole#show management all-client
Management Ip Filter
HTTP-Client:
Start IP address
End IP address----------------------------------------------1. 192.168.1.19
192.168.1.19
2. 192.168.1.25
192.168.1.30– 291 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent

SNMP-Client:
Start IP address
End IP address----------------------------------------------1. 192.168.1.19
192.168.1.19
2. 192.168.1.25
192.168.1.30
TELNET-Client:
Start IP address
End IP address----------------------------------------------1. 192.168.1.19
192.168.1.19
2. 192.168.1.25
192.168.1.30
Console#PPPoE Intermediate AgentThis section describes commands used to configure the PPPoE Intermediate Agent(PPPoE IA) relay parameters required for passing authentication messages betweena client and broadband remote access servers.
Table 55: PPPoE Intermediate Agent Commands
CommandFunctionMode

pppoe intermediate-agent

Enables the PPPoE IA globally on the switchGC

pppoe intermediate-agent
format-type

Sets the access node identifier, generic error message, orvendor identifier for the switchGC

pppoe intermediate-agent
port-enable

Enables the PPPoE IA on an interface

IC

pppoe intermediate-agent
port-format-type

Sets the circuit-id, remote-id, or remote-id delimiter for an ICinterface

pppoe intermediate-agent
port-format-type remoteid-delimiter

Sets the remote-id delimiter for an interface

IC

pppoe intermediate-agent
trust

Sets the trust mode for an interface

IC

pppoe intermediate-agent
vendor-tag strip

Enables the stripping of vendor tags from PPPoE Discovery IC
packets sent from a PPPoE server

clear pppoe intermediateagent statistics

Clears PPPoE IA statistics

PEshow pppoe intermediateagent info

Displays PPPoE IA configuration settingsPEshow pppoe intermediateagent statistics

Displays PPPoE IA statistics

PE– 292 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent

pppoe intermediate- This command enables the PPPoE Intermediate Agent globally on the switch. Useagent the no form to disable this feature.
Syntax[no] pppoe intermediate-agent
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage The switch inserts a tag identifying itself as a PPPoE Intermediate Agent
residing between the attached client requesting network access and the ports
connected to broadband remote access servers (BRAS). The switch extracts
access-loop information from the client’s PPPoE Active Discovery Request, andforwards this information to all trusted ports designated by the pppoe
intermediate-agent trust command. The BRAS detects the presence of thesubscriber’s circuit-ID tag inserted by the switch during the PPPoE discovery
phase, and sends this tag as a NAS-port-ID attribute in PPP authentication and
AAA accounting requests to a RADIUS server.
 PPPoE IA must be enabled globally by this command before this feature can be

enabled on an interface using the pppoe intermediate-agent port-enablecommand.

ExampleConsole(config)#pppoe intermediate-agent
Console(config)#

pppoe intermediate- This command sets the access node identifier, generic error message, or vendor
agent format-type identifier for the switch. Use the no form to restore the default settings.
Syntax
pppoe intermediate-agent format-type {access-node-identifier node-idstring | generic-error-message error-message | vendor-id vendor-id-string}no pppoe intermediate-agent format-type {access-node-identifier |generic-error-message}
node-id-string - String identifying this switch as an PPPoE IA to the PPPoE
server. (Range: 1-48 ASCII characters)
error-message - An error message notifying the sender that the PPPoE
Discovery packet was too large.

– 293 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent
vendor-id-string - This tag is used to pass vendor proprietary information.
The first four octets of the tag contain the vendor id and the remainder isunspecified. The high-order octet of the vendor id is 0 and the low-order 3octets are the SMI Network Management Private Enterprise Code of the
Vendor in network byte order, as defined in the Assigned Numbers RFC(RFC 1700). (Range: 0-4294967295)
Default Setting Access Node Identifier: IP address of the first IPv4 interface on the switch.
 Generic Error Message: PPPoE Discover packet too large to process. Try

reducing the number of tags added.

 Vendor Identifier: 3561

(This is the enterprise number assigned to the Broadband Forum.)

Command Mode
Global Configuration
Command Usage The switch uses the access-node-identifier to generate the circuit-id for PPPoE

discovery stage packets sent to the BRAS, but does not modify the source ordestination MAC address of these PPPoE discovery packets.

 The vendor-specific tag is used to pass vendor proprietary information. The

first four octets of this tag value contain the vendor identifier and theremainder is unspecified. The high-order octet of the vendor ID is 0 and the
low-order 3 octets are the SMI Network Management Private Enterprise Codeof the Vendor in network byte order, as defined in Assigned Numbers RFC 1700.

 These messages are forwarded to all trusted ports designated by the pppoe

intermediate-agent trust command.

ExampleConsole(config)#pppoe intermediate-agent format-type access-node-identifierbillibong
Console(config)#

pppoe intermediate- This command enables the PPPoE IA on an interface. Use the no form to disable thisagent port-enable feature.
Syntax[no] pppoe intermediate-agent port-enable
Default Setting
Disabled– 294 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent

Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
PPPoE IA must also be enabled globally on the switch for this command to takeeffect.
ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#pppoe intermediate-agent port-enable
Console(config-if)#

pppoe intermediate- This command sets the circuit-id, remote-id, or remote-id delimiter for an interface.
agent port-format- Use the no form to restore the default settings.
type
Syntax

pppoe intermediate-agent port-format-type{carry-to-client |circuit-id [string | hostname-port-vlan] circuit-id-string |remote-id {mac-cpe | string remote-id-string} |remote-id-delimiter {enable | ascii-code}}no pppoe intermediate-agent port-format-type {carry-to-client | circuit-id| remote-id | remote-id-delimiter enable}
carry-to-client - Carries circuit ID/remote ID to the client.
circuit-id-string - String identifying the circuit identifier (or interface) on thisswitch to which the user is connected. (Range: 1-10 ASCII characters)
circuit-id hostname-port-vlan - Specifies circuit ID format hostname/port/vlan
mac-cpe - The MAC address of the CPE attached to this interface is used as
the remote ID.
remote-id-string - String identifying the remote identifier (or interface) on
this switch to which the user is connected. (Range: 1-63 ASCII characters)
remote-id-delimiter enable - Enables a user-specified delimiter value forthe remote ID.
ascii-code - A character used to separate components in the remote circuit
ID value. (Range: 0-255)
Default Setting
carry-to-client: No
circuit-id: unit/port:vlan-id or 0/trunk-id:vlan-id
remote-id: port MAC address
remote-id-delimiter: ASCII code 35, ASCII character "#"– 295 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage The PPPoE server extracts the Line-ID tag from PPPoE discovery stage
messages, and uses the Circuit-ID field of that tag as a NAS-Port-ID attribute in
AAA access and accounting requests.
 The switch intercepts PPPoE discovery frames from the client and inserts aunique line identifier using the PPPoE Vendor-Specific tag (0x0105) to PPPoE
Active Discovery Initiation (PADI) and Request (PADR) packets. The switch thenforwards these packets to the PPPoE server. The tag contains the Line-ID of thecustomer line over which the discovery packet was received, entering theswitch (or access node) where the intermediate agent resides.

 Outgoing PAD Offer (PADO) and Session-confirmation (PADS) packets sent fromthe PPPoE Server include the Circuit-Id tag inserted by the switch, and should
be stripped out of PADO and PADS packets which are to be passed directly to
end-node clients using the pppoe intermediate-agent vendor-tag strip
command.

 If the remote-id is unspecified, the port name will be used for this parameter. If

the port name is not configured, the remote-id is set to the port MAC (yy-yy-yyyy-yy-yy#), where # is the default delimiter.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#pppoe intermediate-agent port-format-type circuit-id
string ECS4150-28P
Console(config-if)#

pppoe
intermediate-agent
port-format-type
remote-id-delimiter

This command sets the remote-id delimiter for an interface. Use the enable
keyword to enable the delimiter. Use the no form with the enable keyword todisable the delimiter. Use the no form without any keywords toto restore thedefault settings.
Syntax
pppoe intermediate-agent port-format-type remote-id-delimiter{enable | ascii-code}
ascii-code - ASCII character of delimiter. (Range: 0-255)
Default Setting
Disabled
ASCII code: 35 (“#”)
Command Mode
Interface Configuration (Ethernet, Port Channel)– 296 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent

Command Usage
If the delimiter is enabled and it occurs in the remote ID string, the string will betruncated at that point.
ExampleThis command enables the delimiter for port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#pppoe intermediate-agent port-format-type remote-iddelimiter enable
Console(config-if)#

pppoe intermediate- This command sets an interface to trusted mode to indicate that it is connected to aagent trust PPPoE server. Use the no form to set an interface to untrusted mode.
Syntax[no] pppoe intermediate-agent trust
Default Setting
Untrusted
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Set any interfaces connecting the switch to a PPPoE Server as trusted.

Interfaces that connect the switch to users (PPPoE clients) should be set as
untrusted.

 At least one trusted interface must be configured on the switch for the PPPoE

IA to function.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#pppoe intermediate-agent trust
Console(config-if)#

pppoe intermediate- This command enables the stripping of vendor tags from PPPoE Discovery packets
agent vendor-tag strip sent from a PPPoE server. Use the no form to disable this feature.
Syntax[no] pppoe intermediate-agent vendor-tag strip– 297 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This command only applies to trusted interfaces. It is used to strip off vendorspecific tags (which carry subscriber and line identification information) in PPPoE
Discovery packets received from an upstream PPPoE server before forwarding
them to a user.
ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#pppoe intermediate-agent vendor-tag strip
Console(config-if)#clear pppoe This command clears statistical counters for the PPPoE Intermediate Agent.
intermediate-agent
statistics Syntax
clear pppoe intermediate-agent statistics interface [interface]interfaceethernet unit/port
unit - Stack unit (Range: 1)
port - Port number (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#clear pppoe intermediate-agent statistics
Console#show pppoe This command displays configuration settings for the PPPoE Intermediate Agent.
intermediate-agent
info Syntax
show pppoe intermediate-agent info [interface [interface]]– 298 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agentinterfaceethernet unit/port
unit - Stack unit. (Range: 1)
port - Port number (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show pppoe intermediate-agent info
PPPoE Intermediate Agent Global Status: Enabled
PPPoE Intermediate Agent Vendor ID: 3561
PPPoE Intermediate Agent Admin Access Node Identifier : 192.168.0.2
PPPoE Intermediate Agent Oper Access Node Identifier : 192.168.0.2
PPPoE Intermediate Agent Admin Generic Error Message :PPPoE Discover packet too large to process. Try reducing the number of tags
added.
PPPoE Intermediate Agent Oper Generic Error Message:
PPPoE Discover packet too large to process. Try reducing the number of tags
added.
Console#show pppoe intermediate-agent info interface ethernet 1/1
Interface PPPoE IA Trusted Vendor-Tag Strip Admin Circuit-ID Admin Remote-ID--------- -------- ------- ---------------- ---------------- ---------------Eth 1/1
No
No
No
R-ID Delimiter
Delimiter ASCII Oper Circuit-ID Oper Remote-ID---------------- ---------------- ---------------- ----------------No
35 1/1:vid
CC-37-AB-BC-4F-FB
Carry Circuit and Remote ID to client: FALSE
Console#show pppoe This command displays statistics for the PPPoE Intermediate Agent.
intermediate-agent
statistics Syntax
show pppoe intermediate-agent statistics interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show pppoe intermediate-agent statistics interface ethernet 1/1
Eth 1/1 statistics– 299 –

Chapter 8 | Authentication Commands
PPPoE Intermediate Agent----------------------------------------------------------------------------Received :
All
PADI
PADO
PADR
PADS
PADT
---------- ---------- ---------- ---------- ---------- ---------3
0
0
0
0
3
DroppedConsole#: Response from untrusted----------------------0

Request towards untrusted------------------------0

Malformed--------0

Table 56: show pppoe intermediate-agent statistics - display description
Field

Description

Received
PADI

PPPoE Active Discovery Initiation

PADO

PPPoE Active Discovery Offer

PADR

PPPoE Active Discovery RequestPADS

PPPoE Active Discovery Session-Confirmation

PADT

PPPoE Active Discovery Terminate

DroppedResponse from
untrusted

Response from an interface which not been configured as trusted.

Request towards
untrusted

Request sent to an interface which not been configured as trusted.

Malformed

Corrupted PPPoE message.

– 300 –

9

General Security Measures

This switch supports many methods of segregating traffic for clients attached toeach of the data ports, and for ensuring that only authorized clients gain access tothe network. Port-based authentication using IEEE 802.1X is commonly used forthese purposes. In addition to these methods, several other options of providing
client security are described in this chapter. These include port-based
authentication, which can be configured to allow network client accessby specifying a fixed set of MAC addresses. The addresses assigned to DHCP clients
can also be carefully controlled with IP Source Guard and DHCP Snooping
commands.
Table 57: General Security Commands
Command Group

Function

Port Security*

Configures secure addresses for a port

Network Access*Configures MAC authentication and dynamic VLAN assignment

Web Authentication*

Configures Web authentication

Access Control Lists*

Provides filtering for IP frames (based on address, protocol, TCP/UDP
port number or TCP control code) or non-IP frames (based on MAC
address or Ethernet type)

DHCPv4 Snooping*

Filters untrusted DHCPv4 messages on unsecure ports by building andmaintaining a DHCPv4 snooping binding table

DHCPv6 Snooping*

Filters untrusted DHCPv6 messages on unsecure ports by building andmaintaining a DHCPv6 snooping binding table

IPv4 Source Guard*

Filters IP traffic on insecure ports for which the source address cannot
be identified via DHCP snooping nor static source bindings

IPv6 Source Guard*

Filters IPv6 traffic on insecure ports for which the source address cannot
be identified via DHCPv6 snooping nor static source bindings

ND Snooping

Maintains IPv6 prefix table and user address binding table which can beused for stateless address auto-configuration or for address filtering by
IPv6 Source Guard

ARP Inspection

Validates the MAC-to-IP address bindings in ARP packets

Denial of Service Protection Protects against Denial-of-Service attacks
Port-based Traffic
Segmentation

Configures traffic segmentation for different client sessions based on
specified downlink and uplink ports* The priority of execution for these filtering commands is Port Security, Port Authentication,
Network Access, Web Authentication, Access Control Lists, DHCP Snooping, and then IPv4
Source Guard.

– 301 –

Chapter 9 | General Security Measures

Port Security

Port Security
These commands can be used to enable port security on a port.
When MAC address learning is disabled on an interface, only incoming traffic withsource addresses already stored in the dynamic or static address table for this port
will be authorized to access the network.
When using port security, the switch stops learning new MAC addresses on thespecified port when it has reached a configured maximum number. Only incoming
traffic with source addresses already stored in the dynamic or static address table
for this port will be authorized to access the network. The port will drop any
incoming frames with a source MAC address that is unknown or has beenpreviously learned from another port. If a device with an unauthorized MAC
address attempts to use the switch port, the intrusion will be detected and theswitch can automatically take action by disabling the port and sending a trap
message.
Table 58: Management IP Filter Commands
CommandFunctionMode

mac-address-table static

Maps a static address to a port in a VLAN

GC

mac-learning

Enables MAC address learning on the selected physicalinterface or VLAN

IC

port security

Configures a secure port

IC

port security mac-address
stickySaves the MAC addresses learned by port security as“sticky” entriesIC

port security mac-addressas-permanent

Saves the MAC addresses learned by port security as static PE
entries.

show mac-address-table

Displays entries in the bridge-forwarding databasePEshow port security

Displays port security status and secure address countPE

mac-learning This command enables MAC address learning on the selected interface. Use the noform to disable MAC address learning.
Syntax[no] mac-learning
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet or Port Channel)– 302 –

Chapter 9 | General Security Measures
Port Security

Command Usage The no mac-learning command immediately stops the switch from learning
new MAC addresses on the specified port or trunk. Incoming traffic with source
addresses not stored in the static address table, will be flooded. However, if asecurity function such as 802.1X or DHCP snooping is enabled and maclearning is disabled, then only incoming traffic with source addresses stored in
the static address table will be accepted, all other packets are dropped. Notethat the dynamic addresses stored in the address table when MAC address
learning is disabled are flushed from the system, and no dynamic addresses aresubsequently learned until MAC address learning has been re-enabled.
 The mac-learning commands cannot be used if 802.1X Port Authentication has

been globally enabled on the switch with the dot1x system-auth-control
command, or if MAC Address Security has been enabled by the port security
command on the same interface.

ExampleThe following example disables MAC address learning for port 2.
Console(config)#interface ethernet 1/2
Console(config-if)#no mac-learning
Console(config-if)#

Related Commands
show interfaces status (431)

port security This command enables or configures port security. Use the no form without any

keywords to disable port security. Use the no form with the appropriate keyword to
restore the default settings for a response to security violation or for the maximum
number of allowed addresses.
Syntaxport security [action {shutdown | trap | trap-and-shutdown} |max-mac-count address-count]no port security [action | max-mac-count]action - Response to take when port security is violated.
shutdown - Disable port only.
trap - Issue SNMP trap message only.
trap-and-shutdown - Issue SNMP trap message and disable port.
max-mac-countaddress-count - The maximum number of MAC addresses that can belearned on a port. (Range: 0 - 1024, where 0 means disabled)– 303 –

Chapter 9 | General Security Measures

Port Security

Default Setting
Status: Disabled
Action: None
Maximum Addresses: 0
Command Mode
Interface Configuration (Ethernet)
Command Usage The default maximum number of MAC addresses allowed on a secure port iszero (that is, port security is disabled). To use port security, you must configure
the maximum number of addresses allowed on a port using the port security
max-mac-count command.
 When port security is enabled using the port security command, or the

maximum number or allowed addresses is set to a value lower than the current
limit after port security has been enabled, the switch first clears all dynamicallylearned entries from the address table. It then starts learning new MAC
addresses on the specified port, and stops learning addresses when it reaches aconfigured maximum number. Only incoming traffic with source addresses
already stored in the dynamic or static address table will be accepted.

 To configure the maximum number of address entries which can be learned ona port, specify the maximum number of dynamic addresses allowed. The switch
will learn up to the maximum number of allowed address pairs <source MAC
address, VLAN> for frames received on the port. (The specified maximum
address count is effective when port security is enabled or disabled.) Note thatyou can manually add additional secure addresses to a port using the macaddress-table static command. When the port has reached the maximum
number of MAC addresses, the port will stop learning new addresses. The MAC
addresses already in the address table will be retained and will not be aged out.

 MAC addresses that port security has learned, can be saved in the configuration

file as static entries. See command port security mac-address-as-permanent.

 If port security is enabled, and the maximum number of allowed addresses are

set to a non-zero value, any device not in the address table that attempts to use
the port will be prevented from accessing the switch.

 If a port is disabled due to a security violation, it must be manually re-enabledusing the no shutdown command.

 A secure port has the following restrictions:Cannot be connected to a network interconnection device.

Cannot be a trunk port.



RSPAN and port security are mutually exclusive functions. If port security isenabled on a port, that port cannot be set as an RSPAN uplink port. Also,
when a port is configured as an RSPAN uplink port, source port, or
destination port, port security cannot be enabled on that port.
– 304 –

Chapter 9 | General Security Measures
Port Security

ExampleThe following example enables port security for port 5, and sets the response to asecurity violation to issue a trap message:
Console(config)#interface ethernet 1/5
Console(config-if)#port security action trap

Related Commands
show interfaces status (431)
shutdown (421)
mac-address-table static (516)port security Use this command to save the MAC addresses that port security has learned as
mac-address sticky “sticky” entries.
Syntaxport security mac-address sticky
Command Mode
Interface Configuration
Command Usage
 Sticky MAC addresses that port security has learned are dynamic addresses thatcannot be moved to another port.
 If sticky MAC addresses are received on another secure port, then the port

intrusion action is taken.

ExampleConsole(config-if)#port security mac-address sticky
Console#port security Use this command to save the MAC addresses that port security has learned as
mac-address-as- static entries.
permanent
Syntaxport security mac-address-as-permanent [interface interface]interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)– 305 –

Chapter 9 | General Security Measures

Port Security

Command Mode
Privileged Exec
ExampleThis example shows the switch saving the MAC addresses learned by port security
on ethernet port 1/3.
Console#port security mac-address-as-permanent interface ethernet 1/3
Console#show port security This command displays port security status and the secure address count.
Syntaxshow port security [interface interface]interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleThis example shows the port security settings and number of secure addresses for
all ports.
Console#show port security
Global Port Security Parameters
Secure MAC Aging Mode : Disabled
Port Security Port Summary
Port
Port Security Port Status Intrusion Action-------- ------------- ----------- ---------------Eth 1/ 1 Enabled
Secure/Up
Shutdown
Eth 1/ 2 Disabled
Secure/Down NoneEth 1/ 3 Disabled
Secure/Down NoneEth 1/ 4 Disabled
Secure/Down NoneEth 1/ 5 Disabled
Secure/Down None.
.
.

– 306 –

MaxMacCnt CurrMacCnt--------- ---------20
2
0
0
0
0
0
0
0
0

Chapter 9 | General Security Measures
Port Security

Table 59: show port security - display description
Field

Description

Port

The Ethernet interface port number.

Secure MAC
Aging Mode

Secure MAC aging mode status (enabled or disabled).

Port Security

The configured status (enabled or disabled).

Port Status

The operational status:
Secure/Down – Port security is disabled.
 Secure/Up – Port security is enabled.
 Shutdown – Port is shut down due to a response to a port security violation.
Intrusion Action

The configured intrusion response.

MaxMacCnt

The maximum number of addresses which can be stored in the address table forthis interface (either dynamic or static).

CurrMacCnt

The current number of secure entries in the address table.

The following example shows the port security settings and number of secure
addresses for a specific port. The Last Intrusion MAC and Last Time Detected
Intrusion MAC fields show information about the last detected intrusion MAC
address. These fields are not applicable if no intrusion has been detected or port
security is disabled. The MAC Filter ID field is configured by the network-accessmac-filter command. If this field displays Disabled, then any unknown source MAC
address can be learned as a secure MAC address. If it displays a filter identifier, then
only source MAC address entries in MAC Filter table can be learned as secure MAC
addresses.
Console#show port security interface ethernet 1/2
Global Port Security Parameters
Secure MAC Aging Mode : Disabled
Port Security Details
Port
Port Security
Port Status
Intrusion Action
Max MAC Count
Current MAC CountMAC Filter
Last Intrusion MAC
Last Time Detected Intrusion MAC
Console#: 1/2: Enabled: Secure/Up: None: 0: 0: Disabled
: NA
: NA

This example shows information about a detected intrusion.
Console#show port security interface ethernet 1/2
Global Port Security Parameters
Secure MAC Aging Mode : Disabled
Port Security Details
Port
Port Security– 307 –

: 1/2
: Enabled

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
Port Status
Intrusion Action
Max MAC Count
Current MAC CountMAC Filter
Last Intrusion MAC
Last Time Detected Intrusion MAC
Console#: Secure/Up: None: 0: 0: Disabled: 00-10-22-00-00-01: 2017/7/29 15:13:03

Network Access (MAC Address Authentication)
Network Access authentication controls access to the network by authenticating
the MAC address of each host that attempts to connect to a switch port. Traffic
received from a specific MAC address is forwarded by the switch only if the source
MAC address is successfully authenticated by a central RADIUS server. Whileauthentication for a MAC address is in progress, all traffic is blocked until
authentication is completed. Once successfully authenticated, the RADIUS server
may optionally assign VLAN and QoS settings for the switch port.
Table 60: Network Access Commands
CommandFunctionMode

network-access aging

Enables MAC address aging

GC

network-access mac-filter

Adds a MAC address to a filter table

GC

mac-authentication reauth-time Sets the time period after which a connected MAC
address must be re-authenticatedGC

network-access dynamic-qos

Enables the dynamic quality of service featureIC

network-access dynamic-vlan

Enables dynamic VLAN assignment from a RADIUS server IC

network-access guest-vlan

Specifies the guest VLAN

IC

network-access link-detection

Enables the link detection featureIC

network-access link-detection
link-down

Configures the link detection feature to detect and act
upon link-down eventsIC

network-access link-detection
link-up

Configures the link detection feature to detect and act
upon link-up eventsIC

network-access link-detection
link-up-down

Configures the link detection feature to detect and act
upon both link-up and link-down eventsIC

network-access max-mac-count Sets the maximum number of MAC addresses that can be IC
authenticated on a port via all forms of authentication
network-access mode
mac-authentication

Enables MAC authentication on an interface

IC

network-access port-mac-filter

Enables the specified MAC address filterIC

mac-authentication
intrusion-action

Determines the port response when a connected hostfails MAC authentication.

IC

mac-authentication
max-mac-countSets the maximum number of MAC addresses that can be IC
authenticated on a port via MAC authentication– 308 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
Table 60: Network Access Commands (Continued)
CommandFunctionModeclear network-access

Clears authenticated MAC addresses from the address
table

PE

show network-accessDisplays the MAC authentication settings for portinterfaces

PEshow network-accessmac-address-table

Displays information for entries in the secure MAC
address tablePEshow network-access mac-filter Displays information for entries in the MAC filter tables

PE

network-access aging Use this command to enable aging for authenticated MAC addresses stored in the
secure MAC address table. Use the no form of this command to disable address
aging.
Syntax[no] network-access aging
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Authenticated MAC addresses are stored as dynamic entries in the switch’s
secure MAC address table and are removed when the aging time expires. The
address aging time is determined by the mac-address-table aging-timecommand.
 This parameter applies to authenticated MAC addresses configured by the MAC

Address Authentication process described in this section, as well as to any
secure MAC addresses authenticated by 802.1X, regardless of the 802.1X
Operation Mode (Single-Host, Multi-Host, or MAC-Based authentication as
described under the dot1x operation-mode command).

 The maximum number of secure MAC addresses supported for the switch

system is 1024.

ExampleConsole(config)#network-access aging
Console(config)#– 309 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)

network-access Use this command to add a MAC address into a filter table. Use the no form of thismac-filter command to remove the specified MAC address.
Syntax
network-access mac-filter filter-id
mac-address mac-address [mask mask-address]
no network-access mac-filter filter-id
mac-address mac-address mask mask-addressfilter-id - Specifies a MAC address filter table. (Range: 1-64)
mac-address - Specifies a MAC address entry. (Format: xx-xx-xx-xx-xx-xx or
xxxxxxxxxxxx)
mask - Specifies a MAC address bit mask for a range of addresses.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Specified addresses are exempt from network access authentication.
 This command is different from configuring static addresses with the mac-address-table static command in that it allows you configure a range ofaddresses when using a mask, and then to assign these addresses to one ormore ports with the network-access port-mac-filter command.

 Up to 64 filter tables can be defined.
 There is no limitation on the number of entries that can entered in a filter table.

ExampleConsole(config)#network-access mac-filter 1 mac-address 11-22-33-44-55-66
Console(config)#– 310 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)

mac-authentication Use this command to set the time period after which an authenticated MAC
reauth-time address is removed from the secure address table. Use the no form of thiscommand to restore the default value.
Syntax
mac-authentication reauth-time seconds
no mac-authentication reauth-time
seconds - The reauthentication time period. (Range: 120-1000000 seconds)
Default Setting
1800
Command Mode
Global Configuration
Command Usage The reauthentication time is a global setting and applies to all ports.
 When the reauthentication time expires for a secure MAC address it isreauthenticated with the RADIUS server. During the reauthentication processtraffic through the port remains unaffected.

ExampleConsole(config)#mac-authentication reauth-time 300
Console(config)#

network-access Use this command to enable the dynamic QoS feature for an authenticated port.
dynamic-qos Use the no form to restore the default.
Syntax[no] network-access dynamic-qos
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage The RADIUS server may optionally return dynamic QoS assignments to be
applied to a switch port for an authenticated user. The “Filter-ID” attribute(attribute 11) can be configured on the RADIUS server to pass the following
QoS information:– 311 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
Table 61: Dynamic QoS Profiles
ProfileAttribute Syntax

ExampleDiffServ

service-policy-in=policy-map-nameservice-policy-in=p1

Rate Limit

rate-limit-input=rate (kbps)

rate-limit-input=100 (kbps)

rate-limit-output=rate (kbps)

rate-limit-output=200 (kbps)

802.1pswitchport-priority-default=value

switchport-priority-default=2

IP ACL

ip-access-group-in=ip-acl-nameip-access-group-in=ipv4acl

IPv6 ACL

ipv6-access-group-in=ipv6-acl-nameipv6-access-group-in=ipv6acl

MAC ACL

mac-access-group-in=mac-acl-name

mac-access-group-in=macAcl

 When the last user logs off of a port with a dynamic QoS assignment, the switch

restores the original QoS configuration for the port.

 When a user attempts to log into the network with a returned dynamic QoS

profile that is different from users already logged on to the same port, the user
is denied access.

 While a port has an assigned dynamic QoS profile, any manual QoS

configuration changes only take effect after all users have logged off of the
port.

Note: Any configuration changes for dynamic QoS are not saved to the switch
configuration file.

ExampleThe following example enables the dynamic QoS feature on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#network-access dynamic-qos
Console(config-if)#network-access Use this command to enable dynamic VLAN assignment for an authenticated port.
dynamic-vlan Use the no form to disable dynamic VLAN assignment.
Syntax[no] network-access dynamic-vlan
Default Setting
Enabled– 312 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
Command Mode
Interface Configuration
Command Usage When enabled, the VLAN identifiers returned by the RADIUS server through the802.1X authentication process will be applied to the port, providing the VLANs
have already been created on the switch. GVRP is not used to create the VLANs.
 The VLAN settings specified by the first authenticated MAC address are

implemented for a port. Other authenticated MAC addresses on the port musthave same VLAN configuration, or they are treated as an authentication failure.

 If dynamic VLAN assignment is enabled on a port and the RADIUS server

returns no VLAN configuration, the authentication is still treated as a success,and the host assigned to the default untagged VLAN.

 When the dynamic VLAN assignment status is changed on a port, allauthenticated addresses are cleared from the secure MAC address table.

ExampleThe following example enables dynamic VLAN assignment on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#network-access dynamic-vlan
Console(config-if)#network-access Use this command to assign all traffic on a port to a guest VLAN when 802.1x
guest-vlan authentication or MAC authentication is rejected. Use the no form of this command
to disable guest VLAN assignment.
Syntax
network-access guest-vlan vlan-id
no network-access guest-vlan
vlan-id - VLAN ID (Range: 1-4094)
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage The VLAN to be used as the guest VLAN must be defined and set as active (Seethe vlan database command).

– 313 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
 When used with 802.1X authentication, the intrusion-action must be set for“guest-vlan” to be effective (see the dot1x intrusion-action command).

 A port can only be assigned to the guest VLAN in case of failed authentication,

if switchport mode is set to Hybrid.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#network-access guest-vlan 25
Console(config-if)#network-access Use this command to enable link detection for the selected port. Use the no form oflink-detection this command to restore the default.
Syntax[no] network-access link-detection
Default Setting
Disabled
Command Mode
Interface Configuration
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#network-access link-detection
Console(config-if)#network-access link- Use this command to detect link-down events. When detected, the switch can shutdetection link-down down the port, send an SNMP trap, or both. Use the no form of this command todisable this feature.
Syntax
network-access link-detection link-down
action [shutdown | trap | trap-and-shutdown]no network-access link-detection
action - Response to take when port security is violated.
shutdown - Disable port only.
trap - Issue SNMP trap message only.
trap-and-shutdown - Issue SNMP trap message and disable the port.

– 314 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
Default Setting
Disabled
Command Mode
Interface Configuration
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#network-access link-detection link-down action trap
Console(config-if)#network-access link- Use this command to detect link-up events. When detected, the switch can shutdetection link-up down the port, send an SNMP trap, or both. Use the no form of this command todisable this feature.
Syntax
network-access link-detection link-up
action [shutdown | trap | trap-and-shutdown]no network-access link-detection
action - Response to take when port security is violated.
shutdown - Disable port only.
trap - Issue SNMP trap message only.
trap-and-shutdown - Issue SNMP trap message and disable the port.
Default Setting
Disabled
Command Mode
Interface Configuration
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#network-access link-detection link-up action trap
Console(config-if)#– 315 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)

network-access Use this command to detect link-up and link-down events. When either event islink-detection detected, the switch can shut down the port, send an SNMP trap, or both. Use thelink-up-down no form of this command to disable this feature.
Syntax
network-access link-detection link-up-down
action [shutdown | trap | trap-and-shutdown]no network-access link-detection
action - Response to take when port security is violated.
shutdown - Disable port only.
trap - Issue SNMP trap message only.
trap-and-shutdown - Issue SNMP trap message and disable the port.
Default Setting
Disabled
Command Mode
Interface Configuration
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#network-access link-detection link-up-down action trap
Console(config-if)#network-access max- Use this command to set the maximum number of MAC addresses that can be
mac-count authenticated on a port interface via all forms of authentication. Use the no form of
this command to restore the default.
Syntax
network-access max-mac-count countno network-access max-mac-count
count - The maximum number of authenticated IEEE 802.1X and MAC
addresses allowed. (Range: 1-2048)
Default Setting
1024
Command Mode
Interface Configuration– 316 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
Command Usage
The maximum number of MAC addresses per port is 1024, and the maximum
number of secure MAC addresses supported for the switch system is 1024. Whenthe limit is reached, all new MAC addresses are treated as authentication failures.
ExampleConsole(config-if)#network-access max-mac-count 5
Console(config-if)#network-access mode Use this command to enable network access authentication on a port. Use the no
mac-authentication form of this command to disable network access authentication.
Syntax[no] network-access mode mac-authentication
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage When enabled on a port, the authentication process sends a Password
Authentication Protocol (PAP) request to a configured RADIUS server. The username and password are both equal to the MAC address being authenticated.
 On the RADIUS server, PAP user name and passwords must be configured in the

MAC address format XX-XX-XX-XX-XX-XX (all in upper case).

 Authenticated MAC addresses are stored as dynamic entries in the switch

secure MAC address table and are removed when the aging time expires. The
maximum number of secure MAC addresses supported for the switch system is1024.

 Configured static MAC addresses are added to the secure address table when

seen on a switch port. Static addresses are treated as authenticated without
sending a request to a RADIUS server.

 MAC authentication cannot be configured on trunks (i.e., static nor dynamic).
 When port status changes to down, all MAC addresses are cleared from thesecure MAC address table. Static VLAN assignments are not restored.

 The RADIUS server may optionally return a VLAN identifier list. VLAN identifier

list is carried in the “Tunnel-Private-Group-ID” attribute. The VLAN list cancontain multiple VLAN identifiers in the format “1u 2t”, where “u” indicates anuntagged VLAN and “t” a tagged VLAN. The “Tunnel-Type” attribute should be– 317 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
set to “VLAN”, the “Tunnel-Medium-Type” attribute set to “802”, and the“Radius:Avenda Avenda-Tag-Id” attribute should be set to 0.
ExampleConsole(config-if)#network-access mode mac-authentication
Console(config-if)#network-access port- Use this command to enable the specified MAC address filter. Use the no form of
mac-filter this command to disable the specified MAC address filter.
Syntax
network-access port-mac-filter filter-id
no network-access port-mac-filter
filter-id - Specifies a MAC address filter table. (Range: 1-64)
Default Setting
None
Command Mode
Interface Configuration
Command Mode
 Entries in the MAC address filter table can be configured with the networkaccess mac-filter command.
 Only one filter table can be assigned to a port.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#network-access port-mac-filter 1
Console(config-if)#– 318 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)

mac-authentication Use this command to configure the port response to a host MAC authentication
intrusion-action failure. Use the no form of this command to restore the default.
Syntax
mac-authentication intrusion-action {block-traffic | pass-traffic}
no mac-authentication intrusion-action
block-traffic - Blocks traffic when the authentication has failed.
pass-traffic - Allows network access when authentication has failed.
Default Setting
Block Traffic
Command Mode
Interface Configuration
ExampleConsole(config-if)#mac-authentication intrusion-action block-traffic
Console(config-if)#

mac-authentication Use this command to set the maximum number of MAC addresses that can bemax-mac-count authenticated on a port via MAC authentication. Use the no form of this command
to restore the default.
Syntax
mac-authentication max-mac-count countno mac-authentication max-mac-count
count - The maximum number of MAC-authenticated MAC addresses
allowed. (Range: 1-1024)
Default Setting
1024
Command Mode
Interface Configuration
ExampleConsole(config-if)#mac-authentication max-mac-count 32
Console(config-if)#– 319 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)clear network-access Use this command to clear entries from the secure MAC addresses table.
Syntaxclear network-access mac-address-table [static | dynamic][address mac-address] [interface interface]static - Specifies static address entries.
dynamic - Specifies dynamic address entries.
mac-address - Specifies a MAC address entry. (Format: xx-xx-xx-xx-xx-xx)
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#clear network-access mac-address-table interface ethernet 1/1
Console#show network-access Use this command to display the MAC authentication settings for port interfaces.
Syntaxshow network-access [interface interface]interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Default Setting
Displays the settings for all interfaces.
Command Mode
Privileged Exec

– 320 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
ExampleConsole#show network-access interface ethernet 1/1
Global secure port information
Reauthentication Time: 1800
MAC Address Aging: Disabled
Port : 1/1
MAC Authentication: Disabled
MAC Authentication Intrusion Action: Block traffic
MAC Authentication Maximum MAC Counts : 1024
Maximum MAC Counts: 1024
Dynamic VLAN Assignment: Enabled
Dynamic QoS Assignment: Disabled
MAC Filter ID: Disabled
Guest VLAN
: Disabled
Link Detection: Disabled
Detection Mode
: Link-down
Detection Action: TrapConsole#show network-access Use this command to display secure MAC address table entries.
mac-address-table
Syntaxshow network-access mac-address-table [static | dynamic][address mac-address [mask]] [interface interface] [sort {address |interface}]
static - Specifies static address entries.
dynamic - Specifies dynamic address entries.
mac-address - Specifies a MAC address entry.
(Format: xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx)
mask - Specifies a MAC address bit mask for filtering displayed addresses.
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
sort - Sorts displayed entries by either MAC address or interface.
Default Setting
Displays all filters.
Command Mode
Privileged Exec
Command Usage
When using a bit mask to filter displayed MAC addresses, a 1 means “care” and a 0means “don't care”. For example, a MAC of 00-00-01-02-03-04 and mask FF-FF-FF-– 321 –

Chapter 9 | General Security Measures
Network Access (MAC Address Authentication)
00-00-00 would result in all MACs in the range 00-00-01-00-00-00 to 00-00-01-FFFF-FF to be displayed. All other MACs would be filtered out.
ExampleConsole#show network-access mac-address-table
Interface MAC Address
RADIUS Server
Time
Attribute--------- ----------------- --------------- ------------------------- --------1/1
00-00-01-02-03-04 172.155.120.17 00d06h32m50s
Static1/1
00-00-01-02-03-05 172.155.120.17 00d06h33m20s
Dynamic
1/1
00-00-01-02-03-06 172.155.120.17 00d06h35m10s
Static1/300-00-01-02-03-07 172.155.120.17 00d06h34m20s
Dynamic
Console#show network-access Use this command to display information for entries in the MAC filter tables.
mac-filter
Syntaxshow network-access mac-filter [filter-id]
filter-id - Specifies a MAC address filter table. (Range: 1-64)
Default Setting
Displays all filters.
Command Mode
Privileged Exec
ExampleConsole#show network-access mac-filter
Filter ID MAC Address
MAC Mask--------- ----------------- ----------------1 00-00-01-02-03-08 FF-FF-FF-FF-FF-FF
Console#– 322 –

Chapter 9 | General Security Measures

Web Authentication

Web Authentication
Web authentication allows stations to authenticate and access the network insituations where 802.1X or Network Access authentication are infeasible or
impractical. The web authentication feature allows unauthenticated hosts torequest and receive a DHCP assigned IP address and perform DNS queries. All othertraffic, except for HTTP protocol traffic, is blocked. The switch intercepts HTTP
protocol traffic and redirects it to a switch-generated web page that facilitates username and password authentication via RADIUS. Once authentication is successful,
the web browser is forwarded on to the originally requested web page. Successfulauthentication is valid for all hosts connected to the port.
Note: RADIUS authentication must be activated and configured for the web
authentication feature to work properly (see “Authentication Sequence” onpage 236).
Note: Web authentication cannot be configured on trunk ports.
Table 62: Web Authentication
CommandFunctionModeweb-auth login-attempts

Defines the limit for failed web authentication login
attempts

GC

web-auth quiet-period

Defines the amount of time to wait after the limit for
failed login attempts is exceeded.

GC

web-auth session-timeout

Defines the amount of time a session remains validGC

web-auth system-auth-control

Enables web authentication globally for the switchGC

web-authEnables web authentication for an interfaceICweb-auth re-authenticate (Port) Ends all web authentication sessions on the port andforces the users to re-authenticatePEweb-auth re-authenticate (IP)Ends the web authentication session associated with the PE
designated IP address and forces the user to reauthenticate

show web-authDisplays global web authentication parametersPEshow web-auth interface

Displays interface-specific web authentication
parameters and statistics

PEshow web-auth summary

Displays a summary of web authentication port
parameters and statistics

PE– 323 –

Chapter 9 | General Security Measures
Web Authentication

web-auth This command defines the limit for failed web authentication login attempts. Afterlogin-attempts the limit is reached, the switch refuses further login attempts until the quiet time
expires. Use the no form to restore the default.
Syntaxweb-auth login-attempts countno web-auth login-attempts
count - The limit of allowed failed login attempts. (Range: 1-3)
Default Setting
3 login attempts
Command Mode
Global Configuration
ExampleConsole(config)#web-auth login-attempts 2
Console(config)#

web-auth This command defines the amount of time a host must wait after exceeding thequiet-period limit for failed login attempts, before it may attempt web authentication again. Use
the no form to restore the default.
Syntaxweb-auth quiet-period time
no web-auth quiet period
time - The amount of time the host must wait before attempting
authentication again. (Range: 1-180 seconds)
Default Setting
60 seconds
Command Mode
Global Configuration
ExampleConsole(config)#web-auth quiet-period 120
Console(config)#– 324 –

Chapter 9 | General Security Measures

Web Authentication

web-auth This command defines the amount of time a web-authentication session remains
session-timeout valid. When the session timeout has been reached, the host is logged off and must
re-authenticate itself the next time data transmission takes place. Use the no form
to restore the default.
Syntaxweb-auth session-timeout timeout
no web-auth session timeout
timeout - The amount of time that an authenticated session remains valid.
(Range: 300-3600 seconds)
Default Setting
3600 seconds
Command Mode
Global Configuration
ExampleConsole(config)#web-auth session-timeout 1800
Console(config)#

web-auth system- This command globally enables web authentication for the switch. Use the no form
auth-control to restore the default.
Syntax[no] web-auth system-auth-control
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
Both web-auth system-auth-control for the switch and web-auth for an interface
must be enabled for the web authentication feature to be active.
ExampleConsole(config)#web-auth system-auth-control
Console(config)#– 325 –

Chapter 9 | General Security Measures
Web Authentication

web-auth This command enables web authentication for an interface. Use the no form torestore the default.
Syntax[no] web-authDefault Setting
Disabled
Command Mode
Interface Configuration
Command Usage
Both web-auth system-auth-control for the switch and web-auth for a port must
be enabled for the web authentication feature to be active.
ExampleConsole(config-if)#web-authConsole(config-if)#web-auth re- This command ends all web authentication sessions connected to the port andauthenticate (Port) forces the users to re-authenticate.
Syntaxweb-auth re-authenticate interface interface
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#web-auth re-authenticate interface ethernet 1/2
Console#– 326 –

Chapter 9 | General Security Measures

Web Authentication

web-auth re- This command ends the web authentication session associated with theauthenticate (IP) designated IP address and forces the user to re-authenticate.
Syntaxweb-auth re-authenticate interface interface ip
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
ip - IPv4 formatted IP address
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#web-auth re-authenticate interface ethernet 1/2 192.168.1.5
Console#show web-auth This command displays global web authentication parameters.
Command Mode
Privileged Exec
ExampleConsole#show web-authGlobal Web-Auth Parameters
System Auth Control: Enabled
Session Timeout: 3600Quiet Period: 60
Max Login Attempts: 3
Console#– 327 –

Chapter 9 | General Security Measures
Web Authentication

show web-auth This command displays interface-specific web authentication parameters andinterface statistics.
Syntaxshow web-auth interface interface
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show web-auth interface ethernet 1/2
Web Auth Status: Enabled
Host Summary
IP address
Web-Auth-State Remaining-Session-Time--------------- -------------- ---------------------1.1.1.1
Authenticated 295
1.1.1.2
Authenticated 111
Console#show web-auth This command displays a summary of web authentication port parameters andsummary statistics.
Command Mode
Privileged Exec
ExampleConsole#show web-auth summary
Global Web-Auth Parameters
System Auth Control: Enabled
Port
StatusAuthenticated Host Count-------------------------------1/ 1
Disabled
0
1/ 2
Enabled8
1/ 3Disabled0
1/ 4
Disabled0
1/ 5
Disabled0.
.
.

– 328 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

DHCPv4 Snooping
DHCPv4 snooping allows a switch to protect a network from rogue DHCPv4 servers
or other devices which send port-related information to a DHCPv4 server. This
information can be useful in tracking an IP address back to a physical port. Thissection describes commands used to configure DHCPv4 snooping.
Table 63: DHCP Snooping Commands
CommandFunctionMode

ip dhcp snooping

Enables DHCP snooping globallyGC

ip dhcp snooping information Enables or disables the use of DHCP Option 82
GC
optioninformation, and specifies frame format for the remote-id
ip dhcp snooping information Disables use of sub-type and sub-length for the
option encode no-subtype
CID/RID in Option 82 informationGC

ip dhcp snooping information Sets the remote ID to the switch’s IP address, MAC
GC
option remote-id
address, arbitrary string, TR-101 compliant node
identifier, or removes VLAN ID from the end of the TR101
field
ip dhcp snooping information Sets the board identifier used in Option 82 information
option tr101 board-id
based on TR-101 syntax

GC

ip dhcp snooping information Sets the information option policy for DHCP client
policypackets that include Option 82 informationGC

ip dhcp snooping verify
mac-address

Verifies the client’s hardware address stored in the DHCP GC
packet against the source MAC address in the Ethernet
headerip dhcp snooping vlan

Enables DHCP snooping on the specified VLAN

GC

ip dhcp snooping information Enables or disables the use of DHCP Option 82
option circuit-id
information circuit-id suboptionIC

ip dhcp snooping maxnumber

configures the maximum number of DHCP clients which IC
can be supported per interface

ip dhcp snooping trust

Configures the specified interface as trusted

IC

clear ip dhcp snooping
binding

Clears DHCP snooping binding table entries from RAM

PE

clear ip dhcp snooping
database flash

Removes all dynamically learned snooping entries fromflash memory.

PE

ip dhcp snooping databaseflash

Writes all dynamically learned snooping entries to flash
memoryPEshow ip dhcp snooping

Shows the DHCP snooping configuration settingsPEshow ip dhcp snooping
binding

Shows the DHCP snooping binding table entriesPE– 329 –

Chapter 9 | General Security Measures
DHCPv4 Snooping

ip dhcp snooping This command enables DHCP snooping globally. Use the no form to restore thedefault setting.
Syntax[no] ip dhcp snooping
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
 Network traffic may be disrupted when malicious DHCP messages are received
from an outside source. DHCP snooping is used to filter DHCP messages
received on an unsecure interface from outside the network or fire wall. When
DHCP snooping is enabled globally by this command, and enabled on a VLAN
interface by the ip dhcp snooping vlan command, DHCP messages received onan untrusted interface (as specified by the no ip dhcp snooping trust
command) from a device not listed in the DHCP snooping table will be
dropped.
 When enabled, DHCP messages entering an untrusted interface are filteredbased upon dynamic entries learned via DHCP snooping.

 Table entries are only learned for trusted interfaces. Each entry includes a MAC

address, IP address, lease time, VLAN identifier, and port identifier.

 When DHCP snooping is enabled, the rate limit for the number of DHCP

messages that can be processed by the switch is 100 packets per second. Any
DHCP packets in excess of this limit are dropped.

 Filtering rules are implemented as follows:

If global DHCP snooping is disabled, all DHCP packets are forwarded.



If DHCP snooping is enabled globally, and also enabled on the VLAN where
the DHCP packet is received, all DHCP packets are forwarded for a trusted
port. If the received packet is a DHCP ACK message, a dynamic DHCP
snooping entry is also added to the binding table.



If DHCP snooping is enabled globally, and also enabled on the VLAN where
the DHCP packet is received, but the port is not trusted, it is processed asfollows:


If the DHCP packet is a reply packet from a DHCP server (including
OFFER, ACK or NAK messages), the packet is dropped.

– 330 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

If the DHCP packet is from a client, such as a DECLINE or RELEASE
message, the switch forwards the packet only if the corresponding
entry is found in the binding table.



If the DHCP packet is from client, such as a DISCOVER, REQUEST,INFORM, DECLINE or RELEASE message, the packet is forwarded if MAC
address verification is disabled (as specified by the ip dhcp snooping
verify mac-address command). However, if MAC address verification isenabled, then the packet will only be forwarded if the client’s hardware
address stored in the DHCP packet is the same as the source MAC
address in the Ethernet header.



If the DHCP packet is not a recognizable type, it is dropped.



If a DHCP packet from a client passes the filtering criteria above, it will only
be forwarded to trusted ports in the same VLAN.



If a DHCP packet is from server is received on a trusted port, it will be
forwarded to both trusted and untrusted ports in the same VLAN.

 If DHCP snooping is globally disabled, all dynamic bindings are removed fromthe binding table.

 Additional considerations when the switch itself is a DHCP client – The port(s)through which the switch submits a client request to the DHCP server must be
configured as trusted (using the ip dhcp snooping trust command). Note thatthe switch will not add a dynamic entry for itself to the binding table when it
receives an ACK message from a DHCP server. Also, when the switch sends out
DHCP client packets for itself, no filtering takes place. However, when theswitch receives any messages from a DHCP server, any packets received from
untrusted ports are dropped.

ExampleThis example enables DHCP snooping globally for the switch.
Console(config)#ip dhcp snooping
Console(config)#

Related Commands
ip dhcp snooping vlan (337)
ip dhcp snooping trust (340)– 331 –

Chapter 9 | General Security Measures
DHCPv4 Snooping

ip dhcp snooping This command enables the use of DHCP Option 82 information for the switch, andinformation option specifies the frame format to use for the remote-id when Option 82 information is
generated by the switch. Use the no form without any keywords to disable thisfunction.
Syntax
ip dhcp snooping information option
no ip dhcp snooping information option
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage DHCP provides a relay mechanism for sending information about the switch
and its DHCP clients to the DHCP server. Known as DHCP Option 82, it allows
compatible DHCP servers to use the information when assigning IP addresses,
or to set other services or policies for clients.
 When the DHCP Snooping Information Option 82 is enabled, the requestingclient (or an intermediate relay agent that has used the information fields todescribe itself ) can be identified in the DHCP request packets forwarded by theswitch and in reply packets sent back from the DHCP server.

 When the DHCP Snooping Information Option is enabled, clients can be

identified by the switch port to which they are connected rather than just their
MAC address. DHCP client-server exchange messages are then forwarded
directly between the server and client without having to flood them to theentire VLAN.

 DHCP snooping must be enabled for the DHCP Option 82 information to beinserted into packets. When enabled, the switch will only add/remove option
82 information in incoming DHCP packets but not relay them. Packets areprocessed as follows:

If an incoming packet is a DHCP request packet with option 82 information,
it will modify the option 82 information according to settings specified with
ip dhcp snooping information policy command.



If an incoming packet is a DHCP request packet without option 82
information, enabling the DHCP snooping information option will add
option 82 information to the packet.



If an incoming packet is a DHCP reply packet with option 82 information,
enabling the DHCP snooping information option will remove option 82
information from the packetExample– 332 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

This example enables the DHCP Snooping Information Option.
Console(config)#ip dhcp snooping information option
Console(config)#

ip dhcp snooping This command disables the use of sub-type and sub-length fields for the
information option circuit-ID (CID) and remote-ID (RID) in Option 82 information generated by theencode no-subtype switch. Use the no form to enable the use of these fields.
Syntax[no] ip dhcp snooping information option encode no-subtype
Default Setting
CID/RID sub-type: Enabled
Command Mode
Global Configuration
Command Usage Option 82 information generated by the switch is based on TR-101 syntax asshown below:
Table 64: Option 82 information
82

3-69

1

1-67

opt82

opt-lensub-opt1

string-len

x1

x2

x3

x4

x5

x63

R-124 string

The circuit identifier used by this switch starts at sub-option1 and goes to theend of the R-124 string. The R-124 string includes the following information:

sub-type - Distinguishes different types of circuit IDs.



sub-length - Length of the circuit ID type

access node identifier - ASCII string. Default is the MAC address of theswitch’s CPU. This field is set by the ip dhcp snooping information optioncommand,eth - The second field is the fixed string “eth”

slot - The slot represents the stack unit for this system.



port - The port which received the DHCP request. If the packet arrives overa trunk, the value is the ifIndex of the trunk.

vlan - Tag of the VLAN which received the DHCP request.
Note that the sub-type and sub-length fields can be enabled or disabledusing the ip dhcp snooping information option command.

– 333 –

Chapter 9 | General Security Measures
DHCPv4 Snooping

The ip dhcp snooping information option circuit-id command can beused to modify the default settings described above.

 The format for TR101 option 82 is: “<IP> eth <SID>/<PORT>[:<VLAN>]”. Notethat the SID (Switch ID) is always 0. By default the PVID is added to the end of
the TR101 field for untagged packets. For tagged packets, the VLAN ID is always
added.

ExampleThis example enables the use of sub-type and sub-length fields for thecircuit-ID (CID) and remote-ID (RID).
Console(config)#no ip dhcp snooping information option encode no-subtype
Console(config)#

ip dhcp snooping This command sets the remote ID to the switch’s IP address, MAC address, arbitrary
information option string, TR-101 compliant node identifier, or removes VLAN ID from the end of theremote-id TR101 field. Use the no form to restore the default setting.
Syntax
ip dhcp snooping information option remote-id{ip-address [encode {ascii | hex}] |mac-address [encode {ascii | hex}] |string string [sub-option port-description [delimiter delimiter]] |tr101 {node-identifier {ip | sysname} | no-vlan-field }}no ip dhcp snooping information option remote-id[ip-address encode] | [mac-address encode] | [string sub-option portdescription delimiter] | [tr101 no-vlan-field]
mac-address - Inserts a MAC address in the remote ID sub-option for the
DHCP snooping agent (that is, the MAC address of the switch’s CPU).
ip-address - Inserts an IP address in the remote ID sub-option for the DHCP
snooping agent (that is, the IP address of the management interface).
encode - Indicates encoding in ASCII or hexadecimal.
string - An arbitrary string inserted into the remote identifier field.
(Range: 1-32 characters)
sub-option port-description - Include the port description string.
delimiter delimiter - Include the delimiter (Range 0-255)
tr101 node-identifier - The remote ID generated by the switch is based on
TR-101 syntax (R-124, Access_Node_ID).
ip - Specifies the switch’s IP address as the node identifier.
sysname - Specifies the system name as the node identifier.
tr101 no-vlan-field - Do not add “:VLAN” in TR101 field for untagged
packets.
– 334 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

Default Setting
MAC address: hexadecimal
tr101 no-vlan-field: disabled
Command Mode
Global Configuration
Command Usage
The format for TR101 option 82 is: “<IP> eth <SID>/<PORT>[:<VLAN>]”. Note that
the SID (Switch ID) is always 0. By default the PVID is added to the end of the TR101
field for untagged packets. For tagged packets, the VLAN ID is always added. Use
the ip dhcp snooping information option remote-id tr101 no-vlan-fieldcommand to remove the VLAN ID from the end of the TR101 field for untagged
packets. Use the no form of this command to add the PVID for untagged packets at
the end of the TR101 field.
ExampleThis example sets the remote ID to the switch’s IP address.
Console(config)#ip dhcp snooping information option remote-id tr101
node-identifier ip
Console(config)#

ip dhcp snooping This command sets the board identifier used in Option 82 information based on
information option TR-101 syntax. Use the no form to remove the board identifier.
tr101 board-id
Syntax

ip dhcp snooping information option tr101 board-id board-id
no ip dhcp snooping information option tr101 board-id
board-id – TR101 Board ID. (Range: 0-9)
Default Setting
not defined
Command Mode
Global Configuration
ExampleThis example sets the board ID to 0.
Console(config)#ip dhcp snooping information option tr101 board-id 0
Console(config)#– 335 –

Chapter 9 | General Security Measures
DHCPv4 Snooping

ip dhcp snooping This command sets the DHCP snooping information option policy for DHCP client
information policy packets that include Option 82 information. Use the no form to restore the default
setting.
Syntax
ip dhcp snooping information policy {drop | keep | replace}no ip dhcp snooping information policy
drop - Drops the client’s request packet instead of relaying it.
keep - Retains the Option 82 information in the client request, andforwards the packets to trusted ports.
replace - Replaces the Option 82 information circuit-id and remote-id fields
in the client’s request with information about the relay agent itself, inserts
the relay agent’s address (when DHCP snooping is enabled), and forwards
the packets to trusted ports.
Default Setting
replaceCommand Mode
Global Configuration
Command Usage
When the switch receives DHCP packets from clients that already include DHCP
Option 82 information, the switch can be configured to set the action policy forthese packets. The switch can either drop the DHCP packets, keep the existing
information, or replace it with the switch’s relay information.
ExampleConsole(config)#ip dhcp snooping information policy drop
Console(config)#

ip dhcp snooping This command verifies the client’s hardware address stored in the DHCP packet
verify mac-address against the source MAC address in the Ethernet header. Use the no form to disable
this function.
Syntax[no] ip dhcp snooping verify mac-address
Default Setting
EnabledCommand Mode
Global Configuration– 336 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

Command Usage
If MAC address verification is enabled, and the source MAC address in the Ethernet
header of the packet is not same as the client’s hardware address in the DHCP
packet, the packet is dropped.
ExampleThis example enables MAC address verification.
Console(config)#ip dhcp snooping verify mac-address
Console(config)#

Related Commands
ip dhcp snooping (330)
ip dhcp snooping vlan (337)
ip dhcp snooping trust (340)

ip dhcp snooping vlan This command enables DHCP snooping on the specified VLAN. Use the no form torestore the default setting.
Syntax[no] ip dhcp snooping vlan vlan-id
vlan-id - ID of a configured VLAN (Range: 1-4094)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When DHCP snooping is enabled globally using the ip dhcp snooping
command, and enabled on a VLAN with this command, DHCP packet filtering
will be performed on any untrusted ports within the VLAN as specified by the ip
dhcp snooping trust command.
 When the DHCP snooping is globally disabled, DHCP snooping can still be

configured for specific VLANs, but the changes will not take effect until DHCP
snooping is globally re-enabled.

 When DHCP snooping is globally enabled, and then disabled on a VLAN, alldynamic bindings learned for this VLAN are removed from the binding table.

– 337 –

Chapter 9 | General Security Measures
DHCPv4 Snooping
ExampleThis example enables DHCP snooping for VLAN 1.
Console(config)#ip dhcp snooping vlan 1
Console(config)#

Related Commands
ip dhcp snooping (330)
ip dhcp snooping trust (340)

ip dhcp snooping This command specifies DHCP Option 82 circuit-id suboption information. Use theinformation option no form to use the default settings.
circuit-id
Syntax

ip dhcp snooping information option circuit-id string string |{tr101 {node-identifier {ip | sysname} | no-vlan-field}
no dhcp snooping information option circuit-id [tr101 no-vlan-field]
string - An arbitrary string inserted into the circuit identifier field.
(Range: 1-32 characters)
tr101 node-identifier - The remote ID generated by the switch is based on
TR-101 syntax (R-124, Access_Node_ID).
ip - Specifies the switch’s IP address as the node identifier.
sysname - Specifies the system name as the node identifier.
tr101 no-vlan-field - Do not add “:VLAN” in TR101 field for untagged
packets.
Default Setting
VLAN-Unit-Port
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage DHCP provides a relay mechanism for sending information about the switch

and its DHCP clients to the DHCP server. DHCP Option 82 allows compatible
DHCP servers to use the information when assigning IP addresses, to set otherservices or policies for clients. For more information of this process, refer to the
Command Usage section under the ip dhcp snooping information optioncommand.

 Option 82 information generated by the switch is based on TR-101 syntax asshown below:– 338 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

Table 65: Option 82 information
82

3-69

1

1-67

opt82

opt-lensub-opt1

string-len

x1

x2

x3

x4

x5

x63

R-124 string

The circuit identifier used by this switch starts at sub-option1 and goes to theend of the R-124 string. The R-124 string includes the following information:

sub-type - Distinguishes different types of circuit IDs.



sub-length - Length of the circuit ID type

access node identifier - ASCII string. Default is the MAC address of theswitch’s CPU. This field is set by the ip dhcp snooping information optioncommand,eth - The second field is the fixed string “eth”

slot - The slot represents the stack unit for this system.



port - The port which received the DHCP request. If the packet arrives overa trunk, the value is the ifIndex of the trunk.

vlan - Tag of the VLAN which received the DHCP request.
Note that the sub-type and sub-length fields can be enabled or disabledusing the ip dhcp snooping information option command.



The ip dhcp snooping information option circuit-id command can beused to modify the default settings described above.

 The format for TR101 option 82 is: “<IP> eth <SID>/<PORT>[:<VLAN>]”. Notethat the SID (Switch ID) is always 0. By default the PVID is added to the end of
the TR101 field for untagged packets. For tagged packets, the VLAN ID is always
added. Use the ip dhcp snooping information option remote-id tr101 novlan-field command to remove the VLAN ID from the end of the TR101 field for
untagged packets. Use the no form of this command to add the PVID for
untagged packets at the end of the TR101 field.

ExampleThis example sets the DHCP Snooping Information circuit-id suboption string.
Console(config)#interface ethernet 1/1
Console(config-if)#ip dhcp snooping information option circuit-id string 4500
Console(config-if)#– 339 –

Chapter 9 | General Security Measures
DHCPv4 Snooping

ip dhcp snooping This command configures the maximum number of DHCP clients which can be
max-number supported per interface. Use the no form to restore the default setting.
Syntax
ip dhcp snooping max-number max-number
no dhcp snooping max-number
max-number - Maximum number of DHCP clients. (Range: 1-16)
Default Setting
16
Command Mode
Interface Configuration (Ethernet, Port Channel)
ExampleThis example sets the maximum number of DHCP clients supported on port 1 to 2.
Console(config)#interface ethernet 1/1
Console(config-if)#ip dhcp snooping max-number 2
Console(config-if)#

ip dhcp snooping trust This command configures the specified interface as trusted. Use the no form torestore the default setting.
Syntax[no] ip dhcp snooping trust
Default Setting
All interfaces are untrusted
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage A trusted interface is an interface that is configured to receive only messages
from within the network. An untrusted interface is an interface that isconfigured to receive messages from outside the network or fire wall.
 Set all ports connected to DHCP servers within the local network or fire wall totrusted, and all other ports outside the local network or fire wall to untrusted.

 When DHCP snooping is enabled globally using the ip dhcp snooping

command, and enabled on a VLAN with ip dhcp snooping vlan command,
DHCP packet filtering will be performed on any untrusted ports within the– 340 –

Chapter 9 | General Security Measures

DHCPv4 Snooping

VLAN according to the default status, or as specifically configured for aninterface with the no ip dhcp snooping trust command.
 When an untrusted port is changed to a trusted port, all the dynamic DHCP

snooping bindings associated with this port are removed.

 Additional considerations when the switch itself is a DHCP client – The port(s)through which it submits a client request to the DHCP server must be
configured as trusted.

ExampleThis example sets port 5 to untrusted.
Console(config)#interface ethernet 1/5
Console(config-if)#no ip dhcp snooping trust
Console(config-if)#

Related Commands
ip dhcp snooping (330)
ip dhcp snooping vlan (337)clear ip dhcp This command clears DHCP snooping binding table entries from RAM. Use thissnooping binding command without any optional keywords to clear all entries from the binding
table.

Syntaxclear ip dhcp snooping binding [mac-address vlan vlan-id]
mac-address - Specifies a MAC address entry. (Format: xx-xx-xx-xx-xx-xx or
xxxxxxxxxxxx)
vlan-id - ID of a configured VLAN (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#clear ip dhcp snooping binding 11-22-33-44-55-66 192.168.1.234
Console#clear ip dhcp This command removes all dynamically learned snooping entries from flash
snooping database memory.
flash
Command Mode
Privileged Exec

– 341 –

Chapter 9 | General Security Measures
DHCPv4 Snooping
ExampleConsole#clear ip dhcp snooping database flash
Console#ip dhcp snooping This command writes all dynamically learned snooping entries to flash memory.
database flash
Command Mode
Privileged Exec
Command Usage
This command can be used to store the currently learned dynamic DHCP snooping
entries to flash memory. These entries will be restored to the snooping table when
the switch is reset. However, note that the lease time shown for a dynamic entry
that has been restored from flash memory will no longer be valid.
ExampleConsole#ip dhcp snooping database flash
Console#show ip dhcp This command shows the DHCP snooping configuration settings.
snooping
Command Mode
Privileged Exec
ExampleConsole#show ip dhcp snooping
Global DHCP Snooping Status: disabled
DHCP Snooping Information Option Status: disabled
DHCP Snooping Information Option Sub-option Format: extra subtype included
DHCP Snooping Information Option Remote ID: MAC Address (hex encoded)
DHCP Snooping Information Option Remote ID TR101 VLAN Field: enabled
DHCP Snooping Information Option TR101 Board ID: none
DHCP Snooping Information Policy: replace
DHCP Snooping is configured on the following VLANs:
Verify Source MAC-Address: enabled
Circuit-ID
Circuit-ID Circuit-ID
Interface Trusted Max-Num mode
Value
TR101 VLAN--------- ------- ------- --------------- ----------- ---------Eth 1/1
No
16
VLAN-Unit-Port --enabled
Eth 1/2
No
16
VLAN-Unit-Port --enabled
Eth 1/3
No
16
VLAN-Unit-Port --enabled
Eth 1/4
No
16
VLAN-Unit-Port --enabled
Eth 1/5
No
16
VLAN-Unit-Port --enabled.
.

.

– 342 –

Carry To
Client--------disableddisabled
disabled
disabled
disabled

Chapter 9 | General Security Measures

DHCPv6 Snoopingshow ip dhcp This command shows the DHCP snooping binding table entries.
snooping binding
Command Mode
Privileged Exec
ExampleConsole#show ip dhcp snooping binding
MAC Address
IP Address
Lease(sec) TypeVLAN Interface----------------- --------------- ---------- -------------------- ---- -----11-22-33-44-55-66 192.168.0.99
0 Dynamic-DHCPSNP
1 Eth 1/5
Console#DHCPv6 Snooping
DHCPv6 snooping allows a switch to protect a network from rogue DHCPv6 servers
or other devices which send port-related information to a DHCPv6 server. This
information can be useful in tracking an IP address back to a physical port. Thissection describes commands used to configure DHCPv6 snooping.
Table 66: DHCP Snooping Commands
CommandFunctionMode

ipv6 dhcp snooping

Enables DHCPv6 snooping globallyGC

ipv6 dhcp snooping option
remote-id

Enables insertion of DHCPv6 Option 37 relay agent
remote-id

GC

ipv6 dhcp snooping option
remote-id policy

Sets the information option policy for DHCPv6 client
packets that include Option 37 informationGC

ipv6 dhcp snooping vlan

Enables DHCPv6 snooping on the specified VLAN

GC

ipv6 dhcp snooping
max-binding

Sets the maximum number of entries which can be
stored in the binding database for an interface

IC

ipv6 dhcp snooping trust

Configures the specified interface as trusted

IC

clear ipv6 dhcp snooping
binding

Clears DHCPv6 snooping binding table entries from RAM PE

clear ipv6 dhcp snooping
statistics

Clears statistical counters for DHCPv6 snooping client,server and relay packets

PEshow ipv6 dhcp snooping

Shows the DHCPv6 snooping configuration settingsPEshow ipv6 dhcp snooping
binding

Shows the DHCPv6 snooping binding table entries

PEshow ipv6 dhcp snooping
statistics

Shows statistics for DHCPv6 snooping client, server andrelay packets

PE– 343 –

Chapter 9 | General Security Measures
DHCPv6 Snooping

ipv6 dhcp snooping This command enables DHCPv6 snooping globally. Use the no form to restore thedefault setting.
Syntax[no] ipv6 dhcp snooping
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
 Network traffic may be disrupted when malicious DHCPv6 messages arereceived from an outside source. DHCPv6 snooping is used to filter DHCPv6
messages received on an unsecure interface from outside the network or firewall. When DHCPv6 snooping is enabled globally by this command, andenabled on a VLAN interface by the ipv6 dhcp snooping vlan command, DHCP
messages received on an untrusted interface (as specified by the no ipv6 dhcp
snooping trust command) from a device not listed in the DHCPv6 snooping
table will be dropped.
 When enabled, DHCPv6 messages entering an untrusted interface are filteredbased upon dynamic entries learned via DHCPv6 snooping.

 Table entries are only learned for trusted interfaces. Each entry includes a MAC

address, IPv6 address, lease time, binding type, VLAN identifier, and port
identifier.

 When DHCPv6 snooping is enabled, the rate limit for the number of DHCPv6

messages that can be processed by the switch is 100 packets per second. Any
DHCPv6 packets in excess of this limit are dropped.

 Filtering rules are implemented as follows:

If global DHCPv6 snooping is disabled, all DHCPv6 packets are forwarded.



If DHCPv6 snooping is enabled globally, and also enabled on the VLAN
where the DHCPv6 packet is received, DHCPv6 packets are forwarded for atrusted port as described below.



If DHCPv6 snooping is enabled globally, and also enabled on the VLAN
where the DHCP packet is received, but the port is not trusted, DHCP
packets are processed according to message type as follows:
DHCP Client PacketRequest: Update entry in binding cache, recording client’s DHCPv6
Unique Identifier (DUID), server’s DUID, Identity Association (IA) type, IA– 344 –

Chapter 9 | General Security Measures

DHCPv6 Snooping

Identifier, and address (4 message exchanges to get IPv6 address), andforward to trusted port.


Solicit: Add new entry in binding cache, recording client’s DUID, IA type,
IA ID (2 message exchanges to get IPv6 address with rapid commit
option, otherwise 4 message exchanges), and forward to trusted port.



Decline: If no matching entry is found in binding cache, drop thispacket.



Renew, Rebind, Release, Confirm: If no matching entry is found inbinding cache, drop this packet.



If the DHCPv6 packet is not a recognizable type, it is dropped.

If a DHCPv6 packet from a client passes the filtering criteria above, it will
only be forwarded to trusted ports in the same VLAN.
DHCP Server Packet

If a DHCP server packet is received on an untrusted port, drop thispacket and add a log entry in the system.



If a DHCPv6 Reply packet is received from a server on a trusted port, it
will be processed in the following manner:a. Check if IPv6 address in IA option is found in binding table:

If yes, continue to C.



If not, continue to B.

b. Check if IPv6 address in IA option is found in binding cache:

If yes, continue to C.



If not, check failed, and forward packet to trusted port.

c. Check status code in IA option:


If successful, and entry is in binding table, update lease timeand forward to original destination.



If successful, and entry is in binding cache, move entry frombinding cache to binding table, update lease time and forward
to original destination.

Otherwise, remove binding entry. and check failed.



If a DHCPv6 Relay packet is received, check the relay message
option in Relay-Forward or Relay-Reply packet, and processclient and server packets as described above.
– 345 –

Chapter 9 | General Security Measures
DHCPv6 Snooping If DHCPv6 snooping is globally disabled, all dynamic bindings are removed

from the binding table.

 Additional considerations when the switch itself is a DHCPv6 client – The port(s)through which the switch submits a client request to the DHCPv6 server must
be configured as trusted (using the ipv6 dhcp snooping trust command). Notethat the switch will not add a dynamic entry for itself to the binding table when
it receives an ACK message from a DHCPv6 server. Also, when the switch sends
out DHCPv6 client packets for itself, no filtering takes place. However, when theswitch receives any messages from a DHCPv6 server, any packets received from
untrusted ports are dropped.

ExampleThis example enables DHCPv6 snooping globally for the switch.
Console(config)#ipv6 dhcp snooping
Console(config)#

Related Commands
ipv6 dhcp snooping vlan (348)
ipv6 dhcp snooping trust (349)

ipv6 dhcp snooping This command enables the insertion of remote-id option 37 information into
option remote-id DHCPv6 client messages. Remote-id option information such as the port attachedto the client, DUID, and VLAN ID is used by the DHCPv6 server to assign
preassigned configuration data specific to the DHCPv6 client. Use the no form of
the command to disable this function.
Syntax[no] ipv6 dhcp snooping option remote-id
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage DHCPv6 provides a relay mechanism for sending information about the switch
and its DHCPv6 clients to the DHCPv6 server. Known as DHCPv6 Option 37, it
allows compatible DHCPv6 servers to use the information when assigning IP
addresses, or to set other services or policies for clients.
 When DHCPv6 Snooping Information Option 37 is enabled, the requestingclient (or an intermediate relay agent that has used the information fields todescribe itself ) can be identified in the DHCPv6 request packets forwarded by
the switch and in reply packets sent back from the DHCPv6 server.
– 346 –

Chapter 9 | General Security Measures

DHCPv6 Snooping When the DHCPv6 Snooping Option 37 is enabled, clients can be identified by

the switch port to which they are connected rather than just their MAC address.
DHCPv6 client-server exchange messages are then forwarded directly between
the server and client without having to flood them to the entire VLAN.

 DHCPv6 snooping must be enabled for the DHCPv6 Option 37 information to

be inserted into packets. When enabled, the switch will either drop, keep or
remove option 37 information in incoming DHCPv6 packets. Packets areprocessed as follows:

If an incoming packet is a DHCPv6 request packet with option 37
information, it will modify the option 37 information according to settings
specified with ipv6 dhcp snooping option remote-id policy command.



If an incoming packet is a DHCPv6 request packet without option 37
information, enabling the DHCPv6 snooping information option will add
option 37 information to the packet.



If an incoming packet is a DHCPv6 reply packet with option 37 information,
enabling the DHCPv6 snooping information option will remove option 37
information from the packet.

 When this switch inserts Option 37 information in DHCPv6 client request

packets, the switch’s MAC address (hexadecimal) is used for the remote ID.

ExampleThis example enables the DHCPv6 Snooping Remote-ID Option.
Console(config)#ipv6 dhcp snooping option remote-id
Console(config)#

ipv6 dhcp snooping This command sets the remote-id option policy for DHCPv6 client packets that
option remote-id include Option 37 information. Use the no form to disable this function.
policySyntaxipv6 dhcp snooping option remote-id policy {drop | keep | replace}no ipv6 dhcp snooping option remote-id policy
drop - Drops the client’s request packet instead of relaying it.
keep - Retains the Option 37 information in the client request, andforwards the packets to trusted ports.
replace - Replaces the Option 37 remote-ID in the client’s request with therelay agent’s remote-ID (when DHCPv6 snooping is enabled), and forwards
the packets to trusted ports.
Default Settingdrop– 347 –

Chapter 9 | General Security Measures
DHCPv6 Snooping
Command Mode
Global Configuration
Command Usage
When the switch receives DHCPv6 packets from clients that already include DHCP
Option 37 information, the switch can be configured to set the action policy forthese packets. The switch can either drop the DHCPv6 packets, keep the existing
information, or replace it with the switch’s relay agent information.
ExampleThis example configures the switch to keep existing remote-id option 37
information within DHCPv6 client packets and forward it.
Console(config)#ipv6 dhcp snooping option remote-id policy keep
Console(config)#

ipv6 dhcp snooping This command enables DHCPv6 snooping on the specified VLAN. Use the no form
vlan to restore the default setting.
Syntax[no] ipv6 dhcp snooping vlan {vlan-id | vlan-range}vlan-id - ID of a configured VLAN (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,or a random group of VLANs with each entry separated by a comma.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When DHCPv6 snooping enabled globally using the ipv6 dhcp snooping
command, and enabled on a VLAN with this command, DHCPv6 packet
filtering will be performed on any untrusted ports within the VLAN as specified
by the ipv6 dhcp snooping trust command.
 When the DHCPv6 snooping is globally disabled, DHCPv6 snooping can still be

configured for specific VLANs, but the changes will not take effect until DHCPv6
snooping is globally re-enabled.

 When DHCPv6 snooping is enabled globally, and then disabled on a VLAN, alldynamic bindings learned for this VLAN are removed from the binding table.

– 348 –

Chapter 9 | General Security Measures

DHCPv6 Snooping

ExampleThis example enables DHCP6 snooping for VLAN 1.
Console(config)#ipv6 dhcp snooping vlan 1
Console(config)#

Related Commands
ipv6 dhcp snooping (344)
ipv6 dhcp snooping trust (349)

ipv6 dhcp snooping This command sets the maximum number of entries which can be stored in the
max-binding binding database for an interface. Use the no form to restore the default setting.
Syntaxipv6 dhcp snooping max-binding countno ipv6 dhcp snooping max-binding
count - Maximum number of entries. (Range: 1-5)
Default Setting
5
Command Mode
Interface Configuration (Ethernet, Port Channel)
ExampleThis example sets the maximum number of binding entries to 1.
Console(config)#interface ethernet 1/1
Console(config-if)#ipv6 dhcp snooping max-binding 1
Console(config-if)#

ipv6 dhcp snooping This command configures the specified interface as trusted. Use the no form totrust restore the default setting.
Syntax[no] ipv6 dhcp snooping trust
Default Setting
All interfaces are untrusted
Command Mode
Interface Configuration (Ethernet, Port Channel)– 349 –

Chapter 9 | General Security Measures
DHCPv6 Snooping
Command Usage A trusted interface is an interface that is configured to receive only messages
from within the network. An untrusted interface is an interface that isconfigured to receive messages from outside the network or fire wall.
 Set all ports connected to DHCv6 servers within the local network or fire wall totrusted, and all other ports outside the local network or fire wall to untrusted.

 When DHCPv6 snooping is enabled globally using the ipv6 dhcp snooping

command, and enabled on a VLAN with ipv6 dhcp snooping vlan command,
DHCPv6 packet filtering will be performed on any untrusted ports within the
VLAN according to the default status, or as specifically configured for aninterface with the no ipv6 dhcp snooping trust command.

 When an untrusted port is changed to a trusted port, all the dynamic DHCPv6

snooping bindings associated with this port are removed.

 Additional considerations when the switch itself is a DHCPv6 client – The port(s)through which it submits a client request to the DHCPv6 server must be
configured as trusted.

ExampleThis example sets port 5 to untrusted.
Console(config)#interface ethernet 1/5
Console(config-if)#no ipv6 dhcp snooping trust
Console(config-if)#

Related Commands
ipv6 dhcp snooping (344)
ipv6 dhcp snooping vlan (348)clear ipv6 dhcp This command clears DHCPv6 snooping binding table entries from RAM. Use thissnooping binding command without any optional keywords to clear all entries from the binding
table.

Syntaxclear ipv6 dhcp snooping binding [mac-address ipv6-address]
mac-address - Specifies a MAC address entry. (Format: xx-xx-xx-xx-xx-xx or
xxxxxxxxxxxx)
ipv6-address - Corresponding IPv6 address. This address must be enteredaccording to RFC 2373 “IPv6 Addressing Architecture,” using 8 colonseparated 16-bit hexadecimal values. One double colon may be used in theaddress to indicate the appropriate number of zeros required to fill the
undefined fields.

– 350 –

Chapter 9 | General Security Measures

DHCPv6 Snooping

Command Mode
Privileged Exec
ExampleConsole(config)#clear ipv6 dhcp snooping binding 00-12-cf-01-02-03 2001::1
Console(config)#

clear ipv6 dhcp This command clears statistical counters for DHCPv6 snooping client, server andsnooping statistics relay packets.
Command Mode
Privileged Exec
ExampleConsole(config)#clear ipv6 dhcp snooping statistics
Console(config)#show ipv6 dhcp This command shows the DHCPv6 snooping configuration settings.
snooping
Command Mode
Privileged Exec
ExampleConsole#show ipv6 dhcp snooping
Global DHCPv6 Snooping status: disabled
DHCPv6 Snooping remote-id option status: disabled
DHCPv6 Snooping remote-id policy: drop
DHCPv6 Snooping interface-id option status: enabled
DHCPv6 Snooping interface-id policy: replace
DHCPv6 Snooping is configured on the following VLANs:
Interface--------Eth 1/1
Eth 1/2
Eth 1/3
Eth 1/4
Eth 1/5.
.

Trusted--------No
No
No
No
Yes

.

– 351 –

Max-binding----------555
55

Current-binding--------------00000Chapter 9 | General Security Measures
DHCPv6 Snoopingshow ipv6 dhcp This command shows the DHCPv6 snooping binding table entries.
snooping binding
Command Mode
Privileged Exec
ExampleConsole#show ipv6 dhcp snooping binding
NA - Non-temporary address
TA - Temporary address-------------------------------------- ----------- ---- ------- ---Link-layer Address: 00-13-49-aa-39-26
IPv6 Address
Lifetime
VLAN Port
Type--------------------------------------- ---------- ---- ------- ---2001:b021:1435:5612:ab3c:6792:a452:6712
2591998
1 Eth 1/5
NA--------------------------------------- ---------- ---- ------- ---Link-layer Address: 00-12-cf-01-02-03
IPv6 Address
Lifetime
VLAN Port
Type--------------------------------------- ---------- ---- ------- ---2001:b000::1
2591912
1 Eth 1/3
NA
Console#show ipv6 dhcp This command shows statistics for DHCPv6 snooping client, server and relay
snooping statistics packets.
Command Mode
Privileged Exec
ExampleConsole#show ipv6 dhcp snooping statistics
DHCPv6 Snooping Statistics:
Client Packet: Solicit, Request, Confirm, Renew, Rebind,
Decline, Release, Information-request
Server Packet: Advertise, Reply, Reconfigure
Relay Packet: Relay-forward, Relay-reply
State
ClientServer
Relay
Total-------- -------- -------- -------- -------Received
10
9
0
19
Sent
9
9
0
18
Droped1001Console#– 352 –

Chapter 9 | General Security Measures
IPv4 Source Guard

IPv4 Source Guard
IPv4 Source Guard is a security feature that filters IPv4 traffic on network interfaces
based on manually configured entries in the IPv4 Source Guard table, or dynamic
entries in the DHCPv4 Snooping table when enabled (see “DHCPv4 Snooping” onpage 329). IPv4 source guard can be used to prevent traffic attacks caused when ahost tries to use the IPv4 address of a neighbor to access the network. This section
describes commands used to configure IPv4 Source Guard.
Table 67: IPv4 Source Guard Commands
CommandFunctionMode

ip source-guard binding

Adds a static address to the source-guard binding tableGC

ip source-guard

Configures the switch to filter inbound traffic based on
source IP address, or source IP address andcorresponding MAC addressIC

ip source-guard max-binding Sets the maximum number of entries that can be bound IC
to an interface
ip source-guard mode

Sets the source-guard learning mode to search foraddresses in the ACL binding table or the MAC addressbinding table

IC

clear ip source-guard
binding blocked

Remove all blocked records

PEshow ip source-guard

Shows whether source guard is enabled or disabled oneach interface

PEshow ip source-guard
binding

Shows the source guard binding tablePE

ip source-guard This command adds a static address to the source-guard ACL or MAC addressbinding binding table. Use the no form to remove a static entry.
Syntax
ip source-guard binding [mode {acl | mac}] mac-addressvlan vlan-id ip-address interface ethernet unit/port-list
no ip source-guard binding [mode {acl | mac}] mac-address ip-addressmode - Specifies the binding mode.
acl - Adds binding to ACL table.
mac - Adds binding to MAC address table.
mac-address - A valid unicast MAC address.
vlan-id - ID of a configured VLAN for an ACL filtering table or a range of
VLANs for a MAC address filtering table. To specify a list separate
nonconsecutive VLAN identifiers with a comma and no spaces; use ahyphen to designate a range of IDs. (Range: 1-4094)
ip-address - A valid unicast IP address, including classful types A, B or C.
– 353 –

Chapter 9 | General Security Measures
IPv4 Source Guard
unit - Unit identifier. (Range: 1)
port-list - Physical port number or list of port numbers. Separate
nonconsecutive port numbers with a comma and no spaces; or use ahyphen to designate a range of port numbers. (Range: 1-28/54)
Default Setting
No configured entries
Command Mode
Global Configuration
Command Usage If the binding mode is not specified in this command, the entry is bound to the
ACL table by default.
 Table entries include a MAC address, IP address, lease time, entry type (Static-IP-

SG-Binding, Dynamic-DHCP-Binding), VLAN identifier, and port identifier.

 All static entries are configured with an infinite lease time, which is indicatedwith a value of zero by the show ip source-guard command.

 When source guard is enabled, traffic is filtered based upon dynamic entries

learned via DHCP snooping, or static addresses configured in the source guard
binding table with this command.

 An entry with same MAC address and a different VLAN ID cannot be added tothe binding table.

 Static bindings are processed as follows:

A valid static IP source guard entry will be added to the binding table in
ACL mode if one of the following conditions is true:

If there is no binding entry with the same VLAN ID and MAC address, a
new entry will be added to the binding table using the type of static IP
source guard binding.



If there is an entry with the same VLAN ID and MAC address, and thetype of entry is static IP source guard binding, then the new entry will
replace the old one.



If there is an entry with the same VLAN ID and MAC address, and thetype of the entry is dynamic DHCP snooping binding, then the newentry will replace the old one and the entry type will be changed tostatic IP source guard binding.



Note that a static IP source guard entry cannot be added for an nonexistent VLAN.

A valid static IP source guard entry will be added to the binding table in
MAC mode if one of the following conditions are true:– 354 –

Chapter 9 | General Security Measures
IPv4 Source Guard

If there is no binding entry with the same IP address and MAC address,a new entry will be added to the binding table using the type of static
IP source guard binding entry.



If there is a binding entry with same IP address and MAC address, then
the new entry shall replace the old one.

 Only unicast addresses are accepted for static bindings.

ExampleThis example configures a static source-guard binding on port 5. Since the binding
mode is not specified, the entry is bound to the ACL table by default.
Console(config)#ip source-guard binding 00-E0-4C-68-14-79 vlan 1 192.168.0.99
interface ethernet 1/5
Console(config-if)#

Related Commands
ip source-guard (355)
ip dhcp snooping (330)
ip dhcp snooping vlan (337)

ip source-guard This command configures the switch to filter inbound traffic based on source IP

address, or source IP address and corresponding MAC address. Use the no form todisable this function.
Syntax
ip source-guard {sip | sip-mac}
no ip source-guard
sip - Filters traffic based on IP addresses stored in the binding table.
sip-mac - Filters traffic based on IP addresses and corresponding MAC
addresses stored in the binding table.

Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
Command Usage Source guard is used to filter traffic on an insecure port which receives
messages from outside the network or fire wall, and therefore may be subject
to traffic attacks caused by a host trying to use the IP address of a neighbor.
 Setting source guard mode to “sip” or “sip-mac” enables this function on theselected port. Use the “sip” option to check the VLAN ID, source IP address, and– 355 –

Chapter 9 | General Security Measures
IPv4 Source Guard
port number against all entries in the binding table. Use the “sip-mac” option
to check these same parameters, plus the source MAC address. Use the no ip
source guard command to disable this function on the selected port.
 When enabled, traffic is filtered based upon dynamic entries learned via DHCP

snooping, or static addresses configured in the source guard binding table.

 Table entries include a MAC address, IP address, lease time, entry type (Static-IP-

SG-Binding, Dynamic-DHCP-Binding, VLAN identifier, and port identifier.

 Static addresses entered in the source guard binding table with the ip source-

guard binding command are automatically configured with an infinite leasetime. Dynamic entries learned via DHCP snooping are configured by the DHCP
server itself.

 If the IP source guard is enabled, an inbound packet’s IP address (sip option) or

both its IP address and corresponding MAC address (sip-mac option) will bechecked against the binding table. If no matching entry is found, the packet
will be dropped.

 Filtering rules are implemented as follows:

If DHCPv4 snooping is disabled (see page 330), IP source guard will check
the VLAN ID, source IP address, port number, and source MAC address (forthe sip-mac option). If a matching entry is found in the binding table andthe entry type is static IP source guard binding, the packet will be
forwarded.



If the DHCP snooping is enabled, IP source guard will check the VLAN ID,
source IP address, port number, and source MAC address (for the sip-mac
option). If a matching entry is found in the binding table and the entry typeis static IP source guard binding, or dynamic DHCP snooping binding, thepacket will be forwarded.



If IP source guard is enabled on an interface for which IP source bindings(dynamically learned via DHCP snooping or manually configured) are notyet configured, the switch will drop all IP traffic on that port, except for
DHCP packets allowed by DHCP snooping.

Only unicast addresses are accepted for static bindings.

ExampleThis example enables IP source guard on port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#ip source-guard sip
Console(config-if)#– 356 –

Chapter 9 | General Security Measures
IPv4 Source Guard

Related Commands
ip source-guard binding (353)
ip dhcp snooping (330)
ip dhcp snooping vlan (337)

ip source-guard This command sets the maximum number of entries that can be bound to an
max-binding interface. Use the no form to restore the default setting.
Syntax
ip source-guard [mode {acl | mac}] max-binding number
no ip source-guard [mode {acl | mac}] max-binding
mode - Specifies the learning mode.
acl - Searches for addresses in the ACL table.
mac - Searches for addresses in the MAC address table.
number - The maximum number of IP addresses that can be mapped to aninterface in the binding table. (Range: 1-10)
Default Setting
Mode: ACL, Maximum Binding: 5
Mode: MAC, Maximum Binding: 16
Command Mode
Interface Configuration (Ethernet)
Command Usage This command sets the maximum number of address entries that can bemapped to an interface in the binding table for the specified mode (ACLbinding table or MAC address table) including dynamic entries discovered by
DHCP snooping and static entries set by the ip source-guard command.
 The maximum binding for ACL mode restricts the number of “active” entries

per port. If binding entries exceed the maximum number in IP source guard,
only the maximum number of binding entries will be set. Dynamic binding
entries exceeding the maximum number will be created but will not be active.

 The maximum binding for MAC mode restricts the number of MAC addresses

learned per port. Authenticated IP traffic with different source MAC addresses
cannot be learned if it would exceed this maximum number.

– 357 –

Chapter 9 | General Security Measures
IPv4 Source Guard
ExampleThis example sets the maximum number of allowed entries for ACL mode in thebinding table for port 5 to one entry. The mode is not specified, and therefore
defaults to the ACL binding table.
Console(config)#interface ethernet 1/5
Console(config-if)#ip source-guard max-binding 1
Console(config-if)#

ip source-guard mode This command sets the source-guard learning mode to search for addresses in the

ACL binding table or the MAC address binding table. Use the no form to restore thedefault setting.
Syntax
ip source-guard mode {acl | mac}
no ip source-guard mode
mode - Specifies the learning mode.
acl - Searches for addresses in the ACL binding table.
mac - Searches for addresses in the MAC address binding table.
Default Setting
ACL
Command Mode
Interface Configuration (Ethernet)
Command Usage
There are two modes for the filtering table:
 ACL - IP traffic will be forwarded if it passes the checking process in the ACL

mode binding table.

 MAC - A MAC entry will be added in MAC address table if IP traffic passes thechecking process in MAC mode binding table.

ExampleThis command sets the binding table mode for the specified interface to MAC
mode:
Console(config)#interface ethernet 1/5
Console(config-if)#ip source-guard mode mac
Console(config-if)#– 358 –

Chapter 9 | General Security Measures
IPv4 Source Guard

clear ip source-guard This command clears source-guard binding table entries from RAM.
binding blocked
Syntaxclear ip source-guard binding blocked
Command Mode
Privileged Exec
Command Usage
When IP Source-Guard detects an invalid packet it creates a blocked record. These
records can be viewed using the show ip source-guard binding blocked command.
A maximum of 512 blocked records can be stored before the switch overwrites theoldest record with new blocked records. Use the clear ip source-guard binding
blocked command to clear this table.
ExampleThis command clears the blocked record table.
Console(config)#clear ip source-guard binding blocked
Console(config)#show ip source-guard This command shows whether source guard is enabled or disabled on eachinterface.

Command Mode
Privileged Exec
ExampleConsole#show ip source-guardInterface--------Eth 1/1
Eth 1/2
Eth 1/3
Eth 1/4
Eth
1/5
.
.
.

Filter-type----------DISABLED
DISABLEDDISABLEDDISABLEDDISABLED

Filter-table-----------ACL
ACL
ACL
ACL
ACL

– 359 –ACL Table
Max-binding----------55555MAC Table
Max-binding----------1024
1024
1024
1024
1024

Chapter 9 | General Security Measures
IPv4 Source Guard

show ip source-guard This command shows the source guard binding table.
binding
Syntaxshow ip source-guard binding [dhcp-snooping | static [acl | mac] |blocked [vlan vlan-id | interface interface]dhcp-snooping - Shows dynamic entries configured with DHCP Snooping
commands (see page 329)
static - Shows static entries configured with the ip source-guard binding
command.
acl - Shows static entries in the ACL binding table.
mac - Shows static entries in the MAC address binding table.
blocked - Shows MAC addresses which have been blocked by IP Source
Guard.
vlan-id - ID of a configured VLAN (Range: 1-4094)
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show ip source-guard binding
MAC Address
IP Address
Type
VLAN
Interface----------------- --------------- -------------- --------- --------00-10-b5-f4-d0-01 10.2.44.96
static-acl
1 Eth 1/1
Console#– 360 –

Chapter 9 | General Security Measures
IPv6 Source Guard

IPv6 Source Guard
IPv6 Source Guard is a security feature that filters IPv6 traffic on non-routed, Layer 2
network interfaces based on manually configured entries in the IPv6 Source Guard
table, or dynamic entries in the Neighbor Discovery Snooping table or DHCPv6
Snooping table when either snooping protocol is enabled (see “DHCPv6 Snooping”
on page 343). IPv6 source guard can be used to prevent traffic attacks caused whena host tries to use the IPv6 address of a neighbor to access the network. This section
describes commands used to configure IPv6 Source Guard.
Table 68: IPv6 Source Guard Commands
CommandFunctionMode

ipv6 source-guard binding

Adds a static address to the source-guard binding table

GC

ipv6 source-guard

Configures the switch to filter inbound traffic based on
source IP addressIC

ipv6 source-guard maxbinding

Sets the maximum number of entries that can be bound IC
to an interface

show ipv6 source-guard

Shows whether source guard is enabled or disabled oneach interface

PEshow ipv6 source-guard
binding

Shows the source guard binding tablePE

ipv6 source-guard This command adds a static address to the source-guard binding table. Use the nobinding form to remove a static entry.
Syntaxipv6 source-guard binding mac-address vlan vlan-id ipv6-addressinterface interface
no ipv6 source-guard binding mac-address ipv6-address
mac-address - A valid unicast MAC address.
vlan-id - ID of a configured VLAN (Range: 1-4094)
ipv6-address - Corresponding IPv6 address. This address must be enteredaccording to RFC 2373 “IPv6 Addressing Architecture,” using 8 colonseparated 16-bit hexadecimal values. One double colon may be used in theaddress to indicate the appropriate number of zeros required to fill the
undefined fields.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)– 361 –

Chapter 9 | General Security Measures
IPv6 Source Guard
Default Setting
No configured entries
Command Mode
Global Configuration
Command Usage Table entries include an associated MAC address, IPv6 global unicast address,
entry type (Static-IPv6-SG-Binding, Dynamic-ND-Snooping, Dynamic-DHCPv6Snooping), VLAN identifier, and port identifier.
 Traffic filtering is based only on the source IPv6 address, VLAN ID, and port

number.

 All static entries are configured with an infinite lease time, which is indicatedwith a value of zero by the show ipv6 source-guard command.

 When source guard is enabled, traffic is filtered based upon dynamic entries

learned via ND snooping, DHCPv6 snooping, or static addresses configured in
the source guard binding table with this command.

 An entry with same MAC address and a different VLAN ID cannot be added tothe binding table.

 Static bindings are processed as follows:

If there is no entry with same and MAC address and IPv6 address, a newentry is added to binding table using static IPv6 source guard binding.



If there is an entry with same MAC address and IPv6 address, and the typeof entry is static IPv6 source guard binding, then the new entry will replace
the old one.



If there is an entry with same MAC address and IPv6 address, and the typeof the entry is either a dynamic ND snooping binding or DHCPv6 snooping
binding, then the new entry will replace the old one and the entry type will
be changed to static IPv6 source guard binding.

Only unicast addresses are accepted for static bindings.

ExampleThis example configures a static source-guard binding on port 5.
Console(config)#ipv6 source-guard binding 00-ab-11-cd-23-45 vlan 1 2001::1
interface ethernet 1/5
Console(config)#

Related Commands
ipv6 source-guard (363)– 362 –

Chapter 9 | General Security Measures
IPv6 Source Guard

ipv6 dhcp snooping (344)
ipv6 dhcp snooping vlan (348)

ipv6 source-guard This command configures the switch to filter inbound traffic based on the source IP
address stored in the binding table. Use the no form to disable this function.
Syntaxipv6 source-guard sip
no ipv6 source-guard
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
Command Usage Source guard is used to filter traffic on an insecure port which receives
messages from outside the network or fire wall, and therefore may be subject
to traffic attacks caused by a host trying to use the IP address of a neighbor.
 This command checks the VLAN ID, IPv6 global unicast source IP address, andport number against all entries in the binding table. Use the no ipv6 source
guard command to disable this function on the selected port.

 After IPv6 source guard is enabled on an interface, the switch initially blocks all

IPv6 traffic received on that interface, except for ND packets allowed by ND
snooping and DHCPv6 packets allowed by DHCPv6 snooping. A port access
control list (ACL) is applied to the interface. Traffic is then filtered based upon
dynamic entries learned via ND snooping or DHCPv6 snooping, or static
addresses configured in the source guard binding table. The port allows only
IPv6 traffic with a matching entry in the binding table and denies all other IPv6
traffic.

 Table entries include a MAC address, IPv6 global unicast address, entry type

(Static-IPv6-SG-Binding, Dynamic-ND-Snooping, Dynamic-DHCPv6-Snooping),
VLAN identifier, and port identifier.

 Static addresses entered in the source guard binding table with the ipv6

source-guard binding command are automatically configured with an infinite
lease time. Dynamic entries learned via DHCPv6 snooping are configured by
the DHCPv6 server itself.

 If IPv6 source guard is enabled, an inbound packet’s source IPv6 address will bechecked against the binding table. If no matching entry is found, the packet
will be dropped.

– 363 –

Chapter 9 | General Security Measures
IPv6 Source Guard
 Filtering rules are implemented as follows:

If ND snooping and DHCPv6 snooping are disabled, IPv6 source guard will
check the VLAN ID, source IPv6 address, and port number. If a matchingentry is found in the binding table and the entry type is static IPv6 source
guard binding, the packet will be forwarded.



If ND snooping or DHCPv6 snooping is enabled, IPv6 source guard will
check the VLAN ID, source IP address, and port number. If a matching entry
is found in the binding table and the entry type is static IPv6 source guard
binding, dynamic ND snooping binding, or dynamic DHCPv6 snooping
binding, the packet will be forwarded.



If IPv6 source guard is enabled on an interface for which IPv6 source
bindings (dynamically learned via ND snooping or DHCPv6 snooping, or
manually configured) are not yet configured, the switch will drop all IPv6
traffic on that port, except for ND packets and DHCPv6 packets allowed by
DHCPv6 snooping.

Only IPv6 global unicast addresses are accepted for static bindings.

ExampleThis example enables IP source guard on port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#ipv6 source-guard sip
Console(config-if)#

Related Commands
ipv6 source-guard binding (361)
ipv6 dhcp snooping (344)
ipv6 dhcp snooping vlan (348)

ipv6 source-guard This command sets the maximum number of entries that can be bound to an
max-binding interface. Use the no form to restore the default setting.
Syntaxipv6 source-guard max-binding number
no ipv6 source-guard max-binding
number - The maximum number of IPv6 addresses that can be mapped to
an interface in the binding table. (Range: 1-5)
Default Setting
5– 364 –

Chapter 9 | General Security Measures
IPv6 Source Guard

Command Mode
Interface Configuration (Ethernet)
Command Usage This command sets the maximum number of address entries that can bemapped to an interface in the binding table, including both dynamic entries
discovered by ND snooping, DHCPv6 snooping, and static entries set by theipv6 source-guard command.
 IPv6 source guard maximum bindings must be set to a value higher than

DHCPv6 snooping maximum bindings and ND snooping maximum bindings.

 If IPv6 source guard, ND snooping, and DHCPv6 snooping are enabled on aport, the dynamic bindings used by ND snooping, DHCPv6 snooping, and IPv6
source guard static bindings cannot exceed the maximum allowed bindings set
by the ipv6 source-guard max-binding command. In other words, no new
entries will be added to the IPv6 source guard binding table.

 If IPv6 source guard is enabled on a port, and the maximum number of allowedbindings is changed to a lower value, precedence is given to deleting entries
learned through DHCPv6 snooping, ND snooping, and then manuallyconfigured IPv6 source guard static bindings, until the number of entries in thebinding table reaches the newly configured maximum number of allowedbindings.

ExampleThis example sets the maximum number of allowed entries in the binding table forport 5 to one entry.
Console(config)#interface ethernet 1/5
Console(config-if)#ipv6 source-guard max-binding 1
Console(config-if)#show ipv6 source- This command shows whether IPv6 source guard is enabled or disabled on eachguard interface, and the maximum allowed bindings.
Command Mode
Privileged Exec
ExampleConsole#show ipv6 source-guard
ipv6 permit link-local status: disable
Interface--------Eth 1/1
Eth 1/2
Eth 1/3
Eth 1/4

Filter-type----------Disabled
Disabled
Disabled
Disabled

Max-binding-----------– 365 –

55
5
5

Chapter 9 | General Security Measures
ARP Inspection
Eth 1/5
Eth 1/6.
.
.

SIP
Disabled

1
5

show ipv6 source- This command shows the IPv6 source guard binding table.
guard binding
Syntaxshow ipv6 source-guard binding [dynamic | static]
dynamic - Shows dynamic entries configured with ND Snooping or
DHCPv6 Snooping commands (see page 343)
static - Shows static entries configured with the ipv6 source-guard binding
command.
Command Mode
Privileged Exec
ExampleConsole#show ipv6 source-guard binding
DHCPV6SNP:DHCP - Stateful address
NDSNP:ND - Stateless address
STA - Static IPv6 source guard binding
MAC Address
IPv6 Address
VLAN Interface Type-------------- --------------------------------------- ---- --------- ---00AB-11CD-2345
2001::1
1 Eth 1/5
STA
Console#ARP Inspection
ARP Inspection validates the MAC-to-IP address bindings in Address Resolution
Protocol (ARP) packets. It protects against ARP traffic with invalid address bindings,
which forms the basis for certain “man-in-the-middle” attacks. This is accomplishedby intercepting all ARP requests and responses and verifying each of these packets
before the local ARP cache is updated or the packet is forwarded to the appropriate
destination, dropping any invalid ARP packets.
ARP Inspection determines the validity of an ARP packet based on valid IP-to-MAC
address bindings stored in a trusted database – the DHCP snooping binding
database. ARP Inspection can also validate ARP packets against user-configured
ARP access control lists (ACLs) for hosts with statically configured IP addresses.

– 366 –

Chapter 9 | General Security Measures
ARP Inspection

This section describes commands used to configure ARP Inspection.
Table 69: ARP Inspection Commands
CommandFunctionMode

ip arp inspection

Enables ARP Inspection globally on the switchGC

ip arp inspection filter

Specifies an ARP ACL to apply to one or more VLANs

GC

ip arp inspection log-buffer
logs

Sets the maximum number of entries saved in a log
message, and the rate at these messages are sentGC

ip arp inspection validate

Specifies additional validation of address components in GC
an ARP packet

ip arp inspection vlan

Enables ARP Inspection for a specified VLAN or range of
VLANs

GC

ip arp inspection limit

Sets a rate limit for the ARP packets received on a portIC

ip arp inspection trust

Sets a port as trusted, and thus exempted from ARP
Inspection

ICshow ip arp inspection
configuration

Displays the global configuration settings for ARP
Inspection

PEshow ip arp inspection
interfaceShows the trust status and inspection rate limit for ports PE

show ip arp inspection log

Shows information about entries stored in the log,
including the associated VLAN, port, and addresscomponents

PEshow ip arp inspection
statistics

Shows statistics about the number of ARP packets
processed, or dropped for various reasons

PEshow ip arp inspection vlan

Shows configuration setting for VLANs, including ARP
Inspection status, the ARP ACL name, and if the DHCP
Snooping database is used after ACL validation iscompletedPE

ip arp inspection This command enables ARP Inspection globally on the switch. Use the no form todisable this function.
Syntax[no] ip arp inspection
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When ARP Inspection is enabled globally with this command, it becomes active
only on those VLANs where it has been enabled with the ip arp inspection vlancommand.

– 367 –

Chapter 9 | General Security Measures
ARP Inspection
 When ARP Inspection is enabled globally and enabled on selected VLANs, all

ARP request and reply packets on those VLANs are redirected to the CPU andtheir switching is handled by the ARP Inspection engine.

 When ARP Inspection is disabled globally, it becomes inactive for all VLANs,

including those where ARP Inspection is enabled.

 When ARP Inspection is disabled, all ARP request and reply packets bypass the

ARP Inspection engine and their manner of switching matches that of all otherpackets.

 Disabling and then re-enabling global ARP Inspection will not affect the ARP

Inspection configuration for any VLANs.

 When ARP Inspection is disabled globally, it is still possible to configure ARP

Inspection for individual VLANs. These configuration changes will only become
active after ARP Inspection is globally enabled again.

ExampleConsole(config)#ip arp inspection
Console(config)#

ip arp inspection filter This command specifies an ARP ACL to apply to one or more VLANs. Use the noform to remove an ACL binding. Use the no form to remove an ACL binding.
Syntax
ip arp inspection filter arp-acl-name vlan {vlan-id | vlan-range} [static]
no ip arp inspection filter arp-acl-name vlan {vlan-id | vlan-range}
arp-acl-name - Name of an ARP ACL. (Maximum length: 16 characters)vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,or a random group of VLANs with each entry separated by a comma.
static - ARP packets are only validated against the specified ACL, addressbindings in the DHCP snooping database is not checked.
Default Setting
ARP ACLs are not bound to any VLAN
Static mode is not enabled
Command Mode
Global Configuration– 368 –

Chapter 9 | General Security Measures
ARP Inspection

Command Usage ARP ACLs are configured with the commands described under “ARP ACLs” onpage 406.
 If static mode is enabled, the switch compares ARP packets to the specified ARP

ACLs. Packets matching an IP-to-MAC address binding in a permit or deny rule
are processed accordingly. Packets not matching any of the ACL rules are
dropped. Address bindings in the DHCP snooping database are not checked.

 If static mode is not enabled, packets are first validated against the specified

ARP ACL. Packets matching a deny rule are dropped. All remaining packets arevalidated against the address bindings in the DHCP snooping database.

ExampleConsole(config)#ip arp inspection filter sales vlan 1
Console(config)#

ip arp inspection This command sets the maximum number of entries saved in a log message, andlog-buffer logs the rate at which these messages are sent. Use the no form to restore the default
settings.
Syntax
ip arp inspection log-buffer logs message-number interval seconds
no ip arp inspection log-buffer logs
message-number - The maximum number of entries saved in a log message.
(Range: 0-256, where 0 means no events are saved and no messages sent)
seconds - The interval at which log messages are sent. (Range: 0-86400)
Default Setting
Message Number: 20
Interval: 10 seconds
Command Mode
Global Configuration
Command Usage ARP Inspection must be enabled with the ip arp inspection command before
this command will be accepted by the switch.
 By default, logging is active for ARP Inspection, and cannot be disabled.
 When the switch drops a packet, it places an entry in the log buffer. Each entry

contains flow information, such as the receiving VLAN, the port number, thesource and destination IP addresses, and the source and destination MAC
addresses.

– 369 –

Chapter 9 | General Security Measures
ARP Inspection
 If multiple, identical invalid ARP packets are received consecutively on thesame VLAN, then the logging facility will only generate one entry in the log
buffer and one corresponding system message.

 The maximum number of entries that can be stored in the log buffer isdetermined by the message-number parameter. If the log buffer fills up before amessage is sent, the oldest entry will be replaced with the newest one.

 The switch generates a system message on a rate-controlled basis determinedby the seconds values. After the system message is generated, all entries arecleared from the log buffer.

ExampleConsole(config)#ip arp inspection log-buffer logs 1 interval 10
Console(config)#

ip arp inspection This command specifies additional validation of address components in an ARPvalidate packet. Use the no form to restore the default setting.
Syntax
ip arp inspection validate{dst-mac [ip [allow-zeros] [src-mac]] |ip [allow-zeros] [src-mac] | src-mac}
no ip arp inspection validate
dst-mac - Checks the destination MAC address in the Ethernet header
against the target MAC address in the ARP body. This check is performed
for ARP responses. When enabled, packets with different MAC addresses
are classified as invalid and are dropped.
ip - Checks the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are checked in all ARP requests and responses, whiletarget IP addresses are checked only in ARP responses.
allow-zeros - Allows sender IP address to be 0.0.0.0.
src-mac - Checks the source MAC address in the Ethernet header against
the sender MAC address in the ARP body. This check is performed on both
ARP requests and responses. When enabled, packets with different MAC
addresses are classified as invalid and are dropped.
Default Setting
No additional validation is performed
Command Mode
Global Configuration– 370 –

Chapter 9 | General Security Measures
ARP Inspection

Command Usage
By default, ARP Inspection only checks the IP-to-MAC address bindings specified inan ARP ACL or in the DHCP Snooping database.
ExampleConsole(config)#ip arp inspection validate dst-mac
Console(config)#

ip arp inspection vlan This command enables ARP Inspection for a specified VLAN or range of VLANs. Use
the no form to disable this function.
Syntax[no] ip arp inspection vlan {vlan-id | vlan-range}vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,or a random group of VLANs with each entry separated by a comma.
Default Setting
Disabled on all VLANs
Command Mode
Global Configuration
Command Usage When ARP Inspection is enabled globally with the ip arp inspection command,
it becomes active only on those VLANs where it has been enabled with thiscommand.
 When ARP Inspection is enabled globally and enabled on selected VLANs, all

ARP request and reply packets on those VLANs are redirected to the CPU andtheir switching is handled by the ARP Inspection engine.

 When ARP Inspection is disabled globally, it becomes inactive for all VLANs,

including those where ARP Inspection is enabled.

 When ARP Inspection is disabled, all ARP request and reply packets bypass the

ARP Inspection engine and their manner of switching matches that of all otherpackets.

 Disabling and then re-enabling global ARP Inspection will not affect the ARP

Inspection configuration for any VLANs.

 When ARP Inspection is disabled globally, it is still possible to configure ARP

Inspection for individual VLANs. These configuration changes will only become
active after ARP Inspection is globally enabled again.

– 371 –

Chapter 9 | General Security Measures
ARP Inspection
ExampleConsole(config)#ip arp inspection vlan 1,2
Console(config)#

ip arp inspection limit This command sets a rate limit for the ARP packets received on a port. Use the noform to restore the default setting.
Syntax
ip arp inspection limit {rate pps | none}
no ip arp inspection limit
pps - The maximum number of ARP packets that can be processed by the
CPU per second on trusted or untrusted ports. (Range: 0-750, where 0means that no ARP packets can be forwarded)
none - There is no limit on the number of ARP packets that can beprocessed by the CPU.
Default Setting
15
Command Mode
Interface Configuration (Port, Static Aggregation)
Command Usage This command applies to both trusted and untrusted ports.
 When the rate of incoming ARP packets exceeds the configured limit, theswitch drops all ARP packets in excess of the limit.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip arp inspection limit rate 150
Console(config-if)#

ip arp inspection trust This command sets a port as trusted, and thus exempted from ARP Inspection. Use
the no form to restore the default setting.
Syntax[no] ip arp inspection trust
Default Setting
Untrusted– 372 –

Chapter 9 | General Security Measures
ARP Inspection

Command Mode
Interface Configuration (Port, Static Aggregation)
Command Usage
Packets arriving on untrusted ports are subject to any configured ARP Inspection
and additional validation checks. Packets arriving on trusted ports bypass all ofthese checks, and are forwarded according to normal switching rules.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip arp inspection trust
Console(config-if)#show ip arp inspection This command displays the global configuration settings for ARP Inspection.
configuration
Command Mode
Privileged Exec
ExampleConsole#show ip arp inspection configuration
ARP Inspection Global Information:
Global IP ARP Inspection Status : disabled
Log Message Interval: 1 s
Log Message Number: 5
Need Additional Validation(s): YesAdditional Validation Type
: Destination MAC address
Console#show ip arp inspection This command shows the trust status and ARP Inspection rate limit for ports.
interface
Syntaxshow ip arp inspection interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec

– 373 –

Chapter 9 | General Security Measures
ARP Inspection
ExampleConsole#show ip arp inspection interface ethernet 1/1
Port Number------------Eth 1/1
Console#Trust Status-------------------Trusted

Rate Limit (pps)-----------------------------150

show ip arp inspection This command shows information about entries stored in the log, including thelog associated VLAN, port, and address components.
Command Mode
Privileged Exec
ExampleConsole#show ip arp inspection log
Total log entries number is 1
Num VLAN Port Src IP Address--- ---- ---- -------------1
1
11 192.168.2.2
Console#Dst IP Address-------------192.168.2.1

Src MAC Address Dst MAC Address--------------- -------------00-04-E2-A0-E2-7C FF-FF-FF-FF-FF-FF

show ip arp inspection This command shows statistics about the number of ARP packets processed, or
statistics dropped for various reasons.
Command Mode
Privileged Exec
ExampleConsole#show ip arp inspection statistics
ARP packets received: 150
ARP packets dropped due to rate limt
: 5
Total ARP packets processed by ARP Inspection: 150
ARP packets dropped by additional validation (source MAC address): 0
ARP packets dropped by additional validation (destination MAC address): 0
ARP packets dropped by additional validation (IP address): 0
ARP packets dropped by ARP ACLs
: 0
ARP packets dropped by DHCP snooping: 0
Console#– 374 –

Chapter 9 | General Security Measures

Denial of Service Protection

show ip arp inspection This command shows the configuration settings for VLANs, including ARP
vlan Inspection status, the ARP ACL name, and if the DHCP Snooping database is used
after ARP ACL validation is completed.
Syntaxshow ip arp inspection vlan [vlan-id | vlan-range]vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,or a random group of VLANs with each entry separated by a comma.
Command Mode
Privileged Exec
Command UsageEnter this command to display the configuration settings for all VLANs, or display
the settings for a specific VLAN by entering the VLAN identifier.
ExampleConsole#show ip arp inspection vlan 1
VLAN ID-------1
Console#DAI Status--------------disabled

ACL Name-------------------sales

ACL Status-------------------static

Denial of Service Protection
A denial-of-service attack (DoS attack) is an attempt to block the services provided
by a computer or network resource. This kind of attack tries to prevent an Internet
site or service from functioning efficiently or at all. In general, DoS attacks are
implemented by either forcing the target to reset, to consume most of its resources
so that it can no longer provide its intended service, or to obstruct thecommunication media between the intended users and the target so that they canno longer communicate adequately.
This section describes commands used to protect against DoS attacks.
Table 70: DoS Protection Commands
CommandFunctionMode

dos-protection echo-chargenProtects against DoS echo/chargen attacksGC

dos-protection smurf

Protects against DoS smurf attacksGC

dos-protection tcp-flooding

Protects against DoS TCP-flooding attacksGC

dos-protection tcp-null-scanProtects against DoS TCP-null-scan attacksGC

dos-protection tcp-syn-fin-scanProtects against DoS TCP-SYN/FIN-scan attacks

GC– 375 –

Chapter 9 | General Security Measures
Denial of Service Protection
Table 70: DoS Protection Commands (Continued)
CommandFunctionMode

dos-protection tcp-udp-port-zeroProtects against attacks which set the Layer 4 source GC
or destination port to zero

dos-protection tcp-xmas-scanProtects against DoS TCP-XMAS-scan attacksGC

dos-protection udp-flooding

Protects against DoS UDP-flooding attacksGC

dos-protection win-nuke

Protects against DoS WinNuke attacks

GC

show dos-protection

Shows the configuration settings for DoS protection PE

dos-protection This command protects against DoS echo/chargen attacks in which the echo
echo-chargen service repeats anything sent to it, and the chargen (character generator) service

generates a continuous stream of data. When used together, they create an infinite
loop and result in a denial-of-service. Use the no form without the bit rate
parameter to disable this feature, or with the bit rate parameter to restore thedefautl rate limit..
Syntaxdos-protection echo-chargen [bit-rate-in-kilo rate]
no dos-protection echo-chargen [bit-rate-in-kilo]rate – Maximum allowed rate. (Range: 64-2000 kbits/second)

Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration
ExampleConsole(config)#dos-protection echo-chargen bit-rate-in-kilo 65
Console(config)#

dos-protection smurf This command protects against DoS smurf attacks in which a perpetrator generates
a large amount of spoofed ICMP Echo Request traffic to the broadcast destination
IP address (255.255.255.255), all of which uses a spoofed source address of theintended victim. The victim should crash due to the many interrupts required tosend ICMP Echo response packets. Use the no form to disable this feature.
Syntax[no] dos-protection smurf
Default Setting
Disabled– 376 –

Chapter 9 | General Security Measures

Denial of Service Protection

Command Mode
Global Configuration
ExampleConsole(config)#dos-protection smurf
Console(config)#

dos-protection This command protects against DoS TCP-flooding attacks in which a perpetrator
tcp-flooding sends a succession of TCP SYN requests (with or without a spoofed-Source IP) to atarget and never returns ACK packets. These half-open connections will bindresources on the target, and no new connections can be made, resulting in a denialof service. Use the no form without the bit rate parameter to disable this feature, orwith the bit rate parameter to restore the default rate limit.
Syntaxdos-protection tcp-flooding [bit-rate-in-kilo rate]
no dos-protection tcp-flooding [bit-rate-in-kilo]rate – Maximum allowed rate. (Range: 64-2000 kbits/second)

Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration
ExampleConsole(config)#dos-protection tcp-flooding bit-rate-in-kilo 65
Console(config)#

dos-protection This command protects against DoS TCP-null-scan attacks in which a TCP NULL
tcp-null-scan scan message is used to identify listening TCP ports. The scan uses a series of

strangely configured TCP packets which contain a sequence number of 0 and noflags. If the target's TCP port is closed, the target replies with a TCP RST (reset)
packet. If the target TCP port is open, it simply discards the TCP NULL scan. Use theno form to disable this feature.
Syntax[no] dos-protection tcp-null-scanDefault Setting
Disabled– 377 –

Chapter 9 | General Security Measures
Denial of Service Protection
Command Mode
Global Configuration
Command Usage
In these packets, all TCP flags are 0.
ExampleConsole(config)#dos-protection tcp-null-scan
Console(config)#

dos-protection This command protects against DoS TCP-SYN/FIN-scan attacks in which a TCP SYN/
tcp-syn-fin-scan FIN scan message is used to identify listening TCP ports. The scan uses a series of
strangely configured TCP packets which contain SYN (synchronize) and FIN (finish)flags. If the target's TCP port is closed, the target replies with a TCP RST (reset)
packet. If the target TCP port is open, it simply discards the TCP SYN FIN scan. Use
the no form to disable this feature.
Syntax[no] dos-protection tcp-syn-fin-scanDefault Setting
Disabled
Command Mode
Global Configuration
ExampleConsole(config)#dos-protection tcp-syn-fin-scan
Console(config)#

dos-protection This command protects against DoS attacks in which the TCP or UDP source port or
tcp-udp-port-zero destination port is set to zero. This technique may be used as a form of DoS attack,or it may just indicate a problem with the source device. When this command isenabled, the switch will drop these packets. Use the no form to restore the default
setting.
Syntax[no] dos-protection tcp-udp-port-zeroDefault Setting
Disabled
Command Mode
Global Configuration– 378 –

Chapter 9 | General Security Measures

Denial of Service Protection

ExampleConsole(config)#dos-protection tcp-udp-port-zero
Console(config)#

dos-protection This command protects against DoS TCP-xmas-scan in which a so-called TCP XMAS
tcp-xmas-scan scan message is used to identify listening TCP ports. This scan uses a series of

strangely configured TCP packets which contain a sequence number of 0 and the
URG, PSH and FIN flags. If the target's TCP port is closed, the target replies with a
TCP RST packet. If the target TCP port is open, it simply discards the TCP XMAS scan.
Use the no form to disable this feature.
Syntax[no] dos-protection tcp-xmas-scanDefault Setting
Disabled
Command Mode
Global Configuration
ExampleConsole(config)#dos-protection tcp-xmas-scan
Console(config)#

dos-protection This command protects against DoS UDP-flooding attacks in which a perpetrator
udp-flooding sends a large number of UDP packets (with or without a spoofed-Source IP) to

random ports on a remote host. The target will determine that application islistening at that port, and reply with an ICMP Destination Unreachable packet. It
will be forced to send many ICMP packets, eventually leading it to be unreachable
by other clients. Use the no form without the bit rate parameter to disable thisfeature, or with the bit rate parameter to restore the default rate limit.
Syntaxdos-protection udp-flooding [bit-rate-in-kilo rate]
no dos-protection udp-flooding [bit-rate-in-kilo]rate – Maximum allowed rate. (Range: 64-2000 kbits/second)

Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration– 379 –

Chapter 9 | General Security Measures
Denial of Service Protection
ExampleConsole(config)#dos-protection udp-flooding bit-rate-in-kilo 65
Console(config)#

dos-protection This command protects against DoS WinNuke attacks in which affected thewin-nuke Microsoft Windows 3.1x/95/NT operating systems. In this type of attack, theperpetrator sends the string of OOB out-of-band (OOB) packets contained a TCP
URG flag to the target computer on TCP port 139 (NetBIOS), casing it to lock up anddisplay a “Blue Screen of Death.” This did not cause any damage to, or change dataon, the computer’s hard disk, but any unsaved data would be lost. Microsoft madepatches to prevent the WinNuke attack, but the OOB packets still put the service ina tight loop that consumed all available CPU time. Use the no form without the bit
rate parameter to disable this feature, or with the bit rate parameter to restore thedefault rate limit.
Syntaxdos-protection win-nuke [bit-rate-in-kilo rate]
no dos-protection win-nuke [bit-rate-in-kilo]rate – Maximum allowed rate. (Range: 64-2000 kbits/second)

Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration
ExampleConsole(config)#dos-protection win-nuke bit-rate-in-kilo 65
Console(config)#show dos-protection This command shows the configuration settings for the DoS protection commands.
Command Mode
Privileged Exec
ExampleConsole#show dos-protection
Global DoS Protection:
Echo/Chargen Attack: Disabled, 1000 kilobits per second
Smurf Attack: Enabled
TCP Flooding Attack: Disabled, 1000 kilobits per second
TCP Null Scan
: Enabled
TCP SYN/FIN Scan
: Enabled
TCP/UDP Packets with Port 0 : Enabled– 380 –

Chapter 9 | General Security Measures
Port-based Traffic Segmentation

TCP XMAS Scan
UDP Flooding Attack
WinNuke Attack
Console#: Enabled: Disabled, 1000 kilobits per second: Disabled, 1000 kilobits per second

Port-based Traffic Segmentation
If tighter security is required for passing traffic from different clients throughdownlink ports on the local network and over uplink ports to the service provider,
port-based traffic segmentation can be used to isolate traffic for individual clients.
Traffic belonging to each client is isolated to the allocated downlink ports. But theswitch can be configured to either isolate traffic passing across a client’s allocateduplink ports from the uplink ports assigned to other clients, or to forward traffic
through the uplink ports used by other clients, allowing different clients to shareaccess to their uplink ports where security is less likely to be compromised.
Table 71: Commands for Configuring Traffic Segmentation
CommandFunctionModetraffic-segmentation

Enables traffic segmentationGC

traffic-segmentation session

Creates a client session

GC

traffic-segmentation uplink/
downlink

Configures uplink/downlink ports for client sessions

GC

traffic-segmentation
uplink-to-uplink

Specifies whether or not traffic can be forwarded
between uplink ports assigned to different client
sessionsGC

show traffic-segmentation

Displays the configured traffic segmentsPEtraffic-segmentation This command enables traffic segmentation. Use the no form to disable traffic
segmentation.
Syntax[no] traffic-segmentation
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Traffic segmentation provides port-based security and isolation between ports
within the VLAN. Data traffic on the downlink ports can only be forwarded to,
and from, the designated uplink port(s). Data cannot pass between downlink– 381 –

Chapter 9 | General Security Measures
Port-based Traffic Segmentation
ports in the same segmented group, nor to ports which do not belong to thesame group.
 Traffic segmentation and normal VLANs can exist simultaneously within thesame switch. Traffic may pass freely between uplink ports in segmented groups
and ports in normal VLANs.

 When traffic segmentation is enabled, the forwarding state for the uplink anddownlink ports assigned to different client sessions is shown below.
Table 72: Traffic Segmentation Forwarding
Destination
SourceSession #1
Downlinks

Session #1
Uplinks

Session #2
Downlinks

Session #2
Uplinks

NormalPorts

Session #1
Downlink Ports

Blocking

Forwarding

Blocking

Blocking

Blocking

Session #1
Uplink Ports

Forwarding

Forwarding

Blocking

Blocking/
Forwarding*

Forwarding

Session #2
Downlink Ports

Blocking

Blocking

Blocking

Forwarding

Blocking

Session #2
Uplink Ports

Blocking

Blocking/
Forwarding*

Forwarding

Forwarding

Forwarding

Normal Ports

Forwarding

Forwarding

Forwarding

Forwarding

Forwarding*

The forwarding state for uplink-to-uplink ports is configured by the trafficsegmentation uplink-to-uplink command.

 When traffic segmentation is disabled, all ports operate in normal forwarding

mode based on the settings specified by other functions such as VLANs andspanning tree protocol.

 Enter the traffic-segmentation command without any parameters to enable

traffic segmentation. Then set the interface members for segmented groups
using the traffic-segmentation uplink/downlink command.

 Enter no traffic-segmentation to disable traffic segmentation and clear theconfiguration settings for segmented groups.

ExampleThis example enables traffic segmentation globally on the switch.
Console(config)#traffic-segmentation
Console(config)#– 382 –

Chapter 9 | General Security Measures
Port-based Traffic Segmentation

traffic-segmentation This command creates a traffic-segmentation client session. Use the no form tosession remove a client session.
Syntax[no] traffic-segmentation session session-id
session-id – Traffic segmentation session. (Range: 1-4)
Default Setting
None
Command Mode
Global Configuration
Command Usage Use this command to create a new traffic-segmentation client session.
 Using the no form of this command will remove any assigned uplink or

downlink ports, restoring these interfaces to normal operating mode.

ExampleConsole(config)#traffic-segmentation session 1
Console(config)#

traffic-segmentation This command configures the uplink and down-link ports for a segmented group of
uplink/downlink ports. Use the no form to remove a port from the segmented group.
Syntax[no] traffic-segmentation [session session-id] {uplink interface-list[downlink interface-list] | downlink interface-list}
session-id – Traffic segmentation session. (Range: 1-4)
uplink – Specifies an uplink interface.
downlink – Specifies a downlink interface.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
Session 1 if not defined
No segmented port groups are defined.

– 383 –

Chapter 9 | General Security Measures
Port-based Traffic Segmentation
Command Mode
Global Configuration
Command Usage A port cannot be configured in both an uplink and downlink list.
 A port can only be assigned to one traffic-segmentation session.
 When specifying an uplink or downlink, a list of ports may be entered by usinga hyphen or comma in the port field. Note that lists are not supported for thechannel-id field.

 A downlink port can only communicate with an uplink port in the same session.

Therefore, if an uplink port is not configured for a session, the assigned
downlink ports will not be able to communicate with any other ports.

 If a downlink port is not configured for the session, the assigned uplink ports

will operate as normal ports.

ExampleThis example enables traffic segmentation, and then sets port 10 as the uplink andports 5-8 as downlinks.
Console(config)#traffic-segmentation
Console(config)#traffic-segmentation uplink ethernet 1/10
downlink ethernet 1/5-8
Console(config)#

traffic-segmentation This command specifies whether or not traffic can be forwarded between uplink
uplink-to-uplink ports assigned to different client sessions. Use the no form to restore the default.
Syntaxtraffic-segmentation uplink-to-uplink {blocking | forwarding}no traffic-segmentation uplink-to-uplinkblocking – Blocks traffic between uplink ports assigned to different
sessions.
forwarding – Forwards traffic between uplink ports assigned to different
sessions.
Default Setting
Blocking
Command Mode
Global Configuration– 384 –

Chapter 9 | General Security Measures
Port-based Traffic Segmentation

ExampleThis example enables forwarding of traffic between uplink ports assigned todifferent client sessions.
Console(config)#traffic-segmentation uplink-to-uplink forwarding
Console(config)#show This command displays the configured traffic segments.
traffic-segmentation
Syntaxshow traffic-segmentation [session session-id]
session-id – Traffic segmentation session. (Range: 1-4)
Command Mode
Privileged Exec
ExampleConsole#show traffic-segmentation session 1
Traffic segmentation Status :Uplink-to-Uplink Mode:

EnabledForwarding

Session
Uplink Ports
Downlink Ports--------- ------------------------------ ----------------------------1
Ethernet 1/1
Ethernet 1/2
Ethernet 1/3
Ethernet 1/4
Console#– 385 –

Chapter 9 | General Security Measures
Port-based Traffic Segmentation– 386 –

10

Access Control Lists

Access Control Lists (ACL) provide packet filtering for IPv4 frames (based on
address, protocol, Layer 4 protocol port number or TCP control code), IPv6 frames(based on address, DSCP traffic class, or next header type), or any frames (based on
MAC address or Ethernet type). To filter packets, first create an access list, add therequired rules, and then bind the list to a specific port. This section describes theAccess Control List commands.
Table 73: Access Control List Commands
Command Group

Function

IPv4 ACLs

Configures ACLs based on IPv4 addresses, TCP/UDP port number,protocol type, and TCP control code

IPv6 ACLs

Configures ACLs based on IPv6 addresses, DSCP traffic class, or next
header type

MAC ACLs

Configures ACLs based on hardware addresses, packet format, andEthernet type

ARP ACLs

Configures ACLs based on ARP messages addresses

ACL Information

Displays ACLs and associated rules; shows ACLs assigned to each port

IPv4 ACLs
The commands in this section configure ACLs based on IPv4 addresses, TCP/UDP
port number, protocol type, and TCP control code. To configure IPv4 ACLs, firstcreate an access list containing the required permit or deny rules, and then bind theaccess list to one or more ports.
Table 74: IPv4 ACL Commands
CommandFunctionMode

access-list ip

Creates an IP ACL and enters configuration mode forstandard or extended IPv4 ACLs

GC

permit, deny

Filters packets matching a specified source IPv4 address

IPv4-STD-ACL

permit, deny

Filters packets meeting the specified criteria, including
source and destination IPv4 address, TCP/UDP port
number, protocol type, and TCP control code

IPv4-EXT-ACL

ip access-group

Binds an IPv4 ACL to a portICshow ip access-groupShows port assignments for IPv4 ACLs

PE

show ip access-list

Displays the rules for configured IPv4 ACLs

PE

– 387 –

Chapter 10 | Access Control Lists

IPv4 ACLs

access-list ip This command adds an IP access list and enters configuration mode for standard or
extended IPv4 ACLs. Use the no form to remove the specified ACL.
Syntax[no] access-list ip {standard | extended} acl-namestandard – Specifies an ACL that filters packets based on the source IP
address.
extended – Specifies an ACL that filters packets based on the source ordestination IP address, and other more specific criteria.
acl-name – Name of the ACL. (Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage When you create a new ACL or enter configuration mode for an existing ACL,
use the permit or deny command to add new rules to the bottom of the list.
 To remove a rule, use the no permit or no deny command followed by theexact text of a previously configured rule.

 An ACL can contain up to 1K rules.

ExampleConsole(config)#access-list ip standard david
Console(config-std-acl)#

Related Commands
permit, deny (388)show ip access-list (393)permit, deny This command adds a rule to a Standard IPv4 ACL. The rule sets a filter condition for(Standard IP ACL) packets emanating from the specified source. Use the no form to remove a rule.

Syntax{permit | deny} {any | source bitmask | host source}[time-range time-range-name]no {permit | deny} {any | source bitmask | host source}
any – Any source IP address.
source – Source IP address.
– 388 –

Chapter 10 | Access Control Lists
IPv4 ACLs

bitmask – Dotted decimal number representing the address bits to match.
host – Keyword followed by a specific IP address.
time-range-name - Name of the time range. (Range: 1-32 characters)
Default Setting
None
Command Mode
Standard IPv4 ACL
Command Usage New rules are appended to the end of the list.
 Address bit masks are similar to a subnet mask, containing four integers from 0

to 255, each separated by a period. The binary mask uses 1 bits to indicate“match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with thespecified source IP address, and then compared with the address for each IP
packet entering the port(s) to which this ACL has been assigned.

ExampleThis example configures one permit rule for the specific address 10.1.1.21 andanother rule for the address range 168.92.16.x – 168.92.31.x using a bitmask.
Console(config-std-acl)#permit host 10.1.1.21
Console(config-std-acl)#permit 168.92.16.0 255.255.240.0
Console(config-std-acl)#

Related Commands
access-list ip (388)Time Range (180)permit, deny This command adds a rule to an Extended IPv4 ACL. The rule sets a filter condition(Extended IPv4 ACL) for packets with specific source or destination IP addresses, protocol types, sourceor destination protocol ports, or TCP control codes. Use the no form to remove a
rule.
Syntax{permit | deny} [protocol-number]{any | source address-bitmask | host source}{any | destination address-bitmask | host destination}[precedence precedence] [dscp dscp][time-range time-range-name]no {permit | deny} [protocol-number]{any | source address-bitmask | host source}{any | destination address-bitmask | host destination}– 389 –

Chapter 10 | Access Control Lists

IPv4 ACLs[precedence precedence] [dscp dscp][source-port sport [bitmask]][destination-port dport [port-bitmask]]{permit | deny} [icmp | tcp | udp ]{any | source address-bitmask | host source}{any | destination address-bitmask | host destination}[precedence precedence] [dscp dscp][source-port sport [bitmask]][destination-port dport [port-bitmask]][icmp-type icmp-type][control-flag control-flags flag-bitmask][time-range time-range-name]no {permit | deny} [icmp | tcp | udp ]{any | source address-bitmask | host source}{any | destination address-bitmask | host destination}[precedence precedence] [dscp dscp][source-port sport [bitmask]][destination-port dport [port-bitmask]][icmp-type icmp-type][control-flag control-flags flag-bitmask]
protocol-number – A specific protocol number. (Range: 0-255)
source – Source IP address.
destination – Destination IP address.
address-bitmask – Decimal number representing the address bits to match.
host – Keyword followed by a specific IP address.
dscp – DSCP priority level. (Range: 0-63)
precedence – IP precedence level. (Range: 0-7)
sport – Protocol4 source port number. (Range: 0-65535)
dport – Protocol4 destination port number. (Range: 0-65535)
port-bitmask – Decimal number representing the port bits to match.
(Range: 0-65535)
icmp-type – The ICMP protocol number. (Range: 0-255)
control-flags – Decimal number (representing a bit string) that specifies flag
bits in byte 14 of the TCP header. (Range: 0-63)
flag-bitmask – Decimal number representing the code bits to match.
time-range-name - Name of the time range. (Range: 1-32 characters)
Default Setting
None

4. Includes TCP, UDP or other protocol types.

– 390 –

Chapter 10 | Access Control Lists
IPv4 ACLs

Command Mode
Extended IPv4 ACL
Command Usage All new rules are appended to the end of the list.
 Address bit masks are similar to a subnet mask, containing four integers from 0

to 255, each separated by a period. The binary mask uses 1 bits to indicate“match” and 0 bits to indicate “ignore.” The bit mask is bitwise ANDed with thespecified source IP address, and then compared with the address for each IP
packet entering the port(s) to which this ACL has been assigned.

 The control-code bitmask is a decimal number (representing an equivalent bitmask) that is applied to the control code. Enter a decimal number, where theequivalent binary bit “1” means to match a bit and “0” means to ignore a bit.
The following bits may be specified:







1 (fin) – Finish
2 (syn) – Synchronize
4 (rst) – Reset
8 (psh) – Push
16 (ack) – Acknowledgement
32 (urg) – Urgent pointerFor example, use the code value and mask below to catch packets with thefollowing flags set:


SYN flag valid, use “control-code 2 2”
Both SYN and ACK valid, use “control-code 18 18”
SYN valid and ACK invalid, use “control-code 2 18”

 If an Extended IPv4 rule and MAC rule match the same packet, and these rules

specify a “permit” entry and “deny” entry, the “deny” action takes precedence.

ExampleThis example accepts any incoming packets if the source address is within subnet
10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0)
equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through.
Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any
Console(config-ext-acl)#

This allows TCP packets from class C addresses 192.168.1.0 to any destination
address when set for destination TCP port 80 (i.e., HTTP).
Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any destinationport 80
Console(config-ext-acl)#– 391 –

Chapter 10 | Access Control Lists

IPv4 ACLs

This permits all TCP packets from class C addresses 192.168.1.0 with the TCP control
code set to “SYN.”
Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any controlflag 2 2
Console(config-ext-acl)#

Related Commands
access-list ip (388)Time Range (180)ip access-group This command binds an IPv4 ACL to a port. Use the no form to remove the port.
Syntax
ip access-group acl-name {in | out}
[time-range time-range-name] [counter]
no ip access-group acl-name inacl-name – Name of the ACL. (Maximum length: 32 characters)in – Indicates that this list applies to ingress packets.
out – Indicates that this list applies to egress packets.
time-range-name - Name of the time range. (Range: 1-32 characters)
counter – Enables counter for ACL statistics.
Default Setting
None
Command Mode
Interface Configuration (Ethernet)
Command Usage
If an ACL is already bound to a port and you bind a different ACL to it, the switch
will replace the old binding with the new one.
ExampleConsole(config)#int eth 1/2
Console(config-if)#ip access-group david in
Console(config-if)#

Related Commands
show ip access-list (393)Time Range (180)– 392 –

Chapter 10 | Access Control Lists
IPv4 ACLs

show ip access-group This command shows the ports assigned to IP ACLs.
Command Mode
Privileged Exec
ExampleConsole#show ip access-group
Interface ethernet 1/2
IP access-list david in
Console#show ip access-list This command displays the rules for configured IPv4 ACLs.
Syntaxshow ip access-list {standard | extended} [acl-name]standard – Specifies a standard IP ACL.
extended – Specifies an extended IP ACL.
acl-name – Name of the ACL. (Maximum length: 32 characters)
Command Mode
Privileged Exec
ExampleConsole#show ip access-list standard
IP standard access-list david:
permit host 10.1.1.21
permit 168.92.0.0 255.255.15.0
Console#Related Commands
permit, deny (388)– 393 –

Chapter 10 | Access Control Lists

IPv6 ACLs

IPv6 ACLs
The commands in this section configure ACLs based on IPv6 addresses, DSCP trafficclass, or next header type. To configure IPv6 ACLs, first create an access list
containing the required permit or deny rules, and then bind the access list to one ormore ports.
Table 75: IPv6 ACL Commands
CommandFunctionMode

access-list ipv6

Creates an IPv6 ACL and enters configuration mode forstandard or extended IPv6 ACLs

GC

permit, deny

Filters packets matching a specified source IPv6 address

IPv6- STD-ACL

permit, deny

Filters packets meeting the specified criteria, including
source or destination IPv6 address, DSCP traffic class, ornext header typeIPv6- EXT-ACL

ipv6 access-group

Binds an IPv6 ACL to a portICshow ipv6 access-groupShows port assignments for IPv6 ACLs

PE

show ipv6 access-list

Displays the rules for configured IPv6 ACLs

PE

access-list ipv6 This command adds an IP access list and enters configuration mode for standard or
extended IPv6 ACLs. Use the no form to remove the specified ACL.
Syntax[no] access-list ipv6 {standard | extended} acl-namestandard – Specifies an ACL that filters packets based on the source IP
address.
extended – Specifies an ACL that filters packets based on the destination IP
address, and other more specific criteria.
acl-name – Name of the ACL. (Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage When you create a new ACL or enter configuration mode for an existing ACL,
use the permit or deny command to add new rules to the bottom of the list. To
create an ACL, you must add at least one rule to the list.
 To remove a rule, use the no permit or no deny command followed by theexact text of a previously configured rule.

– 394 –

Chapter 10 | Access Control Lists
IPv6 ACLs

 An ACL can contain up to 64 rules.

ExampleConsole(config)#access-list ipv6 standard david
Console(config-std-ipv6-acl)#

Related Commands
permit, deny (Standard IPv6 ACL) (395)permit, deny (Extended IPv6 ACL) (396)
ipv6 access-group (398)show ipv6 access-list (399)permit, deny This command adds a rule to a Standard IPv6 ACL. The rule sets a filter condition for(Standard IPv6 ACL) packets emanating from the specified source. Use the no form to remove a rule.

Syntax{permit | deny} {any | host source-ipv6-address |source-ipv6-address[/prefix-length]}[time-range time-range-name]no {permit | deny} {any | host source-ipv6-address |source-ipv6-address[/prefix-length]}any – Any source IP address.
host – Keyword followed by a specific IP address.
source-ipv6-address - An IPv6 source address or network class. The address
must be formatted according to RFC 2373 “IPv6 Addressing Architecture,”using 8 colon-separated 16-bit hexadecimal values. One double colon may
be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields.
prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix; i.e., the network portion of theaddress. (Range: 0-128)time-range-name - Name of the time range. (Range: 1-32 characters)
Default Setting
None
Command Mode
Standard IPv6 ACL
Command Usage
New rules are appended to the end of the list.

– 395 –

Chapter 10 | Access Control Lists

IPv6 ACLs

ExampleThis example configures one permit rule for the specific address 2009:DB9:2229::79
and another rule for the addresses with the network prefix 2009:DB9:2229:5::/64.
Console(config-std-ipv6-acl)#permit host 2009:DB9:2229::79
Console(config-std-ipv6-acl)#permit 2009:DB9:2229:5::/64
Console(config-std-ipv6-acl)#

Related Commands
access-list ipv6 (394)Time Range (180)permit, deny This command adds a rule to an Extended IPv6 ACL. The rule sets a filter condition(Extended IPv6 ACL) for packets with specific source or destination IP addresses, or next header type.

Use the no form to remove a rule.
Syntax{permit | deny} [next-header | icmp | tcp | udp]
{any | host source-ipv6-address | source-ipv6-address[/prefix-length]}{any | destination-ipv6-address[/prefix-length]}[next-header next-header [[source-port sport [bitmask]] | [destination-port
dport [port-bitmask]] | [time-range time-range-name] | [dscp dscp]][icmp-type icmp-type}[time-range time-range-name][dscp dscp]
no {permit | deny} [next-header | icmp | tcp | udp]
{any | host source-ipv6-address | source-ipv6-address[/prefix-length]}{any | destination-ipv6-address[/prefix-length]}[next-header next-header [[source-port sport [bitmask]] | [destination-port
dport [port-bitmask]] | [time-range time-range-name] | [dscp dscp]][icmp-type icmp-type}[time-range time-range-name][dscp dscp]
next-header - The type of header immediately following the IPv6 header.
(Range: 0-255)
icmp – Specifies the next header as ICMP.
tcp – Specifies the next header as TCP.
udp – Specifies the next header as UDP.
any – Any IP address (an abbreviation for the IPv6 prefix ::/0).
host – Keyword followed by a specific source IP address.
source-ipv6-address - An IPv6 source address or network class. The address
must be formatted according to RFC 2373 “IPv6 Addressing Architecture,”using 8 colon-separated 16-bit hexadecimal values. One double colon may– 396 –

Chapter 10 | Access Control Lists
IPv6 ACLs

be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields.
destination-ipv6-address - An IPv6 destination address or network class. The
address must be formatted according to RFC 2373 “IPv6 Addressing
Architecture,” using 8 colon-separated 16-bit hexadecimal values. One
double colon may be used in the address to indicate the appropriate
number of zeros required to fill the undefined fields. (The switch only
checks the first 128 bits of the destination address.)prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix; i.e., the network portion of theaddress. (Range: 0-128 for source prefix, 0-128 for destination prefix)
dscp – DSCP traffic class. (Range: 0-63)
next-header – Identifies the type of header immediately following the IPv6
header. (Range: 0-255)
sport – Protocol5 source port number. (Range: 0-65535)
dport – Protocol4 destination port number. (Range: 0-65535)
port-bitmask – Decimal number representing the port bits to match.
(Range: 0-65535)
icmp-type – The ICMP protocol number. (Range: 0-255)
time-range-name - Name of the time range. (Range: 1-32 characters)
Default Setting
None
Command Mode
Extended IPv6 ACL
Command Usage All new rules are appended to the end of the list.
 Optional internet-layer information is encoded in separate headers that may beplaced between the IPv6 header and the upper-layer header in a packet. There
are a small number of such extension headers, each identified by a distinct Next
Header value. IPv6 supports the values defined for the IPv4 Protocol field in RFC
1700, including these commonly used headers:
0 : Hop-by-Hop Options
6 : TCP Upper-layer Header
17 : UDP Upper-layer Header
43 : Routing
44 : Fragment
51 : Authentication
50 : Encapsulating Security Payload
60 : Destination Options

5. Includes TCP and UDP.

– 397 –

(RFC 2460)(RFC 1700)(RFC 1700)(RFC 2460)(RFC 2460)(RFC 2402)(RFC 2406)(RFC 2460)

Chapter 10 | Access Control Lists

IPv6 ACLs

ExampleThis example accepts any incoming packets if the destination address is
2009:DB9:2229::79/8.
Console(config-ext-ipv6-acl)#permit any 2009:db90:2229::79/8
Console(config-ext-ipv6-acl)#

This allows packets to any destination address when the DSCP value is 5.
Console(config-ext-ipv6-acl)#permit any any dscp 5
Console(config-ext-ipv6-acl)#

This allows any packets sent from any source to any destination when the next
header is 43.”
Console(config-ext-ipv6-acl)#permit any any next-header 43
Console(config-ext-ipv6-acl)#

Related Commands
access-list ipv6 (394)Time Range (180)

ipv6 access-group This command binds an IPv6 ACL to a port. Use the no form to remove the port.
Syntaxipv6 access-group acl-name {in | out}
[time-range time-range-name] [counter]
no ipv6 access-group acl-name {in | out}
acl-name – Name of the ACL. (Maximum length: 32 characters)in – Indicates that this list applies to ingress packets.
out – Indicates that this list applies to egress packets.
time-range-name - Name of the time range. (Range: 1-32 characters)
counter – Enables counter for ACL statistics.
Default Setting
None
Command Mode
Interface Configuration (Ethernet)– 398 –

Chapter 10 | Access Control Lists
IPv6 ACLs

Command Usage
If a port is already bound to an ACL and you bind it to a different ACL, the switch
will replace the old binding with the new one.
ExampleConsole(config)#interface ethernet 1/2
Console(config-if)#ipv6 access-group standard david in
Console(config-if)#

Related Commands
show ipv6 access-list (399)Time Range (180)show ipv6 This command shows the ports assigned to IPv6 ACLs.
access-group
Command Mode
Privileged Exec
ExampleConsole#show ipv6 access-group
Interface ethernet 1/2
IPv6 standard access-list david in
Console#Related Commands
ipv6 access-group (398)show ipv6 access-list This command displays the rules for configured IPv6 ACLs.
Syntaxshow ipv6 access-list {standard | extended} [acl-name]standard – Specifies a standard IPv6 ACL.
extended – Specifies an extended IPv6 ACL.
acl-name – Name of the ACL. (Maximum length: 32 characters)
Command Mode
Privileged Exec
ExampleConsole#show ipv6 access-list standard
IPv6 standard access-list david:
permit host 2009:DB9:2229::79– 399 –

Chapter 10 | Access Control Lists

MAC ACLs

permit 2009:DB9:2229:5::/64
Console#Related Commands
permit, deny (Standard IPv6 ACL) (395)permit, deny (Extended IPv6 ACL) (396)
ipv6 access-group (398)

MAC ACLs
The commands in this section configure ACLs based on hardware addresses, packet
format, and Ethernet type. The ACLs can further specify optional IP and IPv6
addresses including protocol type and upper layer ports. To configure MAC ACLs,
first create an access list containing the required permit or deny rules, and thenbind the access list to one or more ports.
Table 76: MAC ACL Commands
CommandFunctionMode

access-list mac

Creates a MAC ACL and enters configuration modeGC

permit, deny

Filters packets matching a specified source and destination MAC-ACL
address, packet format, and Ethernet type. They can befurther specified using optional IP and IPv6 addresses
including protocol type and upper layer ports.

mac access-group

Binds a MAC ACL to a portICshow mac access-groupShows port assignments for MAC ACLs

PE

show mac access-list

Displays the rules for configured MAC ACLs

PE

access-list mac This command enters MAC ACL configuration mode. Rules can be added to filter

packets matching a specified MAC source or destination address (i.e., physical layer
address), or Ethernet protocol type. Rules can also be used to filter packets basedon IPv4/v6 addresses, including Layer 4 ports and protocol types. Use the no form
to remove the specified ACL.
Syntax[no] access-list mac acl-nameacl-name – Name of the ACL. (Maximum length: 32 characters,)

Default Setting
None
Command Mode
Global Configuration– 400 –

Chapter 10 | Access Control Lists
MAC ACLs

Command Usage When you create a new ACL or enter configuration mode for an existing ACL,
use the permit or deny command to add new rules to the bottom of the list.
 To remove a rule, use the no permit or no deny command followed by theexact text of a previously configured rule.

 An ACL can contain up to 1024 rules.

ExampleConsole(config)#access-list mac jerry
Console(config-mac-acl)#

Related Commands
permit, deny (401)
mac access-group (405)show mac access-list (406)permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a

specified MAC source or destination address (i.e., physical layer address), or
Ethernet protocol type. Rules can also filter packets based on IPv4/v6 addresses,
including Layer 4 ports and protocol types. Use the no form to remove a rule.
Syntax{permit | deny}{any | host source | source addres}{any | host destination | destination address}[ip {any | host source-ip | source-ip network-mask}{any | host destination-ip | destination-ip network-mask}][ipv6 {any | host source-ipv6 | source-ipv6/prefix-length}{any | host destination-ipv6 | destination-ipv6/prefix-length}][cos cos cos-bitmask][vid vid vid-bitmask][ethertype ethertype [ethertype-bitmask]][protocol protocol][l4-source-port sport [port-bitmask]][l4-destination-port dport [port-bitmask]][time-range time-range-name]no {permit | deny}{any | host source | source address}{any | host destination | destination address}[ip {any | host source-ip | source-ip network-mask}{any | host destination-ip | destination-ip network-mask}][ipv6 {any | host source-ipv6 | source-ipv6/prefix-length}{any | host destination-ipv6 | destination-ipv6/prefix-length}][cos cos cos-bitmask][vid vid vid-bitmask]– 401 –

Chapter 10 | Access Control Lists

MAC ACLs[ethertype ethertype [ethertype-bitmask]][protocol protocol][l4-source-port sport [port-bitmask]][l4-destination-port dport [port-bitmask]]
Note: The default is for Ethernet II packets.
{permit | deny} tagged-eth2{any | host source | source address}{any | host destination | destination address}[ip {any | host source-ip | source-ip network-mask}{any | host destination-ip | destination-ip network-mask}][ipv6 {any | host source-ipv6 | source-ipv6/prefix-length}{any | host destination-ipv6 | destination-ipv6/prefix-length}][cos cos cos-bitmask] [vid vid vid-bitmask][ethertype ethertype [ethertype-bitmask]][protocol protocol][l4-source-port sport [port-bitmask]][l4-destination-port dport [port-bitmask]][time-range time-range-name]no {permit | deny} tagged-eth2{any | host source | source address}{any | host destination | destination address}[ip {any | host source-ip | source-ip network-mask}{any | host destination-ip | destination-ip network-mask}][ipv6 {any | host source-ipv6 | source-ipv6/prefix-length}{any | host destination-ipv6 | destination-ipv6/prefix-length}][cos cos cos-bitmask] [vid vid vid-bitmask][ethertype ethertype [ethertype-bitmask]][protocol protocol][l4-source-port sport [port-bitmask]][l4-destination-port dport [port-bitmask]]{permit | deny} untagged-eth2{any | host source | source address}{any | host destination | destination address}[ip {any | host source-ip | source-ip network-mask}{any | host destination-ip | destination-ip network-mask}][ipv6 {any | host source-ipv6 | source-ipv6/prefix-length}{any | host destination-ipv6 | destination-ipv6/prefix-length}][ethertype ethertype [ethertype-bitmask]][protocol protocol][l4-source-port sport [port-bitmask]][l4-destination-port dport [port-bitmask]][time-range time-range-name]– 402 –

Chapter 10 | Access Control Lists
MAC ACLs

no {permit | deny} untagged-eth2{any | host source | source address}{any | host destination | destination address}[ip {any | host source-ip | source-ip network-mask}{any | host destination-ip | destination-ip network-mask}][ipv6 {any | host source-ipv6 | source-ipv6/prefix-length}{any | host destination-ipv6 | destination-ipv6/prefix-length}][ethertype ethertype [ethertype-bitmask]][protocol protocol][l4-source-port sport [port-bitmask]][l4-destination-port dport [port-bitmask]]{permit | deny} tagged-802.3{any | host source | source address}{any | host destination | destination address}[cos cos cos-bitmask] [vid vid vid-bitmask][time-range time-range-name]no {permit | deny} tagged-802.3{any | host source | source address}{any | host destination | destination address}[cos cos cos-bitmask] [vid vid vid-bitmask]{permit | deny} untagged-802.3{any | host source | source address}{any | host destination | destination address}[time-range time-range-name]no {permit | deny} untagged-802.3{any | host source | source address}{any | host destination | destination address}
tagged-eth2 – Tagged Ethernet II packets.
untagged-eth2 – Untagged Ethernet II packets.
tagged-802.3 – Tagged Ethernet 802.3 packets.
untagged-802.3 – Untagged Ethernet 802.3 packets.
any – Any MAC, IPv4 or IPv6 source or destination address.
host – A specific MAC, IPv4 or IPv6 address.
source – Source MAC, IPv4 or IPv6 address.
destination – Destination MAC, IPv4 or IPv6 address.
network-mask – Network mask for IP subnet. This mask identifies the hostaddress bits used for routing to specific subnets.
prefix-length - Length of IPv6 prefix. A decimal value indicating how many
contiguous bits (from the left) of the address comprise the prefix; i.e., thenetwork portion of the address. (Range: 0-128)
cos – Class-of-Service value (Range: 0-7)
cos-bitmask 6 – Class-of-Service bitmask. (Range: 0-7)

– 403 –

Chapter 10 | Access Control Lists

MAC ACLsvid – VLAN ID. (Range: 1-4094)
vid-bitmask6 – VLAN bitmask. (Range: 1-4095)
ethertype – A specific Ethernet protocol number. (Range: 0-ffff hex)
ethertype-bitmask6 – Protocol bitmask. (Range: 0-ffff hex)
protocol - IP protocol or IPv6 next header. (Range: 0-255)
For information on next headers, see permit, deny (Extended IPv6 ACL).
sport7 – Protocol source port number. (Range: 0-65535)
dport7 – Protocol destination port number. (Range: 0-65535)
port-bitmask – Decimal number representing the port bits to match.
(Range: 0-65535)
time-range-name - Name of the time range. (Range: 1-32 characters)
Default Setting
None
Command Mode
MAC ACL
Command Usage New rules are added to the end of the list.
 The ethertype option can only be used to filter Ethernet II formatted packets.
 A detailed listing of Ethernet protocol types can be found in RFC 1060. A few ofthe more common types include the following:

0800 - IP
0806 - ARP
8137 - IPX

 If an Extended IPv4 rule and MAC rule match the same packet, and these rules

specify a “permit” entry and “deny” entry, the “deny” action takes precedence.

ExampleThis rule permits packets from any source MAC address to the destination address00-e0-29-94-34-de where the Ethernet type is 0800.
Console(config-mac-acl)#permit any host 00-e0-29-94-34-de ethertype 0800
Console(config-mac-acl)#

Related Commands
access-list mac (400)Time Range (180)
6. For all bitmasks, “1” means relevant and “0” means ignore.
7. Includes TCP, UDP or other protocol types.

– 404 –

Chapter 10 | Access Control Lists
MAC ACLs

mac access-group This command binds a MAC ACL to a port. Use the no form to remove the port.
Syntax
mac access-group acl-name {in | out}
[time-range time-range-name] [counter]no mac access-group acl-name {in | out}
acl-name – Name of the ACL. (Maximum length: 32 characters)in – Indicates that this list applies to ingress packets.
out – Indicates that this list applies to egress packets.
time-range-name - Name of the time range. (Range: 1-32 characters)
counter – Enables counter for ACL statistics.
Default Setting
None
Command Mode
Interface Configuration (Ethernet)
Command Usage
If an ACL is already bound to a port and you bind a different ACL to it, the switch
will replace the old binding with the new one.
ExampleConsole(config)#interface ethernet 1/2
Console(config-if)#mac access-group jerry inConsole(config-if)#

Related Commands
show mac access-list (406)Time Range (180)show mac This command shows the ports assigned to MAC ACLs.
access-group
Command Mode
Privileged Exec
ExampleConsole#show mac access-group
Interface ethernet 1/5
MAC access-list M5 inConsole#– 405 –

Chapter 10 | Access Control Lists

ARP ACLs

Related Commands
mac access-group (405)show mac access-list This command displays the rules for configured MAC ACLs.
Syntaxshow mac access-list [acl-name]acl-name – Name of the ACL. (Maximum length: 32 characters)
Command Mode
Privileged Exec
ExampleConsole#show mac access-list
MAC access-list jerry:
permit any 00-e0-29-94-34-de ethertype 0800
Console#Related Commands
permit, deny (401)
mac access-group (405)

ARP ACLs
The commands in this section configure ACLs based on the IP or MAC addresscontained in ARP request and reply messages. To configure ARP ACLs, first create anaccess list containing the required permit or deny rules, and then bind the accesslist to one or more VLANs using the ip arp inspection vlan command.
Table 77: ARP ACL Commands
CommandFunctionMode

access-list arp

Creates a ARP ACL and enters configuration modeGC

permit, deny

Filters packets matching a specified source or destination
address in ARP messages

ARP-ACLshow access-list arp

Displays the rules for configured ARP ACLs

PE

access-list arp This command adds an ARP access list and enters ARP ACL configuration mode. Use
the no form to remove the specified ACL.
Syntax[no] access-list arp acl-name– 406 –

Chapter 10 | Access Control Lists

ARP ACLs

acl-name – Name of the ACL. (Maximum length: 32 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage When you create a new ACL or enter configuration mode for an existing ACL,
use the permit or deny command to add new rules to the bottom of the list. To
create an ACL, you must add at least one rule to the list.
 To remove a rule, use the no permit or no deny command followed by theexact text of a previously configured rule.

 An ACL can contain up to 128 rules.

ExampleConsole(config)#access-list arp factory
Console(config-arp-acl)#

Related Commands
permit, deny (407)show access-list arp (408)permit, deny (ARP ACL) This command adds a rule to an ARP ACL. The rule filters packets matching a

specified source or destination address in ARP messages. Use the no form to
remove a rule.
Syntax[no] {permit | deny}
ip {any | host source-ip | source-ip ip-address-bitmask}{any | host destination-ip | destination-ip ip-address-bitmask}mac {any | host source-mac | source-mac mac-address-bitmask}[any | host destination-mac | destination-mac mac-address-bitmask] [log]This form indicates either request or response packets.
[no] {permit | deny} request
ip {any | host source-ip | source-ip ip-address-bitmask}{any | host destination-ip | destination-ip ip-address-bitmask}mac {any | host source-mac | source-mac mac-address-bitmask}[any | host destination-mac | destination-mac mac-address-bitmask] [log][no] {permit | deny} response
ip {any | host source-ip | source-ip ip-address-bitmask}– 407 –

Chapter 10 | Access Control Lists

ARP ACLs{any | host destination-ip | destination-ip ip-address-bitmask}mac {any | host source-mac | source-mac mac-address-bitmask}[any | host destination-mac | destination-mac mac-address-bitmask] [log]source-ip – Source IP address.
destination-ip – Destination IP address with bitmask.
ip-address-bitmask8 – IPv4 number representing the address bits to match.
source-mac – Source MAC address.
destination-mac – Destination MAC address range with bitmask.
mac-address-bitmask8 – Bitmask for MAC address (in hexadecimal format).
log - Logs a packet when it matches the access control entry.
Default Setting
None
Command Mode
ARP ACL
Command Usage
New rules are added to the end of the list.
ExampleThis rule permits packets from any source IP and MAC address to the destination
subnet address 192.168.0.0.
Console(config-arp-acl)#$permit response ip any 192.168.0.0 255.255.0.0 mac
any any
Console(config-arp-acl)#

Related Commands
access-list arp (406)show access-list arp This command displays the rules for configured ARP ACLs.
Syntaxshow access-list arp [acl-name]acl-name – Name of the ACL. (Maximum length: 32 characters)
Command Mode
Privileged Exec

8. For all bitmasks, binary “1” means relevant and “0” means ignore.

– 408 –

Chapter 10 | Access Control Lists

ACL Information

ExampleConsole#show access-list arp
ARP access-list factory:
permit response ip any 192.168.0.0 255.255.0.0 mac any any
Console#Related Commands
permit, deny (407)

ACL Information
This section describes commands used to display ACL information.
Table 78: ACL Information Commands
CommandFunctionModeclear access-list
hardware counters

Clears hit counter for rules in all ACLs, or in a specified ACL

PEshow access-groupShows the ACLs assigned to each portPEshow access-list

Show all ACLs and associated rules

PE

clear access-list This command clears the hit counter for the rules in all ACLs, or for the rules in a
hardware counters specified ACL.
Syntaxclear access-list hardware counters[direction in [interface interface]] |[interface interface] | [name acl-name[direction in]]in – Clears counter for ingress rules.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
acl-name – Name of the ACL. (Maximum length: 32 characters)
Command Mode
Privileged Exec
ExampleConsole#clear access-list hardware counters
Console#– 409 –

Chapter 10 | Access Control Lists
ACL Information

show access-group This command shows the port assignments of ACLs.
Syntaxshow access-group [ip | ipv6 | mac]ip - Ingress or egress access groups for IP ACLs
ipv6 - Ingress or egress access groups for IPv6 ACLs
mac - Ingress or egress access groups for MAC ACLs
Command Mode
Privileged Executive
ExampleConsole#show access-group
Interface ethernet 1/1
IP access-list ex1 in
IP access-list ex1 out
Interface ethernet 1/2
IPv6 access-list i6ex in
IPv6 access-list i6ex out
Console#show access-list This command shows all ACLs and associated rules.
Syntaxshow access-list[[arp [acl-name]] |[ip [extended [acl-name] | standard [acl-name]] |[ipv6 [extended [acl-name] | standard [acl-name]] |[mac [acl-name]] | [tcam-utilization] | [hardware counters]]
arp – Shows ingress or egress rules for ARP ACLs.
hardware counters – Shows statistics for all ACLs.9
ip extended – Shows ingress or egress rules for Extended IPv4 ACLs.
ip standard – Shows ingress or egress rules for Standard IPv4 ACLs.
ipv6 extended – Shows ingress or egress rules for Extended IPv6 ACLs.
ipv6 standard – Shows ingress or egress rules for Standard IPv6 ACLs.
mac – Shows ingress or egress rules for MAC ACLs.
tcam-utilization – Shows the percentage of user configured ACL rules as apercentage of total ACL rules
acl-name – Name of the ACL. (Maximum length: 32 characters)

9. Due to a hardware limitation, this option only displays statistics for permit rules.

– 410 –

Chapter 10 | Access Control Lists

ACL Information

Command Mode
Privileged Exec
ExampleConsole#show access-list
IP standard access-list david:
permit host 10.1.1.21
permit 168.92.0.0 255.255.15.0
IP extended access-list bob:permit TCP 192.168.1.0 255.255.255.0 any destination-port 80
permit TCP 192.168.1.0 255.255.255.0 any control-flag 2 2
permit 10.7.1.1 255.255.255.0 any
MAC access-list jerry:
permit any host 00-30-29-94-34-de ethertype 800 800
permit any any VID 1 ethertype 0000 cos 1 1
IP extended access-list A6:
permit any any DSCP 5
permit any any next-header 43
permit any 2009:db90:2229::79/8
ARP access-list arp1:
permit response ip any 192.168.0.0 255.255.0.0 mac any any
permit ip any any mac any any
permit ip any any mac any host 12-12-12-12-12-12 log
Console#– 411 –

Chapter 10 | Access Control Lists
ACL Information– 412 –

11

Interface Commands

These commands are used to display or set communication parameters for an
Ethernet port, aggregated link, or VLAN; or perform cable diagnostics on thespecified interface.
Table 79: Interface Commands
CommandFunctionModeinterface

Configures an interface type and enters interface
configuration mode

GC

alias

Configures an alias name for the interfaceICcapabilities

Advertises the capabilities of a given interface for use inautonegotiationIC

description

Adds a description to an interface configuration

IC

discard

Discards CDP, PVST, or VLAN 0 packets

ICflowcontrol

Enables flow control on a given interfaceIChistory

Configures a periodic sampling of statistics, specifying the IC
sampling interval and number of samples

media-type

Forces transceiver mode to use for SFP/SFP+/SFP28 ports

IC

fec

Configures the Forward Error Correction (FEC) mode on
25G SFP28 ports

IC

negotiation

Enables autonegotiation of a given interface

IC

shutdown

Disables an interfaceIC

speed-duplex

Configures the speed and duplex operation of a given
interface when autonegotiation is disabledIC

clear counters

Clears statistics on an interface

PEshow discard

Displays if CDP and PVST packets are being discarded

PEshow interfaces brief

Displays a summary of key information, includingPE
operational status, native VLAN ID, default priority, speed/
duplex mode, and port typeshow interfaces counters

Displays statistics for the specified interfaces

show interfaces history

Displays periodic sampling of statistics, including theNE, PE
sampling interval, number of samples, and counter values

show interfaces status

Displays status for the specified interface

Interface Configuration

show interfaces switchport Displays the administrative and operational status of aninterface– 413 –

NE, PE

NE, PE
NE, PE

Chapter 11 | Interface Commands

Table 79: Interface Commands (Continued)
CommandFunction

Mode

Transceiver Threshold Configurationtransceiver-monitor

Sends a trap when any of the transceiver’s operational
values fall outside specified thresholds

ICtransceiver-threshold-auto

Uses default threshold settings obtained from thetransceiver to determine when an alarm or trap message
should be sentIC

transceiver-thresholdcurrent

Sets thresholds for transceiver current which can be used
to trigger an alarm or warning message

ICtransceiver-threshold
rx-power

Sets thresholds for the transceiver power level of thereceived signal which can be used to trigger an alarm or
warning message

ICtransceiver-threshold
temperature

Sets thresholds for the transceiver temperature which can IC
be used to trigger an alarm or warning message

transceiver-threshold
tx-power

Sets thresholds for the transceiver power level of theICtransmitted signal which can be used to trigger an alarm or
warning message

transceiver-thresholdvoltage

Sets thresholds for the transceiver voltage which can beused to trigger an alarm or warning message

ICshow interfaces transceiver Displays the temperature, voltage, bias current, transmit
power, and receive powerPEshow interfaces transceiver- Displays the alarm/warning thresholds for temperature,
thresholdvoltage, bias current, transmit power, and receive power

PE

Cable Diagnostics
test cable-diagnostics

Performs cable diagnostics on the specified portPEtest loop internal

Performs internal loop back test on the specified portPEshow cable-diagnostics

Shows the results of a cable diagnostics testPEshow loop internal

Shows the results of a loop back testPE

power-saveEnables power savings mode on the specified portICshow power-saveShows the configuration settings for power savingsPE

Power Savings– 414 –

Chapter 11 | Interface Commands

Interface Configurationinterface This command configures an interface type and enters interface configuration

mode. Use the no form with a trunk to remove an inactive interface. Use the noform with a Layer 3 VLAN (normal type) to change it back to a Layer 2 interface.
Syntaxinterface interface
no interface interface [port-channel channel-id | vlan vlan-id]
interfaceethernet unit/port-list
unit - Unit identifier. (Range: 1)
port-list - Physical port number or list of port numbers. Separate
nonconsecutive port numbers with a comma and no spaces; or usea hyphen to designate a range of port numbers. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id (Range: 1-4094)
Default Setting
None
Command Mode
Global Configuration
ExampleTo specify several different ports, enter the following command:
Console(config)#interface ethernet 1/17-20,23
Console(config-if)#alias This command configures an alias name for an interface. Use the no form to
remove an alias name.
Syntaxalias string
no aliasstring - A mnemonic name to help you remember what is attached to thisinterface. (Range: 1-64 characters)
Default SettingNone– 415 –

Chapter 11 | Interface Commands

Command Mode
Interface Configuration (Port Channel, VLAN)
Command Usage
The alias is displayed in the running-configuration file.
ExampleConsole(config)#interface port-channel 4
Console(config-if)#alias financeConsole(config-if)#capabilities This command advertises the port capabilities of a given interface during auto-

negotiation. Use the no form with parameters to remove an advertised capability,or the no form without parameters to restore the default values.
Syntax[no] capabilities {1000full | 100full | 100half | 10full | 10half | flowcontrol}
1000full - Supports 1 Gbps full-duplex operation
100full - Supports 100 Mbps full-duplex operation
100half - Supports 100 Mbps half-duplex operation
10full - Supports 10 Mbps full-duplex operation
10half - Supports 10 Mbps half-duplex operation
flowcontrol - Supports flow control

Default Setting
1000BASE-T: 10half, 10full, 100half, 100full, 1000full
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage When auto-negotiation is enabled with the negotiation command, the switch
will negotiate the best settings for a link based on the capabilities command.
When auto-negotiation is disabled, you must manually specify the link
attributes with the speed-duplex and flowcontrol commands.
ExampleThe following example configures Ethernet port 5 capabilities to include 100half
and 100full.
Console(config)#interface ethernet 1/5
Console(config-if)#capabilities 100half
Console(config-if)#capabilities 100full– 416 –

Chapter 11 | Interface Commands

Console(config-if)#capabilities flowcontrol
Console(config-if)#

Related Commands
negotiation (421)speed-duplex (422)flowcontrol (418)description This command adds a description to an interface. Use the no form to remove thedescription.
Syntaxdescription string
no description
string - Comment or a description to help you remember what is attachedto this interface. (Range: 1-64 characters)
Default Setting
None
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
The description is displayed by the show interfaces status command and in therunning-configuration file. An example of the value which a network manager
might store in this object is the name of the manufacturer, and the product name.
ExampleThe following example adds a description to port 4.
Console(config)#interface ethernet 1/4
Console(config-if)#description RD-SW#3
Console(config-if)#discard This command discards CDP, PVST, or VLAN 0 packets. Use the no form to forward
the specified packet type to other ports configured the same way.
Syntax[no] discard {cdp | pvst | vlan0}
cdp – Cisco Discovery Protocol.
pvst – Per-VLAN Spanning Tree.

– 417 –

Chapter 11 | Interface Commands

vlan0 – Packets with a VLAN ID of 0.
Default Setting
Default - Forward CDP, PVST, and VLAN 0 packets
Command Mode
Interface Configuration (Ethernet)
Command Usage
Use the no discard command to allow CDP, PVST, or VLAN 0 packets to be
forwarded to other ports in the same VLAN which are also configured to forward
the specified packet type.
ExampleThe following example forwards CDP packets entering port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#discard cdp
Console(config-if)#flowcontrol This command enables flow control. Use the no form to disable flow control.
Syntax[no] flowcontrol
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
Flow control can eliminate frame loss by “blocking” traffic from end stations orsegments connected directly to the switch when its buffers fill. When enabled, backpressure is used for half-duplex operation and IEEE 802.3-2002 (formally IEEE
802.3x) for full-duplex operation.
ExampleThe following example enables flow control on port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#flowcontrol
Console(config-if)#– 418 –

Chapter 11 | Interface Commands

history This command configures a periodic sampling of statistics, specifying the samplinginterval and number of samples. Use the no form to remove a named entry fromthe sampling table.
Syntaxhistory name interval buckets
no history [name]name - A symbolic name for this entry in the sampling table. (Range: 1-31
characters)interval - The interval for sampling statistics. (Range: 1-86400 seconds.
buckets - The number of samples to take. (Range: 1-96)
Default Setting
15min - 15 minute interval, 96 buckets
1day - 1 day interval, 7 buckets
Command Mode
Interface Configuration (Ethernet, Port Channel)
ExampleThis example sets a interval of 15 minutes for sampling standard statistical values
on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#history 15min 15 10
Console(config-if)#media-type This command forces the transceiver mode to use for SFP/SFP+/SFP28 ports. Use
the no form to restore the default mode.
Syntaxmedia-type {copper-forced | sfp-forced [mode | ifmode {kr | sr_lr}] |sfp-preferred-auto}
no media-type [sfp-forced ifmode]
copper-forced - Always uses the built-in RJ-45 port.
sfp-forced - Forces transceiver mode for the SFP/SFP+/SFP28 port.
sfp-preferred-auto - Uses SFP/SFP+/SFP28 port if both combination types
are functioning and the SFP/SFP+/SFP28 port has a valid link.
mode
1000sfp - Always uses 1000BASE SFP mode.
10gsfp - Always uses 10GBASE SFP mode.

– 419 –

Chapter 11 | Interface Commands

25gsfp - Always uses 25GBASE SFP mode.
ifmode - Sets a specific interface mode when the media type is not
automatically recognized.
kr - Sets the mode for DAC copper media.
sr_lr - Sets the mode for optical/AOC fiber media.
Default Setting
SFP/SFP+/SFP28 ports: None
Command Mode
Interface Configuration (Ethernet)
Command Usage
Available sfp-forced modes include: 1000sfp, 10gsfp, 25gsfp
ExampleThis forces the switch to use the 1000sfp mode for SFP port 28.
Console(config)#interface ethernet 1/28
Console(config-if)#media-type sfp-forced 1000sfp
Console(config-if)#

fec This command configures the Forward Error Correction (FEC) mode of 25G SFP28
ports. Use the no form to disable FEC mode.
Syntaxfec {rs}
no fecrs - Enables Reed-Solomon FEC (RS-FEC) on the port.
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
Command Usage Forward Error Correction (FEC) is a technique used for correcting data errors intransmission links. The use of Reed-Solomon FEC (RS-FEC) on noisy network
links can improve reliability and performance. The RS-FEC mode must be
enabled on both ends of a link.
 If negotiation is enabled (auto mode), this command has no effect.

– 420 –

Chapter 11 | Interface Commands

ExampleConsole(config)#interface ethernet 1/50
Console(config-if)#fec rs
Console(config-if)#negotiation This command enables auto-negotiation for a given interface. Use the no form todisable auto-negotiation.
Syntax[no] negotiation
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage 1000BASE-T does not support forced mode. Auto-negotiation should always be
used to establish a connection over any 1000BASE-T port or trunk.
 When auto-negotiation is enabled the switch will negotiate the best settings

for a link based on the capabilities command. When auto-negotiation isdisabled, you must manually specify the link attributes with the speed-duplex
and flowcontrol commands.

ExampleThe following example configures port 10 to use auto-negotiation.
Console(config)#interface ethernet 1/10
Console(config-if)#negotiation
Console(config-if)#

Related Commands
capabilities (416)speed-duplex (422)

shutdown This command disables an interface. To restart a disabled interface, use the noform.

Syntax[no] shutdown– 421 –

Chapter 11 | Interface Commands

Default Setting
All interfaces are enabled.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This command allows you to disable a port due to abnormal behavior(e.g., excessive collisions), and then re-enable it after the problem has been
resolved. You may also want to disable a port for security reasons.
ExampleThe following example disables port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#shutdown
Console(config-if)#

speed-duplex This command configures the speed and duplex mode of a given interface when
auto-negotiation is disabled. Use the no form to restore the default.
Syntaxspeed-duplex {100full | 100half | 10full | 10half}no speed-duplex
100full - Forces 100 Mbps full-duplex operation
100half - Forces 100 Mbps half-duplex operation
10full - Forces 10 Mbps full-duplex operation
10half - Forces 10 Mbps half-duplex operation
Default Setting
 Auto-negotiation is enabled by default.
 When auto-negotiation is disabled, the default speed-duplex setting is 100full

for 1000BASE-T ports.

Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage The 1000BASE-T standard does not support forced mode. Auto-negotiation

should always be used to establish a connection over any 1000BASE-T port or
trunk. If not used, the success of the link process cannot be guaranteed whenconnecting to other types of switches.

– 422 –

Chapter 11 | Interface Commands

ExampleThe following example configures port 5 to 100 Mbps, half-duplex operation.
Console(config)#interface ethernet 1/5
Console(config-if)#speed-duplex 100half
Console(config-if)#clear counters This command clears statistics on an interface.
Syntaxclear counters interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Statistics are only initialized for a power reset. This command sets the base value fordisplayed statistics to zero for the current management session. However, if you log
out and back into the management interface, the statistics displayed will show theabsolute value accumulated since the last power reset.
ExampleThe following example clears statistics on port 5.
Console#clear counters ethernet 1/5
Console#show discard This command displays whether or not CDP and PVST packets are being discarded.
Command Mode
Privileged Exec
ExampleIn this example, “Default” means that the packets are not discarded.
– 423 –

Chapter 11 | Interface Commands

Console#show discard
Port
CDP
PVST
-------- ------- ------Eth 1/ 1 No
No
Eth 1/ 2 No
No
Eth 1/ 3 No
No
Eth 1/ 4 No
No
Eth 1/ 5 No
NoEth
1/ 6 NoNo.
.
.

show interfaces brief This command displays a summary of key information, including operational

status, native VLAN ID, default priority, speed/duplex mode, and port type for all
ports.
Command Mode
Privileged Exec
Command Usage If an SFP transceiver is inserted in a port, the Type field will show the SFP type
as interpreted from Ethernet Compliance Codes (Data Byte 6 in Address A0h).
The Ethernet Compliance Code is a bitmap value, of which one bit is
supposedly turned on. However, if the read-out is not recognizable (e.g., 2 ormore bits on, or all 0s), the Type field just displays the raw data (hexadecimalvalue).
 If link status is down due to an administrative setting or the result of a protocol

state, the reason will be listed in the Status field (i.e., Disabled, STP LBD,
BpduGuard, LinkDet, DynQoS, PortSec, LBD, ATC Bcast, ATC Mcast, UDLD,
License).

ExampleConsole#show interfaces brief
Interface Name
StatusPVID Pri Speed/Duplex Type
Trunk--------- --------------- --------- ---- --- ------------- ------------ ----Eth 1/ 1
Up
1
0 Auto-1000full 1000BASE-T
None
Eth 1/ 2
Up
1
0 Auto1000BASE-T
None
Eth 1/ 3Up
1
0 Auto1000BASE-T
None
Eth 1/ 4
Up1
0 Auto1000BASE-T
None
Eth 1/ 5Up1
0 Auto1000BASE-T
None
Eth 1/ 6
Up1
0 Auto1000BASE-T
None
.
.
.

– 424 –

Chapter 11 | Interface Commands

show interfaces This command displays interface statistics.
counters
Syntaxshow interfaces counters [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default SettingShows the counters for all interfaces.
Command Mode
Normal Exec, Privileged Exec
Command Usage
If no interface is specified, information on all interfaces is displayed.
ExampleConsole#show interfaces counters ethernet 1/1
Ethernet 1/ 1===== IF table Stats =====
29370 Octets Input
3763 Octets Output
0 Unicast Input
7 Unicast Output
0 Discard Input
0 Discard Output
0 Error Input
0 Error Output
0 Unknown Protocols Input
0 QLen Output===== Extended Iftable Stats =====
54 Multi-cast Input
13 Multi-cast Output
98 Broadcast Input
5 Broadcast Output===== Ether-like Stats =====
0 Alignment Errors
0 FCS Errors
0 Single Collision Frames
0 Multiple Collision Frames
0 SQE Test Errors
0 Deferred Transmissions
0 Late Collisions
0 Excessive Collisions
0 Internal Mac Transmit Errors
0 Internal Mac Receive Errors
0 Frames Too Long
0 Carrier Sense Errors
0 Symbol Errors
0 Pause Frames Input
0 Pause Frames Output– 425 –

Chapter 11 | Interface Commands===== RMON Stats =====

0 Drop Events
33133 Octets
177 Packets
98 Broadcast PKTS
54 Multi-cast PKTS
0 Undersize PKTS
0 Oversize PKTS
0 Fragments
0 Jabbers
0 CRC Align Errors
0 Collisions
18 Packet Size <= 64 Octets
71 Packet Size 65 to 127 Octets
17 Packet Size 128 to 255 Octets
71 Packet Size 256 to 511 Octets
0 Packet Size 512 to 1023 Octets
0 Packet Size 1024 to 1518 Octets===== Port Utilization (recent 300 seconds) =====
0 Octets Input in kbits per second
0 Packets Input per second
0.00 % Input Utilization
0 Octets Output in kbits per second
0 Packets Output per second
0.00 % Output Utilization
Console#Table 80: show interfaces counters - display description
Parameter

Description

IF Table Stats
Octets Input

The total number of octets received on the interface, including framing
characters.

Octets Output

The total number of octets transmitted out of the interface, including
framing characters.

Unicast Input

The number of subnetwork-unicast packets delivered to a higher-layer
protocol.

Unicast Output

The total number of packets that higher-level protocols requested betransmitted to a subnetwork-unicast address, including those thatwere discarded or not sent.

Discard Input

The number of inbound packets which were chosen to be discarded
even though no errors had been detected to prevent their being
deliverable to a higher-layer protocol. One possible reason for
discarding such a packet could be to free up buffer space.

Discard Output

The number of outbound packets which were chosen to be discarded
even though no errors had been detected to prevent their beingtransmitted. One possible reason for discarding such a packet could beto free up buffer space.

Error Input

The number of inbound packets that contained errors preventing themfrom being deliverable to a higher-layer protocol.

Error Output

The number of outbound packets that could not be transmitted
because of errors.

Unknown Protocols Input

The number of packets received which were discarded because of an
unknown or unsupported protocol.

QLen Output

The length of the output packet queue (in packets).

– 426 –

Chapter 11 | Interface Commands

Table 80: show interfaces counters - display description (Continued)
Parameter

Description

Extended IF Table Stats
Multicast Input

The number of packets, delivered by this sub-layer to a higher (sub)layer, which were addressed to a multicast address at this sub-layer.

Multicast Output

The total number of packets that higher-level protocols requested betransmitted, and which were addressed to a multicast address at thissub-layer, including those that were discarded or not sent.

Broadcast Input

The number of packets, delivered by this sub-layer to a higher (sub)layer, which were addressed to a broadcast address at this sub-layer.

Broadcast Output

The total number of packets that higher-level protocols requested betransmitted, and which were addressed to a broadcast address at thissub-layer, including those that were discarded or not sent.

Etherlike Statistics
Alignment Errors

The number of alignment errors (missynchronized data packets).

FCS Errors

A count of frames received on a particular interface that are an integral
number of octets in length but do not pass the FCS check. This countdoes not include frames received with frame-too-long or frame-tooshort error.

Single Collision Frames

The number of successfully transmitted frames for which transmission
is inhibited by exactly one collision.

Multiple Collision Frames

A count of successfully transmitted frames for which transmission is
inhibited by more than one collision.

SQE Test Errors

A count of times that the SQE TEST ERROR message is generated by the
PLS sublayer for a particular interface.

Deferred Transmissions

A count of frames for which the first transmission attempt on aparticular interface is delayed because the medium was busy.

Late Collisions

The number of times that a collision is detected later than 512 bit-times
into the transmission of a packet.

Excessive Collisions

A count of frames for which transmission on a particular interface fails
due to excessive collisions. This counter does not increment when theinterface is operating in full-duplex mode.

Internal MAC Transmit
Errors

A count of frames for which transmission on a particular interface fails
due to an internal MAC sublayer transmit error.

Internal Mac Receive Errors A count of frames for which reception on a particular interface fails due
to an internal MAC sublayer receive error.
Frames Too Long

A count of frames received on a particular interface that exceed the
maximum permitted frame size.

Carrier Sense Errors

The number of times that the carrier sense condition was lost or neverasserted when attempting to transmit a frame.

– 427 –

Chapter 11 | Interface Commands

Table 80: show interfaces counters - display description (Continued)
Parameter

Description

Symbol Errors

For an interface operating at 100 Mb/s, the number of times there wasan invalid data symbol when a valid carrier was present.
For an interface operating in half-duplex mode at 1000 Mb/s, thenumber of times the receiving media is non-idle (a carrier event) for aperiod of time equal to or greater than slotTime, and during which
there was at least one occurrence of an event that causes the PHY toindicate'Data reception error' or 'carrier extend error' on the GMII.
For an interface operating in full-duplex mode at 1000 Mb/s, thenumber of times the receiving media is non-idle (a carrier event) for aperiod of time equal to or greater than minFrameSize, and during
which there was at least one occurrence of an event that causes the
PHY to indicate 'Data reception error' on the GMII

Pause Frames Input

Count of pause frames received on the interface

Pause Frames Output

Count of pause frames transmitted from the interface.

RMON Statistics
Drop Events

The number of events in which packets were dropped at the interface
due to lack of resources.

OctetsTotal number of octets of data received on the network. This statistic
can be used as a reasonable indication of Ethernet utilization.

Packets

The total number of packets (including error, unicast, broadcast,multicast, unknown-unicast, etc.) received.

Broadcast PKTS

The total number of good packets received that were directed to thebroadcast address. Note that this does not include multicast packets.

Multicast PKTS

The total number of good packets received that were directed to thismulticast address.

Undersize PKTS

The total number of packets received that were less than 64 octets long(excluding framing bits, but including FCS octets) and were otherwise
well formed.

Oversize PKTS

The total number of packets received that were longer than 1518 octets(excluding framing bits, but including FCS octets) and were otherwise
well formed.

Fragments

The total number of frames received that were less than 64 octets inlength (excluding framing bits, but including FCS octets) and had either
an FCS or alignment error.

Jabbers

The total number of frames received that were longer than 1518 octets(excluding framing bits, but including FCS octets), and had either an
FCS or alignment error.

CRC Align Errors

The number of frames that do not end with an even number of octets
and have a bad Cyclic Redundancy Check (CRC).

Collisions

The best estimate of the total number of collisions on this Ethernet
segment.

Packet Size <= 64 Octets

The total number of packets (including bad packets) received andtransmitted that were less than 64 octets in length (excluding framing
bits but including FCS octets).

– 428 –

Chapter 11 | Interface Commands

Table 80: show interfaces counters - display description (Continued)
Parameter

Description

Packet Size 65 to 127 Octets The total number of packets (including bad packets) received andtransmitted where the number of octets fall within the specified range
Packet Size 128 to 255(excluding framing bits but including FCS octets).
OctetsPacket Size 256 to 511
OctetsPacket Size 512 to 1023
OctetsPacket Size 1024 to 1518
OctetsPort Utilization (recent 300 seconds) Statistics
Octets input in kbits per
secondNumber of octets entering this interface in kbits per second.

Packets input per second

Number of packets entering this interface in packets per second.

% Input utilization

The input utilization rate for this interface.

Octets output in kbits per
secondNumber of octets leaving this interface in kbits per second.

Packets output per second

Number of packets leaving this interface in packets per second.

% Output utilization

The output utilization rate for this interface.

show interfaces This command displays periodic sampling of statistics, including the sampling
history interval, number of samples, and counter values.
Syntaxshow interfaces history [interface [name [current | previous index count][input | output]]]
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
name - Name of sample as defined in the history command.
(Range: 1-31 characters)
current - Statistics recorded in current interval.
previous - Statistics recorded in previous intervals.
index - An index into the buckets containing previous samples.
(Range: 1-96)
count - The number of historical samples to display. (Range: 1-96)
input - Ingress traffic.
output - Egress traffic.
– 429 –

Chapter 11 | Interface Commands

Default SettingShows the historical settings and status for all interfaces.
Command Mode
Normal Exec, Privileged Exec
Command Usage
If no interface is specified, information on all interfaces is displayed.
ExampleConsole#show interfaces history ethernet 1/1 15min
Interface: Eth 1/ 1
Name
: 15minInterval: 900 second(s)Buckets Requested : 96
Buckets Granted: 17
Status: Active
Current Entries
Start Time%
Octets Input
UnicastMulticast
Broadcast------------ ------ --------------- ------------- ------------- -----------00d 04:15:00
0.00
3201
0
31
6
Errors------------0%
Octets Output
UnicastMulticast
Broadcast------ --------------- ------------- ------------- ------------0.00
716
4
2
0
Discards
Errors------------- ------------00Previous Entries
Start Time%
Octets Input
UnicastMulticast
Broadcast------------ ------ --------------- ------------- ------------- -----------00d 00:00:00
0.00
52248
0
560
120
00d 00:15:00
0.00
51278
0
549
99
00d 00:30:00
0.00
51252
0
546
111
00d 00:45:00
0.00
51076
0
547
99
00d 01:00:00
0.00
51636
0
546
117
00d 01:15:00
0.00
55632
0
571
108
00d 01:30:00
0.00
51990
0
546
120
00d 01:45:00
0.00
51616
0
549
102
00d 02:00:00
0.00
51444
0
546
114
00d 02:15:00
0.00
51424
0
549
99
00d 02:30:00
0.00
51168
0
543
114
00d 02:45:00
0.00
51548
0
553
99
00d 03:00:00
0.00
50602
0
545
102
00d 03:15:00
0.00
52768
0
549
120
00d 03:30:00
0.00
50272
0
543
100
00d 03:45:00
0.00
52238
0
548
116
00d 04:00:00
0.00
50602
0
545
102
Start Time

Discards– 430 –

ErrorsChapter 11 | Interface Commands------------ ------------- ------------00d 00:00:00
0
0
00d 00:15:00
0
0
00d 00:30:00
0000d 00:45:00
0000d 01:00:00
0
0
00d 01:15:00
0
0
00d 01:30:00
0000d 01:45:00
0000d 02:00:00
0
0
00d 02:15:00
0
0
00d 02:30:00
0000d 02:45:00
0000d 03:00:00
0
0
00d 03:15:00
0
0
00d 03:30:00
0000d 03:45:00
0000d 04:00:00
00
Console#show interfaces status This command displays the status for an interface.
Syntaxshow interfaces status [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id (Range: 1-4094)
Default SettingShows the status for all interfaces.
Command Mode
Normal Exec, Privileged Exec
Command Usage
If no interface is specified, information on all interfaces is displayed.
ExampleConsole#show interfaces status ethernet 1/1
Information of Eth 1/1
Basic Information:
Port Type: 1000BASE-T
MAC Address: 90-3C-B3-8C-44-B3
Configuration:
Name:Port Admin: Up– 431 –

Chapter 11 | Interface Commands

Speed-duplex: AutoCapabilities: 10half, 10full, 100half, 100full, 1000full
Broadcast Storm: Disabled
Broadcast Storm Limit : 500 packets/second
Multicast Storm: Disabled
Multicast Storm Limit : 500 packets/second
Unknown Unicast Storm: Disabled
Unknown Unicast Storm Limit : 500 packets/second
Flow Control: Disabled
VLAN Trunking: Disabled
LACP: Disabled
MAC Learning: Enabled
Media Type: NoneCurrent Status:
Link Status: Up
Port Operation Status : Up
Operation Speed-duplex : 1000full
Up Time: 0w 0d 7h 27m 37s (26857 seconds)
Flow Control Type: NoneMax Frame Size
: 1518 bytes (1522 bytes for tagged frames)
MAC Learning Status: Enabled
Console#show interfaces This command displays the administrative and operational status of the specified
switchport interfaces.
Syntaxshow interfaces switchport [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default SettingShows all interfaces.
Command Mode
Normal Exec, Privileged Exec
Command Usage
If no interface is specified, information on all interfaces is displayed.
ExampleThis example shows the configuration setting for port 1.
Console#show interfaces switchport ethernet 1/1
Information of Eth 1/1
Broadcast Threshold: Disabled
Multicast Threshold: Disabled– 432 –

Chapter 11 | Interface Commands

Unknown Unicast Threshold: Disabled
LACP Status: Disabled
Ingress Rate Limit: Disabled, 1000000 kbits/second
Egress Rate Limit: Disabled, 1000000 kbits/second
VLAN Membership Mode
: Hybrid
Ingress Rule
: Enabled
Acceptable Frame Type: All frames
Native VLAN
: 1
Priority for Untagged Traffic : 0
GVRP Status: Disabled
Allowed VLAN:
1(u)Forbidden VLAN:
802.1Q Tunnel Status: Disabled
802.1Q Tunnel Mode
: Normal
802.1Q Tunnel TPID
: 8100 (Hex)
Layer 2 Protocol Tunnel: NoneConsole#Table 81: show interfaces switchport - display description
Field

Description

BroadcastThresholdShows if broadcast storm suppression is enabled or disabled; if enabled it also
shows the threshold level (page 485).

Multicast Threshold Shows if multicast storm suppression is enabled or disabled; if enabled it also
shows the threshold level (page 485).
Unknown Unicast
ThresholdShows if unknown unicast storm suppression is enabled or disabled; if enabled
it also shows the threshold level (page 485).

Storm Threshold
Resolution

Shows configuration threshold for storm control commands.

LACP Status

Shows if Link Aggregation Control Protocol has been enabled or disabled(page 451).

Ingress/Egress Rate Shows if rate limiting is enabled, and the current rate limit (page 483).
Limit
Rate Limit
Resolution

Shows configuration threshold for rate limit commands.

VLAN Membership
Mode

Indicates membership mode as Trunk or Hybrid (page 576).

Ingress RuleShows if ingress filtering is enabled or disabled (page 575).

Acceptable FrameType

Shows if acceptable VLAN frames include all types or tagged frames only
(page 573).

Native VLAN

Indicates the default Port VLAN ID (page 577).

Priority for
Untagged Traffic

Indicates the default priority for untagged frames (page 652).

GVRP Status

Shows if GARP VLAN Registration Protocol is enabled or disabled (page 567).

Allowed VLAN

Shows the VLANs this interface has joined, where “(u)” indicates untagged and“(t)” indicates tagged (page 574).

Allowed VLAN

Shows the VLANs this interface has joined, where “(u)” indicates untagged and“(t)” indicates tagged (page 574).

Forbidden VLAN

Shows the VLANs this interface can not join (page 566).

– 433 –

Chapter 11 | Interface Commands

Table 81: show interfaces switchport - display description (Continued)
Field

Description

802.1Q-tunnel
StatusShows if 802.1Q tunnel is enabled on this interface (page 581).

802.1Q-tunnel
Mode

Shows the tunnel mode as Normal, 802.1Q Tunnel or 802.1Q Tunnel Uplink(page 582).

802.1Q-tunnel TPID Shows the Tag Protocol Identifier used for learning and switching packets(page 582).
Layer 2 Protocol
TunnelShows if Layer 2 Protocol tunnel is enabled (page 590).

Transceiver Threshold Configurationtransceiver-monitor This command sends a trap when any of the transceiver’s operational values falloutside of specified thresholds. Use the no form to disable trap messages.

Syntax[no] transceiver-monitor
Default Setting
Disabled
Command Mode
Interface Configuration
ExampleConsole(config)interface ethernet 1/1
Console(config-if)#transceiver-monitor
Console#transceiver-threshold- This command uses default threshold settings obtained from the transceiver to
auto determine when an alarm or warning message should be sent. Use the no form todisable this feature.
Syntax[no ] transceiver-threshold-auto
Default Setting
EnabledCommand Mode
Interface Configuration– 434 –

Chapter 11 | Interface Commands

ExampleConsole(config)interface ethernet 1/12
Console(config-if)#transceiver-threshold-auto
Console#transceiver-threshold This command sets thresholds for transceiver current which can be used to trigger
current an alarm or warning message. Use the no form to restore the default settings.
Syntaxtransceiver-threshold current {high-alarm | high-warning | low-alarm |low-warning} threshold-value
high-alarm – Sets the high current threshold for an alarm message.
high-warning – Sets the high current threshold for a warning message.
low-alarm – Sets the low current threshold for an alarm message.
low-warning – Sets the low current threshold for a warning message.
threshold-value – The threshold of the transceiver current.
(Range: 0-13100 in units of 0.01 mA)
Default Setting
Defaults are transceiver dependent.
Command Mode
Interface Configuration
Command Usage If trap messages are enabled with the transceiver-monitor command, and ahigh-threshold alarm or warning message is sent if the current value is greaterthan or equal to the threshold, and the last sample value was less than thethreshold. After a rising event has been generated, another such event will not
be generated until the sampled value has fallen below the high threshold andreaches the low threshold.
 If trap messages are enabled with the transceiver-monitor command, and a

low-threshold alarm or warning message is sent if the current value is less thanor equal to the threshold, and the last sample value was greater than thethreshold. After a falling event has been generated, another such event will not
be generated until the sampled value has risen above the low threshold andreaches the high threshold.

 Threshold events are triggered as described above to avoid a hysteresis effectwhich would continuously trigger event messages if the power level were tofluctuate just above and below either the high threshold or the low threshold.

 Trap messages enabled by the transceiver-monitor command are sent to any

management station configured by the snmp-server host command.
– 435 –

Chapter 11 | Interface Commands

 Transceiver-Threshold Auto must be disabled.

ExampleThe following example sets alarm thresholds for the transceiver current at port 9.
Console(config)interface ethernet 1/9
Console(config-if)#transceiver-threshold current low-alarm 100
Console(config-if)#transceiver-threshold rx-power high-alarm 700
Console#transceiver-threshold This command sets thresholds for the transceiver power level of the received signal
rx-power which can be used to trigger an alarm or warning message. Use the no form torestore the default settings.
Syntaxtransceiver-threshold rx-power {high-alarm | high-warning | low-alarm |low-warning} threshold-value
no transceiver-threshold rx-powerhigh-alarm – Sets the high power threshold for an alarm message.
high-warning – Sets the high power threshold for a warning message.
low-alarm – Sets the low power threshold for an alarm message.
low-warning – Sets the low power threshold for a warning message.
threshold-value – The power threshold of the received signal.
(Range: -4000 - 820 in units of 0.01 dBm)
Default Setting
Defaults are transceiver dependent.
Command Mode
Interface Configuration
Command Usage The threshold value is the power ratio in decibels (dB) of the measured powerreferenced to one milliwatt (mW).
 Refer to the Command Usage section under the transceiver-threshold current

command for more information on configuring transceiver thresholds.

 Trap messages enabled by the transceiver-monitor command are sent to any

management station configured by the snmp-server host command.

– 436 –

Chapter 11 | Interface Commands

ExampleThe following example sets alarm thresholds for the signal power received at port
1.
Console(config)interface ethernet 1/1
Console(config-if)#transceiver-threshold rx-power low-alarm -21
Console(config-if)#transceiver-threshold rx-power high-alarm -3
Console#transceiver-threshold This command sets thresholds for the transceiver temperature which can be usedtemperature to trigger an alarm or warning message. Use the no form to restore the default
settings.
Syntaxtransceiver-threshold temperature {high-alarm | high-warning | low-alarm| low-warning} threshold-value
no transceiver-threshold temperature
high-alarm – Sets the high temperature threshold for an alarm message.
high-warning – Sets the high temperature threshold for a warning
message.
low-alarm – Sets the low temperature threshold for an alarm message.
low-warning – Sets the low temperature threshold for a warning message.
threshold-value – The threshold of the transceiver temperature.
(Range: -12800 - 12800 in units of 0.01 Celsius)
Default Setting
Defaults are transceiver dependent.
Command Mode
Interface Configuration
Command Usage Refer to the Command Usage section under the transceiver-threshold current
command for more information on configuring transceiver thresholds.
 Trap messages enabled by the transceiver-monitor command are sent to any

management station configured by the snmp-server host command.

– 437 –

Chapter 11 | Interface Commands

ExampleThe following example sets alarm thresholds for the transceiver temperature at
port 1.
Console(config)interface ethernet 1/1
Console(config-if)#transceiver-threshold temperature low-alarm 97
Console(config-if)#transceiver-threshold temperature high-alarm -83
Console#transceiver-threshold This command sets thresholds for the transceiver power level of the transmitted
tx-power signal which can be used to trigger an alarm or warning message. Use the no form
to restore the default settings.
Syntaxtransceiver-threshold tx-power {high-alarm | high-warning | low-alarm |low-warning} threshold-value
no transceiver-threshold tx-powerhigh-alarm – Sets the high power threshold for an alarm message.
high-warning – Sets the high power threshold for a warning message.
low-alarm – Sets the low power threshold for an alarm message.
low-warning – Sets the low power threshold for a warning message.
threshold-value – The power threshold of the transmitted signal.
(Range: -4000 - 820 in units of 0.01 dBm)
Default Setting
Defaults are transceiver dependent.
Command Mode
Interface Configuration
Command Usage The threshold value is the power ratio in decibels (dB) of the measured powerreferenced to one milliwatt (mW).
 Refer to the Command Usage section under the transceiver-threshold current

command for more information on configuring transceiver thresholds.

 Trap messages enabled by the transceiver-monitor command are sent to any

management station configured by the snmp-server host command.

– 438 –

Chapter 11 | Interface Commands

ExampleThe following example sets alarm thresholds for the signal power transmitted at
port 9.
Console(config)interface ethernet 1/9
Console(config-if)#transceiver-threshold tx-power low-alarm -4000
Console(config-if)#transceiver-threshold tx-power high-alarm 820
Console#transceiver-threshold This command sets thresholds for the transceiver voltage which can be used tovoltage trigger an alarm or warning message. Use the no form to restore the default
settings.
Syntaxtransceiver-threshold voltage {high-alarm | high-warning | low-alarm |low-warning} threshold-value
no transceiver-threshold voltage
high-alarm – Sets the high voltage threshold for an alarm message.
high-warning – Sets the high voltage threshold for a warning message.
low-alarm – Sets the low voltage threshold for an alarm message.
low-warning – Sets the low voltage threshold for a warning message.
threshold-value – The threshold of the transceiver voltage.
(Range: 0-655 in units of 0.01 Volt)
Default Setting
Defaults are transceiver dependent.
Command Mode
Interface Configuration
Command Usage Refer to the Command Usage section under the transceiver-threshold current
command for more information on configuring transceiver thresholds.
 Trap messages enabled by the transceiver-monitor command are sent to any

management station configured by the snmp-server host command.

ExampleThe following example sets alarm thresholds for the transceiver voltage at port 9.
Console(config)interface ethernet 1/9
Console(config-if)#transceiver-threshold voltage low-alarm 100
Console(config-if)#transceiver-threshold voltage high-alarm 500
Console#– 439 –

Chapter 11 | Interface Commands

show interfaces This command displays identifying information for the specified transceiver,transceiver including connector type and vendor-related parameters, as well as thetemperature, voltage, bias current, transmit power, and receive power.
Syntaxshow interfaces transceiver [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 25-28)
Default SettingShows all interfaces.
Command Mode
Privileged Exec
Command Usage
The switch can display diagnostic information for SFP modules which support the
SFF-8472 Specification for Diagnostic Monitoring Interface for Optical Transceivers.
This information allows administrators to remotely diagnose problems with opticaldevices. This feature, referred to as Digital Diagnostic Monitoring (DDM) in thecommand display, provides information on transceiver parameters including
temperature, supply voltage, laser bias current, laser power, and received opticalpower, and related alarm thresholds.
ExampleConsole#show interfaces transceiver ethernet 1/28
Information of Eth 1/28
Connector Type: LC
Fiber Type: [0x00]
Eth Compliance Codes : 1000BASE-ZX
Baud Rate: 1300 MBd
Vendor OUI: 00-00-5F
Vendor Name
: SumitomoElectric
Vendor PN: SCP6G94-FN-BWH
Vendor Rev: Z
Vendor SN: SE08T712Z00006
Date Code: 10-09-14
DDM Information
Temperature: 35.64 degree C
Vcc: 3.25 V
Bias Current: 12.13 mA
TX Power: 2.36 dBm
RX Power: -24.20 dBm
DDM Thresholds
Low Alarm
Low Warning---------------------- -----------Temperature(Celsius)-45.00-40.00
Voltage(Volts)
2.90
3.00
Current(mA)
1.00
3.00
TxPower(dBm)-11.50-10.50– 440 –High Warning-----------85.00
3.60
50.00
-2.00

High Alarm-----------90.00
3.70
60.00
-1.00

Chapter 11 | Interface Commands

RxPower(dBm)
Console#-23.98-23.01

-1.00

0.00

show interfaces This command Displays the alarm/warning thresholds for temperature, voltage,transceiver-threshold bias current, transmit power, and receive power.
Syntaxshow interfaces transceiver-threshold [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 25-28)
Default SettingShows all interfaces.
Command Mode
Privileged Exec
Command Usage The switch can display diagnostic information for SFP modules which support
the SFF-8472 Specification for Diagnostic Monitoring Interface for Optical
Transceivers. This information allows administrators to remotely diagnose
problems with optical devices. This feature, referred to as Digital Diagnostic
Monitoring (DDM) in the command display, provides information ontransceiver parameters including temperature, supply voltage, laser bias
current, laser power, received optical power, and related alarm thresholds.
 The DDM thresholds displayed by this command only apply to ports whichhave a DDM-compliant transceiver inserted.

ExampleConsole#show interfaces transceiver-threshold ethernet 1/28
Information of Eth 1/28
DDM Thresholds
Transceiver-monitor: Disabled
Transceiver-threshold-auto : Enabled
Low Alarm
Low Warning High Warning---------------------- ------------ -----------Temperature(Celsius)-123.00
0.00
70.00
Voltage(Volts)
3.10
3.15
3.45
Current(mA)
6.00
7.00
90.00
TxPower(dBm)-12.00-11.50-9.50
RxPower(dBm)-21.50-21.00-3.50
Console#– 441 –High Alarm-----------75.00
3.50
100.00-9.00-3.00

Chapter 11 | Interface Commands

Cable Diagnostics

test cable-diagnostics This command performs cable diagnostics on the specified port to diagnose any
cable faults (short, open, etc.) and report the cable length.
Syntaxtest cable-diagnostics interface interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec
Command Usage Cable diagnostics are performed using an internal Digital Signal Processing test
process when the port link-up speed is 1 Gbps. The method analyses the cableby sending a pulsed signal into the cable, and then examining the reflection ofthat pulse. If the port link-up speed is not 1 Gbps, then Time Domain
Reflectometry (TDR) test method is used. TDR also detects a cable fault bysending a signal through the cable and reading the signal that is reflected back.
However, note that TDR can only determine if a link is valid or faulty.
 This cable test is only accurate for Ethernet cables 7 - 100 meters long.
 The test takes approximately 5 seconds. Use the show cable-diagnostics

command to display the results of the test, including common cable failures, aswell as the status and approximate length of each cable pair.

 Ports are linked down while running cable diagnostics.
 To ensure more accurate measurement of the length to a fault, first disable

power-saving mode (using the no power-save command) on the link partner
before running cable diagnostics.

ExampleConsole#test cable-diagnostics interface ethernet 1/24
Console#– 442 –

Chapter 11 | Interface Commands

test loop internal This command performs an internal loop back test on the specified port.
Syntaxtest loop internal interface interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec
Command Usage Loopback testing can only be performed on a port that is not linked up. Theinternal loopback makes it possible to check that an interface is working
properly without having to make any network connections.
 When performing an internal loopback test, packets from the specified

interface are looped back into its internal PHY. Outgoing data is looped back to
the receiver without actually being transmitted.

ExampleConsole#test loop internal interface ethernet 1/1
Internal loopback test: succeeded
Console#show This command shows the results of a cable diagnostics test.
cable-diagnostics
Syntaxshow cable-diagnostics interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec
Command Usage The results include common cable failures, as well as the status andapproximate distance to a fault, or the approximate cable length if no fault isfound.

– 443 –

Chapter 11 | Interface Commands

 For link-down ports, the reported distance to a fault is accurate to within +/- 2

meters. For link-up ports, the accuracy is +/- 10 meters.

 Potential conditions which may be listed by the diagnostics are shown by thelegend in the following example. Additional information is provided for thefollowing test results.







OK: Correctly terminated pair
ON: Open pair, no link partner
ST: Shorted pair
IE (Impedance mismatch): Terminating impedance is not in the reference
range.
NS (Not Supported): This message is displayed for any Gigabit Ethernet
ports linked up at a speed lower than 1000 Mbps.
UN: Unknown Error

ExampleConsole#show cable-diagnostics interface ethernet 1/7
TF: Test failed
OK: OK
ON: Open
ST: Short
IE: Impedance error
NC: No cable
NT: Not tested
NS: Not supported
UN: Unknown
Port
Type Link
Pair A
Pair B
Pair C
Pair D
Last
StatusmetersmetersmetersmetersUpdated-------- ---- -------- -------- -------- -------- -------- ----------------Eth 1/ 7 GEUp
OK (8)OK (8)OK (8)OK (8)
2019-07-16 11:54:24
Console#show loop internal This command shows the results of a loop back test.
Syntaxshow loop internal interface [interface]interfaceethernet unit/port
unit - Stack unit. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec
ExampleConsole#show loop internal interface ethernet 1/1– 444 –

Chapter 11 | Interface Commands

Port-------Eth 1/1
Console#Test Result-------------Succeeded

Last Update-------------------2024-07-15 15:26:56

Power Savings

power-save This command enables power savings mode on the specified port. Use the no form
to disable this feature.
Syntax[no] power-save
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet ports 1-24/48)
Command Usage Power saving mode only applies to the Ethernet ports using copper media.
 Power savings can be enabled on Ethernet RJ-45 ports.
 The power-saving methods provided by this switch include:Power saving when there is no link partner:
Under normal operation, the switch continuously auto-negotiates to find alink partner, keeping the MAC interface powered up even if no linkconnection exists. When using power-savings mode, the switch checks forenergy on the circuit to determine if there is a link partner. If none isdetected, the switch automatically turns off the transmitter, and most of
the receive circuitry (entering Sleep Mode). In this mode, the low-power
energy-detection circuit continuously checks for energy on the cable. If
none is detected, the MAC interface is also powered down to save
additional energy. If energy is detected, the switch immediately turns on
both the transmitter and receiver functions, and powers up the MAC
interface.

Power saving when there is a link partner:
Traditional Ethernet connections typically operate with enough power tosupport at least 100 meters of cable even though average network cable
length is shorter. When power-savings mode is enabled, the switch
determines whether or not it can reduce the signal amplitude used on aparticular link.

– 445 –

Chapter 11 | Interface Commands

 When the power-save command is enabled and traffic is reduced there is areduction in power. For example, factory hardware component testing has
shown significant power reduction >10%-45%10 are realized when 1000M
Ethernet ports operate at slower rates from 300 to 0 Mbps.

Note: Power savings can only be implemented on Ethernet ports using twistedpair cabling. Power-savings mode on a active link only works when connection
speed is 1/10 Gbps, and line length is less than 60 meters.

ExampleConsole(config)#interface ethernet 1/24
Console(config-if)#power-save
Console(config-if)#show power-save This command shows the configuration settings for power savings.
Syntaxshow power-save [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec
ExampleConsole#show power-save interface ethernet 1/24
Power Saving Status:
Ethernet 1/24 : Enabled
Console#10. The percentage reduction is for the switch hardware interface internal component only.

– 446 –

12

Link Aggregation Commands

Ports can be statically grouped into an aggregate link (i.e., trunk) to increase thebandwidth of a network connection or to ensure fault recovery. Or you can use the
Link Aggregation Control Protocol (LACP) to automatically negotiate a trunk link
between this switch and another network device. For static trunks, the switches
have to comply with the Cisco EtherChannel standard. For dynamic trunks, theswitches have to comply with LACP. This switch supports up to 28 trunks. For
example, a trunk consisting of two 1000 Mbps ports can support an aggregate
bandwidth of 4 Gbps when operating at full duplex.
Table 82: Link Aggregation Commands
CommandFunction

Mode

Manual Configuration Commands
interface port-channel

Configures a trunk and enters interface
configuration mode for the trunkGC

port-channelload-balance

Sets the load-distribution method among ports inaggregated links

GC

channel-group

Adds a port to a trunk

IC (Ethernet)

Dynamic Configuration Commands
lacp

Configures LACP for the current interface

IC (Ethernet)

lacp actor/partner mode Configures the port’s LACP actor or partner(Ethernet Interface)negotiation activity mode

IC (Ethernet)

lacp admin-key

Configures a port's administration key

IC (Ethernet)

lacp port-priority

Configures a port's LACP port priority

IC (Ethernet)

lacp system-priority

Configures a port's LACP system priority

IC (Ethernet)

lacp admin-key

Configures an port channel’s administration key

IC (Port Channel)

lacp timeout

Configures the timeout to wait for next LACPDU

IC (Port Channel)

Trunk Status Display Commands
show interfaces status
port-channel

Shows trunk information

NE, PEshow lacp

Shows LACP information

PEshow port-channel load- Shows the load-distribution method used onbalanceaggregated links

PE

Multi-Chassis Link Aggregation Group Commands
mlag

Enables MLAG globallyGC

mlag domain peer-link

Configures the MLAG domain peer linkGC

mlag group member

Configures MLAG domain member ports

GC– 447 –

Chapter 12 | Link Aggregation Commands

Table 82: Link Aggregation Commands
CommandFunctionModeshow mlag

Shows MLAG configuration settingsPEshow mlag groupShows MLAG group settingsPEshow mlag domain

Shows MLAG domain settingsPE

Guidelines for Creating Trunks
General Guidelines – Finish configuring trunks before you connect the corresponding network

cables between switches to avoid creating a loop.

 A trunk can have up to 8 ports.
 The ports at both ends of a connection must be configured as trunk ports.
 All ports in a trunk must be configured in an identical manner, including

communication mode (i.e., speed and duplex mode), VLAN assignments, and
CoS settings.

 Any of the Gigabit ports on the front panel can be trunked together, including

ports of different media types.

 All the ports in a trunk have to be treated as a whole when moved from/to,

added or deleted from a VLAN via the specified port-channel.

 STP, VLAN, and IGMP settings can only be made for the entire trunk via thespecified port-channel.

Dynamically Creating a Port Channel –Ports assigned to a common port channel must meet the following criteria: Ports must have the same LACP system priority.
 Ports must have the same port admin key (Ethernet Interface).
 If the port channel admin key (lacp admin key - Port Channel) is not set when achannel group is formed (i.e., it has the null value of 0), the operational key is
set to the same value as the operational key of the first member port.

 However, if the port channel admin key is set, then the port admin key must be

set to the same value for a port to be allowed to join a channel group.

 If a link goes down, LACP port priority is used to select the backup link.

– 448 –

Chapter 12 | Link Aggregation Commands

Manual Configuration Commands

port-channel This command sets the load-distribution method among ports in aggregated links
load-balance (for both static and dynamic trunks). Use the no form to restore the default setting.
Syntaxport-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip| src-mac}
no port-channel load-balance
dst-ip - Load balancing based on destination IP address.
dst-mac - Load balancing based on destination MAC address.
src-dst-ip - Load balancing based on source and destination IP address.
src-dst-mac - Load balancing based on source and destination MAC
address.
src-ip - Load balancing based on source IP address.
src-mac - Load balancing based on source MAC address.
Default Setting
src-dst-ip
Command Mode
Global Configuration
Command Usage This command applies to all static and dynamic trunks on the switch.
 To ensure that the switch traffic load is distributed evenly across all links in atrunk, select the source and destination addresses used in the load-balancecalculation to provide the best result for trunk connections:

dst-ip: All traffic with the same destination IP address is output on thesame link in a trunk. This mode works best for switch-to-router trunk links
where traffic through the switch is destined for many different hosts. Do
not use this mode for switch-to-server trunk links where the destination IP
address is the same for all traffic.

dst-mac: All traffic with the same destination MAC address is output on thesame link in a trunk. This mode works best for switch-to-switch trunk links
where traffic through the switch is destined for many different hosts. Do
not use this mode for switch-to-router trunk links where the destination
MAC address is the same for all traffic.

src-dst-ip: All traffic with the same source and destination IP address is
output on the same link in a trunk. This mode works best for switch-to-– 449 –

Chapter 12 | Link Aggregation Commands

router trunk links where traffic through the switch is received from anddestined for many different hosts.


src-dst-mac: All traffic with the same source and destination MAC address
is output on the same link in a trunk. This mode works best for switch-toswitch trunk links where traffic through the switch is received from anddestined for many different hosts.



src-ip: All traffic with the same source IP address is output on the same linkin a trunk. This mode works best for switch-to-router or switch-to-server
trunk links where traffic through the switch is received from many different
hosts.

src-mac: All traffic with the same source MAC address is output on thesame link in a trunk. This mode works best for switch-to-switch trunk links
where traffic through the switch is received from many different hosts.

ExampleConsole(config)#port-channel load-balance dst-ip
Console(config)#channel-group This command adds a port to a trunk. Use the no form to remove a port from atrunk.

Syntaxchannel-group channel-id
no channel-groupchannel-id - Trunk index (Range: 1-28)
Default Setting
The current port is not a member of any trunk.
Command Mode
Interface Configuration (Ethernet)
Command Usage When configuring static trunks, the switches must comply with the Cisco
EtherChannel standard.
 Use no channel-group to remove a port group from a trunk.
 Use no interface port-channel to remove a trunk from the switch.

– 450 –

Chapter 12 | Link Aggregation Commands

ExampleThe following example creates trunk 1 and then adds port 10:
Console(config)#interface port-channel 1
Console(config-if)#exit
Console(config)#interface ethernet 1/10
Console(config-if)#channel-group 1
Console(config-if)#Dynamic Configuration Commands

lacp This command enables 802.3ad Link Aggregation Control Protocol (LACP) for thecurrent interface. Use the no form to disable it.
Syntax[no] lacp
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
Command Usage The ports on both ends of an LACP trunk must be configured for full duplex.
 A trunk formed with another switch using LACP will automatically be assigned

the next available port-channel ID.

 If the target switch has also enabled LACP on the connected ports, the trunk

will be activated automatically.

 If more than eight ports attached to the same target switch have LACP enabled,

the additional ports will be placed in standby mode, and will only be enabled if
one of the active links fails.

ExampleThe following shows LACP enabled on ports 1-3. Because LACP has also beenenabled on the ports at the other end of the links, the show interfaces status portchannel 1 command shows that Trunk1 has been established.
Console(config)#interface ethernet 1/25
Console(config-if)#lacp
Console(config-if)#interface ethernet 1/26
Console(config-if)#lacp
Console(config-if)#interface ethernet 1/27
Console(config-if)#lacp
Console(config-if)#end– 451 –

Chapter 12 | Link Aggregation Commands

Console#show interfaces status port-channel 1
Information of Trunk 1
Basic Information:
Port Type: 10GBASE SFP+
MAC Address: 12-34-12-34-12-3F
Configuration:
Name:Port Admin: Up
Speed-duplex: 10GfullBroadcast Storm: Enabled
Broadcast Storm Limit : 500 packets/second
Multicast Storm: Disabled
Multicast Storm Limit : 500 packets/second
Unknown Unicast Storm: Disabled
Unknown Unicast Storm Limit : 500 packets/second
Storm Threshold Resolution : 1 packets/second
Flow Control: Disabled
MAC Learning: Enabled
Link-up-down Trap
: Enabled
Current status:
Created By: LACP
Link Status: Up
Port Operation Status : Up
Operation Speed-duplex : 10Gfull
Up Time: 0w 0d 0h 0m 53s (53 seconds)
Flow Control Type: NoneMax Frame Size
: 1518 bytes (1522 bytes for tagged frames)
MAC Learning Status: Enabled
Member Ports: Eth1/25, Eth1/26, Eth1/27,
Active Member Ports: Eth1/25, Eth1/26, Eth1/27,
Console#lacp actor/partner This command configures a port's LACP actor or partner negotiation activity mode.
mode (Ethernet Interface) Use the no form to restore to the default setting.
Syntaxlacp {actor | partner} mode {active | passive}no lacp {actor | partner} mode
actor - The local side an aggregate link.
partner - The remote side of an aggregate link.
mode - Configures the negotiation activity mode.
active - Specifies the port’s activity mode to initiate and transmit LACP
negotiation packets.
passive - Specifies the port’s activity mode to only respond to LACP
negotiation packets.
Default Setting
Actor: Active, Partner: Passive
Command Mode
Interface Configuration (Ethernet)– 452 –

Chapter 12 | Link Aggregation Commands

Command Usage An LACP trunk cannot be instantiated if both sides are set to passive.
ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#lacp actor mode passive
Console(config-if)#lacp admin-key This command configures a port's LACP administration key. Use the no form to(Ethernet Interface) restore the default setting.

Syntaxlacp {actor | partner} admin-key key
no lacp {actor | partner} admin-key
actor - The local side an aggregate link.
partner - The remote side of an aggregate link.
key - The port admin key must be set to the same value for ports thatbelong to the same link aggregation group (LAG). (Range: 0-65535)
Default Setting
Actor: 1, Partner: 0
Command Mode
Interface Configuration (Ethernet)
Command Usage Ports are only allowed to join the same LAG if (1) the LACP system priority
matches, (2) the LACP port admin key matches, and (3) the LACP port channel
key matches (if configured).
 If the port channel admin key (lacp admin key - Port Channel) is not set when achannel group is formed (i.e., it has the null value of 0), this key is set to thesame value as the port admin key (lacp admin key - Ethernet Interface) usedby the interfaces that joined the group.

 Once the remote side of a link has been established, LACP operational settings

are already in use on that side. Configuring LACP settings for the partner only
applies to its administrative state, not its operational state.

Note: Configuring the partner admin-key does not affect remote or local switch
operation. The local switch just records the partner admin-key for user reference.
 If the admin key is not set, the actor’s operational key is determined by port's

link speed (10G - 5, 1000f - 4, 100f - 3, 10f - 2).
– 453 –

Chapter 12 | Link Aggregation Commands

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#lacp actor admin-key 120
Console(config-if)#lacp port-priority This command configures LACP port priority. Use the no form to restore the default
setting.
Syntaxlacp {actor | partner} port-priority priority
no lacp {actor | partner} port-priority
actor - The local side an aggregate link.
partner - The remote side of an aggregate link.
priority - LACP port priority is used to select a backup link. (Range: 0-65535)
Default Setting
32768
Command Mode
Interface Configuration (Ethernet)
Command Usage Setting a lower value indicates a higher effective priority.
 If an active port link goes down, the backup port with the highest priority is

selected to replace the downed link. However, if two or more ports have thesame LACP port priority, the port with the lowest physical port number will beselected as the backup port.

 If an LAG already exists with the maximum number of allowed port members,and LACP is subsequently enabled on another port using a higher priority thanan existing member, the newly configured port will replace an existing port
member that has a lower priority.

 Once the remote side of a link has been established, LACP operational settings

are already in use on that side. Configuring LACP settings for the partner only
applies to its administrative state, not its operational state, and will only takeeffect the next time an aggregate link is established with the partner.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#lacp actor port-priority 128– 454 –

Chapter 12 | Link Aggregation Commands

lacp system-priority This command configures a port's LACP system priority. Use the no form to restore
the default setting.
Syntaxlacp {actor | partner} system-priority priority
no lacp {actor | partner} system-priority
actor - The local side an aggregate link.
partner - The remote side of an aggregate link.
priority - This priority is used to determine link aggregation group (LAG)
membership, and to identify this device to other switches during LAG
negotiations. (Range: 0-65535)
Default Setting
32768
Command Mode
Interface Configuration (Ethernet)
Command Usage Port must be configured with the same system priority to join the same LAG.
 System priority is combined with the switch’s MAC address to form the LAG

identifier. This identifier is used to indicate a specific LAG during LACP
negotiations with other systems.

 Once the remote side of a link has been established, LACP operational settings

are already in use on that side. Configuring LACP settings for the partner only
applies to its administrative state, not its operational state, and will only takeeffect the next time an aggregate link is established with the partner.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#lacp actor system-priority 3
Console(config-if)#lacp admin-key This command configures a port channel's LACP administration key. Use the no(Port Channel) form to restore the default setting.

Syntaxlacp admin-key key
no lacp admin-key
key - The port channel admin key is used to identify a specific linkaggregation group (LAG) during local LACP setup on this switch.
(Range: 0-65535)– 455 –

Chapter 12 | Link Aggregation Commands

Default Setting
None
Command Mode
Interface Configuration (Port Channel)
Command Usage Ports are only allowed to join the same LAG if (1) the LACP system priority
matches, (2) the LACP port admin key matches, and (3) the LACP port channel
key matches (if configured).
 If the port channel admin key (lacp admin key - Port Channel) is not set when achannel group is formed (i.e., it has the null value of 0), the operational key is
set to the same value as the operational key of the first member port. Note thatwhen the LAG is no longer used, the port channel admin key is reset to 0.

ExampleConsole(config)#interface port-channel 1
Console(config-if)#lacp admin-key 3
Console(config-if)#lacp timeout This command configures the timeout to wait for the next LACP data unit
(LACPDU).
Syntaxlacp timeout {long | short}
long - Specifies a slow timeout of 90 seconds.
short - Specifies a fast timeout of 3 seconds.
Default Setting
long
Command Mode
Interface Configuration (Port Channel)
Command Usage The timeout configured by this command is set in the LACP timeout bit of theActor State field in transmitted LACPDUs. When the partner switch receives an
LACPDU set with a short timeout from the actor switch, the partner adjusts thetransmit LACPDU interval to 1 second. When it receives an LACPDU set with along timeout from the actor, it adjusts the transmit LACPDU interval to 30
seconds.
 If the actor does not receive an LACPDU from its partner before the configured

timeout expires, the partner port information will be deleted from the LACP
group.
– 456 –

Chapter 12 | Link Aggregation Commands

 When a dynamic port-channel member leaves a port-channel, the default

timeout value will be restored on that port.

 When a dynamic port-channel is torn down, the configured timeout value will

be retained. When the dynamic port-channel is constructed again, that timeout
value will be used.

ExampleConsole(config)#interface port-channel 1
Console(config-if)#lacp timeout shortConsole(config-if)#

Trunk Status Display Commands

show lacp This command displays LACP information.
Syntaxshow lacp [port-channel] {counters | internal | neighbors }port-channel - Local identifier for a link aggregation group. (Range: 1-28)
counters - Statistics for LACP protocol messages.
internal - Configuration settings and operational state for local side.
neighbors - Configuration settings and operational state for remote side.
Default Setting
Port Channel: all
Command Mode
Privileged Exec
ExampleConsole#show lacp 1 counters
Port Channel: 1
Member Port
: Eth 1/14
LACPDU Sent
: 7
LACPDU Received: 6MarkerPDU Sent
: 0MarkerPDU Received: 0MarkerResponsePDU Sent
: 0MarkerResponsePDU Received : 0
Unknown Packet Received: 0
Illegal Packet Received
: 0
.
.
.

– 457 –

Chapter 12 | Link Aggregation Commands

Table 83: show lacp counters - display description
Field

Description

Port Channel

The LACP port channel trunk number.

Member Port

The Ethernet interface that is a member of the LACP port-channel trunk.

LACPDUs Sent

Number of valid LACPDUs transmitted from this channel group.

LACPDUs Received

Number of valid LACPDUs received on this channel group.

MarkerPDU Sent

Number of valid Marker PDUs transmitted from this channel group.

MarkerPDU Received

Number of valid Marker PDUs received by this channel group.

MarkerResponsePDU
Sent

Number of valid MarkerResponse PDUs transmitted from this channel group.

MarkerResponsePDU
Received

Number of valid MarkerResponse PDUs received by this channel group.

Unknown Packet
Received

Number of frames received that either (1) Carry the Slow Protocols Ethernet
Type value, but contain an unknown PDU, or (2) are addressed to the Slow
Protocols group MAC Address, but do not carry the Slow Protocols Ethernet
Type.

Illegal Packet Received Number of frames that carry the Slow Protocols Ethernet Type value, but
contain a badly formed PDU or an illegal value of Protocol Subtype.

Console#show lacp 1 internalPort Channel : 1
Admin Key: 0
Oper Key: 4
Timeout: Long-----------------------------------------------------------Member Port
: Eth 1/14
Periodic Time: 30 seconds
System Priority : 32768
Port Priority: 32768
Admin Key: 4
Oper Key: 4
Admin State: Defaulted, Aggregatable, Long Timeout, Actvie LACPOper State: Distributing, Collecting, Synchronization, Aggregatable,
Long Timeout, Actvie LACP.
.
.

Table 84: show lacp internal - display description
Field

Description

Port Channel

The LACP port channel trunk number.

Admin Key

Current administrative value of the key for the aggregation port.

Oper Key

Current operational value of the key for the aggregation port.

Timeout

Time to wait for the next LACPDU before deleting partner port information.

Periodic TimeThe number of seconds between periodic LACPDU transmissions.

System Priority

LACP system priority assigned to this port channel.

Port Priority

LACP port priority assigned to this interface within the channel group.

– 458 –

Chapter 12 | Link Aggregation Commands

Table 84: show lacp internal - display description (Continued)
Field

Description

Admin State,
Oper State Expired – The actor’s receive machine is in the expired state;

Administrative or operational values of the actor’s state parameters:
 Defaulted – The actor’s receive machine is using defaulted operational

partner information, administratively configured for the partner.

 Distributing – If false, distribution of outgoing frames on this link isdisabled; i.e., distribution is currently disabled and is not expected to beenabled in the absence of administrative changes or changes in received
protocol information.
 Collecting – Collection of incoming frames on this link is enabled; i.e.,collection is currently enabled and is not expected to be disabled in theabsence of administrative changes or changes in received protocol
information.
 Synchronization – The System considers this link to be IN_SYNC; i.e., it has
been allocated to the correct Link Aggregation Group, the group has been
associated with a compatible Aggregator, and the identity of the Link
Aggregation Group is consistent with the System ID and operational Key
information transmitted.
Admin State,
Oper State(continued)

 Aggregation – The system considers this link to be aggregatable; i.e., apotential candidate for aggregation.

 Long timeout – Periodic transmission of LACPDUs uses a slow transmissionrate.
 LACP-Activity – Activity control value with regard to this link.
(0: Passive; 1: Active)

Console#show lacp 1 neighbors
Port Channel : 1-----------------------------------------------------------Member Port
: Eth 1/14
Partner Admin System ID : 32768, 00-00-00-00-00-00
Partner Oper System ID : 32768, FC-0A-81-B7-C7-E0
Partner Admin Port ID: 32768, 14
Partner Oper Port ID: 32768, 14
Partner Admin Key: 0
Partner Oper Key: 4
Partner Admin State: Defaulted, Distributing, Collecting,
Synchronization, Long Timeout, Passive LACP
Partner Oper State: Distributing, Collecting, Synchronization,
Aggregatable, Long Timeout, Actvie LACP.
.
.

Table 85: show lacp neighbors - display description
Field

Description

Port Channel

The LACP port channel trunk number.

Member Port

The Ethernet interface that is a member of the LACP port-channel trunk.

Partner Admin
System ID

LAG partner’s system ID assigned by the user.

Partner Oper
System ID

LAG partner’s system ID assigned by the LACP protocol.

Partner Admin Port
ID

Current administrative value of the port number for the protocol Partner.

– 459 –

Chapter 12 | Link Aggregation Commands

Table 85: show lacp neighbors - display description (Continued)
Field

Description

Partner Oper PortID

Operational port number assigned to this aggregation port by the port’s
protocol partner.

Partner Admin Key

Current administrative value of the Key for the protocol partner.

Partner Oper Key

Current operational value of the Key for the protocol partner.

Partner Admin State Administrative values of the partner’s state parameters. (See preceding table.)Partner Oper State

Operational values of the partner’s state parameters. (See preceding table.)

Console#show lacp sysid
Port Channel
System Priority
System MAC Address------------------------------------------------------------------------1
32768
00-30-F1-8F-2C-A7
232768
00-30-F1-8F-2C-A7
332768
00-30-F1-8F-2C-A7
432768
00-30-F1-8F-2C-A7
532768
00-30-F1-8F-2C-A7
6
32768
00-30-F1-8F-2C-A7
7
32768
00-30-F1-D4-73-A0
832768
00-30-F1-D4-73-A0
932768
00-30-F1-D4-73-A0
1032768
00-30-F1-D4-73-A0
1132768
00-30-F1-D4-73-A0
1232768
00-30-F1-D4-73-A0.
.
.

Table 86: show lacp sysid - display description
Field

Description

Channel group

A link aggregation group configured on this switch.

System Priority*

LACP system priority for this channel group.

System MAC
Address*

System MAC address.

* The LACP system priority and system MAC address are concatenated to form the LAG system ID.

show port-channel This command shows the load-distribution method used on aggregated links.
load-balance
Command Mode
Privileged Exec
ExampleConsole#show port-channel load-balance
Trunk Load Balance Mode: Destination IP address
Console– 460 –

Chapter 12 | Link Aggregation Commands

MLAG Commands

A multi-chassis link aggregation group (MLAG) is a pair of links that terminate on
two cooperating switches and appear as an ordinary link aggregation group (LAG).
The cooperating switches are MLAG peer switches and communicate through aninterface called a peer link. While the peer link’s primary purpose is exchanging
MLAG control information between peer switches, but also carries data traffic fromdevices that are attached to only one MLAG peer and have no alternative path. An
MLAG domain consists of the peer switches and the control links that connect
these switches.
Figure 1: MLAG Domain Topology

MLAG Configuration
 MLAG must be enabled globally using the mlag command.
 The MLAG domain ID and peer link must be set using the mlag domain

peer-link command.

 The MLAG ID, associated MLAG domain ID and MLAG member must be

configured using the mlag group member command. The associated MLAG
domain may be nonexistent, which causes MLAG to be inactive locally.

 For a port to be configured as MLAG peer link or member:

STP status of the port must be disabled.



LACP status of the port must be disabled.

The port must not be any type of traffic segmentation port.

– 461 –

Chapter 12 | Link Aggregation Commands

MLAG Restrictions
 Traffic segmentation up-link/down-link port cannot be configured on an MLAG

member or peer link.

 All actions which cause a port to become nonexistent, such as deleting a trunk

port, adding a port to a trunk, or enabling LACP, are not allowed for an MLAG
member or peer link. Also, a trunk member port is not allowed to be an MLAG
member or peer link.

 STP cannot be enabled on a peer link or an MLAG member. An STP enabled

port cannot be configured as a peer link or an MLAG member.

mlag This command enables MLAG globally on the switch. Use the no form to disable
MLAG.

Syntax[no] mlag
Default Setting
EnabledCommand Mode
Global Configuration
ExampleConsole(config)#mlag
Console(config)#

mlag domain This command configures an MLAG domain. Use the no form to remove the MLAG
peer-link domain.
Syntaxmlag domain domain-id peer-link interface
no mlag domain domain-id
domain-id – Domain identifier. (Range: 1-16 characters)interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)– 462 –

Chapter 12 | Link Aggregation Commands

Command Usage There shall be one and only one peer link for a pair of MLAG devices in the same
MLAG domain. (See Figure 1.)
 The peer link can be a normal port or a static trunk.
 MAC learning is automatically disabled for the peer link.
 An MLAG domain is active if the domain ID and a peer link are set.

Command Mode
Global Configuration
ExampleConsole(config)#mlag domain 1 peer-link ethernet 1/1
Console(config)#

mlag group member This command configures MLAG domain member ports. Use the no form to
remove member ports.
Syntaxmlag group mlag-id domain domain-id member interface
no domain domain-id
mlag-id – MLAG identifier. (Range: 1-1000)
domain-id – Domain identifier. (Range: 1-16 characters)interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Global Configuration
Command Usage An MLAG domain can have two and only two MLAG devices. (See Figure 1.)
 An MLAG domain may have many MLAGs.
 An MLAG can belong to one and only one MLAG domain.
 The associated MLAG domain may be nonexistent, which causes the MLAG to

be inactive locally.

– 463 –

Chapter 12 | Link Aggregation Commands

 There can be one and only one MLAG member for each MLAG on an MLAG

device.

 The MLAG member can be a normal port or a static trunk.
 An MLAG member is active if the MLAG ID is set and the associated MLAG

domain is active.

 An MLAG is formed when the peer MLAG members are both active.
 The following items apply when an MLAG is formed.
When an MLAG member is operationally up and the MLAG peer member is
not operationally down, all traffic from the peer link can not be forwarded
to the MLAG member.

When an MLAG member is operationally up and the MLAG peer member isoperationally down, all traffic from the peer link can be forwarded to the
MLAG member.

When an MLAG member is operationally up, all updates for learned MAC
addresses on the MLAG peer member will be synced to the MLAG member
automatically.

When an MLAG member is operationally down, all updates for learned MAC
addresses on the MLAG peer member will be synced through the peer link
automatically.
Figure 2: MLAG Peer Operation

 When the MLAG peer member is down or nonexistent, learned MAC addresses

synced through the peer link for the MLAG will be removed automatically.

 All updates of learned MAC addresses of non MLAG ports on a peer device shallbe synced to the peer link automatically.

ExampleConsole(config)#mlag group 1 domain 1 member ethernet 1/1
Console(config)#– 464 –

Chapter 12 | Link Aggregation Commands

show mlag This command shows MLAG configuration settings.
Command Mode
Privileged Exec
ExampleConsole#show mlag
Global Status : Enabled
Domain List
: 1,2
MLAG List: 10,20,30-35,50
Console#show mlag group The command shows MLAG group settings.
Command Mode
Privileged Exec
Syntaxshow mlag group mlag-id
mlag-id – MLAG identifier. (Range: 1-1000)
ExampleConsole#show mlag group 1
Console#show mlag domain The command shows MLAG domain settings.
Command Mode
Privileged Exec
Syntaxshow mlag domain domain-id
domain-id – Domain identifier. (Range: 1-16 characters)
ExampleConsole#show mlag domain 1
Peer Link : Eth 1/1
MLAG List : 10,20,33-35
Console#– 465 –

Chapter 12 | Link Aggregation Commands– 466 –

13

Power over Ethernet Commands

The commands in this group control the power that can be delivered to attached
PoE devices through RJ-45 ports 1-24 on the ECS4150-28P and 1-48 on the
ECS4150-54P.
The switch’s power management enables total switch power and individual port
power to be controlled within a configured power budget. Port power can be
automatically turned on and off for connected devices, and a per-port power
priority can be set so that the switch never exceeds its allocated power budget.
When a device is connected to a switch port, its power requirements are detectedby the switch before power is supplied. If the power required by a device exceeds
the power budget of the port or the whole switch, port power and priority settings
are used to control the supplied power.
Table 87: PoE Commands
CommandFunctionModepower inline

Turns power on and off for specific ports

IC

power inline maximum
allocation

Sets the maximum power available to specific switch ports

IC

power inline priority

Sets the priority for power supplied to specific ports

ICshow power inline status Displays the current status of power management on specific PE
ports or all ports
show power inline time- Shows the time-range and current status for specific ports or PE
range
for all ports
show power mainpower Displays current status of power management for the switchPE

power inline This command instructs the switch to automatically detect if a PoE-compliant

device is connected to the specified port, and turn power on or off accordingly(optionally using an applied time range). Use the no form to turn off power for aport, or the no form with the time-range keyword to remove the time range
settings.
Syntaxpower inline [time-range time-range-name]no power inline [time-range]time-range-name - Name of a time-range during which PoE is supplied tothe attached device. (Range: 1-30 characters)– 467 –

Chapter 13 | Power over Ethernet Commands

Default Setting
Detection is enabled for PoE-compliant devices.
Command Mode
Interface Configuration (Ethernet RJ-45 ports)
Command Usage The switch only provides power to the Gigabit Ethernet copper-media ports.
 When detection is enabled for PoE-compliant devices, power is automaticallysupplied when a device is detected on the port, providing that the power
demanded does not exceed the port’s power budget or the switch’s powerbudget.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#power inline
Console(config-if)#exit
Console(config)#interface ethernet 1/2
Console(config-if)#no power inline
Console(config-if)#

Related Commands
time-range (180)

power inline This command limits the power allocated to specific ports. Use the no form tomaximum allocation restore the default setting.
Syntaxpower inline maximum allocation classno power inline maximum allocation
class - The maximum power classification for the port.
(Options: 1, 2, 3, 4, 5, 6, 7, 8)
Default Setting
Ports 1-40: Class 4 (30000 milliwatts)
Ports 41-48: Class 8 (90000 milliwatts)
Command Mode
Interface Configuration (Ethernet RJ-45 ports)– 468 –

Chapter 13 | Power over Ethernet Commands

Command Usage The following table define the maximum power of each PD class.
Table 88: Maximum PoE Based on PD Classification
PD Class

Maximum Power (Watts)

Class 1

4Class 2

7Class 3

15.4

Class 430

Class 545

Class 660

Class 775

Class 890

 The total PoE power delivered by all ports cannot exceed the switch’s maximum

power budget.

 If a device is connected to a switch port and the switch detects that it requires

more than the maximum power allocated to the port, no power is supplied tothe device (i.e., port power remains off ).

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#power inline maximum allocation 3
Changing maximum allocation may turn off port.Do you want to change? <y/n>yConsole(config-if)#

power inline priority This command sets the power priority for specific ports. Use the no form to restore
the default setting.
Syntaxpower inline priority priority
no power inline priority
priority - The power priority for the port.
Options: 1 (critical), 2 (high), or 3 (low)Default Setting
3 (low)
Command Mode
Interface Configuration (Ethernet RJ-45 ports)– 469 –

Chapter 13 | Power over Ethernet Commands

Command Usage If the power demand from devices connected to all switch ports exceeds thepower budget set for the switch, the port power priority settings are used tocontrol the supplied power.


If a device connected to a low-priority port causes the switch to exceed its
budget, power will be dropped from low-priority ports starting in reverse
sequence from the highest RJ-45 port number.
For example, with all ports low priority and ports 2-13 on, when you
connect port 1, power to port 13 will turn off and power to port 1 will turnon.



If a device is connected to a critical or high-priority port that would cause
the switch to exceed its power budget as determined during bootup,
power is provided to the port only if the switch can drop power to one ormore lower-priority ports and thereby remain within its overall budget.
Power will be dropped from lower-priority ports starting in reverse
sequence from the highest RJ-45 port number..
For example, if ports 2 to 14 request 30W and ports 2-12 are low priority
with ports 13-14 high priority, port 12 will turn off and ports 2-11 and 13-14
will turn on.



If priority is not set for any ports, and PoE consumption exceeds the
maximum power provided by the switch, power is shut down starting inreverse sequence from the highest RJ-45 port number.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#power inline priority 2
Console(config-if)#show power inline This command displays the current power status for all ports or for specific ports.
statusSyntaxshow power inline status [interface]interfaceethernet
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec

– 470 –

Chapter 13 | Power over Ethernet Commands

ExampleConsole#show power inline status
Unit: 1Compatible Mode : Enabled
Time
Max
Used
Interface Admin
Range
Oper PowerPower
Priority--------- -------- -------- ---- -------- -------- -------Eth 1/ 1 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 2 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 3 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 4 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 5 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 6 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 7 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 8 Enabled -Off 30000 mW
0 mW Low
Eth 1/ 9 Enabled -Off 30000 mW
0 mW Low
Eth 1/10 Enabled -Off 30000 mW
0 mW Low
Eth 1/11 Enabled -Off 30000 mW
0 mW Low
Eth 1/12 Enabled -Off 30000 mW
0 mW Low.
.
.

Table 89: show power inline status - display description
Field

Description

Admin

The power mode set on the port (see power inline)

Time Range

Time during which power is suppliedOper

The current operating power status (displays on, off, or Ovld)
Note that if a port status is Ovld, you have to first turn off port power (no power
inline) and then turn it back on (power inline) to provide power on the port.

Max Power

The maximum power allocated to this port (see power inline maximum
allocation)

Used PowerThe current power consumption on the port in milliwatts

Priority

The port’s power priority setting (see power inline priority)

show power inline This command displays the time-range and current status for specific ports or for all
time-range ports.
Syntaxshow power inline time-range [interface]interfaceethernet
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-24/48)
Command Mode
Privileged Exec

– 471 –

Chapter 13 | Power over Ethernet Commands

ExampleConsole#show power inline time-range ethernet 1/5
Interface Time Range Name Status--------- ---------------- -------Eth 1/ 5 r&dInactive
Console#Related Commands
power inline (467)show power Use this command to display the current power status for the switch.
mainpower
Command Mode
Privileged Exec
ExampleThis example shows the maximum available PoE power and maximum allocated
PoE power for the ECS4150-28P.
Console#show power mainpower
Unit 1 PoE Status
PoE Maximum Available Power : 370.0 Watts (using main power)
PoE Maximum Allocation Power : 370.0 Watts
System Operation Status: Off
PoE Power Consumption: 0.0 Watts
Software Version: Version 0007 (Hex)Console#Table 90: show power mainpower - display description
Field

Description

PoE Maximum
Available PowerThe available power budget for the switch

PoE Maximum
Allocation PowerThe overall maximum power which is allocated to switch ports.

System Operation
Status

The current operating power status (displays on or off)

PoE Power
Consumption

The current power consumption on the switch in watts

Software Version

The version of software running on the PoE controller subsystem in the switch.

– 472 –

14

Port Mirroring Commands

Data can be mirrored from a local port on the same switch or from a remote port on
another switch for analysis at the target port using software monitoring tools or a
hardware probe. This switch supports the following mirroring modes.
Table 91: Port Mirroring Commands
CommandFunction

Local Port Mirroring

Mirrors data to another port for analysis without affecting the data passing
through or the performance of the monitored port

RSPAN Mirroring

Mirrors data from remote switches over a dedicated VLAN

Local Port Mirroring Commands
This section describes how to mirror traffic from a source port to a target port.
Table 92: Mirror Port Commands
CommandFunctionModeport monitor

Configures a mirror session

ICshow port monitor

Shows the configuration for a mirror port

PE

port monitor This command configures a mirror session. Use the no form to clear a mirror
session.
Syntaxport monitor {interface [rx | tx | both] | vlan vlan-id |mac-address mac-address | access-list acl-name}no port monitor {interface | vlan vlan-id |mac-address mac-address | access-list acl-name}interfaceethernet unit/port (source port)
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
rx - Mirror received packets.
tx - Mirror transmitted packets.
– 473 –

Chapter 14 | Port Mirroring Commands
Local Port Mirroring Commands
both - Mirror both received and transmitted packets.
vlan-id - VLAN ID (Range: 1-4094)
mac-address - MAC address in the form of xx-xx-xx-xx-xx-xx or
xxxxxxxxxxxx.
acl-name – Name of the ACL. (Maximum length: 32 characters, no spaces orother special characters)
Default Setting
 No mirror session is defined.
 When enabled for an interface, default mirroring is for both received andtransmitted packets.

 When enabled for a VLAN or a MAC address, mirroring is restricted to received

packets.

Command Mode
Interface Configuration (Ethernet, destination port)
Command Usage You can mirror traffic from any source port to a destination port for real-time

analysis. You can then attach a logic analyzer or RMON probe to the destination
port and study the traffic crossing the source port in a completely unobtrusive
manner.

 Set the destination port by specifying an Ethernet interface with the interface

configuration command, and then use the port monitor command to specify
the source of the traffic to mirror. Note that the destination port cannot be atrunk or trunk member port.

 When mirroring traffic from a port, the mirror port and monitor port speeds

should match, otherwise traffic may be dropped from the monitor port. Whenmirroring traffic from a VLAN, traffic may also be dropped under heavy loads.

 When VLAN mirroring and port mirroring are both enabled, the target port canreceive a mirrored packet twice; once from the source mirror port and again
from the source mirror VLAN.

 When mirroring traffic from a MAC address, ingress traffic with the specified

source address entering any port in the switch, other than the target port, will
be mirrored to the destination port.

 Spanning Tree BPDU packets are not mirrored to the target port.
 When mirroring VLAN traffic or packets based on a source MAC address, thetarget port cannot be set to the same target port as that used for basic port
mirroring.

– 474 –

Chapter 14 | Port Mirroring Commands

Local Port Mirroring Commands

 You can create multiple mirror sessions, but all sessions must share the same

destination port.

 The destination port cannot be a trunk or trunk member port.
 ACL-based mirroring is only used for ingress traffic. To mirror an ACL, follow

these steps:

1. Use the access-list command to add an ACL.
2. Use the access-group command to add a mirrored port to access control
list.

3. Use the port monitor access-list command to specify the destination port
to which traffic matching the ACL will be mirrored.

ExampleThe following example configures the switch to mirror all packets from port 6 to 5:
Console(config)#interface ethernet 1/5
Console(config-if)#port monitor ethernet 1/6 both
Console(config-if)#

This example configures port 2 to monitor packets matching the MAC address 0012-CF-XX-XX-XX received by port 1:
Console(config)#access-list mac m1
Console(config-mac-acl)#permit 00-12-cf-00-00-00 ff-ff-ff-00-00-00 any
Console(config-mac-acl)#exit
Console(config)#interface ethernet 1/1
Console(config-if)#mac access-group m1 inConsole(config-if)#interface ethernet 1/2
Console(config-if)#port monitor access-list m1
Console(config-if)#show port monitor This command displays mirror information.
Syntaxshow port monitor [interface]interface - ethernet unit/port (source port)
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
vlan-id - VLAN ID (Range: 1-4094)
mac-address - MAC address in the form of xx-xx-xx-xx-xx-xx or
xxxxxxxxxxxx.

– 475 –

Chapter 14 | Port Mirroring Commands
RSPAN Mirroring Commands
acl-name – Name of the ACL. (Maximum length: 32 characters, no spaces orother special characters)
Default SettingShows all sessions.
Command Mode
Privileged Exec
Command Usage
This command displays the currently configured source port, destination port, andmirror mode (i.e., RX, TX, RX/TX).
ExampleThe following shows mirroring configured from port 6 to port 5:
Console(config)#interface ethernet 1/5
Console(config-if)#port monitor ethernet 1/6
Console(config-if)#end
Console#show port monitor
Port Mirroring------------------------------------Destination Port (listen port) : Eth 1/ 5
Source Port (monitored Port): Eth 1/ 6
Mode
: RX/TX
Console#RSPAN Mirroring Commands
Remote Switched Port Analyzer (RSPAN) allows you to mirror traffic from remoteswitches for analysis on a local destination port.
Table 93: RSPAN Commands
CommandFunctionModevlan rspan

Creates a VLAN dedicated to carrying RSPAN traffic

VC

rspan source

Specifies the source port and traffic type to be
mirroredGC

rspan destination

Specifies the destination port to monitor the
mirrored trafficGC

rspan remote vlan

Specifies the RSPAN VLAN, switch role (source,
intermediate or destination), and the uplink portsGC

no rspan session

Deletes a configured RSPAN session

GC

show rspan

Displays the configuration settings for an RSPAN
sessionPE– 476 –

Chapter 14 | Port Mirroring Commands

RSPAN Mirroring Commands

Configuration Guidelines
Take the following steps to configure an RSPAN session:

1. Use the vlan rspan command to configure a VLAN to use for RSPAN. (Default
VLAN 1 and switch cluster VLAN 4093 are prohibited.)

2. Use the rspan source command to specify the interfaces and the traffic type(RX, TX or both) to be monitored.

3. Use the rspan destination command to specify the destination port for the
traffic mirrored by an RSPAN session.

4. Use the rspan remote vlan command to specify the VLAN to be used for an

RSPAN session, to specify the switch’s role as a source, intermediate relay, or
destination of the mirrored traffic, and to configure the uplink ports designatedto carry this traffic.

RSPAN Limitations
The following limitations apply to the use of RSPAN on this switch:
 RSPAN Ports – Only ports can be configured as an RSPAN source, destination, or

uplink; static and dynamic trunks are not allowed. A port can only be
configured as one type of RSPAN interface – source, destination, or uplink. Also,
note that the source port and destination port cannot be configured on thesame switch.

Only 802.1Q trunk or hybrid (i.e., general use) ports can be configured as an
RSPAN uplink or destination port – access ports are not allowed (see switchportmode).
 Local/Remote Mirror – The destination of a local mirror session (created with theport monitor command) cannot be used as the destination for RSPAN traffic.

 Spanning Tree – If the spanning tree is disabled, BPDUs will not be flooded onto

the RSPAN VLAN.

MAC address learning is not supported on RSPAN uplink ports when RSPAN isenabled on the switch. Therefore, even if spanning tree is enabled after RSPAN
has been configured, MAC address learning will still not be re-started on the
RSPAN uplink ports.
 IEEE 802.1X – RSPAN and 802.1X are mutually exclusive functions. When 802.1X

is enabled globally, RSPAN uplink ports cannot be configured, even though
RSPAN source and destination ports can still be configured. When RSPAN uplink
ports are enabled on the switch, 802.1X cannot be enabled globally.
RSPAN uplink ports cannot be configured to use IEEE 802.1X Port
Authentication, but RSPAN source ports and destination ports can be
configured to use it– 477 –

Chapter 14 | Port Mirroring Commands
RSPAN Mirroring Commands
 Port Security – If port security is enabled on any port, that port cannot be set as

an RSPAN uplink port, even though it can still be configured as an RSPAN sourceor destination port. Also, when a port is configured as an RSPAN uplink port,
port security cannot be enabled on that port.

rspan source Use this command to specify the source port and traffic type to be mirrored

remotely. Use the no form to disable RSPAN on the specified port, or with a traffic
type keyword to disable mirroring for the specified type.
Syntax[no] rspan session session-id source interface interface-list [rx | tx | both]session-id – A number identifying this RSPAN session. (Range: 1)
Three sessions are allowed, including both local and remote mirroring,using different VLANs for RSPAN sessions.
interface-list – One or more source ports. Use a hyphen to indicate aconsecutive list of ports or a comma between non-consecutive ports.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
rx - Mirror received packets.
tx - Mirror transmitted packets.
both - Mirror both received and transmitted packets.

Default Setting
Both TX and RX traffic is mirrored
Command Mode
Global Configuration
Command Usage One or more source ports can be assigned to the same RSPAN session, either on
the same switch or on different switches.
 Only ports can be configured as an RSPAN source – static and dynamic trunks

are not allowed.

 Only 802.1Q trunk or hybrid (i.e., general use) ports can be configured as an

RSPAN source port – access ports are not allowed (see switchport mode).

 The source port and destination port cannot be configured on the same switch.

– 478 –

Chapter 14 | Port Mirroring Commands

RSPAN Mirroring Commands

ExampleThe following example configures the switch to mirror received packets from port 2
and 3:
Console(config)#rspan session 1 source interface ethernet 1/2
Console(config)#rspan session 1 source interface ethernet 1/3
Console(config)#

rspan destination Use this command to specify the destination port to monitor the mirrored traffic.
Use the no form to disable RSPAN on the specified port.
Syntaxrspan session session-id destination interface interface [tagged | untagged]
no rspan session session-id destination interface interface
session-id – A number identifying this RSPAN session. (Range: 1)
Three sessions are allowed, including both local and remote mirroring,using different VLANs for RSPAN sessions.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
tagged - Traffic exiting the destination port carries the RSPAN VLAN tag.
untagged - Traffic exiting the destination port is untagged.
Default Setting
Traffic exiting the destination port is untagged.
Command Mode
Global Configuration
Command Usage Only one destination port can be configured on the same switch per session,
but a destination port can be configured on more than one switch for the samesession.
 Only 802.1Q trunk or hybrid (i.e., general use) ports can be configured as an

RSPAN destination port – access ports are not allowed (see switchport mode).

 Only ports can be configured as an RSPAN destination – static and dynamic

trunks are not allowed.

 The source port and destination port cannot be configured on the same switch.

– 479 –

Chapter 14 | Port Mirroring Commands
RSPAN Mirroring Commands
 A destination port can still send and receive switched traffic, and participate in

any Layer 2 protocols to which it has been assigned.

ExampleThe following example configures port 4 to receive mirrored RSPAN traffic:
Console(config)#rspan session 1 destination interface ethernet 1/2
Console(config)#

rspan remote vlan Use this command to specify the RSPAN VLAN, switch role (source, intermediate or
destination), and the uplink ports. Use the no form to disable the RSPAN on thespecified VLAN.
Syntax[no] rspan session session-id remote vlan vlan-id{source | intermediate | destination} uplink interface
session-id – A number identifying this RSPAN session. (Range: 1)
Three sessions are allowed, including both local and remote mirroring,using different VLANs for RSPAN sessions.
vlan-id - ID of configured RSPAN VLAN. (Range: 1-4094)
Use the vlan rspan command to reserve a VLAN for RSPAN mirroring before
enabling RSPAN with this command.
source - Specifies this device as the source of remotely mirrored traffic.
intermediate - Specifies this device as an intermediate switch,transparently passing mirrored traffic from one or more sources to one ormore destinations.
destination - Specifies this device as a switch configured with a destination
port which is to receive mirrored traffic for this session.
uplink - A port configured to receive or transmit remotely mirrored traffic.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Default Setting
None
Command Mode
Global Configuration– 480 –

Chapter 14 | Port Mirroring Commands

RSPAN Mirroring Commands

Command Usage Only 802.1Q trunk or hybrid (i.e., general use) ports can be configured as an
RSPAN uplink port – access ports are not allowed (see switchport mode).
 Only one uplink port can be configured on a source switch, but there is nolimitation on the number of uplink ports configured on an intermediate or
destination switch.

 Only destination and uplink ports will be assigned by the switch as members of

this VLAN. Ports cannot be manually assigned to an RSPAN VLAN with theswitchport allowed vlan command. Nor can GVRP dynamically add port
members to an RSPAN VLAN. Also, note that the show vlan command will not
display any members for an RSPAN VLAN, but will only show configured RSPANVLAN identifiers.

ExampleThe following example enables RSPAN on VLAN 2, specifies this device as an RSPAN
destination switch, and the uplink interface as port 3:
Console(config)#rspan session 1 remote vlan 2 destination uplink ethernet 1/3
Console(config)#

no rspan session Use this command to delete a configured RSPAN session.
Syntaxno rspan session session-id
session-id – A number identifying this RSPAN session. (Range: 1)
Three sessions are allowed, including both local and remote mirroring,using different VLANs for RSPAN sessions.
Command Mode
Global Configuration
Command Usage
The no rspan session command must be used to disable an RSPAN VLAN before it
can be deleted from the VLAN database (see the vlan command).
ExampleConsole(config)#no rspan session 1
Console(config)#– 481 –

Chapter 14 | Port Mirroring Commands
RSPAN Mirroring Commands

show rspan Use this command to displays the configuration settings for an RSPAN session.
Syntaxshow rspan session [session-id]
session-id – A number identifying this RSPAN session. (Range: 1)
Three sessions are allowed, including both local and remote mirroring,using different VLANs for RSPAN sessions.
Command Mode
Privileged Exec
ExampleConsole#show rspan session
RSPAN Session ID: 1
Source Ports (mirrored ports): NoneRX Only: NoneTX Only: NoneBOTH: NoneDestination Port (monitor port) : Eth 1/2
Destination Tagged Mode
: Untagged
Switch Role
: Destination
RSPAN VLAN
: 2
RSPAN Uplink Ports: Eth 1/3
Operation Status: Up
Console#– 482 –

15

Congestion Control Commands

The switch can set the maximum upload or download data transfer rate for any
port. It can control traffic storms by setting a maximum threshold for broadcast
traffic or multicast traffic. It can also set bounding thresholds for broadcast andmulticast storms which can be used to automatically trigger rate limits or to shut
down a port.
Table 94: Congestion Control Commands
Command Group

Function

Rate Limiting

Sets the input and output rate limits for a port.

Storm Control

Sets the traffic storm threshold for each port.

Automatic Traffic Control
Commands

Sets thresholds for broadcast and multicast storms which can be used
to trigger configured rate limits or to shut down a port.

Rate Limit Commands
Rate limit commands allow the network manager to control the maximum rate fortraffic transmitted or received on an interface. Rate limiting is configured oninterfaces at the edge of a network to limit traffic into or out of the network.
Packets that exceed the acceptable amount of traffic are dropped.
Rate limiting can be applied to individual ports or trunks. When an interface isconfigured with this feature, the traffic rate will be monitored by the hardware toverify conformity. Non-conforming traffic is dropped.
Table 95: Rate Limit Commands
CommandFunctionrate-limit

Configures the maximum input or output rate for an ICinterface– 483 –

Mode

Chapter 15 | Congestion Control Commands
Rate Limit Commands

rate-limit This command defines the rate limit for a specific interface. Use this command

without specifying a rate to enable rate limiting. Use the no form to disable rate
limiting.
Syntax
rate-limit {input | output} [rate]
no rate-limit {input | output}
input – Input rate for specified interface
output – Output rate for specified interface
rate – Maximum value in kbps.
(Range: 64 - 100,000 kbits per second for 10/100 Mbps ports.
64 - 1,000,000 kbits per second for Gigabit Ethernet ports;
64 - 10,000,000 kbits per second for 10 Gigabit Ethernet ports)

Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
Using both rate limiting and storm control on the same interface may lead to
unexpected results. It is therefore not advisable to use both of these commands on
the same interface.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#rate-limit input 64
Console(config-if)#

Related Commandshow interfaces switchport (432)– 484 –

Chapter 15 | Congestion Control Commands
Storm Control Commands

Storm Control Commands
Storm control commands can be used to configure broadcast, multicast, andunknown unicast storm control thresholds. Traffic storms may occur when a device
on your network is malfunctioning, or if application programs are not welldesigned or properly configured. If there is too much traffic on your network,
performance can be severely degraded or everything can come to complete halt.
You can protect your network from traffic storms by setting a threshold forbroadcast, multicast or unknown unicast traffic. Any packets exceeding thespecified threshold will then be dropped.
Table 96: Rate Limit Commands
CommandFunctionModeswitchport packet-rate

Configures broadcast, multicast, and unknown
unicast storm control thresholds

ICshow interfaces
switchport

Displays the administrative and operational statusof an interface

NE, PE

switchport This command configures broadcast, multicast and unknown unicast storm
packet-rate control. Use the no form to restore the default setting.
Syntaxswitchport {broadcast | multicast | unknown-unicast} packet-rate rate
no switchport {broadcast | multicast | unknown-unicast}broadcast - Specifies storm control for broadcast traffic.
multicast - Specifies storm control for multicast traffic.
unknown-unicast - Specifies storm control for unknown unicast traffic.
rate - Threshold level as a rate; i.e. (Range: 500–14881000 pps.
500-148500 pps for 10/100 Mbps ports;
500-1488000 pps for 1 Gbps ports:
1000-14881000 pps for 10 Gbps ports)
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage When traffic exceeds the threshold specified for broadcast and multicast or
unknown unicast traffic, packets exceeding the threshold are dropped until therate falls back down beneath the threshold.

– 485 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
 Using both rate limiting and storm control on the same interface may lead to

unexpected results. It is therefore not advisable to use both of these commandson the same interface.

ExampleThe following shows how to configure broadcast storm control at 600 packets per
second:Console(config)#interface ethernet 1/5
Console(config-if)#switchport broadcast packet-rate 600
Console(config-if)#

Related Commands
show interfaces switchport (432)

Automatic Traffic Control Commands
Automatic Traffic Control (ATC) configures bounding thresholds for broadcast andmulticast storms which can be used to trigger configured rate limits or to shut
down a port.
Table 97: ATC Commands
CommandFunction

Mode

Threshold Commands
auto-traffic-control
apply-timer

Sets the time at which to apply the control response GC
after ingress traffic has exceeded the upper
thresholdauto-traffic-control
release-timer

Sets the time at which to release the control
GC
response after ingress traffic has fallen beneath thelower thresholdauto-traffic-control*

Enables automatic traffic control for broadcast or
multicast storms

auto-traffic-control
actionSets the control action to limit ingress traffic or shut IC (Port)
down the offending port

auto-traffic-control
alarm-clear-threshold

Sets the lower threshold for ingress traffic beneath
which a cleared storm control trap is sent

auto-traffic-control
alarm-fire-threshold

Sets the upper threshold for ingress traffic beyond IC (Port)
which a storm control response is triggered after theapply timer expires

IC (Port)

IC (Port)

auto-traffic-control auto- Automatically releases a control responsecontrol-release

IC (Port)

auto-traffic-control
control-release

PE

Manually releases a control response– 486 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

Table 97: ATC Commands (Continued)
CommandFunction

Mode

ATC Trap Commands
snmp-server enable
Sends a trap when broadcast traffic falls beneathport-traps atc broadcast- the lower threshold after a storm control response
alarm-clear
has been triggered

IC (Port)

snmp-server enable
Sends a trap when broadcast traffic exceeds theport-traps atc broadcast- upper threshold for automatic storm control
alarm-fire

IC (Port)

snmp-server enable
Sends a trap when broadcast traffic exceeds theport-traps atc broadcast- upper threshold for automatic storm control andcontrol-apply
the apply timer expires

IC (Port)

snmp-server enable
Sends a trap when broadcast traffic falls beneathport-traps atc broadcast- the lower threshold after a storm control responsecontrol-releasehas been triggered and the release timer expires

IC (Port)

snmp-server enable
Sends a trap when multicast traffic falls beneath the IC (Port)
port-traps atc multicast- lower threshold after a storm control response has
alarm-clear
been triggeredsnmp-server enable
Sends a trap when multicast traffic exceeds theport-traps atc multicast- upper threshold for automatic storm control
alarm-fire

IC (Port)

snmp-server enable
Sends a trap when multicast traffic exceeds theport-traps atc multicast- upper threshold for automatic storm control andcontrol-apply
the apply timer expires

IC (Port)

snmp-server enable
Sends a trap when multicast traffic falls beneath the IC (Port)
port-traps atc multicast- lower threshold after a storm control response has
control-release
been triggered and the release timer expires
ATC Display Commands
show auto-traffic-control Shows global configuration settings for automaticstorm control

PEshow auto-traffic-control Shows interface configuration settings and storm
interfacecontrol status for the specified port

PE*

Enabling automatic storm control on a port will disable hardware-level storm control on thesame port if configured by the switchport packet-rate command.

– 487 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
Usage Guidelines
ATC includes storm control for broadcast or multicast traffic. The control response
for either of these traffic types is the same, as shown in the following diagrams.
Figure 3: Storm Control by Limiting the Traffic Rate

Traffic[kpps]

Alarm Fire
Threshold（1～255kpps）

Storm Alarm
Fire TRAP

Storm Alarm
Fire TRAP

Traffic

TrafficControl
Apply Trap

Traffic

StromAlarm
ClearTRAP

StromAlarm
ClearTRAP

Release Timer
expired(0～300sec)

AlarmClear
Threshold（1～255kpps）
Apply Timer
expired(0 300)Auto Storm Control

The key elements of this diagram are described below:
 Alarm Fire Threshold – The highest acceptable traffic rate. When ingress traffic

exceeds the threshold, ATC sends a Storm Alarm Fire Trap and logs it.

 When traffic exceeds the alarm fire threshold and the apply timer expires, a

traffic control response is applied, and a Traffic Control Apply Trap is sent andlogged.

 Alarm Clear Threshold – The lower threshold beneath which a control response

can be automatically terminated after the release timer expires. When ingresstraffic falls below this threshold, ATC sends a Storm Alarm Clear Trap and logs it.

 When traffic falls below the alarm clear threshold after the release timer

expires, traffic control (for rate limiting) will be stopped and a Traffic Control
Release Trap sent and logged. Note that if the control action has shut down aport, it can only be manually re-enabled using the auto-traffic-control controlrelease command).

 The traffic control response of rate limiting can be released automatically or

manually. The control response of shutting down a port can only be released
manually.

– 488 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

Figure 4: Storm Control by Shutting Down a PortThe key elements of this diagram are the same as that described in the preceding
diagram, except that automatic release of the control response is not provided.
When traffic control is applied, you must manually re-enable the port.
Functional Limitations
Automatic storm control is a software level control function. Traffic storms can also
be controlled at the hardware level using the switchport packet-rate command.
However, only one of these control types can be applied to a port. Enabling
automatic storm control on a port will disable hardware-level storm control on that
port.
Threshold Commands

auto-traffic-control This command sets the time at which to apply the control response after ingress
apply-timer traffic has exceeded the upper threshold. Use the no form to restore the default
setting.
Syntax
auto-traffic-control {broadcast | multicast} apply-timer seconds
no auto-traffic-control {broadcast | multicast} apply-timer
broadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
seconds - The interval after the upper threshold has been exceeded atwhich to apply the control response. (Range: 5-300 seconds)
Default Setting
300 seconds
Command Mode
Global Configuration– 489 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
Command Usage
After the apply timer expires, a control action may be triggered as specified by theauto-traffic-control action command and a trap message sent as specified by thesnmp-server enable port-traps atc broadcast-control-apply command or snmpserver enable port-traps atc multicast-control-apply command.
ExampleThis example sets the apply timer to 200 seconds for all ports.
Console(config)#auto-traffic-control broadcast apply-timer 200
Console(config)#

auto-traffic-control This command sets the time at which to release the control response after ingress
release-timer traffic has fallen beneath the lower threshold. Use the no form to restore thedefault setting.
Syntax
auto-traffic-control {broadcast | multicast} release-timer seconds
no auto-traffic-control {broadcast | multicast} release-timer
broadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
seconds - The time at which to release the control response after ingresstraffic has fallen beneath the lower threshold. (Range: 5-900 seconds)
Default Setting
900 seconds
Command Mode
Global Configuration
Command Usage
This command sets the delay after which the control response can be terminated.
The auto-traffic-control auto-control-release command must be used to enable ordisable the automatic release of a control response of rate-limiting. To re-enable aport which has been shut down by automatic traffic control, you must manually reenable the port using the auto-traffic-control control-release command.
ExampleThis example sets the release timer to 800 seconds for all ports.
Console(config)#auto-traffic-control broadcast release-timer 800
Console(config)#– 490 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

auto-traffic-control This command enables automatic traffic control for broadcast or multicast storms.
Use the no form to disable this feature.
Syntax[no] auto-traffic-control {broadcast | multicast}broadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
Command Usage Automatic storm control can be enabled for either broadcast or multicast
traffic. It cannot be enabled for both of these traffic types at the same time.
 Automatic storm control is a software level control function. Traffic storms canalso be controlled at the hardware level using the switchport packet-ratecommand. However, only one of these control types can be applied to a port.
Enabling automatic storm control on a port will disable hardware-level storm
control on that port.

ExampleThis example enables automatic storm control for broadcast traffic on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#auto-traffic-control broadcast
Console(config-if)#auto-traffic-control This command sets the control action to limit ingress traffic or shut down theaction offending port. Use the no form to restore the default setting.
Syntax
auto-traffic-control {broadcast | multicast} action {rate-control | shutdown}no auto-traffic-control {broadcast | multicast} action
broadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
rate-control - If a control response is triggered, the rate of ingress traffic islimited based on the threshold configured by the auto-traffic-control
alarm-clear-threshold command.

– 491 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
shutdown - If a control response is triggered, the port is administratively
disabled. A port disabled by automatic traffic control can only be manually
re-enabled.
Default Setting
rate-control
Command Mode
Interface Configuration (Ethernet)
Command Usage When the upper threshold is exceeded and the apply timer expires, a control
response will be triggered based on this command.
 When the control response is set to rate limiting by this command, the rate

limits are determined by the auto-traffic-control alarm-clear-thresholdcommand.

 If the control response is to limit the rate of ingress traffic, it can be

automatically terminated once the traffic rate has fallen beneath the lower
threshold and the release timer has expired.

 If a port has been shut down by a control response, it will not be re-enabled byautomatic traffic control. It can only be manually re-enabled using the autotraffic-control control-release command.

ExampleThis example sets the control response for broadcast traffic on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#auto-traffic-control broadcast action shutdown
Console(config-if)#auto-traffic-control This command sets the lower threshold for ingress traffic beneath which a control
alarm-clear-threshold response for rate limiting will be released after the Release Timer expires, if so
configured by the auto-traffic-control auto-control-release command. Use the noform to restore the default setting.
Syntax
auto-traffic-control {broadcast | multicast} alarm-clear-threshold threshold
no auto-traffic-control {broadcast | multicast} alarm-clear-thresholdbroadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
threshold - The lower threshold for ingress traffic beneath which a cleared
storm control trap is sent. (Range: 1-255 kilo-packets per second)– 492 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

Default Setting
128 kilo-packets per second
Command Mode
Interface Configuration (Ethernet)
Command Usage Once the traffic rate falls beneath the lower threshold, a trap message may besent if configured by the snmp-server enable port-traps atc broadcast-alarmclear command or snmp-server enable port-traps atc multicast-alarm-clear
command.
 If rate limiting has been configured as a control response, it will be

discontinued after the traffic rate has fallen beneath the lower threshold, andthe release timer has expired. Note that if a port has been shut down by acontrol response, it will not be re-enabled by automatic traffic control. It can
only be manually re-enabled using the auto-traffic-control control-releasecommand.

ExampleThis example sets the clear threshold for automatic storm control for broadcast
traffic on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#auto-traffic-control broadcast alarm-clear-threshold 155
Console(config-if)#auto-traffic-control This command sets the upper threshold for ingress traffic beyond which a storm
alarm-fire-threshold control response is triggered after the apply timer expires. Use the no form torestore the default setting.
Syntax
auto-traffic-control {broadcast | multicast} alarm-fire-threshold threshold
no auto-traffic-control {broadcast | multicast} alarm-fire-thresholdbroadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
threshold - The upper threshold for ingress traffic beyond which a storm
control response is triggered after the apply timer expires. (Range: 1-255
kilo-packets per second)
Default Setting
128 kilo-packets per second
Command Mode
Interface Configuration (Ethernet)– 493 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
Command Usage Once the upper threshold is exceeded, a trap message may be sent if
configured by the snmp-server enable port-traps atc broadcast-alarm-firecommand or snmp-server enable port-traps atc multicast-alarm-fire command.
 After the upper threshold is exceeded, the control timer must first expire asconfigured by the auto-traffic-control apply-timer command before a control
response is triggered if configured by the auto-traffic-control action command.

ExampleThis example sets the trigger threshold for automatic storm control for broadcast
traffic on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#auto-traffic-control broadcast alarm-fire-threshold 255
Console(config-if)#auto-traffic-control This command automatically releases a control response of rate-limiting after the
auto-control-release time specified in the auto-traffic-control release-timer command has expired.
Syntax
auto-traffic-control {broadcast | multicast} auto-control-releasebroadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
Command Mode
Interface Configuration (Ethernet)
Command Usage This command can be used to automatically stop a control response of ratelimiting after the specified action has been triggered and the release timer has
expired.
 To release a control response which has shut down a port after the specified

action has been triggered and the release timer has expired, use the autotraffic-control control-release command.

ExampleConsole(config-if)#auto-traffic-control broadcast auto-control-release
Console(config-if)#– 494 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

auto-traffic-control This command manually releases a control response.
control-release
Syntax
auto-traffic-control {broadcast | multicast} control-releaseinterface interface
broadcast - Specifies automatic storm control for broadcast traffic.
multicast - Specifies automatic storm control for multicast traffic.
interfaceethernet unit/port-list
unit - Unit identifier. (Range: 1)
port-list - Physical port number or list of port numbers. Separate
nonconsecutive port numbers with a comma and no spaces; or usea hyphen to designate a range of port numbers. (Range: 1-28/54)
Command Mode
Privileged Exec
Command Usage
This command can be used to manually stop a control response of rate-limiting or
port shutdown any time after the specified action has been triggered.
ExampleConsole#auto-traffic-control broadcast control-release interface ethernet 1/1
Console#SNMP Trap Commands
snmp-server enable This command sends a trap when broadcast traffic falls beneath the lower
port-traps atc threshold after a storm control response has been triggered. Use the no form tobroadcast-alarm-clear disable this trap.
Syntax[no] snmp-server enable port-traps atc broadcast-alarm-clear
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)– 495 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc broadcast-alarm-clear
Console(config-if)#

Related Commands
auto-traffic-control action (491)
auto-traffic-control alarm-clear-threshold (492)snmp-server enable This command sends a trap when broadcast traffic exceeds the upper threshold for
port-traps atc automatic storm control. Use the no form to disable this trap.
broadcast-alarm-fire
Syntax[no] snmp-server enable port-traps atc broadcast-alarm-fireDefault Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc broadcast-alarm-fireConsole(config-if)#

Related Commands
auto-traffic-control alarm-fire-threshold (493)snmp-server enable This command sends a trap when broadcast traffic exceeds the upper threshold for
port-traps atc automatic storm control and the apply timer expires. Use the no form to disablebroadcast-control- this trap.
apply
Syntax[no] snmp-server enable port-traps atc broadcast-control-apply
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)– 496 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc broadcast-control-apply
Console(config-if)#

Related Commands
auto-traffic-control alarm-fire-threshold (493)
auto-traffic-control apply-timer (489)snmp-server enable This command sends a trap when broadcast traffic falls beneath the lower
port-traps atc threshold after a storm control response has been triggered and the release timer
broadcast-control- expires. Use the no form to disable this trap.
release
Syntax[no] snmp-server enable port-traps atc
broadcast-control-release
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc broadcast-controlrelease
Console(config-if)#

Related Commands
auto-traffic-control alarm-clear-threshold (492)
auto-traffic-control action (491)
auto-traffic-control release-timer (490)snmp-server enable This command sends a trap when multicast traffic falls beneath the lower thresholdport-traps atc after a storm control response has been triggered. Use the no form to disable thismulticast-alarm-clear trap.
Syntax[no] snmp-server enable port-traps atc multicast-alarm-clear
Default Setting
Disabled– 497 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
Command Mode
Interface Configuration (Ethernet)
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc multicast-alarm-clear
Console(config-if)#

Related Commands
auto-traffic-control action (491)
auto-traffic-control alarm-clear-threshold (492)snmp-server enable This command sends a trap when multicast traffic exceeds the upper threshold for
port-traps atc automatic storm control. Use the no form to disable this trap.
multicast-alarm-fire
Syntax[no] snmp-server enable port-traps atc multicast-alarm-fireDefault Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc multicast-alarm-fireConsole(config-if)#

Related Commands
auto-traffic-control alarm-fire-threshold (493)snmp-server enable This command sends a trap when multicast traffic exceeds the upper threshold for
port-traps atc automatic storm control and the apply timer expires. Use the no form to disable
multicast-control- this trap.
apply
Syntax[no] snmp-server enable port-traps atc multicast-control-apply
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)– 498 –

Chapter 15 | Congestion Control Commands

Automatic Traffic Control Commands

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc multicast-control-apply
Console(config-if)#

Related Commands
auto-traffic-control alarm-fire-threshold (493)
auto-traffic-control apply-timer (489)snmp-server enable This command sends a trap when multicast traffic falls beneath the lower thresholdport-traps atc after a storm control response has been triggered and the release timer expires.
multicast-control- Use the no form to disable this trap.
release
Syntax[no] snmp-server enable port-traps atc
multicast-control-release
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#snmp-server enable port-traps atc multicast-controlrelease
Console(config-if)#

Related Commands
auto-traffic-control alarm-clear-threshold (492)
auto-traffic-control action (491)
auto-traffic-control release-timer (490)
ATC Display Commands

show auto-traffic- This command shows global configuration settings for automatic storm control.
control
Command Mode
Privileged Exec
ExampleConsole#show auto-traffic-control
Storm-control: Broadcast– 499 –

Chapter 15 | Congestion Control Commands
Automatic Traffic Control Commands
Apply-timer (sec): 300
release-timer (sec) : 900
Storm-control: Multicast
Apply-timer(sec): 300
release-timer(sec) : 900
Console#show auto-traffic- This command shows interface configuration settings and storm control status forcontrol interface the specified port.
Syntaxshow auto-traffic-control interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show auto-traffic-control interface ethernet 1/1
Eth 1/1 Information-----------------------------------------------------------------------Storm Control:
BroadcastMulticastState:Disabled
Disabled
Action:rate-control
rate-control
Auto Release Control:
Disabled
Disabled
Alarm Fire Threshold(Kpps): 128
128
Alarm Clear Threshold(Kpps):128
128
Trap Storm Fire:Disabled
Disabled
Trap Storm Clear:
Disabled
Disabled
Trap Traffic Apply:
Disabled
Disabled
Trap Traffic Release:
Disabled
Disabled
Console#– 500 –

16

Loopback Detection Commands

The switch can be configured to detect general loopback conditions caused byhardware problems or faulty protocol settings. When enabled, a control frame istransmitted on the participating ports, and the switch monitors inbound traffic tosee if the frame is looped back.
Table 98: Loopback Detection Commands
CommandFunctionModeloopback-detection

Enables loopback detection globally on the switch
or on a specified interface

GC, ICloopback-detection
actionSpecifies the response to take for a detectedloopback conditionGC

loopback-detection
recover-timeSpecifies the interval to wait before releasing aninterface from shutdown stateGC

loopback-detection
transmit-intervalSpecifies the interval at which to transmit loopback GC
detection control frames

loopback detection trap Configures the switch to send a trap when aloopback condition is detected or the switch
recover from a loopbackGC

loopback-detection
releaseManually releases all interfaces currently shut down PE
by the loopback detection featureshow loopbackdetection

Shows loopback detection configuration settings
for the switch or for a specified interface

PE

Usage Guidelines
 The default settings for the control frame transmit interval and recover time
may be adjusted to improve performance for your specific environment. The
shutdown mode may also need to be changed once you determine what kindof packets are being looped back.
 When a loopback event is detected on an interface or when a interface isreleased from a shutdown state caused by a loopback event, a trap message issent and the event recorded in the system log.

 Loopback detection must be enabled both globally and on an interface forloopback detection to take effect.

– 501 –

Chapter 16 | Loopback Detection Commands

loopback-detection This command enables loopback detection globally on the switch or on a specified
interface. Use the no form to disable loopback detection.
Syntax[no] loopback-detection
Default Setting
EnabledCommand Mode
Global Configuration
Interface Configuration (Ethernet, Port Channel)
Command Usage Loopback detection must be enabled globally for the switch by this commandand enabled for a specific interface for this function to take effect.
 Loopback detection cannot be enabled globally if ingress filtering of any port

whose loopback detection is enabled cannot be enabled.

 Loopback detection cannot be enabled for a port if ingress filtering cannot beenabled.

 When loopback detection is enabled globally and for a port, the ingressfiltering of the port is automatically enabled. The ingress filtering setting is
restored after loopback detection is disabled globally or for the port.

ExampleThis example enables general loopback detection on the switch, disables loopback
detection provided for the spanning tree protocol on port 1, and then enables
general loopback detection for that port.
Console(config)#loopback-detection
Console(config)#interface ethernet 1/1
Console(config-if)#loopback-detection
Console(config)#

loopback-detection This command specifies the protective action the switch takes when a loopback
action condition is detected. Use the no form to restore the default setting.
Syntaxloopback-detection action {block | none | shutdown}no loopback-detection action
block - When a loopback is detected on a port which a member of a
specific VLAN, packets belonging to that VLAN are dropped at theoffending port.
– 502 –

Chapter 16 | Loopback Detection Commands

none - No action is taken.
shutdown - Shuts down the interface.
Default Setting
Shut down
Command Mode
Global Configuration
Command Usage When the response to a detected loopback condition is set to block user traffic,
loopback detection control frames may untagged or tagged depending on the
port’s VLAN membership type.
 When the response to a detected loopback condition is set to block user traffic,

ingress filtering for the port is enabled automatically if not already enabled by
the switchport ingress-filtering command. The port’s original setting for ingressfiltering will be restored when loopback detection is disabled.

 Use the loopback-detection recover-time command to set the time to wait

before re-enabling an interface shut down by the loopback detection process.

 When the loopback detection response is changed, any ports placed in

shutdown state by the loopback detection process will be immediately
restored to operation regardless of the remaining recover time.

ExampleThis example sets the loopback detection mode to shut down user traffic.
Console(config)#loopback-detection action shutdown
Console(config)#

loopback-detection This command specifies the interval to wait before the switch automatically
recover-time releases an interface from shutdown state. Use the no form to restore the default
setting.
Syntaxloopback-detection recover-time seconds
no loopback-detection recover-time
seconds - Recovery time from shutdown state. (Range: 60-1,000,000
seconds, or 0 to disable automatic recovery)
Default Setting
60 seconds– 503 –

Chapter 16 | Loopback Detection Commands

Command Mode
Global Configuration
Command Usage
If the recovery time is set to zero, all ports placed in shutdown state can be restored
to operation using the loopback-detection release command. To restore a specificport, use the no shutdown command.
ExampleConsole(config)#loopback-detection recover-time 120
Console(config-if)#loopback-detection This command specifies the interval at which to transmit loopback detection
transmit-interval control frames. Use the no form to restore the default setting.
Syntaxloopback-detection transmit-interval seconds
no loopback-detection transmit-interval
seconds - The transmission interval for loopback detection control frames.
(Range: 1-32767 seconds)
Default Setting
10 seconds
Command Mode
Global Configuration
ExampleConsole(config)#loopback-detection transmit-interval 60
Console(config)#

loopback detection This command sends a trap when a loopback condition is detected, or when thetrap switch recovers from a loopback condition. Use the no form to restore the default
state.

Syntaxloopback-detection trap [both | detect | none | recover]no loopback-detection trap
both - Sends an SNMP trap message when a loopback condition isdetected, or when the switch recovers from a loopback condition.
detect - Sends an SNMP trap message when a loopback condition isdetected.
– 504 –

Chapter 16 | Loopback Detection Commands

none - Does not send an SNMP trap for loopback detection or recovery.
recover - Sends an SNMP trap message when the switch recovers from aloopback condition.
Default Setting
None
Command Mode
Global Configuration
Command Usage
Refer to the loopback-detection recover-time command for information on
conditions which constitute loopback recovery.
ExampleConsole(config)#loopback-detection trap both
Console(config)#

loopback-detection This command releases all interfaces currently shut down by the loopback
release detection feature.
Syntaxloopback-detection release
Command Mode
Privileged Exec
ExampleConsole#loopback-detection release
Console#show loopback- This command shows loopback detection configuration settings for the switch or
detection for a specified interface.
Syntaxshow loopback-detection [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)– 505 –

Chapter 16 | Loopback Detection Commands

port-channel
channel no. Port-channel interface number. (Range 1-28)
Command Mode
Privileged Exec
Command Usage
Although global action may be set to None, this command will still display theconfigured Detection Port Admin State and Information Oper State.
ExampleConsole#show loopback-detection
Loopback Detection Global Information
Global Status: Enabled
Transmit Interval : 10
Recover Time
: 60
Action: Shutdown
Trap: NoneLoopback Detection Port Information
Port
Admin State Oper State-------- ----------- ---------Eth 1/ 1 Enabled
NormalEth 1/ 2 Disabled
NormalEth 1/ 3 Disabled
Normal.
.
.
Console#show loopback-detection ethernet 1/1
Loopback Detection Information of Eth 1/1
Admin State : EnabledOper State : Normal
Looped VLAN : None
Console#– 506 –

17

UniDirectional Link Detection
Commands
The switch can be configured to detect and disable unidirectional Ethernet fiber orcopper links. When enabled, the protocol advertises a port’s identity and learns
about its neighbors on a specific LAN segment; and stores information about its
neighbors in a cache. It can also send out a train of echo messages undercircumstances that require fast notifications or re-synchronization of the cachedinformation.
Table 99: UniDirectional Link Detection Commands
CommandFunctionMode

udld detection-interval

Sets the amount of time the switch remains in
detection state after discovering a neighborGC

udld message-interval

Configures the message interval between UDLD
probe messages

GC

udld recovery

Automatically recovers from UDLD disabled port
state after a period specified by the udld recoveryinterval commandGC

udld recovery-intervalSpecifies the period after which to automatically
recover from UDLD disabled port stateGC

udld aggressive

Sets UDLD to aggressive mode on an interface

IC

udld port

Enables UDLD on a portICshow udld

Shows UDLD configuration settings and operational PE
statusudld detection- This command sets the amount of time the switch remains in detection state after
interval discovering a neighbor. Use the no form to restore the default setting.
Syntaxudld detection-interval detection-interval
no udld detection-interval
detection-interval – The amount of time the switch remains in detection
state after discovering a neighbor through UDLD. (Range: 5-255 seconds)
Default Setting
5 seconds
Command Mode
Global Configuration– 507 –

Chapter 17 | UniDirectional Link Detection Commands

Command Usage
When a neighbor device is discovered by UDLD, the switch enters “detection state”
and remains in this state for specified detection-interval. After the detectioninterval expires, the switch tries to decide whether or the link is unidirectional
based on the information collected during “detection state.”
ExampleConsole(config)#udld detection-interval 10
Console(config)#udld message-interval This command configures the message interval between UDLD probe messages forports in the advertisement phase and determined to be bidirectional. Use the noform to restore the default setting.
Syntaxudld message-interval message-interval
no udld message-interval
message-interval – The interval at which a port sends UDLD probemessages after linkup or detection phases. (Range: 7-90 seconds)
Default Setting
15 seconds
Command Mode
Global Configuration
Command Usage
During the detection phase, messages are exchanged at the maximum rate of one
per second. After that, if the protocol reaches a stable state and determines that thelink is bidirectional, the message interval is increased to a configurable value basedon a curve known as M1(t), a time-based function described in RFC 5171.
If the link is deemed anything other than bidirectional at the end of the detection
phase, this curve becomes a flat line with a fixed value of Mfast (7 seconds).
If the link is instead deemed bidirectional, the curve will use Mfast for the first four
subsequent message transmissions and then transition to an Mslow value for allother steady-state transmissions. Mslow is the value configured by this command.
ExampleThis example sets the message interval to 10 seconds.
Console(config)#udld message-interval 10
Console(config)#– 508 –

Chapter 17 | UniDirectional Link Detection Commands

udld recovery This command configures the switch to automatically recover from UDLD disabled
port state after a period specified by the udld recovery-interval command. Use theno form to disable this feature.
Syntax[no] udld recovery
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
When automatic recovery state is changed by this command, any ports shut downby UDLD will be reset.
ExampleConsole(config)#udld recovery
Console(config)#udld recovery-interval This command specifies the period after which to automatically recover from UDLD
disabled port state. Use the no form to restore the default setting.
udld recovery-interval recovery-interval
no udld recovery-interval
recovery-interval – The interval after which a port is reset after being placedin UDLD disabled state. (Range: 30-86400 seconds)
Default Setting
300 seconds
Command Mode
Global Configuration
Command Usage This command is only applicable when automatic recovery has been enabledwith the udld recovery command.
 When the recovery interval is changed by this command, any ports shut downby UDLD will be reset.

– 509 –

Chapter 17 | UniDirectional Link Detection Commands

ExampleConsole(config)#udld recovery-interval 30
Console(config)#udld aggressive This command sets UDLD to aggressive mode on an interface. Use the no form torestore the default setting.
Syntax[no] udld aggressive
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet Port)
Command UsageUDLD can function in two modes: normal mode and aggressive mode.
 In normal mode, determination of link status at the end of the detection

process is always based on information received in UDLD messages: whether
that’s information about the exchange of proper neighbor identification or theabsence of such. Hence, albeit bound by a timer, normal mode determinations
are always based on gleaned information, and as such are “event-based.” If nosuch information can be obtained (e.g., because of a bidirectional loss ofconnectivity), UDLD follows a conservative approach to minimize false
positives during the detection process and deems a port to be in“undetermined” state. In other words, normal mode will shut down a port only
if it can explicitly determine that the associated link is faulty for an extended
period of time.

 In aggressive mode, UDLD will also shut down a port if it loses bidirectional

connectivity with the neighbor for the same extended period of time (as thatmentioned above for normal mode) and subsequently fails repeated last-resort
attempts to re-establish communication with the other end of the link. Thismode of operation assumes that loss of communication with the neighbor is ameaningful network event in itself, and a symptom of a serious connectivity
problem. Because this type of detection can be event-less, and lack of
information cannot always be associated to an actual malfunction of the link,
this mode is recommended only in certain scenarios (typically only on point-topoint links where no communication failure between two neighbors is
admissible).

– 510 –

Chapter 17 | UniDirectional Link Detection Commands

ExampleThis example enables UDLD aggressive mode on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#udld aggressive
Console(config-if)#udld port This command enables UDLD on a port. Use the no form to disable UDLD on aninterface.
Syntax[no] udld port
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet Port)
Command Usage UDLD requires that all the devices connected to the same LAN segment berunning the protocol in order for a potential mis-configuration to be detected
and for prompt corrective action to be taken.
 Whenever a UDLD device learns about a new neighbor or receives a

resynchronization request from an out-of-synch neighbor, it (re)starts thedetection process on its side of the connection and sends N echo messages in
reply. (This mechanism implicitly assumes that N packets are sufficient to getthrough a link and reach the other end, even though some of them might get
dropped during the transmission.)
Since this behavior must be the same on all the neighbors, the sender of theechoes expects to receive an echo in reply. If the detection process ends
without the proper echo information being received, the link is considered to
be unidirectional.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#udld port
Console(config-if)#– 511 –

Chapter 17 | UniDirectional Link Detection Commands

show udld This command shows UDLD configuration settings and operational status for theswitch or for a specified interface.
Syntaxshow udld [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show udld
Message Interval: 15
Detection Interval : 5 seconds
Recovery: Disabled
Recovery Interval : 300 seconds
Interface UDLD

Mode

Oper State
Msg Invl
Port State
Det Invl--------- -------- ---------- ------------------------------------- -------Eth 1/ 1 Disabled Normal
Disabled
7 s
Unknown
5 s
Eth 1/ 2 Disabled Normal
Disabled
7 s
Unknown
5 s
Eth 1/ 3 Disabled Normal
Disabled
7 s
Unknown
5 s
Eth 1/ 4 Disabled Normal
Disabled
7 s
Unknown
5 s
Eth 1/ 5 Disabled Normal
Disabled
7 s
Unknown
5 s.
.
.
Console#show udld interface ethernet 1/1
Interface UDLD
Mode
Oper State
Msg Invl
Port State
Det Invl--------- -------- ---------- ------------------------------------- -------Eth 1/ 1 Disabled Normal
Disabled
7 s
Unknown
5 s
Console#Table 100: show udld - display description
Field

Description

Interface

The Interface - Ethernet unit and port number.

Message Interval

The interval between UDLD probe messages for ports in advertisement phase

Detection Interval

The period the switch remains in detection state after discovering a neighbor

RecoveryShows if automatic recovery from UDLD disabled port state is enabled– 512 –

Chapter 17 | UniDirectional Link Detection Commands

Table 100: show udld - display description (Continued)
Field

Description

Recovery Interval

Shows the period after which to recover from UDLD disabled port state if
automatic recovery is enabled

UDLD

Shows if UDLD is enabled or disabled on a port

ModeShows if UDLD is functioning in Normal or Aggressive mode

Oper State

Shows the UDLD operational state (Disabled, Link down, Link up,
Advertisement, Detection, Disabled port, Advertisement - Single neighbor,
Advertisement - Multiple neighbors)

Port State

Shows the UDLD port state (Unknown, Bidirectional, Unidirectional, Transmitto-receive loop, Mismatch with neighbor state reported, Neighbor's echo isempty)The state is Unknown if the link is down or not connected to a UDLD-capabledevice. The state is Bidirectional if the link has a normal two-way connection toa UDLD-capable device. All other states indicate mis-wiring.

Msg Invl

The interval between UDLD probe messages used for the indicated operational
state

Det Invl

The period the switch remains in detection state after discovering a neighbor– 513 –

Chapter 17 | UniDirectional Link Detection Commands– 514 –

18

Address Table Commands

These commands are used to configure the address table for filtering specified
addresses, displaying current entries, clearing the table, or setting the aging time.
Table 101: Address Table Commands
CommandFunctionMode

mac-address-tableaging-time

Sets the aging time of the address table

GC

mac-address-tablehash-lookup-depth

Sets the hash lookup depth of MAC address table

GC

mac-address-table static Maps a static address to a port in a VLAN

GC

clear mac-address-table
dynamic

PE

Removes any learned entries from the forwarding
databaseshow mac-address-table Displays entries in the bridge-forwarding database PE
show mac-address-table Shows the aging time for the address tableaging-timePE

show mac-address-table Shows the number of MAC addresses used and the PE
countnumber of available MAC addresses
show mac-address-table Shows the hash lookup depth of MAC address table PE
hash-lookup-depth

mac-address-table This command sets the aging time for entries in the address table. Use the no form
aging-time to restore the default aging time.
Syntax
mac-address-table aging-time seconds
no mac-address-table aging-time
seconds - Aging time. (Range: 5-514 seconds; 0 to disable aging)
Default Setting
300 seconds
Command Mode
Global Configuration
Command Usage
The aging time is used to age out dynamically learned forwarding information.

– 515 –

Chapter 18 | Address Table Commands

ExampleConsole(config)#mac-address-table aging-time 100
Console(config)#

mac-address-table This command sets the hash lookup depth used when searching the MAC address
hash-lookup-depth table. Use the no form to restore the default setting.
Syntax
mac-address-table hash-lookup-depth depth
no mac-address-table hash-lookup-depth
depth - The depth used in the hash lookup process. (Range: 4-32, in
multiples of 4)
Default Setting
4
Command Mode
Global Configuration
Command Usage
Using the default depth of 4, MAC address collisions tend to increase once morethan 8K entries have been learned. Setting the depth to a larger value reduces theoccurrence of hash collisions, but can also decrease forwarding performance.
ExampleConsole(config)#mac-address-table hash-lookup-depth 4
Console(config)#

mac-address-table This command maps a static address to a destination port in a VLAN. Use the nostatic form to remove an address.
Syntax
mac-address-table static mac-address interface interface vlan vlan-id [action]no mac-address-table static mac-address vlan vlan-id
mac-address - MAC address.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)– 516 –

Chapter 18 | Address Table Commands

port-channel channel-id (Range: 1-28)
vlan-id - VLAN ID (Range: 1-4094)
action delete-on-reset - Assignment lasts until the switch is reset.
permanent - Assignment is permanent.
Default Setting
No static addresses are defined. The default lifetime is permanent.
Command Mode
Global Configuration
Command Usage
The static address for a host device can be assigned to a specific port within a
specific VLAN. Use this command to add static addresses to the MAC Address Table.
Static addresses have the following characteristics:
 Static addresses will not be removed from the address table when a given

interface link is down.

 Static addresses are bound to the assigned interface and will not be moved.

When a static address is seen on another interface, the address will be ignored
and will not be written to the address table.

 A static address cannot be learned on another port until the address is removed

with the no form of this command.

ExampleConsole(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet
1/1 vlan 1 delete-on-reset
Console(config)#– 517 –

Chapter 18 | Address Table Commands

clear mac-address- This command removes any learned entries from the forwarding database.
table dynamic
Syntaxclear mac-address-table dynamic [[all] | [address mac-address [mask]] |[interface interface] | [vlan vlan-id]]all - all learned entries
address mac-address - MAC address.
mask - Bits to match in the address.
interface interface
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN ID (Range: 1-4094)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#clear mac-address-table dynamic all
Console#– 518 –

Chapter 18 | Address Table Commands

show mac-address- This command shows classes of entries in the bridge-forwarding database.
table
Syntaxshow mac-address-table [address mac-address [mask]] [interface interface][vlan vlan-id] [sort {address | vlan | interface}]
mac-address - MAC address.
mask - Bits to match in the address.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan-id - VLAN ID (Range: 1-4094)
sort - Sort by address, vlan or interface.
Default Setting
None
Command Mode
Privileged Exec
Command Usage The MAC Address Table contains the MAC addresses associated with eachinterface. Note that the Type field may include the following types:

Learn - Dynamic address entries
Config - Static entry
Security - Port Security

 The mask should be hexadecimal numbers (representing an equivalent bitmask) in the form xx-xx-xx-xx-xx-xx that is applied to the specified MAC
address. Enter hexadecimal numbers, where an equivalent binary bit “0” means
to match a bit and “1” means to ignore a bit. For example, a mask of 00-00-0000-00-00 means an exact match, and a mask of FF-FF-FF-FF-FF-FF means “any.” The maximum number of address entries is 16K.

ExampleConsole#show mac-address-table
Interface MAC Address
VLAN TypeLife Time--------- ----------------- ---- -------- ----------------CPU
00-E0-00-00-00-01
1 CPU
Delete on ResetEth 1/ 1 00-E0-0C-10-90-09
1 Learn
Delete on Timeout
Eth 1/ 1 00-E0-29-94-34-64
1 Learn
Delete on Timeout
Console#– 519 –

Chapter 18 | Address Table Commands

show mac-address- This command shows the aging time for entries in the address table.
table aging-time
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show mac-address-table aging-timeAging Status : Enabled
Aging Time: 300 sec.
Console#show mac-address- This command shows the number of MAC addresses used and the number oftable count available MAC addresses for the overall system or for an interface.
Syntaxshow mac-address-table count [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show mac-address-table count interface ethernet 1/1
MAC Entries for Eth 1/1
Total Address Count:0
Static Address Count:0
Dynamic Address Count:0
Console#show mac-address-table countCompute the number of MAC Address...
Maximum number of MAC Address which can be created in the system:
Total Number of MAC Address: 16384
Number of Static MAC Address: 1024Current number of entries which have been created in the system:
Total Number of MAC Address: 3– 520 –

Chapter 18 | Address Table Commands

Number of Static MAC Address
Number of Dynamic MAC Address
Console#: 1: 2

show mac-address- This command shows the hash lookup depth used when searching the MAC
table hash-lookup- address table.
depth
Syntaxshow mac-address-table hash-lookup-depth
Command Mode
Privileged Exec
ExampleConsole#show mac-address-table hash-lookup-depth
Configured Hash Lookup Depth: 4
Activated Hash Lookup Depth: 4
Console#– 521 –

Chapter 18 | Address Table Commands– 522 –

19

Smart Pair Commands

Smart Pair Concept
A smart pair consists of two ports which are paired to provide layer 2 link
redundancy, The pair consists of a primary port and a backup port. All traffic isforwarded through the primary port and the backup port will be set to standby. If
the primary port link goes down, the backup port is activated and all traffic isforwarded through it. If the primary port recovers, all traffic will again be forwarded
through the primary port after a configured delay. (wait-to-restore delay).
These commands are used to configure the smart pair ports, set the wait to restore
delay, show the smart pairs configured on the switch and restore traffic manually toa configured smart pair.
Table 102: Address Table Commands
CommandFunctionModesmart-pair

Creates a new Smart Pair with an ID and enters into smart GC
pair configuration mode.

smart-pair restore

Manually restores traffic to a smart pair link that is in the PE
up conditions.

primary-port

Configures the Primary Port of the Smart Pairsmart pairbackup-port

Configures the Backup Port of the Smart Pairsmart pair

wtr-delay

Configures the delay time to wait to restore traffic to asmart pair link after one of the links is restored.

smart pairshow smart-pair

Displays all the currently configured smart pairs and their PE
associated information.

smart-pair This command creates a smart pair in the switch configuration distinguished by aunique identification number and enters the smart-pair configuration mode. Use
the no form to delete the smart pair from the switch configuration.
Syntaxsmart-pair ID
no smart-pair ID
ID - Identification Number. (Range: 1-1000)
Default SettingNone– 523 –

Chapter 19 | Smart Pair Commands
Smart Pair Concept
Command Mode
Global Configuration
Command Usage
Use the command to create a new smart pair or to enter the smart-pairconfiguration mode of an existing smart pair.
ExampleConsole(config)#smart-pair 1
Console(config-smart-pair)#smart-pair restore Use the smart-pair restore command to manually restore traffic to the primary portof a specified smart pair.
Syntaxsmart-pair restore ID
ID - Identification Number. (Range: 1-1000)
Default Setting
None
Command Mode
Privileged Exec.
Command Usage
The link of the primary port must be in the up condition for the command tosucceed.
ExampleConsole#smart-pair restore 1
Console#– 524 –

Chapter 19 | Smart Pair Commands
Smart Pair Concept

primary-port This command configures the primary port of a specified smart pair. Use the noform of the command to remove the configured primary port from the smart pair.
Syntaxprimary-port interface
no primary-portinterfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)

Default Setting
None
Command Mode
Smart Pair Configuration Mode
Command Usage
When setting the primary-port of the smart pair the following limitations are
enforced: Spanning-Tree must be disabled on the port.
 A configured primary port can only be a member of a single smart pair.
 Dynamic trunk ports cannot be configured as a smart pair port (only static

trunk ports).

 When a trunk group is identified as a primary port of a smart pair, any members

removed from the trunk group will not retain the smart pair settings.

 When all members of trunk group set as a primary port are removed, theprimary port is also removed.

 The VLAN mode of the primary-port should not be changed after it isconfigured otherwise the behavior becomes unpredictable.

ExampleConsole(config-smart-pair)#primary-port ethernet 1/1
Console(config-smart-pair)#Related Commands“spanning-tree spanning-disabled” on page 556– 525 –

Chapter 19 | Smart Pair Commands
Smart Pair Concept

backup-port This command configures the backup port of a specified smart pair. Use the noform of the command to remove the configured backup port from the smart pair.
Syntaxbackup-port interface
no backup
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Smart Pair Configuration Mode
Command Usage
When setting the backup-port of the smart pair the following limitations are
enforced: Spanning-Tree must be disabled on the port.
 A configured backup port can only be a member of a single smart pair.
 Dynamic trunk ports cannot be configured as a smart pair port (only static

trunk ports).

 When a trunk group is identified as a backup port of a smart pair, any members

removed from the trunk group will not retain the smart pair settings.

 When all members of trunk group set as a backup port are removed, thebackup port is also removed.

 The VLAN mode of the backup port should not be changed after it isconfigured otherwise the behavior becomes unpredictable.

ExampleConsole(config-smart-pair)#backup-port ethernet 1/2
Console(config-smart-pair)#Related Commands“spanning-tree spanning-disabled” on page 556– 526 –

Chapter 19 | Smart Pair Commands
Smart Pair Concept

wtr-delay This command sets the wait-to-restore delay for a smart pair. Use the no form of thecommand to set the delay to the default value.
Syntaxwtr-delay seconds
seconds - delay in seconds (Range:0, 5-3600)
Default Setting
None
Command Mode
Smart Pair Configuration Mode
Command Usage If the wtr-delay parameter is set to 0, traffic will not be restored after a failed
port is recovered.
 If the wtr-delay is set from 5 to 3600 (seconds) and a failed smart port recovers,

traffic will be restored to the port after the configured delay in seconds.

ExampleConsole(config-smart-pair)#wtr-delay 120
Console(config-smart-pair)#show smart-pair This command shows the configured smart pairs on the switch.
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show smart-pairID
Primary Port Backup Port---- ------------ ----------1
Eth 1/ 1
Eth 1/ 2
Console#– 527 –

Chapter 19 | Smart Pair Commands
Smart Pair Concept– 528 –

20

TWAMP Commands

The Two-Way Active Measurement Protocol (TWAMP) is defined by RFC 5357.
TWAMP is an open protocol for measuring network performance between any two
devices that support the TWAMP protocol.
TWAMP uses the methodology and architecture of OWAMP (One-Way Active
Measurement Protocol, RFC 4656), which defines an open protocol for themeasurement of one-way metrics, but extends it to two-way, or round-trip, metrics.
TWAMP consists of two protocols; a control protocol and a test session protocol.
When starting a performance measurement session, the TWAMP control protocol isused to initiate and set up the test session. The TWAMP test protocol then uses UDP
for sending and receiving the test packets for performance measurement.
Table 103: TWAMP Commands
CommandFunctionModetwamp reflector

Enables TWAMP Session-Reflector on the switch

GC

twamp reflector refwait

Sets the TWAMP Reflector timeout

GC

show twamp reflector

Displays the TWAMP Reflector configuration andsessions on the switch

PE

twamp reflector This command enables the TWAMP Session-Reflector globally on the switch. Use
the no form to disable the TWAMP reflector function.
Syntaxtwamp reflector
no twamp reflector
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
The switch only supports the function of a Session-Reflector (RFC 5357). As a
Reflector, the switch can receive test packets from a Session Sender and send test
packet responses.

– 529 –

Chapter 20 | TWAMP Commands

ExampleConsole(config)#twamp reflector
Console(config)#

twamp reflector This command sets the TWAMP session timeout on the switch. Use the no form to
refwait restore the default.
Syntaxtwamp reflector refwait seconds
no twamp reflector refwait
seconds - The timeout value in seconds. (Range: 30-3600)
Default Setting
900 seconds
Command Mode
Global Configuration
Command UsageThe Session-Reflector will discontinue any session that has been started when no
packet associated with that session has been received for the timeout period.
ExampleConsole(config)#twamp reflector refwait 300
Console(config)#show twamp reflector This command shows the configured TWAMP Reflector settings and sessions on
the switch.

Command Mode
Privileged Exec
ExampleConsole#show twamp reflector
TWAMP Reflector Status: Enabled
TWAMP Reflector REFWAIT: 900 seconds
TWAMP Reflector Mode: UnauthenticatedTotal number of sessions: 0
Sender Address----------------Console#

Sender Port-----------– 530 –

Reflector Address-------------------

Reflector Port--------------

21

Spanning Tree Commands

This section includes commands that configure the Spanning Tree Algorithm (STA)
globally for the switch, and commands that configure STA for the selectedinterface.
Table 104: Spanning Tree Commands
CommandFunctionModespanning-tree

Enables the spanning tree protocol

GC

spanning-tree
cisco-prestandard

Configures spanning tree operation to be compatible with GC
Cisco prestandard versions

spanning-tree forward-time

Configures the spanning tree bridge forward timeGC

spanning-tree hello-time

Configures the spanning tree bridge hello timeGC

spanning-tree max-age

Configures the spanning tree bridge maximum age

GCspanning-tree mode

Configures STP, RSTP or MSTP modeGC

spanning-tree
mst configuration

Changes to MSTP configuration modeGC

spanning-tree pathcost
methodConfigures the path cost method for RSTP/MSTP

GC

spanning-tree priority

Configures the spanning tree bridge priority

GC

spanning-treesystem-bpdu-flooding

Floods BPDUs to all other ports or just to all other ports inthe same VLAN when global spanning tree is disabledGC

spanning-tree tc-prop

Configures a topology change propagation domain

GC

spanning-treetransmission-limit

Configures the transmission limit for RSTP/MSTPGC

max-hops

Configures the maximum number of hops allowed in theregion before a BPDU is discarded

MST

mst priority

Configures the priority of a spanning tree instanceMST

mst vlan

Adds VLANs to a spanning tree instance

MST

name

Configures the name for the multiple spanning tree

MST

revision

Configures the revision number for the multiple spanning
tree

MST

spanning-tree bpdu-filter

Filters BPDUs for edge portsIC

spanning-tree bpdu-guard

Shuts down an edge port if it receives a BPDU

IC

spanning-tree cost

Configures the spanning tree path cost of an interface

ICspanning-tree edge-port

Enables fast forwarding for edge portsIC

spanning-tree link-type

Configures the link type for RSTP/MSTPIC– 531 –

Chapter 21 | Spanning Tree Commands

Table 104: Spanning Tree Commands (Continued)
CommandFunctionModespanning-tree
loopback-detection

Enables BPDU loopback detection for a portIC

spanning-tree loopbackdetection action

Configures the response for loopback detection to blockuser traffic or shut down the interface

ICspanning-tree loopbackdetection release-mode

Configures loopback release mode for a portIC

spanning-tree
loopback-detection trap

Enables BPDU loopback SNMP trap notification for a portIC

spanning-tree restricted-tcn

Prevents a TCN from being propagated from anaggregation switch to the uplink port on access switchesIC

spanning-tree mst cost

Configures the path cost of an instance in the MST

IC

spanning-tree
mst port-priority

Configures the priority of an instance in the MST

IC

spanning-tree
port-bpdu-flooding

Floods BPDUs to other ports when global spanning tree isdisabledIC

spanning-tree port-priority

Configures the spanning tree priority of an interface

ICspanning-tree root-guard

Prevents a designated port from passing superior BPDUs

IC

spanning-tree
spanning-disabled

Disables spanning tree for an interface

ICspanning-tree tc-prop-stop

Stops propagation of topology change informationIC

spanning-tree
loopback-detection release

Manually releases a port placed in discarding state byloopback-detection

PE

spanning-tree
protocol-migration

Re-checks the appropriate BPDU format

PEshow spanning-treeShows spanning tree configuration for the common
spanning tree (i.e., overall bridge), a selected interface, oran instance within the multiple spanning treePEshow spanning-tree
mst configuration

Shows the multiple spanning tree configuration

PEshow spanning-tree tc-prop

Shows configuration of topology change propagation
domainsPE

spanning-tree This command enables the Spanning Tree Algorithm globally for the switch. Use
the no form to disable it.
Syntax[no] spanning-tree
Default Setting
Spanning tree is disabled.
Command Mode
Global Configuration– 532 –

Chapter 21 | Spanning Tree Commands

Command Usage The Spanning Tree Algorithm (STA) can be used to detect and disable network
loops, and to provide backup links between switches, bridges or routers. This
allows the switch to interact with other bridging devices (that is, an STAcompliant switch, bridge or router) in your network to ensure that only one
route exists between any two stations on the network, and provide backup
links which automatically take over when a primary link goes down.
ExampleThis example shows how to enable the Spanning Tree Algorithm for the switch:
Console(config)#spanning-tree
Console(config)#

spanning-tree This command configures spanning tree operation to be compatible with Cisco
cisco-prestandard prestandard versions. Use the no form to restore the default setting.
[no] spanning-tree cisco-prestandard
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
Cisco prestandard versions prior to Cisco IOS Release 12.2(25)SEC do not fully
follow the IEEE standard, causing some state machine procedures to function
incorrectly. The command forces the spanning tree protocol to function in amanner compatible with Cisco prestandard versions.
ExampleConsole(config)#spanning-tree cisco-prestandard
Console(config)#

spanning-tree This command configures the spanning tree bridge forward time globally for thisforward-time switch. Use the no form to restore the default setting.
Syntaxspanning-tree forward-time seconds
no spanning-tree forward-time
seconds - Time in seconds. (Range: 4 - 30 seconds)
The minimum value is the higher of 4 or [(max-age / 2) + 1].

– 533 –

Chapter 21 | Spanning Tree Commands

Default Setting
15 seconds
Command Mode
Global Configuration
Command Usage
This command sets the maximum time (in seconds) a port will wait beforechanging states (i.e., discarding to learning to forwarding). This delay is required
because every device must receive information about topology changes before it
starts to forward frames. In addition, each port needs time to listen for conflicting
information that would make it return to the discarding state; otherwise, temporary
data loops might result.
ExampleConsole(config)#spanning-tree forward-time 20
Console(config)#

spanning-tree This command configures the spanning tree bridge hello time globally for thishello-time switch. Use the no form to restore the default.
Syntaxspanning-tree hello-time timeno spanning-tree hello-timetime - Time in seconds. (Range: 1-10 seconds).
The maximum value is the lower of 10 or [(max-age / 2) - 1].
Default Setting
2 seconds
Command Mode
Global Configuration
Command Usage
This command sets the time interval (in seconds) at which the root device transmits
a configuration message.
ExampleConsole(config)#spanning-tree hello-time 5
Console(config)#

Related Commands
spanning-tree forward-time (533)spanning-tree max-age (535)– 534 –

Chapter 21 | Spanning Tree Commands

spanning-tree This command configures the spanning tree bridge maximum age globally for thismax-age switch. Use the no form to restore the default.
Syntaxspanning-tree max-age seconds
no spanning-tree max-age
seconds - Time in seconds. (Range: 6-40 seconds)
The minimum value is the higher of 6 or [2 x (hello-time + 1)].
The maximum value is the lower of 40 or [2 x (forward-time - 1)].
Default Setting
20 seconds
Command Mode
Global Configuration
Command Usage
This command sets the maximum time (in seconds) a device can wait without
receiving a configuration message before attempting to reconverge. All device
ports (except for designated ports) should receive configuration messages atregular intervals. Any port that ages out STA information (provided in the lastconfiguration message) becomes the designated port for the attached LAN. If it is aroot port, a new root port is selected from among the device ports attached to the
network.
ExampleConsole(config)#spanning-tree max-age 40
Console(config)#

Related Commands
spanning-tree forward-time (533)spanning-tree hello-time (534)spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form torestore the default.
Syntaxspanning-tree mode {stp | rstp | mstp}
no spanning-tree mode
stp - Spanning Tree Protocol (IEEE 802.1D)
rstp - Rapid Spanning Tree Protocol (IEEE 802.1w)
mstp - Multiple Spanning Tree (IEEE 802.1s)– 535 –

Chapter 21 | Spanning Tree Commands

Default Setting
rstp
Command Mode
Global Configuration
Command Usage Spanning Tree Protocol
This option uses RSTP set to STP forced compatibility mode. It uses RSTP for theinternal state machine, but sends only 802.1D BPDUs. This creates one
spanning tree instance for the entire network. If multiple VLANs are
implemented on a network, the path between specific VLAN members may be
inadvertently disabled to prevent network loops, thus isolating groupmembers. When operating multiple VLANs, we recommend selecting the MSTP
option.
 Rapid Spanning Tree Protocol

RSTP supports connections to either STP or RSTP nodes by monitoring theincoming protocol messages and dynamically adjusting the type of protocol
messages the RSTP node transmits, as described below:


STP Mode – If the switch receives an 802.1D BPDU after a port’s migration
delay timer expires, the switch assumes it is connected to an 802.1D bridgeand starts using only 802.1D BPDUs.

RSTP Mode – If RSTP is using 802.1D BPDUs on a port and receives an RSTP
BPDU after the migration delay expires, RSTP restarts the migration delay
timer and begins using RSTP BPDUs on that port.

 Multiple Spanning Tree ProtocolTo allow multiple spanning trees to operate over the network, you must
configure a related set of bridges with the same MSTP configuration,
allowing them to participate in a specific set of spanning tree instances.



A spanning tree instance can exist only on bridges that have compatible
VLAN instance assignments.

Be careful when switching between spanning tree modes. Changing
modes stops all spanning-tree instances for the previous mode and restarts
the system in the new mode, temporarily disrupting user traffic.

ExampleThe following example configures the switch to use Rapid Spanning Tree:
Console(config)#spanning-tree mode rstp
Console(config)#– 536 –

Chapter 21 | Spanning Tree Commands

spanning-tree This command changes to Multiple Spanning Tree (MST) configuration mode.
mst configuration
Syntaxspanning-tree mst configuration
Default Setting
No VLANs are mapped to any MST instance.
The region name is set the switch’s MAC address.
Command Mode
Global Configuration
ExampleConsole(config)#spanning-tree mst configuration
Console(config-mstp)#

Related Commands
mst vlan (542)
mst priority (541)name (543)
revision (543)max-hops (541)

spanning-tree This command configures the path cost method used for Rapid Spanning Tree andpathcost method Multiple Spanning Tree. Use the no form to restore the default.
Syntaxspanning-tree pathcost method {long | short}no spanning-tree pathcost method
long - Specifies 32-bit based values that range from 0-200,000,000.
This method is based on the IEEE 802.1w Rapid Spanning Tree Protocol.
short - Specifies 16-bit based values that range from 0-65535.
This method is based on the IEEE 802.1D Spanning Tree Protocol.
Default Setting
Long method
Command Mode
Global Configuration
Command Usage The path cost method is used to determine the best path between devices.
Therefore, lower values should be assigned to ports attached to faster media,– 537 –

Chapter 21 | Spanning Tree Commands

and higher values assigned to ports with slower media. Note that path cost
(page 546) takes precedence over port priority (page 554).
 The path cost methods apply to all spanning tree modes (STP, RSTP and MSTP).

Specifically, the long method can be applied to STP since this mode issupported by a backward compatible mode of RSTP.

ExampleConsole(config)#spanning-tree pathcost method long
Console(config)#

spanning-tree priority This command configures the spanning tree priority globally for this switch. Use
the no form to restore the default.
Syntaxspanning-tree priority priority
no spanning-tree priority
priority - Priority of the bridge. (Range – 0-61440, in steps of 4096; Options:0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960,
45056, 49152, 53248, 57344, 61440)
Default Setting
32768
Command Mode
Global Configuration
Command Usage
Bridge priority is used in selecting the root device, root port, and designated port.
The device with the highest priority (i.e., lower numeric value) becomes the STA
root device. However, if all devices have the same priority, the device with thelowest MAC address will then become the root device.
ExampleConsole(config)#spanning-tree priority 40960
Console(config)#– 538 –

Chapter 21 | Spanning Tree Commands

spanning-tree This command configures how the system floods BPDUs to other ports whensystem-bpdu-flooding spanning tree is disabled globally on the switch or disabled on specific ports. Use
the no form to restore the default.
Syntaxspanning-tree system-bpdu-flooding {to-all | to-vlan}no spanning-tree system-bpdu-flooding
to-all - Floods BPDUs to all other spanning-tree disabled ports on theswitch.
to-vlan - Floods BPDUs to all other spanning-tree disabled ports within thereceiving port’s native VLAN (i.e., as determined by port’s PVID).
Default Setting
Floods to all other spanning-tree disabled ports in the same VLAN.
Command Mode
Global Configuration
Command Usage
The spanning-tree system-bpdu-flooding command has no effect if BPDU
flooding is disabled on a port (see the spanning-tree port-bpdu-flooding
command).
ExampleConsole(config)#spanning-tree system-bpdu-flooding to-all
Console(config)#

spanning-tree tc-prop This command configures a topology change propagation domain. Use the noform to remove a propagation domain.
Syntaxspanning-tree tc-prop group group-id {ethernet interface |port-channel trunk-id}
group-id - Group identifier. (Range: 1-255)
interface - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
trunk-id - Trunk index (Range: 1-28)– 539 –

Chapter 21 | Spanning Tree Commands

Default Setting
All ports and trunks belong to a common group.
Command Mode
Global Configuration
Command Usage
A port can only belong to one group. When an interface is added to a group, it isremoved from the default group. When a TCN BPDU or BPDU with the TC flag set isreceived on an interface, that interface will only notify members in same group to
propagate this topology change.
ExampleConsole(config)#spanning-tree tc-prop group 1 ethernet 1/1-5
Console(config)#

spanning-tree This command configures the maximum number of RSTP/MSTP BPDU
transmission-limit transmissions permitted within the Hello Time interval. Use the no form to restore
the default.
Syntaxspanning-tree transmission-limit countno spanning-tree transmission-limit
count - The transmission limit number. (Range: 1-10)
Default Setting
3
Command Mode
Global Configuration
Command Usage
This command limits the number of BPDUs transmitted within the configured Hello
Time interval.
ExampleConsole(config)#spanning-tree transmission-limit 4
Console(config)#– 540 –

Chapter 21 | Spanning Tree Commands

max-hops This command configures the maximum number of hops in the region before a

BPDU is discarded. Use the no form of the command to set the number of hops tothe default value.
Syntaxmax-hops hop-number
no max-hops
hop-number - Maximum hop number for multiple spanning tree.
(Range: 1-40)

Default Setting
20
Command Mode
MST Configuration
Command Usage
An MSTI region is treated as a single node by the STP and RSTP protocols. Therefore,
the message age for BPDUs inside an MSTI region is never changed. However, eachspanning tree instance within a region, and the internal spanning tree (IST) thatconnects these instances use a hop count to specify the maximum number ofbridges that will propagate a BPDU. Each bridge decrements the hop count by one
before passing on the BPDU. When the hop count reaches zero, the message isdropped.
ExampleConsole(config-mstp)#max-hops 30
Console(config-mstp)#

mst priority This command configures the priority of a spanning tree instance. Use the no form
to restore the default.
Syntax
mst instance-id priority priority
no mst instance-id priority
instance-id - Instance identifier of the spanning tree. (Range: 0-4094)
priority - Priority of the a spanning tree instance.
(Range: 0-61440 in steps of 4096; Options: 0, 4096, 8192, 12288, 16384,
20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344,
61440)
Default Setting
32768– 541 –

Chapter 21 | Spanning Tree Commands

Command Mode
MST Configuration
Command Usage MST priority is used in selecting the root bridge and alternate bridge of thespecified instance. The device with the highest priority (i.e., lowest numericalvalue) becomes the MSTI root device. However, if all devices have the samepriority, the device with the lowest MAC address will then become the root
device.
 You can set this switch to act as the MSTI root device by specifying a priority of

0, or as the MSTI alternate device by specifying a priority of 16384.

ExampleConsole(config-mstp)#mst 1 priority 4096
Console(config-mstp)#

mst vlan This command adds VLANs to a spanning tree instance. Use the no form to remove
the specified VLANs. Using the no form without any VLAN parameters to remove all
VLANs.
Syntax[no] mst instance-id vlan vlan-range
instance-id - Instance identifier of the spanning tree. (Range: 0-4094)
vlan-range - Range of VLANs. (Range: 1-4094)
Default SettingnoneCommand Mode
MST Configuration
Command Usage Use this command to group VLANs into spanning tree instances. MSTP

generates a unique spanning tree for each instance. This provides multiple
pathways across the network, thereby balancing the traffic load, preventing
wide-scale disruption when a bridge node in a single instance fails, andallowing for faster convergence of a new topology for the failed instance.

 By default all VLANs are assigned to the Internal Spanning Tree (MSTI 0) thatconnects all bridges and LANs within the MST region. This switch supports up
to 64 instances. You should try to group VLANs which cover the same generalarea of your network. However, remember that you must configure all bridges
within the same MSTI Region (page 543) with the same set of instances, and thesame instance (on each bridge) with the same set of VLANs. Also, note that– 542 –

Chapter 21 | Spanning Tree Commands

RSTP treats each MSTI region as a single node, connecting all regions to the
Common Spanning Tree.
ExampleConsole(config-mstp)#mst 1 vlan 2-5
Console(config-mstp)#name This command configures the name for the multiple spanning tree region in which
this switch is located. Use the no form of the command to set the name to thedefault name.
Syntaxname nameno namename - Name of multiple spanning tree region. (Range: 1-32 alphanumericcharacters)
Default Setting
Switch’s MAC address
Command Mode
MST Configuration
Command Usage
The MST region name and revision number (page 543) are used to designate aunique MST region. A bridge (i.e., spanning-tree compliant device such as thisswitch) can only belong to one MST region. And all bridges in the same region must
be configured with the same MST instances.
ExampleConsole(config-mstp)#name R&D
Console(config-mstp)#

Related Commands
revision (543)

revision This command configures the revision number for this multiple spanning tree

configuration of this switch. Use the no form of the command to set the revision
number to the default value.
Syntaxrevision number– 543 –

Chapter 21 | Spanning Tree Commands

no revision
number - Revision number of the spanning tree. (Range: 0-65535)
Default Setting0Command Mode
MST Configuration
Command Usage
The MST region name (page 543) and revision number are used to designate aunique MST region. A bridge (i.e., spanning-tree compliant device such as thisswitch) can only belong to one MST region. And all bridges in the same region must
be configured with the same MST instances.
ExampleConsole(config-mstp)#revision 1
Console(config-mstp)#

Related Commands
name (543)spanning-tree This command allows you to avoid transmitting BPDUs on configured edge ports
bpdu-filter that are connected to end nodes. Use the no form to disable this feature.
Syntax[no] spanning-tree bpdu-filter
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This command stops all Bridge Protocol Data Units (BPDUs) from beingtransmitted on configured edge ports to save CPU processing time. Thisfunction is designed to work in conjunction with edge ports which should only
connect end stations to the switch, and therefore do not need to process
BPDUs. However, note that if a trunking port connected to another switch or
bridging device is mistakenly configured as an edge port, and BPDU filtering isenabled on this port, this might cause a loop in the spanning tree.
 BPDU filter can only be configured on an interface if the edge port attribute is

not disabled (that is, if edge port is set to enabled or auto with the spanningtree edge-port command).
– 544 –

Chapter 21 | Spanning Tree Commands

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree edge-port
Console(config-if)#spanning-tree bpdu-filter
Console(config-if)#

Related Commands
spanning-tree edge-port (547)spanning-tree This command shuts down an edge port (i.e., an interface set for fast forwarding) if
bpdu-guard it receives a BPDU. Use the no form without any keywords to disable this feature, orwith a keyword to restore the default settings.
Syntaxspanning-tree bpdu-guard [auto-recovery [interval interval]]no spanning-tree bpdu-guard [auto-recovery [interval]]
auto-recovery - Automatically re-enables an interface after the specified
interval.
interval - The time to wait before re-enabling an interface. (Range: 30-86400
seconds)
Default Setting
BPDU Guard: Disabled
Auto-Recovery: Disabled
Auto-Recovery Interval: 300 seconds
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage An edge port should only be connected to end nodes which do not generate
BPDUs. If a BPDU is received on an edge port, this indicates an invalid network
configuration, or that the switch may be under attack by a hacker. If aninterface is shut down by BPDU Guard, it must be manually re-enabled using
the no shutdown command if the auto-recovery interval is not specified.
 BPDU guard can only be configured on an interface if the edge port attribute is

not disabled (that is, if edge port is set to enabled or auto with the spanningtree edge-port command).

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree edge-port
Console(config-if)#spanning-tree bpdu-guard
Console(config-if)#– 545 –

Chapter 21 | Spanning Tree Commands

Related Commands
spanning-tree edge-port (547)spanning-tree spanning-disabled (556)spanning-tree cost This command configures the spanning tree path cost for the specified interface.
Use the no form to restore the default auto-configuration mode.
Syntaxspanning-tree cost costno spanning-tree cost
cost - The path cost for the port. (Range: 0 for auto-configuration, 1-65535
for short path cost method, 1-200,000,000 for long path cost method)11
Table 105: Recommended STA Path Cost Range
Port TypeShort Path Cost
(IEEE 802.1D-1998)

Long Path Cost
(IEEE 802.1D-2004)

Ethernet

50-600200,000-20,000,000

Fast Ethernet

10-60

20,000-2,000,000

Gigabit Ethernet

3-10

2,000-200,000

10G Ethernet

1-5

200-20,000

Default Setting
By default, the system automatically detects the speed and duplex mode used oneach port, and configures the path cost according to the values shown below. Path
cost “0” is used to indicate auto-configuration mode. When the short path cost
method is selected and the default path cost recommended by the IEEE 8021w
standard exceeds 65,535, the default is set to 65,535.
Table 106: Default STA Path Costs
Port TypeShort Path Cost
(IEEE 802.1D-1998)

Long Path Cost
(IEEE 802.1D-2004)

Ethernet

65,5351,000,000

Fast Ethernet

65,535100,000

Gigabit Ethernet

10,00010,00010G Ethernet

1,000

1,000

Command Mode
Interface Configuration (Ethernet, Port Channel)

11. Use the spanning-tree pathcost method command to set the path cost method. The
range displayed in the CLI prompt message shows the maximum value for path cost.
However, note that the switch still enforces the rules for path cost based on thespecified path cost method (long or short).

– 546 –

Chapter 21 | Spanning Tree Commands

Command Usage This command is used by the Spanning Tree Algorithm to determine the best
path between devices. Therefore, lower values should be assigned to ports
attached to faster media, and higher values assigned to ports with slower
media.
 Path cost takes precedence over port priority.
 When the path cost method (page 537) is set to short, the maximum value forpath cost is 65,535.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree cost 50
Console(config-if)#spanning-tree This command specifies an interface as an edge port. Use the no form to restore theedge-port default.
Syntaxspanning-tree edge-port [auto]no spanning-tree edge-port
auto - Automatically determines if an interface is an edge port.
Default Setting
AutoCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage You can enable this option if an interface is attached to a LAN segment that is at
the end of a bridged LAN or to an end node. Since end nodes cannot cause
forwarding loops, they can pass directly through to the spanning tree
forwarding state. Specifying Edge Ports provides quicker convergence fordevices such as workstations or servers, retains the current forwarding
database to reduce the amount of frame flooding required to rebuild addresstables during reconfiguration events, does not cause the spanning tree toinitiate reconfiguration when the interface changes state, and also overcomesother STA-related time out problems. However, remember that Edge Portshould only be enabled for ports connected to an end-node device.
 When edge port is set as auto, the operational state is determined

automatically by the Bridge Detection State Machine described in 802.1D-2004,
where the edge port state may change dynamically based on environmentchanges (e.g., receiving a BPDU or not within the required interval).
– 547 –

Chapter 21 | Spanning Tree Commands

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree edge-port
Console(config-if)#spanning-tree This command configures the link type for Rapid Spanning Tree and Multiple
link-type Spanning Tree. Use the no form to restore the default.
Syntaxspanning-tree link-type {auto | point-to-point | shared}no spanning-tree link-typeauto - Automatically derived from the duplex mode setting.
point-to-point - Point-to-point link.
shared - Shared medium.
Default Setting
autoCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Specify a point-to-point link if the interface can only be connected to exactly
one other bridge, or a shared link if it can be connected to two or more bridges.
 When automatic detection is selected, the switch derives the link type from theduplex mode. A full-duplex interface is considered a point-to-point link, while ahalf-duplex interface is assumed to be on a shared link.

 RSTP only works on point-to-point links between two bridges. If you designatea port as a shared link, RSTP is forbidden. Since MSTP is an extension of RSTP,
this same restriction applies.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree link-type point-to-point– 548 –

Chapter 21 | Spanning Tree Commands

spanning-tree This command enables the detection and response to Spanning Tree loopback
loopback-detection BPDU packets on the port. Use the no form to disable this feature.
Syntax[no] spanning-tree loopback-detection
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage If Port Loopback Detection is not enabled and a port receives it’s own BPDU,
then the port will drop the loopback BPDU according to IEEE Standard 802.1W2001 9.3.4.
 Port Loopback Detection will not be active if Spanning Tree is disabled on theswitch.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree loopback-detection

spanning-tree This command configures the response for loopback detection to shut down theloopback-detection interface. Use the no form to restore the default.
actionSyntaxspanning-tree loopback-detection action {shutdown duration}no spanning-tree loopback-detection action
shutdown - Shuts down the interface.
duration - The duration to shut down the interface.
(Range: 60-86400 seconds)
Default Setting
shutdown, 60 seconds
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage If an interface is shut down by this command, and the release mode is set to“auto” with the spanning-tree loopback-detection release-mode command, the– 549 –

Chapter 21 | Spanning Tree Commands

selected interface will be automatically enabled when the shutdown interval
has expired.
 If an interface is shut down by this command, and the release mode is set to“manual,” the interface can be re-enabled using the spanning-tree
loopback-detection release command.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree loopback-detection action shutdown 600
Console(config-if)#spanning-tree This command configures the release mode for a port that was placed in theloopback-detection discarding state because a loopback BPDU was received. Use the no form to restore
release-mode the default.
Syntaxspanning-tree loopback-detection release-mode {auto | manual}
no spanning-tree loopback-detection release-mode
auto - Allows a port to automatically be released from the discarding state
when the loopback state ends.
manual - The port can only be released from the discarding state manually.
Default Setting
autoCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage If the port is configured for automatic loopback release, then the port will only
be returned to the forwarding state if one of the following conditions is
satisfied:The port receives any other BPDU except for it’s own, or;

The port’s link status changes to link down and then link up again, or;

The port ceases to receive it’s own BPDUs in a forward delay interval.

 If Port Loopback Detection is not enabled and a port receives it’s own BPDU,

then the port will drop the loopback BPDU according to IEEE Standard 802.1W2001 9.3.4 (Note 1).

 Port Loopback Detection will not be active if Spanning Tree is disabled on theswitch.

– 550 –

Chapter 21 | Spanning Tree Commands

 When configured for manual release mode, then a link down / up event will not

release the port from the discarding state. It can only be released using thespanning-tree loopback-detection release command.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree loopback-detection release-mode manual
Console(config-if)#spanning-tree This command enables SNMP trap notification for Spanning Tree loopback BPDU
loopback-detection detections. Use the no form to restore the default.
trap
Syntax[no] spanning-tree loopback-detection trap
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree loopback-detection trap

spanning-tree This command prevents a TCNs from being propagated from a switch port to otherrestricted-tcn ports. Use the no form to restore the default setting.
Syntax[no] spanning-tree restricted-tcn
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Commnad Usage
This command prevents a switch from propagating Topology Change Notifications(TCNs) to other ports on the switch.

– 551 –

Chapter 21 | Spanning Tree Commands

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree restricted-tcn

spanning-tree This command configures the path cost on a spanning instance in the Multiple
mst cost Spanning Tree. Use the no form to restore the default auto-configuration mode.
Syntaxspanning-tree mst instance-id cost costno spanning-tree mst instance-id costinstance-id - Instance identifier of the spanning tree. (Range: 0-4094)
cost - Path cost for an interface. (Range: 0 for auto-configuration, 1-65535
for short path cost method12, 1-200,000,000 for long path cost method)
The recommended path cost range is listed in Table 105 on page 546.
Default Setting
By default, the system automatically detects the speed and duplex mode used oneach port, and configures the path cost according to the values shown in Table 106.
Path cost “0” is used to indicate auto-configuration mode. When the short path cost
method is selected and the default path cost recommended by the IEEE 8021w
standard exceeds 65,535, the default is set to 65,535. The default path costs arelisted in Table 106 on page 546.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Each spanning-tree instance is associated with a unique set of VLAN IDs.
 This command is used by the multiple spanning-tree algorithm to determine

the best path between devices. Therefore, lower values should be assigned tointerfaces attached to faster media, and higher values assigned to interfaces
with slower media.

 Use the no spanning-tree mst cost command to specify auto-configurationmode.

 Path cost takes precedence over interface priority.

ExampleConsole(config)#interface Ethernet 1/5
Console(config-if)#spanning-tree mst 1 cost 50
Console(config-if)#

12. Use the spanning-tree pathcost method command to set the path cost method.

– 552 –

Chapter 21 | Spanning Tree Commands

Related Commands
spanning-tree mst port-priority (553)spanning-tree This command configures the interface priority on a spanning instance in the
mst port-priority Multiple Spanning Tree. Use the no form to restore the default.
Syntaxspanning-tree mst instance-id port-priority priority
no spanning-tree mst instance-id port-priority
instance-id - Instance identifier of the spanning tree. (Range: 0-4094)
priority - Priority for an interface. (Range: 0-240 in steps of 16)
Default Setting
128
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This command defines the priority for the use of an interface in the multiple
spanning-tree. If the path cost for all interfaces on a switch are the same, theinterface with the highest priority (that is, lowest value) will be configured as anactive link in the spanning tree.
 Where more than one interface is assigned the highest priority, the interface

with lowest numeric identifier will be enabled.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree mst 1 port-priority 0
Console(config-if)#

Related Commands
spanning-tree mst cost (552)spanning-tree This command floods BPDUs to other ports when spanning tree is disabled globally
port-bpdu-flooding or disabled on a specific port. Use the no form to restore the default setting.
Syntax[no] spanning-tree port-bpdu-flooding
Default Setting
Enabled– 553 –

Chapter 21 | Spanning Tree Commands

Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage When enabled, BPDUs are flooded to all other spanning-tree disabled ports on
the switch or within the receiving port's native VLAN as specified by thespanning-tree system-bpdu-flooding command.
 The spanning-tree system-bpdu-flooding command has no effect if BPDU

flooding is disabled on a port by the spanning-tree port-bpdu-flooding
command.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree port-bpdu-flooding
Console(config-if)#spanning-tree This command configures the priority for the specified interface. Use the no form toport-priority restore the default.
Syntaxspanning-tree port-priority priority
no spanning-tree port-priority
priority - The priority for a port. (Range: 0-240, in steps of 16)
Default Setting
128
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This command defines the priority for the use of a port in the Spanning Tree

Algorithm. If the path cost for all ports on a switch are the same, the port withthe highest priority (that is, lowest value) will be configured as an active link inthe spanning tree.

 Where more than one port is assigned the highest priority, the port with lowest

numeric identifier will be enabled.

 The criteria used for determining the port role is based on root bridge ID, root

path cost, designated bridge, designated port, port priority, and port number,in that order and as applicable to the role under question.

– 554 –

Chapter 21 | Spanning Tree Commands

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree port-priority 0

Related Commands
spanning-tree cost (546)spanning-tree This command prevents a designated port13 from taking superior BPDUs intoroot-guard account and allowing a new STP root port to be elected. Use the no form to disable
this feature.
Syntax[no] spanning-tree root-guard
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage

 A bridge with a lower bridge identifier (or same identifier and lower MAC

address) can take over as the root bridge at any time.

 When Root Guard is enabled, and the switch receives a superior BPDU on thisport, it is set to the Discarding state until it stops receiving superior BPDUs for a
fixed recovery period. While in the discarding state, no traffic is forwarded
across the port.

 Root Guard can be used to ensure that the root bridge is not formed at a

suboptimal location. Root Guard should be enabled on any designated port
connected to low-speed bridges which could potentially overload a slower linkby taking over as the root port and forming a new spanning tree topology. It
could also be used to form a border around part of the network where the root
bridge is allowed.

 When spanning tree is initialized globally on the switch or on an interface, theswitch will wait for 20 seconds to ensure that the spanning tree has converged
before enabling Root Guard.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#spanning-tree root-guard
Console(config-if)#

13. See Port Role in the Web Management Guide.

– 555 –

Chapter 21 | Spanning Tree Commands

spanning-tree This command disables the spanning tree algorithm for the specified interface. Use
spanning-disabled the no form to re-enable the spanning tree algorithm for the specified interface.
Syntax[no] spanning-tree spanning-disabled
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
When spanning tree is enabled globally (spanning-tree command) or enabled on
an interface by this command, loopback detection is disabled.
ExampleThis example disables the spanning tree algorithm for port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#spanning-tree spanning-disabled
Console(config-if)#spanning-tree This command stops the propagation of topology change notifications (TCN for
tc-prop-stop STP) and topology change messages (TC for RSTP/MSTP). Use the no form to allow
propagation of TCN/TC messages.
Syntax[no] spanning-tree tc-prop-stop
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
When this command is enabled on an interface, topology change information
originating from the interface will still be propagated.
This command should not be used on an interface which is purposely configured ina ring topology.

– 556 –

Chapter 21 | Spanning Tree Commands

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#spanning-tree tc-prop-stop
Console(config-if)#spanning-tree This command manually releases a port placed in discarding state by loopbackloopback-detection detection.
release
Syntaxspanning-tree loopback-detection release interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
Command Usage
Use this command to release an interface from discarding state if loopback
detection release mode is set to “manual” by the spanning-tree loopback-detection
release-mode command and BPDU loopback occurs.
ExampleConsole#spanning-tree loopback-detection release ethernet 1/1
Console#spanning-tree This command re-checks the appropriate BPDU format to send on the selected
protocol-migration interface.
Syntaxspanning-tree protocol-migration interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)– 557 –

Chapter 21 | Spanning Tree Commands

Command Mode
Privileged Exec
Command Usage
If at any time the switch detects STP BPDUs, including Configuration or Topology
Change Notification BPDUs, it will automatically set the selected interface to forced
STP-compatible mode. However, you can also use the spanning-tree protocolmigration command at any time to manually re-check the appropriate BPDU
format to send on the selected interfaces (i.e., RSTP or STP-compatible).
ExampleConsole#spanning-tree protocol-migration ethernet 1/5
Console#show spanning-tree This command shows the configuration for the common spanning tree (CST), for all
instances within the multiple spanning tree (MST), or for a specific instance within
the multiple spanning tree (MST).
Syntaxshow spanning-tree [interface | mst instance-id [brief | interface] | brief |stp-enabled-only]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
instance-id - Instance identifier of the multiple spanning tree.
(Range: 0-4094)
brief - Shows a summary of global and interface settings.
stp-enabled-only - Displays global settings, and settings for interfaces forwhich STP is enabled.
Default Setting
None
Command Mode
Privileged Exec
Command Usage Use the show spanning-tree command with no parameters to display thespanning tree configuration for the switch for the Common Spanning Tree
(CST) and for every interface in the tree.

– 558 –

Chapter 21 | Spanning Tree Commands

 Use the show spanning-tree interface command to display the spanning tree

configuration for an interface within the Common Spanning Tree (CST).

 Use the show spanning-tree mst command to display the spanning tree

configuration for all instances within the Multiple Spanning Tree (MST),
including global settings and settings for active interfaces.

 Use the show spanning-tree mst instance-id command to display thespanning tree configuration for an instance within the Multiple Spanning Tree
(MST), including global settings and settings for all interfaces.

ExampleConsole#show spanning-tree
Spanning Tree Information--------------------------------------------------------------Spanning Tree Mode
: MSTP
Spanning Tree Enabled/Disabled : Enabled
Instance: 0
VLANs Configured: 1-4094
Priority: 32768
Bridge Hello Time (sec.): 2
Bridge Max. Age (sec.): 20
Bridge Forward Delay (sec.): 15
Root Hello Time (sec.): 2
Root Max. Age (sec.): 20
Root Forward Delay (sec.): 15
Max. Hops: 20
Remaining Hops
: 20
Designated Root
: 32768.0.0001ECF8D8C6Current Root Port: 21
Current Root Cost
: 100000
Number of Topology Changes: 5
Last Topology Change Time (sec.): 11409
Transmission Limit: 3
Path Cost Method: LongFlooding Behavior: To VLAN
Cisco Prestandard: Disabled--------------------------------------------------------------Eth 1/ 1 Information--------------------------------------------------------------Admin Status: EnabledRole: Disabled
State: Discarding
External Admin Path Cost
: 0
Internal Admin Path Cost
: 0
External Oper Path Cost
: 100000Internal Oper Path Cost
: 100000
Priority: 128
Designated Cost
: 100000
Designated Port
: 128.1
Designated Root
: 32768.0.0001ECF8D8C6Designated Bridge: 32768.0.123412341234
Forward Transitions: 4
Admin Edge Port
: DisabledOper Edge Port
: Disabled
Admin Link Type: AutoOper Link Type: Point-to-point
Flooding Behavior: Enabled
Spanning-Tree Status: Enabled
Loopback Detection Status: Enabled
Loopback Detection Release Mode
: Auto– 559 –

Chapter 21 | Spanning Tree Commands

Loopback Detection Trap
: Disabled
Loopback Detection Action: Block
Root Guard Status: Disabled
BPDU Guard Status: Disabled
BPDU Guard Auto Recovery: Disabled
BPDU Guard Auto Recovery Interval : 300
BPDU Filter Status: Disabled
TC Propagate Stop
: Disabled
Restricted TCN: Disabled.
.
.

This example shows a brief summary of global and interface setting for the
spanning tree.
Console#show spanning-tree brief
Spanning Tree Mode
: RSTP
Spanning Tree Enabled/Disabled : Enabled
Designated Root
: 32768.0000E8944000
Current Root Port (Eth): 1/24Current Root Cost
: 10000
Interface Pri Designated
Designated Oper
STP
Role State Oper
Bridge ID
Port ID
Cost
StatusEdge--------- --- --------------------- ---------- -------- ------ ---- ----- --Eth 1/ 1 128 32768.0000E89382A0
128.1
100000 EN
DESG FWD
No
Eth 1/ 2 128 32768.0000E89382A0
128.2
10000 ENDISB BLKNo
Eth 1/ 3 128 32768.0000E89382A0
128.3
10000 ENDISB BLKNo
Eth 1/ 4 128 32768.0000E89382A0
128.4
10000 ENDISB BLKNo
Eth 1/ 5 128 32768.0000E89382A0
128.5
10000 ENDISB BLK
No.
.
.

show spanning-tree This command shows the configuration of the multiple spanning tree.
mst configuration
Command Mode
Privileged Exec
ExampleConsole#show spanning-tree mst configuration
Mstp Configuration Information-------------------------------------------------------------Configuration Name : R&D
Revision Level:0
Instance VLANs-------------------------------------------------------------0
1-4094
Console#– 560 –

Chapter 21 | Spanning Tree Commands

show spanning-tree This command shows the configuration of topology change propagation domains.
tc-prop
Syntaxshow spanning-tree tc-prop [group group-id]
group-id - Group identifier. (Range: 1-255)
Command Mode
Privileged Exec
ExampleConsole#show spanning-tree tc-prop group 1
Group 1
Eth 1/ 1, Eth 1/ 2, Eth 1/ 3, Eth 1/ 4, Eth 1/ 5
Console#– 561 –

Chapter 21 | Spanning Tree Commands– 562 –

22

VLAN Commands

A VLAN is a group of ports that can be located anywhere in the network, but
communicate as though they belong to the same physical segment. This section
describes commands used to create VLAN groups, add port members, specify how
VLAN tagging is used, and enable automatic VLAN registration for the selectedinterface.
Table 107: VLAN Commands
Command Group

Function

GVRP and Bridge Extension Configures GVRP settings that permit automatic VLAN learning; shows
Commands
the configuration for bridge extension MIB
Editing VLAN Groups

Sets up VLAN groups, including name, VID and state

Configuring VLAN
Interfaces

Configures VLAN interface parameters, including ingress and egress
tagging mode, ingress filtering, and PVID

Displaying VLAN
Information

Displays VLAN groups, status, port members, and MAC addresses

Configuring IEEE 802.1Q
Tunneling

Configures 802.1Q Tunneling (QinQ Tunneling)

Configuring L2PT
Tunneling1

Configures Layer 2 Protocol Tunneling (L2PT), either by discarding,
processing, or transparently passing control packets across a QinQ
tunnelConfiguring VLAN
Translation2

Maps VLAN ID between customer and service provider for networks
that do not support IEEE 802.1Q tunneling

Configuring Protocol-based Configures protocol-based VLANs based on frame type and protocol
VLANs2
Configuring IP Subnet
VLANs2

Configures IP Subnet-based VLANs

Configuring MAC Based
VLANs2

Configures MAC-based VLANs

Configuring Voice VLANs

Configures VoIP traffic detection and enables a Voice VLAN

Configuring Excluded
VLANs

Configures excluded VLAN sessions

1
2

These functions are not compatible.
If a packet matches the rules defined by more than one of these functions, only one of themis applied, with the precedence being MAC-based, IP subnet-based, protocol-based, andthen native port-based (see the switchport priority default command).

– 563 –

Chapter 22 | VLAN Commands
GVRP and Bridge Extension Commands

GVRP and Bridge Extension Commands
GARP VLAN Registration Protocol defines a way for switches to exchange VLAN
information in order to automatically register VLAN members on interfaces acrossthe network. This section describes how to enable GVRP for individual interfaces
and globally for the switch, as well as how to display default configuration settings
for the Bridge Extension MIB.
Table 108: GVRP and Bridge Extension Commands
CommandFunctionModebridge-ext gvrp

Enables GVRP globally for the switchGC

garp timer

Sets the GARP timer for the selected function

ICswitchport forbidden vlan

Configures forbidden VLANs for an interfaceICswitchport gvrp

Enables GVRP for an interface

ICshow bridge-ext

Shows the global bridge extension configuration

PEshow garp timer

Shows the GARP timer for the selected function

NE, PEshow gvrp configuration

Displays GVRP configuration for the selected interface

NE, PE

bridge-ext gvrp This command enables GVRP globally for the switch. Use the no form to disable it.
Syntax[no] bridge-ext gvrp
Default Setting
Disabled
Command Mode
Global Configuration
Command UsageGVRP defines a way for switches to exchange VLAN information in order to register
VLAN members on ports across the network. This function should be enabled topermit automatic VLAN registration, and to support VLANs which extend beyond
the local switch.
ExampleConsole(config)#bridge-ext gvrp
Console(config)#– 564 –

Chapter 22 | VLAN Commands
GVRP and Bridge Extension Commands

garp timer This command sets the values for the join, leave and leaveall timers. Use the noform to restore the timers’ default values.
Syntaxgarp timer {join | leave | leaveall} timer-value
no garp timer {join | leave | leaveall}{join | leave | leaveall} - Timer to set.
timer-value - Value of timer.
Ranges:join: 20-1000 centiseconds
leave: 60-3000 centiseconds
leaveall: 500-18000 centiseconds
Default Setting
join: 20 centiseconds
leave: 60 centiseconds
leaveall: 1000 centiseconds
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Group Address Registration Protocol is used by GVRP and GMRP to register orderegister client attributes for client services within a bridged LAN. The default
values for the GARP timers are independent of the media access method ordata rate. These values should not be changed unless you are experiencing
difficulties with GMRP or GVRP registration/deregistration.
 Timer values are applied to GVRP for all the ports on all VLANs.
 Timer values must meet the following restrictions:

leave > (2 x join)leaveall > leave

Note: Set GVRP timers on all Layer 2 devices connected in the same network to thesame values. Otherwise, GVRP may not operate successfully.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#garp timer join 100
Console(config-if)#– 565 –

Chapter 22 | VLAN Commands
GVRP and Bridge Extension Commands
Related Commands
show garp timer (568)switchport forbidden This command configures forbidden VLANs. Use the no form to remove the list ofvlan forbidden VLANs.
Syntaxswitchport forbidden vlan {add vlan-list | remove vlan-list}
no switchport forbidden vlan
add vlan-list - List of VLAN identifiers to add.
remove vlan-list - List of VLAN identifiers to remove.
vlan-list - Separate nonconsecutive VLAN identifiers with a comma and nospaces; use a hyphen to designate a range of IDs. (Range: 1-4094).
Default Setting
No VLANs are included in the forbidden list.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This command prevents a VLAN from being automatically added to thespecified interface via GVRP using the switchport gvrp command.

 If a VLAN has been added to the set of allowed VLANs for an interface, then you

cannot add it to the set of forbidden VLANs for that same interface.

 GVRP cannot be enabled for ports set to Access mode (see the switchportmode command).

 This command will not be accepted if the specified VLAN does not exist on theswitch.

ExampleThe following example shows how to prevent port 1 from being added to VLAN 3:
Console(config)#interface ethernet 1/1
Console(config-if)#switchport forbidden vlan add 3
Console(config-if)#– 566 –

Chapter 22 | VLAN Commands
GVRP and Bridge Extension Commands

switchport gvrp This command enables GVRP for a port. Use the no form to disable it.
Syntax[no] switchport gvrp
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command UsageGVRP cannot be enabled for ports set to Access mode using the switchport mode
command.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#switchport gvrp
Console(config-if)#show bridge-ext This command shows the configuration for bridge extension commands.
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show bridge-ext
Maximum Supported VLAN Numbers: 4094
Maximum Supported VLAN ID: 4094
Extended Multicast Filtering Services : No
Static Entry Individual Port: Yes
VLAN Version Number: 2
VLAN Learning: IVL
Configurable PVID Tagging: Yes
Local VLAN Capable: No
Traffic Classes: Enabled
Global GVRP Status: Disabled
Console#– 567 –

Chapter 22 | VLAN Commands
GVRP and Bridge Extension Commands
Table 109: show bridge-ext - display description
Field

Description

Maximum
Supported VLAN
Numbers

The maximum number of VLANs supported on this switch.

Maximum
The maximum configurable VLAN identifier supported on this switch.
Supported VLAN ID
Extended Multicast
Filtering Services

This switch does not support the filtering of individual multicast addresses
based on GMRP (GARP Multicast Registration Protocol).

Static Entry
Individual PortThis switch allows static filtering for unicast and multicast addresses. (Refer tothe mac-address-table static command.)VLAN Version
NumberBased on IEEE 802.1Q, “1” indicates Bridges that support only single spanning
tree (SST) operation, and “2” indicates Bridges that support multiple spanning
tree (MST) operation.

VLAN LearningThis switch uses Independent VLAN Learning (IVL), where each port maintains
its own filtering database.

Configurable PVID
Tagging

This switch allows you to override the default Port VLAN ID (PVID used in frametags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to theswitchport allowed vlan command.)

Local VLAN Capable This switch does not support multiple local bridges outside of the scope of
802.1Q defined VLANs.
Traffic Classes

This switch provides mapping of user priorities to multiple traffic classes. (Refer
to “Class of Service Commands” on page 649.)

Global GVRP Status

GARP VLAN Registration Protocol defines a way for switches to exchange VLAN
information in order to automatically register VLAN members on interfaces
across the network. This field shows if GVRP is globally enabled or disabled.
(Refer to the bridge-ext gvrp command.)show garp timer This command shows the GARP timers for the selected interface.
Syntaxshow garp timer [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default SettingShows all GARP timers.
Command Mode
Normal Exec, Privileged Exec

– 568 –

Chapter 22 | VLAN Commands
GVRP and Bridge Extension Commands
ExampleConsole#show garp timer ethernet 1/1
Eth 1/ 1 GARP Timer Status:
Join Timer: 20 centiseconds
Leave Timer: 60 centiseconds
Leave All Timer : 1000 centiseconds
Console#Related Commands
garp timer (565)show gvrp This command shows if GVRP is enabled.
configuration
Syntaxshow gvrp configuration [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default SettingShows both global and interface-specific configuration.
Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show gvrp configuration ethernet 1/7
Eth 1/ 7:
GVRP Configuration : Disabled
Console#– 569 –

Chapter 22 | VLAN Commands
Editing VLAN Groups

Editing VLAN Groups
Table 110: Commands for Editing VLAN Groups
CommandFunctionModevlan database

Enters VLAN database mode to add, change, and delete
VLANs

GC

vlan

Configures a VLAN, including VID, name and state

VC

vlan database This command enters VLAN database mode. All commands in this mode will takeeffect immediately.
Default Setting
None
Command Mode
Global Configuration
Command Usage Use the VLAN database command mode to add, change, and delete VLANs.
After finishing configuration changes, you can display the VLAN settings byentering the show vlan command.
 Use Interface Configuration mode (Ethernet, Port Channel) to define the port

membership mode and add or remove ports from a VLAN. The results of thesecommands are written to the running-configuration file, and you can display
this file by entering the show running-config command.

ExampleConsole(config)#vlan database
Console(config-vlan)#

Related Commands
show vlan (579)– 570 –

Chapter 22 | VLAN Commands

Editing VLAN Groups

vlan This command configures a VLAN. Use the no form to restore the default settings ordelete a VLAN.
Syntaxvlan vlan-id [name vlan-name] media ethernet [state {active | suspend}][rspan]no vlan vlan-id [name | state]vlan-id - VLAN ID, specified as a single number, a range of consecutive
numbers separated by a hyphen, or multiple numbers separated bycommas. (Range: 1-4094)
name - Keyword to be followed by the VLAN name.
vlan-name - ASCII string from 1 to 32 characters.
media ethernet - Ethernet media type.
state - Keyword to be followed by the VLAN state.
active - VLAN is operational.
suspend - VLAN is suspended. Suspended VLANs do not pass packets.
rspan - Keyword to create a VLAN used for mirroring traffic fromremote switches. The VLAN used for RSPAN cannot include VLAN 1 (theswitch’s default VLAN). Nor should it include VLAN 4093 (which is used
for switch clustering). Configuring VLAN 4093 for other purposes may
cause problems in the Clustering operation. For more information on
configuring RSPAN through the CLI, see “RSPAN Mirroring Commands”
on page 476.
Note: Ports can only be added to an RSPAN VLAN using the commands describedunder “RSPAN Mirroring Commands”.

Default Setting
By default only VLAN 1 exists and is active.
Command Mode
VLAN Database Configuration
Command Usage
 no vlan vlan-id deletes the VLAN.
 no vlan vlan-id name removes the VLAN name.
 no vlan vlan-id state returns the VLAN to the default state (i.e., active).
 You can configure up to 4094 VLANs on the switch.

– 571 –

Chapter 22 | VLAN Commands
Configuring VLAN Interfaces
ExampleThe following example adds a VLAN, using VLAN ID 105 and name RD5. The VLAN is
activated by default.
Console(config)#vlan database
Console(config-vlan)#vlan 105 name RD5 media ethernet
Console(config-vlan)#

Related Commands
show vlan (579)

Configuring VLAN Interfaces
Table 111: Commands for Configuring VLAN Interfaces
CommandFunctionModeinterface vlan

Enters interface configuration mode for a specified VLAN

IC

switchport acceptableframe-types

Configures frame types to be accepted by an interfaceICswitchport allowed vlan

Configures the VLANs associated with an interfaceICswitchport forbidden vlan

Configures forbidden VLANs for an interfaceICswitchport gvrp

Enables GVRP for an interfaceICswitchport ingress-filtering Enables ingress filtering on an interfaceICswitchport mode

Configures VLAN membership mode for an interfaceICswitchport native vlan

Configures the PVID (native VLAN) of an interfaceICvlan-trunking

Allows unknown VLAN groups to pass through a specified ICinterfaceswitchport priority default

Sets a port priority for incoming untagged framesICinterface vlan This command enters interface configuration mode for VLANs, which is used toconfigure VLAN parameters for a physical interface. Use the no form to change aLayer 3 normal VLAN back to a Layer 2 interface.
Syntax[no] interface vlan vlan-id
vlan-id - ID of the configured VLAN. (Range: 1-4094)
Default Setting
None
Command Mode
Global Configuration– 572 –

Chapter 22 | VLAN Commands

Configuring VLAN Interfaces

Command Usage Creating a “normal” VLAN with the vlan command initializes it as a Layer 2interface. To change it to a Layer 3 interface, use the interface command toenter interface configuration for the desired VLAN, enter any Layer 3
configuration commands, and save the configuration settings.
 To change a Layer 3 normal VLAN back to a Layer 2 VLAN, use the no interface

command.

ExampleThe following example shows how to set the interface configuration mode to
VLAN 1, and then assign an IP address to the VLAN:
Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.254 255.255.255.0
Console(config-if)#

Related Commands
shutdown (421)interface (415)vlan (571)switchport This command configures the acceptable frame types for a port. Use the no form toacceptable-frame- restore the default.
types
Syntaxswitchport acceptable-frame-types {all | tagged}
no switchport acceptable-frame-types
all - The port accepts all frames, tagged or untagged.
tagged - The port only receives tagged frames.
Default Setting
All frame types
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
When set to receive all frame types, any received frames that are untagged areassigned to the port default VLAN if not matched to a configured MAC VLAN, IPsubnet VLAN, or protocol VLAN.

– 573 –

Chapter 22 | VLAN Commands
Configuring VLAN Interfaces
ExampleThe following example shows how to restrict the traffic received on port 1 totagged frames:
Console(config)#interface ethernet 1/1
Console(config-if)#switchport acceptable-frame-types tagged
Console(config-if)#

Related Commands
switchport mode (576)switchport This command configures VLAN groups on the selected interface. Use the no form
allowed vlan to restore the default.
Syntaxswitchport allowed vlan {vlan-list | add vlan-list [tagged | untagged | doubletagged] | remove vlan-list}
no switchport allowed vlan
vlan-list - If a VLAN list is entered without using the add option, theinterface is assigned to the specified VLANs, and membership in all
previous VLANs is removed. The interface is added as an untagged member
if switchport mode is set to hybrid or access, or as an tagged member if
switchport mode is set to trunk.
Separate nonconsecutive VLAN identifiers with a comma and no spaces;
use a hyphen to designate a range of IDs. (Range: 1-4094).
add vlan-list - List of VLAN identifiers to add. When the add option is used,
the interface is assigned to the specified VLANs, and membership in all
previous VLANs is retained.
remove vlan-list - List of VLAN identifiers to remove.
tagged - Adds a port as a tagged member of a VLAN.
untagged - Adds a port as an untagged member of a VLAN.
double-tagged - Adds a port as a double-tagged member of a VLAN.
Default Setting
All ports are assigned to VLAN 1 by default.
The default frame type is untagged.
Command Mode
Interface Configuration (Ethernet, Port Channel)– 574 –

Chapter 22 | VLAN Commands

Configuring VLAN Interfaces

Command Usage If a port or trunk has switchport mode set to access, then only one VLAN can be
added with this command. If a VLAN list is specified, only the last VLAN in thelist will be added to the interface.
 If a port or trunk has switchport mode set to trunk (i.e., 1Q Trunk), then you can

only assign the interface to VLAN groups as a tagged member.

 Frames are always tagged within the switch. The tagged/untagged parameterused when adding a VLAN to an interface tells the switch whether to keep or
remove the tag from a frame on egress.

 If none of the intermediate network devices nor the host at the other end of theconnection supports VLANs, the interface should be added to these VLANs as
an untagged member. Otherwise, it is only necessary to add at most one VLAN
as untagged, and this should correspond to the native VLAN for the interface.

 If a VLAN on the forbidden list for an interface is manually added to thatinterface, the VLAN is automatically removed from the forbidden list for thatinterface.

 Ports can only be added to an RSPAN VLAN using the commands describedunder “RSPAN Mirroring Commands”.

ExampleThe following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as
tagged VLANs for port 1:
Console(config)#interface ethernet 1/1
Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged
Console(config-if)#switchport This command enables ingress filtering for an interface. Use the no form to restore
ingress-filtering the default.
Syntax[no] switchport ingress-filtering
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 575 –

Chapter 22 | VLAN Commands
Configuring VLAN Interfaces
Command Usage If ingress filtering is disabled and a port receives frames classified to VLANs forwhich it is not a member, these frames will be flooded to all other ports that are
members of the VLANs.
 If ingress filtering is enabled and a port receives frames classified to VLANs forwhich it is not a member, these frames will be discarded.

 Ingress filtering does not affect VLAN independent BPDU frames, such as GVRPor STA. However, they do affect VLAN dependent BPDU frames, such as GMRP.

 Ingress filtering cannot be enabled for a port if the port does not join the PVID

VLAN.

 Ingress filtering cannot be disabled for a port if loopback detection on the port

is active. (Both global and per port are enabled.)

ExampleThe following example shows how to set the interface to port 1 and then enable
ingress filtering:
Console(config)#interface ethernet 1/1
Console(config-if)#switchport ingress-filtering
Console(config-if)#switchport mode This command configures the VLAN membership mode for a port. Use the no form
to restore the default.
Syntaxswitchport mode {access | hybrid | trunk}no switchport mode
access - Specifies an access VLAN interface. The port transmits and receives
untagged frames on a single VLAN only.
hybrid - Specifies a hybrid VLAN interface. The port may transmit tagged or
untagged frames.
trunk - Specifies a port as an end-point for a VLAN trunk. A trunk is a direct
link between two switches, so the port transmits tagged frames that
identify the source VLAN. Note that frames belonging to the port’s default
VLAN (i.e., associated with the PVID) are also transmitted as tagged frames.
Default Setting
All ports are in hybrid mode with the PVID set to VLAN 1.
Command Mode
Interface Configuration (Ethernet, Port Channel)– 576 –

Chapter 22 | VLAN Commands

Configuring VLAN Interfaces

ExampleThe following shows how to set the configuration mode to port 1, and then set theswitchport mode to hybrid:
Console(config)#interface ethernet 1/1
Console(config-if)#switchport mode hybrid
Console(config-if)#

Related Commands
switchport acceptable-frame-types (573)switchport native vlan This command configures the PVID (i.e., port VLAN ID) for a port. Use the no form torestore the default.
Syntaxswitchport native vlan vlan-id
no switchport native vlan
vlan-id - Default VLAN ID for a port. (Range: 1-4094)
Default Setting
VLAN 1
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage When changing the PVID for a port using access mode, the port willautomatically join the new PVID VLAN and leave the VLAN which it had joined
before.

 When using Access mode, and an interface is assigned to a new VLAN, its PVID

is automatically set to the identifier for that VLAN.

 The PVID can be set to any VLAN that the port does not join when using hybrid

or trunk mode, and ingress filtering is disabled.

 The PVID can only be set to a VLAN that the port joins when using hybrid ortrunk mode, and ingress filtering is enabled.

ExampleThe following example shows how to set the PVID for port 1 to VLAN 3:
Console(config)#interface ethernet 1/1
Console(config-if)#switchport native vlan 3
Console(config-if)#– 577 –

Chapter 22 | VLAN Commands
Configuring VLAN Interfaces

vlan-trunking This command allows unknown VLAN groups to pass through the specified
interface. Use the no form to disable this feature.
Syntax[no] vlan-trunking
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Use this command to configure a tunnel across one or more intermediateswitches which pass traffic for VLAN groups to which they do not belong.

The following figure shows VLANs 1 and 2 configured on switches A and B, with
VLAN trunking being used to pass traffic for these VLAN groups across switches
C, D and E.
Figure 5: Configuring VLAN Trunking

Without VLAN trunking, you would have to configure VLANs 1 and 2 on all
intermediate switches – C, D and E; otherwise these switches would drop any
frames with unknown VLAN group tags. However, by enabling VLAN trunking
on the intermediate switch ports along the path connecting VLANs 1 and 2,
you only need to create these VLAN groups in switches A and B. Switches C, D
and E automatically allow frames with VLAN group tags 1 and 2 (groups thatare unknown to those switches) to pass through their VLAN trunking ports.
 VLAN trunking is mutually exclusive with the “access” switchport mode (see theswitchport mode command). If VLAN trunking is enabled on an interface, thenthat interface cannot be set to access mode, and vice versa.

 To prevent loops from forming in the spanning tree, all unknown VLANs will bebound to a single instance (either STP/RSTP or an MSTP instance, depending on
the selected STA mode).

 If both VLAN trunking and ingress filtering are disabled on an interface, packets

with unknown VLAN tags will still be allowed to enter this interface and will be– 578 –

Chapter 22 | VLAN Commands

Displaying VLAN Information

flooded to all other ports where VLAN trunking is enabled. (In other words,
VLAN trunking will still be effectively enabled for the unknown VLAN).
ExampleThe following example enables VLAN trunking on ports 27 and 28 to establish apath across the switch for unknown VLAN groups:
Console(config)#interface ethernet 1/27
Console(config-if)#vlan-trunking
Console(config-if)#interface ethernet 1/28
Console(config-if)#vlan-trunking
Console(config-if)#

Displaying VLAN Information
This section describes commands used to display VLAN information.

Table 112: Commands for Displaying VLAN Information
CommandFunctionModeshow interfaces status vlan Displays status for the specified VLAN interface

NE, PEshow interfaces switchport Displays the administrative and operational status of aninterface

NE, PEshow vlan

NE, PE

Shows VLAN information

show vlan This command shows VLAN information.
Syntaxshow vlan [id vlan-id | name vlan-name]id - Keyword to be followed by the VLAN ID.
vlan-id - ID of the configured VLAN. (Range: 1-4094)
name - Keyword to be followed by the VLAN name.
vlan-name - ASCII string from 1 to 32 characters.
Default SettingShows all VLANs.
Command Mode
Normal Exec, Privileged Exec
ExampleThe following example shows how to display information for VLAN 1:– 579 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunneling

Console#show vlan id 1
VLAN ID: 1
Type: Static
Name: DefaultVlan
Status: Active
Ports/Port Channels : Eth1/ 1(S) Eth1/ 2(S) Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S)Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S)Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S)Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S)Eth1/21(S) Eth1/22(S) Eth1/23(S) Eth1/24(S) Eth1/25(S)Eth1/26(S) Eth1/27(S) Eth1/28(S)Console#Configuring IEEE 802.1Q TunnelingIEEE 802.1Q tunneling (QinQ tunneling) uses a single Service Provider VLAN(SPVLAN) for customers who have multiple VLANs. Customer VLAN IDs arepreserved and traffic from different customers is segregated within the service
provider’s network even when they use the same customer-specific VLAN IDs. QinQ
tunneling expands VLAN space by using a VLAN-in-VLAN hierarchy, preserving thecustomer’s original tagged packets, and adding SPVLAN tags to each frame (alsocalled double tagging).
This section describes the commands used to configure QinQ tunneling.
Table 113: 802.1Q Tunneling Commands
CommandFunction

dot1q-tunnel
system-tunnel-control

Configures the switch to operate in normal mode or QinQ GC
mode

dot1q-tunnel tpid

Configures the other tag ethertype for QinQ tunnelingGC

switchport dot1q-tunnel
mode

Configures the QinQ tunnel port mode of an interfaceICswitchport dot1q-tunnel
priority map

Copies inner tag priority to outer tag priorityICswitchport dot1q-tunnel
service match cvid

Creates a CVLAN to SPVLAN mapping entry and optionally IC
replaces the CVLAN

switchport dot1q-tunnel
vlan-double-tag cvid

Adds a CVID to untagged framesICshow dot1q-tunnel service

Displays tunnel service subscriptions, default discard
service, and discarded untagged traffic configuration

PEshow dot1q-tunnel

Displays the configuration of QinQ tunnel portsPEshow dot1q-tunnel vlandouble-tag

Displays port double-tag CVID configuration

PEshow interfaces switchport Displays port QinQ operational status– 580 –ModePE

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunneling
General Configuration Guidelines for QinQ

1. Configure the switch to QinQ mode (dot1q-tunnel system-tunnel-control).
2. Create a SPVLAN (vlan).
3. Configure the QinQ tunnel access port to dot1Q-tunnel access mode(switchport dot1q-tunnel mode).

4. Set the Tag Protocol Identifier (TPID) value of the tunnel access port. This step isrequired if the attached client is using a nonstandard 2-byte ethertype toidentify 802.1Q tagged frames. The standard ethertype value is 0x8100. (See
dot1q-tunnel tpid.)

5. Configure the QinQ tunnel access port to join the SPVLAN as an untagged
member (switchport allowed vlan).

6. Configure the SPVLAN ID as the native VID on the QinQ tunnel access port
(switchport native vlan).

7. Configure the QinQ tunnel uplink port to dot1Q-tunnel uplink mode(switchport dot1q-tunnel mode).

8. Configure the QinQ tunnel uplink port to join the SPVLAN as a tagged member(switchport allowed vlan).

Limitations for QinQ The native VLAN for the tunnel uplink ports and tunnel access ports cannot be

the same. However, the same service VLANs can be set on both tunnel port
types.

 IGMP Snooping should not be enabled on a tunnel access port.
 If the spanning tree protocol is enabled, be aware that a tunnel access or tunnel

uplink port may be disabled if the spanning tree structure is automaticallyreconfigured to overcome a break in the tree. It is therefore advisable to disable
spanning tree on these ports.

dot1q-tunnel This command sets the switch to operate in QinQ mode. Use the no form to disable
system-tunnel-control QinQ operating mode.
Syntax[no] dot1q-tunnel system-tunnel-control
Default Setting
Disabled– 581 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunneling
Command Mode
Global Configuration
Command Usage
QinQ tunnel mode must be enabled on the switch for QinQ interface settings to befunctional.
ExampleConsole(config)#dot1q-tunnel system-tunnel-control
Console(config)#

Related Commands
show dot1q-tunnel (588)show interfaces switchport (432)

dot1q-tunnel tpid Use this command to set the global setting for the QinQ outer tag ethertype field.
Use the no form of the command to set the ethertype field to the default value.
Syntax[no] dot1q-tunnel tpid ethertype
ethertype – A specific Ethernet protocol number. (Range: 800-ffff hex)
Default Setting
The ethertype is set to 0x8100
Command Mode
Global Configuration
Command Usage
Use the dot1q-tunnel tpid command to set the global custom 802.1Q ethertype.
This feature allows the switch to interoperate with third-party switches that do not
use the standard 0x8100 ethertype to identify 802.1Q-tagged frames. For example,
if 0x1234 is set as the global 802.1Q ethertype, incoming frames on trunk ports
containing that ethertype are assigned to the VLAN contained in the tag following
the ethertype field. Frames arriving on trunk ports containing any other ethertype
are looked upon as untagged frames, and assigned to the native VLAN of the port.
The specified ethertype only applies to ports configured in Uplink mode using theswitchport dot1q-tunnel mode command. If the port is in normal mode (i.e,unspecified), the TPID is always 0x8100. If the port is in Access mode, received
packets are processes as untagged packets.
ExampleConsole(config)#dot1q-tunnel tpid 0x88A8
Console(config)#– 582 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunneling
Related Commands
show dot1q-tunnel (588)switchport dot1q-tunnel mode (583)switchport This command configures an interface as a QinQ tunnel port. Use the no form to
dot1q-tunnel mode disable QinQ on the interface.
Syntaxswitchport dot1q-tunnel mode {access | uplink}no switchport dot1q-tunnel mode
access – Sets the port as an 802.1Q tunnel access port.
uplink – Sets the port as an 802.1Q tunnel uplink port.
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage QinQ tunneling must be enabled on the switch using the dot1q-tunnel
system-tunnel-control command before the switchport dot1q-tunnel modeinterface command can take effect.
 When a tunnel uplink port receives a packet from a customer, the customer tag(regardless of whether there are one or more tag layers) is retained in the innertag, and the service provider’s tag added to the outer tag.

 When a tunnel uplink port receives a packet from the service provider, theouter service provider’s tag is stripped off, and the packet passed on to the
VLAN indicated by the inner tag. If no inner tag is found, the packet is passed
onto the native VLAN defined for the uplink port.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel mode access
Console(config-if)#

Related Commands
show dot1q-tunnel (588)show interfaces switchport (432)– 583 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunnelingswitchport dot1q- This command copies the inner tag priority to the outer tag priority. Use the notunnel priority map form to disable this feature.
Syntax[no] switchport dot1q-tunnel priority map
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
When priority bits are found in the inner tag, these are also copied to the outer tag.
This allows the service provider to differentiate service based on the indicatedpriority and appropriate methods of queue management at intermediate nodes
across the tunnel.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel priority map
Console(config-if)#switchport This command creates a CVLAN to SPVLAN mapping entry and optionally replaces
dot1q-tunnel service the CVLAN (ECS4150-54T and ECS4150-54P only). Use the no form to delete allmatch cvid VLAN mapping entries or a specified entry.
Syntaxswitchport dot1q-tunnel service svid match cvid cvid [replace cvid cvid]
no switchport dot1q-tunnel service [svid [match cvid cvid]]
svid - VLAN ID for the outer VLAN tag (Service Provider VID). (Range: 1-4094)
cvid - VLAN ID for the inner VLAN tag (Customer VID). (Range: 1-4094)
replace - Specifies a VLAN ID to replace the customer VLAN ID. (Onlyavailable for ECS4150-54T and ECS4150-54P.)
Default Setting
Default mapping uses the PVID of the ingress port on the edge router for the SPVID.
Command Mode
Interface Configuration (Ethernet, Port Channel; replace option is Ethernet only)
Command Usage The inner VLAN tag of a customer packet entering the edge router of a service
provider’s network is mapped to an outer tag indicating the service provider– 584 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunneling
VLAN that will carry this traffic across the 802.1Q tunnel. This process isperformed in a transparent manner.
 When priority bits are found in the inner tag, these are also copied to the outertag. This allows the service provider to differentiate service based on theindicated priority and appropriate methods of queue management atintermediate nodes across the tunnel.

 Rather than relying on standard service paths and priority queuing, QinQ VLAN

mapping can be used to further enhance service by defining a set ofdifferentiated service pathways to follow across the service provider’s network
for traffic arriving from specified inbound customer VLANs.

 Note that all customer interfaces should be configured as access interfaces(that is, a user-to-network interface) and service provider interfaces as uplinkinterfaces (that is, a network-to-network interface). Use the dot1q-tunnel tpid
uplink command to set an interface to access or uplink mode.

 When using the replace option to replace a customer VLAN ID, the port must

be configured as a double-tagged member of the VLAN using the switchportallowed vlan command.

ExampleThis example sets the SVID to 99 in the outer tag for egress packets exiting port 1
when the packet’s CVID is 2.
Console(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel service 99 match cvid 2
Console(config-if)#

The following example maps C-VLAN 10 to S-VLAN 100, C-VLAN 20 to S-VLAN 200
and C-VLAN 30 to S-VLAN 300 for ingress traffic on port 1 of Switches A and B.
Figure 6: Mapping QinQ Service VLAN to Customer VLAN
Switch C[SVID 100, CVID 10][SVID 200, CVID 20][SVID 300, CVID 30]

Port 1

Port 2
Port 1[VID 10][VID 20][VID 30]

Switch A

Port 2[SVID 100, CVID 10][SVID 200, CVID 20][SVID 300, CVID 30]
Port 2

Switch B

Port 1[VID 10][VID 20][VID 30]

Step 1. Configure Switch A and B.

1. Create VLANs 100, 200 and 300.
Console(config)#vlan database
Console(config-vlan)#vlan 100,200,300 media ethernet state active– 585 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunneling

2. Enable QinQ.
Console(config)#dot1q-tunnel system-tunnel-control

3. Configure port 2 as a tagged member of VLANs 100, 200 and 300 using uplinkmode.

Console(config)#interface ethernet 1/2
Console(config-if)#switchport allowed vlan add 100,200,300 tagged
Console(config-if)#switchport dot1q-tunnel mode uplink

4. Configures port 1 as an untagged member of VLANs 100, 200 and 300 using
access mode.

Console(config)#interface ethernet 1/1
Console(config-if)#switchport allowed vlan add 100,200,300 untagged
Console(config-if)#switchport dot1q-tunnel mode access

5. Configure the following selective QinQ mapping entries.
Console(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel service 100 match cvid 10
Console(config-if)#switchport dot1q-tunnel service 200 match cvid 20
Console(config-if)#switchport dot1q-tunnel service 300 match cvid 30

6. Configures port 1 as member of VLANs 10, 20 and 30 to avoid filtering out
incoming frames tagged with VID 10, 20 or 30 on port 1

Console(config)#interface ethernet 1/1
Console(config-if)#switchport allowed vlan add 10,20,30

7. Verify configuration settings.
Console#show dot1q-tunnel service
802.1Q Tunnel Service Subscriptions
Port

Match C-VID S-VID-------- ----------- ----Eth 1/ 3

10

100

Eth 1/ 320200

Eth 1/ 330

300

Step 2. Configure Switch C.

1. Create VLAN 100, 200 and 300.
Console(config)#vlan database

Console(config-vlan)#vlan 100,200,300 media ethernet state active

2. Configure port 1 and port 2 as tagged members of VLAN 100, 200 and 300.
Console(config)#interface ethernet 1/1,2

Console(config-if)#switchport allowed vlan add 100,200,300 tagged– 586 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q Tunnelingswitchport This command adds a customer VLAN ID to untagged frames. Use the no form to
dot1q-tunnel vlan- remove the configuration.
double-tag cvid
Syntaxswitchport dot1q-tunnel vlan-double-tag cvid cvid
no switchport dot1q-tunnel vlan-double-tag
cvid - VLAN ID for the inner VLAN tag (Customer VID). (Range: 1-4094)
Default Setting
None.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage When a port receives an untagged frame (the frame does not contain any VLANtag), the switch will label the frame with the port’s native VLAN tag (SVID) andinsert the specified customer VLAN (CVID).
 The SVID (Native VLAN) and specified VLAN (CVID) will be inserted in thecustomer frames as they enter the service provider network, and the tags will
be stripped when frames leave the service provider network.

 This double-tag function feature can select whether to label the inner VLAN

tag, but cannot select the outer VLAN tag, and can only use TPID 0x8100.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel vlan-double-tag cvid 101
Console(config-if)#show dot1q-tunnel This command shows tunnel service subscriptions, default discard service, andservice discarded untagged traffic configuration.
Syntaxshow dot1q-tunnel service [svid]
svid - VLAN ID for the outer VLAN tag (SPVID). (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#show dot1q-tunnel service
802.1Q Tunnel Service Subscriptions– 587 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q TunnelingPort
Match C-VID S-VID Replace-------- ----------- ----- -------Eth 1/ 3
10100
Eth 1/ 320200
Eth 1/ 330
300
Console(config)#show dot1q-tunnel service 100802.1Q Tunnel Service Subscriptions
Port
Match C-VID S-VID Replace-------- ----------- ----- -------Eth 1/ 3
10100
Console#show dot1q-tunnel This command displays information about QinQ tunnel ports.
Syntaxshow dot1q-tunnel [interface interface [service svid]]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
svid - VLAN ID for the outer VLAN tag (SPVID). (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole(config)#dot1q-tunnel system-tunnel-control
Console(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel mode access
Console(config-if)#interface ethernet 1/2
Console(config-if)#switchport dot1q-tunnel mode uplink
Console(config-if)#end
Console#show dot1q-tunnel
802.1Q Tunnel Status : Enabled
802.1Q Tunnel TPID
: 8100 (Hex)
Port
Mode
Priority Mapping-------- ------ ---------------Eth 1/ 1 Access Disabled
Eth 1/ 2 Uplink DisabledEth
1/ 3 Normal Disabled.
.
.
Console#show dot1q-tunnel interface ethernet 1/5

802.1Q Tunnel Service Subscriptions

Port
Match C-VID S-VID Replace-------- ----------- ----- --------– 588 –

Chapter 22 | VLAN Commands
Configuring IEEE 802.1Q TunnelingEth 1/ 51

100

Console#show dot1q-tunnel service 100802.1Q Tunnel Service Subscriptions
Port
Match C-VID S-VID Replace-------- ----------- ----- -------Eth 1/ 5
1100
Eth 1/ 61
100
Console#Related Commands
dot1q-tunnel tpid (582)show dot1q-tunnel This command shows port double-tag CVID configuration.
vlan-double-tag
Syntaxshow dot1q-tunnel vlan-double-tag
Command Mode
Privileged Exec
ExampleConsole#show dot1q-tunnel vlan-double-tag
802.1Q Tunnel Vlan Stacking Subscriptions
Port
StatusCVlan---------- --------- -------Eth 1/ 1 Enabled 101
Eth 1/ 2 Disabled 0
Eth 1/ 3 Disabled 0
Eth 1/ 4 Disabled 0
Eth 1/ 5 Disabled 0
Eth 1/ 6 Disabled 0
Eth 1/ 7 Disabled 0.
.
.
.
Console#– 589 –

Chapter 22 | VLAN Commands
Configuring L2PT Tunneling

Configuring L2PT TunnelingThis section describes the commands used to configure Layer 2 Protocol Tunneling(L2PT).
Table 114: L2 Protocol Tunnel Commands
CommandFunctionModel2protocol-tunnel tunneldmac

Configures the destination address for Layer 2 Protocol
TunnelingGC

switchport
l2protocol-tunnel

Enables Layer 2 Protocol Tunneling for the specified
protocolICshow l2protocol-tunnel

Shows settings for Layer 2 Protocol TunnelingPEl2protocol-tunnel This command configures the destination address for Layer 2 Protocol Tunnelingtunnel-dmac (L2PT). Use the no form to restore the default setting.
Syntaxl2protocol-tunnel tunnel-dmac mac-address
no l2protocol-tunnel tunnel-dmac
mac-address – The switch rewrites the destination MAC address in all
upstream L2PT protocol packets (i.e, STP BPDUs) to this value, and forwards
them on to uplink ports. The MAC address must be specified in the format
xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx.
The tunnel address can be any multicast address, except for the following:

IPv4 multicast addresses (with prefix 01-00-5E)

IPv6 multicast addresses (with prefix 33-33-33)

Addresses used by the spanning tree protocol.

Default Setting
01-12-CF-.00-00-02, proprietary tunnel address
Command Mode
Global Configuration
Command Usage When L2PT is not used, protocol packets (such as STP) are flooded to 802.1Q
access ports on the same edge switch, but filtered from 802.1Q tunnel ports.
This creates disconnected protocol domains in the customer’s network.
 L2PT can be used to pass various types of protocol packets belonging to thesame customer transparently across a service provider’s network. In this way,
normally segregated network segments can be configured to function inside acommon protocol domain.
– 590 –

Chapter 22 | VLAN Commands

Configuring L2PT Tunneling L2PT encapsulates protocol packets entering ingress ports on the service

provider’s edge switch, replacing the destination MAC address with aproprietary MAC address (for example, the spanning tree protocol uses 10-12CF-00-00-02), a reserved address for other specified protocol types (as definedin IEEE 802.1ad – Provider Bridges), or a user-defined address. All intermediateswitches carrying this traffic across the service provider’s network treat these
encapsulated packets in the same way as normal data, forwarding them acrossto the tunnel’s egress port. The egress port decapsulates these packets, restoresthe proper protocol and MAC address information, and then floods them onto
the same VLANs at the customer’s remote site (via all of the appropriate tunnel
ports and access ports14 connected to the same metro VLAN).

 The way in which L2PT processes packets is based on the following criteria – (1)packet is received on a QinQ uplink port, (2) packet is received on a QinQ access
port, or (3) received packet is Cisco-compatible L2PT (i.e., as indicated by aproprietary MAC address).

Processing protocol packets defined in IEEE 802.1ad – Provider Bridges
 When an IEEE 802.1ad protocol packet is received on an uplink port (i.e., an

802.1Q tunnel ingress port connecting the edge switch to the service provider
network)with the destination address 01-80-C2-00-00-00,0B~0F (C-VLAN tag), it isforwarded to all QinQ uplink ports and QinQ access ports in the same SVLAN for which L2PT is enabled for that protocol.

with the destination address 01-80-C2-00-00-01~0A (S-VLAN tag), it isfiltered, decapsulated, and processed locally by the switch if the protocol is
supported.

 When a protocol packet is received on an access port (i.e., an 802.1Q trunk port

connecting the edge switch to the local customer network)with the destination address 01-80-C2-00-00-00,0B~0F (C-VLAN), and

L2PT is enabled on the port, the frame is forwarded to all QinQ uplink
ports and QinQ access ports on which L2PT is enabled for that protocolin the same S-VLAN.

L2PT is disabled on the port, the frame is decapsulated and processed
locally by the switch if the protocol is supported.

with destination address 01-80-C2-00-00-01~0A (S-VLAN), the frame isfiltered, decapsulated, and processed locally by the switch if the protocol is
supported.

14. Access ports in this context are 802.1Q trunk ports.

– 591 –

Chapter 22 | VLAN Commands
Configuring L2PT Tunneling
Processing Cisco-compatible protocol packets
 When a Cisco-compatible L2PT packet is received on an uplink port, andrecognized as a CDP/VTP/STP/PVST+ protocol packet (where STP means
STP/RSTP/MSTP), it is forwarded to the following ports in the same S-VLAN:(a) all access ports for which L2PT has been disabled, and (b) all uplink
ports.

recognized as a Generic Bridge PDU Tunneling (GBPT) protocol packet (i.e.,having the destination address 01-00-0C-CD-CD-D0), it is forwarded to thefollowing ports in the same S-VLAN:
other access ports for which L2PT is enabled after decapsulating thepacket and restoring the proper protocol and MAC address
information.



all uplink ports.

 When a Cisco-compatible L2PT packet is received on an access port, and

recognized as a CDP/VTP/STP/PVST+ protocol packet, and

L2PT is enabled on this port, it is forwarded to the following ports in thesame S-VLAN: (a) other access ports for which L2PT is enabled, and(b) uplink ports after rewriting the destination address to make it a
GBPT protocol packet (i.e., setting the destination address to 01-00-0CCD-CD-D0).



L2PT is disabled on this port, it is forwarded to the following ports inthe same S-VLAN: (a) other access ports for which L2PT is disabled, and(b) all uplink ports.

recognized as a GBPT protocol packet (i.e., having the destination address
01-00-0C-CD-CD-D0), and

L2PT is enabled on this port, it is forwarded to other access ports in thesame S-VLAN for which L2PT is enabled

L2PT is disabled on this port, it is forwarded to the following ports inthe same S-VLAN: (a) other access ports for which L2PT is disabled, and(b) all uplink ports.

 For L2PT to function properly, QinQ must be enabled on the switch using the

dot1q-tunnel system-tunnel-control command, and the interface configured to802.1Q tunnel mode using the dot1q-tunnel tpid command.

ExampleConsole(config)#dot1q-tunnel system-tunnel-control
Console(config)#l2protocol-tunnel tunnel-dmac 01-80-C2-00-00-01
Console(config-)#– 592 –

Chapter 22 | VLAN Commands

Configuring L2PT Tunnelingswitchport This command enables Layer 2 Protocol Tunneling (L2PT) for the specified protocol.
l2protocol-tunnel Use the no form to disable L2PT for the specified protocol.
Syntax[no] switchport l2protocol-tunnel {cdp | lacp | lldp | pvst+ | spanning-tree |vtp}
cdp - Cisco Discovery Protocol
lacp - Link Aggregation Control Protocol
lldp - Link Layer Discovery Protocol
pvst+ - Cisco Per VLAN Spanning Tree Plus
spanning-tree - Spanning Tree (STP, RSTP, MSTP)
vtp - Cisco VLAN Trunking Protocol
Default Setting
Disabled for all protocols
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Refer to the Command Usage section for the l2protocol-tunnel tunnel-dmac
command.
 For L2PT to function properly, QinQ must be enabled on the switch using the

dot1q-tunnel system-tunnel-control command, and the interface configured to802.1Q tunnel mode using the dot1q-tunnel tpid command.

ExampleConsole(config)#dot1q-tunnel system-tunnel-control
Console(config)#interface ethernet 1/1
Console(config-if)#switchport dot1q-tunnel mode access
Console(config-if)#switchport l2protocol-tunnel spanning-tree
Console(config-if)#show This command shows settings for Layer 2 Protocol Tunneling (L2PT).
l2protocol-tunnel
Command Mode
Privileged Exec
ExampleConsole#show l2protocol-tunnel
Layer 2 Protocol Tunnel
Tunnel MAC Address : 01-12-CF-00-00-00– 593 –

Chapter 22 | VLAN Commands
Configuring VLAN Translation
Interface Protocol---------------------------------------------------------Eth 1/ 1
Spanning Tree
Console#Configuring VLAN Translation
QinQ tunneling uses double tagging to preserve the customer’s VLAN tags on
traffic crossing the service provider’s network. However, if any switch in the pathcrossing the service provider’s network does not support this feature, then theswitches directly connected to that device can be configured to swap thecustomer’s VLAN ID with the service provider’s VLAN ID for upstream traffic, or theservice provider’s VLAN ID with the customer’s VLAN ID for downstream traffic.
This section describes commands used to configure VLAN translation.
Table 115: VLAN Translation Commands
CommandFunctionModeswitchport vlan-translation Maps VLAN IDs between the customer and service provider IC
show vlan-translation

Displays the configuration settings for VLAN translationPEswitchport This command maps VLAN IDs between the customer and service provider.
vlan-translation
Syntaxswitchport vlan-translation [ingress | egress] original-vlan new-vlan
no switchport vlan-translation [ingress | egress] original-vlan
ingress - specifies ingress only
egress - specifies egress only
original-vlan - The original VLAN ID. (Range: 1-4094)
new-vlan - The new VLAN ID. (Range: 1-4094)
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage If the next switch upstream does not support QinQ tunneling, then use thiscommand to map the customer’s VLAN ID to the service provider’s VLAN ID for
the upstream port. Similarly, if the next switch downstream does not support
QinQ tunneling, then use this command to map the service provider’s VLAN ID– 594 –

Chapter 22 | VLAN Commands

Configuring VLAN Translation

to the customer’s VLAN ID for the downstream port. Note that one command
maps both the original-vlan to new-vlan for ingress traffic and the new-vlan tooriginal-vlan for egress traffic on the specified port.
For example, assume that the upstream switch does not support QinQ
tunneling. If the command switchport vlan-translation 10 100 is used to map
VLAN 10 to VLAN 100 for upstream traffic entering port 1, and VLAN 100 to
VLAN 10 for downstream traffic leaving port 1, then the VLAN IDs will beswapped as shown below.
Figure 7: Configuring VLAN Translation(VLAN 10)(VLAN 100)
downstream(VLAN 100)

1

upstream

2(VLAN 10)

 The maximum number of VLAN translation entries is 8 per port, and up to 96 forthe system. However, note that configuring a large number of entries may
degrade the performance of other processes that also use the TCAM, such as IP
Source Guard filter rules, Quality of Service (QoS) processes, QinQ, MAC-based
VLANs, VLAN translation, or traps.

 If VLAN translation is set on an interface with this command, and the sameinterface is also configured as a QinQ access port with the dot1q-tunnel tpid
command, VLAN tag assignments will be determined by the QinQ process, not
by VLAN translation.

ExampleThis example configures VLAN translation for Port 1 as described in the Command
Usage section above.
Console(config)#vlan database
Console(config-vlan)#vlan 10 media ethernet state active
Console(config-vlan)#vlan 100 media ethernet state active
Console(config-vlan)#exit
Console(config)#interface ethernet 1/1,2
Console(config-if)#switchport allowed vlan add 10 tagged
Console(config-if)#switchport allowed vlan add 100 tagged
Console(config-if)#interface ethernet 1/1
Console(config-if)#switchport vlan-translation 10 100
Console(config-if)#end
Console#show vlan-translation
Ingress VLAN Translation
Interface Old VID New VID--------- ------- ------Eth 1/ 1
10100
Egress VLAN Translation
Interface Old VID New VID--------- ------- ------Eth 1/ 1
100
10Console#– 595 –

Chapter 22 | VLAN Commands
Configuring Protocol-based VLANs

show vlan-translation This command displays the configuration settings for VLAN translation.
Syntaxshow vlan-translation [egress [interface interface] | ingress[interface interface]| interface interface]egress - Show configuration settings for egress ports.
ingress - Show configuration settings for ingress ports.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show vlan-translation
Ingress VLAN Translation
Interface Old VID New VID--------- ------- ------Eth 1/ 1
10100
Eth 1/ 2100
200
Egress VLAN Translation
Interface Old VID New VID--------- ------- ------Eth 1/ 1
100
10
Eth 1/ 2100
200
Eth 1/ 2200
10Console#Configuring Protocol-based VLANs
The network devices required to support multiple protocols cannot be easily
grouped into a common VLAN. This may require non-standard devices to passtraffic between different VLANs in order to encompass all the devices participating
in a specific protocol. This kind of configuration deprives users of the basic benefits
of VLANs, including security and easy accessibility.
To avoid these problems, you can configure this switch with protocol-based VLANs
that divide the physical network into logical VLAN groups for each required
protocol. When a frame is received at a port, its VLAN membership can then be
determined based on the protocol type in use by the inbound packets.

– 596 –

Chapter 22 | VLAN Commands
Configuring Protocol-based VLANs
Table 116: Protocol-based VLAN Commands
CommandFunctionModeprotocol-vlan
protocol-group

Create a protocol group, specifying the supported
protocols

GC

protocol-vlan
protocol-group

Maps a protocol group to a VLAN

IC

show protocol-vlan
protocol-groupShows the configuration of protocol groups

PEshow interfaces
protocol-vlan
protocol-groupShows the interfaces mapped to a protocol group and the PE
corresponding VLAN

To configure protocol-based VLANs, follow these steps:

1. First configure VLAN groups for the protocols you want to use (page 571).

Although not mandatory, we suggest configuring a separate VLAN for eachmajor protocol running on your network. Do not add port members at thistime.

2. Create a protocol group for each of the protocols you want to assign to a VLAN
using the protocol-vlan protocol-group command (Global Configurationmode).

3. Then map the protocol for each interface to the appropriate VLAN using theprotocol-vlan protocol-group command (Interface Configuration mode).

Note: Traffic which matches IP Protocol Ethernet Frames is mapped to the VLAN
that has been configured with the switch’s administrative IP interface (default VLAN
1). IP Protocol Ethernet traffic must not be mapped to another VLAN or you will loseadministrative network connectivity to the switch. If lost in this manner, network
access can be regained by removing the offending Protocol VLAN rule via theconsole. Alternately, the switch can be power-cycled, however all unsaved
configuration changes will be lost.

– 597 –

Chapter 22 | VLAN Commands
Configuring Protocol-based VLANs

protocol-vlan This command creates a protocol group, or adds specific protocols to a group. Use
protocol-group the no form to remove a protocol group.

(Configuring Groups)

Syntax
protocol-vlan protocol-group group-id [{add | remove}frame-type frame protocol-type protocol]
no protocol-vlan protocol-group group-id
group-id - Group identifier of this protocol group. (Range: 1-2147483647)
frame15 - Frame type used by this protocol. (Options: ethernet, rfc_1042,
llc_other)
protocol - Protocol type. The only option for the llc_other frame type is
ipx_raw. The options for all other frames types include: arp, ip, ipv6, pppoedis, pppoe-ses, rarp.
Default Setting
No protocol groups are configured.
Command Mode
Global Configuration
ExampleThe following creates protocol group 1, and specifies Ethernet frames with IP and
ARP protocol types:
Console(config)#protocol-vlan protocol-group 1 add frame-type ethernet
protocol-type ip
Console(config)#protocol-vlan protocol-group 1 add frame-type ethernet
protocol-type arp
Console(config)#

protocol-vlan This command maps a protocol group to a VLAN for the current interface. Use theprotocol-group no form to remove the protocol mapping for this interface.

(Configuring Interfaces)

Syntax
protocol-vlan protocol-group group-id vlan vlan-id [priority priority]
no protocol-vlan protocol-group group-id
group-id - Group identifier of this protocol group. (Range: 1-2147483647)
vlan-id - VLAN to which matching protocol traffic is forwarded.
(Range: 1-4094)
priority - The priority assigned to untagged ingress traffic.
(Range: 0-7, where 7 is the highest priority)
15. SNAP frame types are not supported by this switch due to hardware limitations.

– 598 –

Chapter 22 | VLAN Commands
Configuring Protocol-based VLANs
Default Setting
No protocol groups are mapped for any interface.
Priority: 0
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage When creating a protocol-based VLAN, only assign interfaces via thiscommand. If you assign interfaces using any of the other VLAN commands(such as the vlan command), these interfaces will admit traffic of any protocol
type into the associated VLAN.
 When MAC-based, IP subnet-based, and protocol-based VLANs are supported

concurrently, priority is applied in this sequence, and then port-based VLANs
last.

 When a frame enters a port that has been assigned to a protocol VLAN, it isprocessed in the following manner:

If the frame is tagged, it will be processed according to the standard rules
applied to tagged frames.



If the frame is untagged and the protocol type matches, the frame isforwarded to the appropriate VLAN.



If the frame is untagged but the protocol type does not match, the frame isforwarded to the default VLAN for this interface.

ExampleThe following example maps the traffic entering Port 1 which matches the protocol
type specified in protocol group 1 to VLAN 2.
Console(config)#interface ethernet 1/1
Console(config-if)#protocol-vlan protocol-group 1 vlan 2 priority 0
Console(config-if)#show protocol-vlan This command shows the frame and protocol type associated with protocol groups.
protocol-group
Syntaxshow protocol-vlan protocol-group [group-id] [sort-by-type]group-id - Group identifier for a protocol group. (Range: 1-2147483647)
sort-by-type - Sort display information by frame type and protocol type.
Default Setting
All protocol groups are displayed.

– 599 –

Chapter 22 | VLAN Commands
Configuring Protocol-based VLANs
Command Mode
Privileged Exec
ExampleThis shows protocol group 1 configured for IP over Ethernet:
Console#show protocol-vlan protocol-group
Protocol Group ID
Frame Type
Protocol Type------------------ ------------- --------------1
ethernet
08 00
Console#show interfaces This command shows the mapping from protocol groups to VLANs for the selected
protocol-vlan interfaces.
protocol-group
Syntaxshow interfaces protocol-vlan protocol-group [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
The mapping for all interfaces is displayed.
Command Mode
Privileged Exec
ExampleThis shows that traffic entering Port 1 that matches the specifications for protocolgroup 1 will be mapped to VLAN 2:
Console#show interfaces protocol-vlan protocol-group
Port
Protocol Group ID VLAN ID Priority-------- ----------------- ------- -------Eth 1/1 1
2
1
Console#– 600 –

Chapter 22 | VLAN Commands

Configuring IP Subnet VLANs

Configuring IP Subnet VLANs
When using IEEE 802.1Q port-based VLAN classification, all untagged frames
received by a port are classified as belonging to the VLAN whose VID (PVID) is
associated with that port.
When IP subnet-based VLAN classification is enabled, the source address of
untagged ingress frames are checked against the IP subnet-to-VLAN mappingtable. If an entry is found for that subnet, these frames are assigned to the VLAN
indicated in the entry. If no IP subnet is matched, the untagged frames are classified
as belonging to the receiving port’s VLAN ID (PVID).
Table 117: IP Subnet VLAN Commands
CommandFunctionModesubnet-vlan

Defines the IP Subnet VLANs

GC

show subnet-vlan

Displays IP Subnet VLAN settingsPEsubnet-vlan This command configures IP Subnet VLAN assignments. Use the no form to remove
an IP subnet-to-VLAN assignment.
Syntaxsubnet-vlan subnet ip-address mask vlan vlan-id [priority priority]
no subnet-vlan subnet {ip-address mask | all}
ip-address – The IP address that defines the subnet. Valid IP addresses
consist of four decimal numbers, 0 to 255, separated by periods.
mask – This mask identifies the host address bits of the IP subnet.
vlan-id – VLAN to which matching IP subnet traffic is forwarded.
(Range: 1-4094)
priority – The priority assigned to untagged ingress traffic. (Range: 0-7,
where 7 is the highest priority)
Default Setting
Priority: 0
Command Mode
Global Configuration
Command Usage Each IP subnet can be mapped to only one VLAN ID. An IP subnet consists of an
IP address and a subnet mask. The specified VLAN need not be an existing
VLAN.

– 601 –

Chapter 22 | VLAN Commands
Configuring IP Subnet VLANs
 When an untagged frame is received by a port, the source IP address is checkedagainst the IP subnet-to-VLAN mapping table, and if an entry is found, thecorresponding VLAN ID is assigned to the frame. If no mapping is found, the
PVID of the receiving port is assigned to the frame.

 The IP subnet cannot be a broadcast or multicast IP address.
 When MAC-based, IP subnet-based, or protocol-based VLANs are supported

concurrently, priority is applied in this sequence, and then port-based VLANs
last.

ExampleThe following example assigns traffic for the subnet 192.168.12.192, mask
255.255.255.224, to VLAN 4.
Console(config)#subnet-vlan subnet 192.168.12.192 255.255.255.224 vlan 4
Console(config)#show subnet-vlan This command displays IP Subnet VLAN assignments.
Command Mode
Privileged Exec
Command Usage Use this command to display subnet-to-VLAN mappings.
 The last matched entry is used if more than one entry can be matched.

ExampleThe following example displays all configured IP subnet-based VLANs.
Console#show subnet-vlan
IP Address
Mask--------------- --------------192.168.12.0
255.255.255.128
192.168.12.128
255.255.255.192
192.168.12.192
255.255.255.224
192.168.12.224
255.255.255.240
192.168.12.240
255.255.255.248
192.168.12.248
255.255.255.252
192.168.12.252
255.255.255.254
192.168.12.254
255.255.255.255
192.168.12.255
255.255.255.255
Console#– 602 –VLAN ID------1
3
4
5
6
7
8
9
10

Priority-------0
0
0
0
0
0
0
0
0

Chapter 22 | VLAN Commands

Configuring MAC Based VLANs

Configuring MAC Based VLANs
When using IEEE 802.1Q port-based VLAN classification, all untagged frames
received by a port are classified as belonging to the VLAN whose VID (PVID) is
associated with that port.
When MAC-based VLAN classification is enabled, the source address of untagged
ingress frames are checked against the MAC address-to-VLAN mapping table. If an
entry is found for that address, these frames are assigned to the VLAN indicated in
the entry. If no MAC address is matched, the untagged frames are classified as
belonging to the receiving port’s VLAN ID (PVID).
Table 118: MAC Based VLAN Commands
CommandFunctionMode

mac-vlan

Defines the IP Subnet VLANs

GC

show mac-vlan

Displays IP Subnet VLAN settingsPE

mac-vlan This command configures MAC address-to-VLAN mapping. Use the no form to
remove an assignment.
Syntax
mac-vlan mac-address mac-address [mask mask-address] vlan vlan-id[priority priority]
no mac-vlan mac-address {mac-address [mask mask-address] | all}mac-address – The source MAC address to be matched. Configured MAC
addresses can only be unicast addresses. The MAC address must be
specified in the format xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx.
mask-address - Identifies a range of MAC addresses. The mask can be
specified in the format xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx, where an
equivalent binary value “1” means relevant and “0” means ignore.
vlan-id – VLAN to which the matching source MAC address traffic isforwarded. (Range: 1-4094)
priority – The priority assigned to untagged ingress traffic. (Range: 0-7,
where 7 is the highest priority)
Default Setting
None
Command Mode
Global Configuration
Command Usage The MAC-to-VLAN mapping applies to all ports on the switch.
– 603 –

Chapter 22 | VLAN Commands
Configuring MAC Based VLANs
 Source MAC addresses can be mapped to only one VLAN ID.
 Configured MAC addresses cannot be broadcast or multicast addresses.
 When MAC-based, IP subnet-based, and protocol-based VLANs are supported

concurrently, priority is applied in this sequence, and then port-based VLANs
last.

 The binary equivalent mask matching the characters in the front of the first

non-zero character must all be 1s (e.g., 111, i.e., it cannot be 101 or 001...). A
mask for the MAC address: 00-50-6e-00-5f-b1 translated into binary:
MAC: 00000000-01010000-01101110-00000000-01011111-10110001
could be: 11111111-11xxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
So the mask in hexadecimal for this example could be:
ff-fx-xx-xx-xx-xx/ff-c0-00-00-00-00/ff-e0-00-00-00-00

ExampleThe following example assigns traffic from source MAC address 00-00-00-11-22-33
to VLAN 10.
Console(config)#mac-vlan mac-address 00-00-00-11-22-33 mask FF-FF-FF-FF-00-00
vlan 10
Console(config)#show mac-vlan This command displays MAC address-to-VLAN assignments.
Command Mode
Privileged Exec
Command Usage
Use this command to display MAC address-to-VLAN mappings.
ExampleThe following example displays all configured MAC address-based VLANs.
Console#show mac-vlan
MAC Address
Mask
VLAN ID Priority------------------ ------------------ -------- -------00-E0-4C-68-14-79 FF-FF-FF-FF-FF-FF
100
0
Console#– 604 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs

Configuring Voice VLANs
The switch allows you to specify a Voice VLAN for the network and set a CoS priority
for the VoIP traffic. VoIP traffic can be detected on switch ports by using the source
MAC address of packets, or by using LLDP (IEEE 802.1AB) to discover connected
VoIP devices. When VoIP traffic is detected on a configured port, the switch
automatically assigns the port to the Voice VLAN. Alternatively, switch ports can be
manually configured.
Table 119: Voice VLAN Commands
CommandFunctionModevoice vlan

Defines the Voice VLAN ID

GCvoice vlan aging

Configures the aging time for Voice VLAN ports

GC

voice vlan mac-address

Configures VoIP device MAC addressesGCswitchport voice vlan

Sets the Voice VLAN port modeICswitchport voice vlanpriority

Sets the VoIP traffic priority for ports

ICswitchport voice vlan rule

Sets the automatic VoIP traffic detection method for ports IC

switchport voice vlan
security

Enables Voice VLAN security on ports

ICshow voice vlan

Displays Voice VLAN settingsPEvoice vlan This command enables VoIP traffic detection and defines the Voice VLAN ID. Use
the no form to disable the Voice VLAN.
Syntaxvoice vlan voice-vlan-id
no voice vlan
voice-vlan-id - Specifies the voice VLAN ID. (Range: 1-4094)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When IP telephony is deployed in an enterprise network, it is recommended toisolate the Voice over IP (VoIP) network traffic from other data traffic. Traffic
isolation helps prevent excessive packet delays, packet loss, and jitter, which
results in higher voice quality. This is best achieved by assigning all VoIP traffic
to a single VLAN.

– 605 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs
 VoIP traffic can be detected on switch ports by using the source MAC address ofpackets, or by using LLDP (IEEE 802.1AB) to discover connected VoIP devices.
When VoIP traffic is detected on a configured port, the switch automaticallyassigns the port as a tagged member of the Voice VLAN.

 Only one Voice VLAN is supported and it must already be created on the switch

before it can be specified as the Voice VLAN.

 The Voice VLAN ID cannot be modified when the global auto-detection statusis enabled (see the switchport voice vlan command).

ExampleThe following example enables VoIP traffic detection and specifies the Voice VLAN
ID as 1234.
Console(config)#voice vlan 1234
Console(config)#

voice vlan aging This command sets the Voice VLAN ID time out. Use the no form to restore thedefault.
Syntaxvoice vlan aging minutes
no voice vlan
minutes - Specifies the port Voice VLAN membership time out.
(Range: 5-43200 minutes)
Default Setting
1440 minutes
Command Mode
Global Configuration
Command Usage
The Voice VLAN aging time is the time after which a port is removed from the VoiceVLAN when VoIP traffic is no longer received on the port.
The VoIP aging time starts to count down when the OUI’s MAC address expires from
the MAC address table. Therefore, the MAC address aging time should be added tothe overall aging time. For example, if you configure the MAC address table aging
time to 30 seconds, and voice VLAN aging time to 5 minutes, then after 5.5 minutes,
a port will be removed from the voice VLAN when VoIP traffic is no longer received
on the port. Alternatively, if you clear the MAC address table manually, then theswitch will also start counting down the voice VLAN aging time.

– 606 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs

Note that when the switchport voice vlan command is set to auto mode, theremaining aging time displayed by the show voice vlan command will be
displayed. Otherwise, if the switchport voice vlan command is disabled or set to
manual mode, the remaining aging time will display “NA.”ExampleThe following example configures the Voice VLAN aging time as 3000 minutes.
Console(config)#voice vlan aging 3000
Console(config)#

voice vlan This command specifies MAC address ranges to add to the OUI Telephony list. Use
mac-address the no form to remove an entry from the list.
Syntaxvoice vlan mac-address mac-address mask mask-address[description description]
no voice vlan mac-address mac-address mask mask-address
mac-address - Defines a MAC address OUI that identifies VoIP devices in the
network. (Format: xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx; for example,
01-23-45-00-00-00)
mask-address - Identifies a range of MAC addresses. (Range: 80-00-00-0000-00 to FF-FF-FF-FF-FF-FF)
description - User-defined text that identifies the VoIP devices. (Range: 1-30
characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage VoIP devices attached to the switch can be identified by the manufacturer’s
Organizational Unique Identifier (OUI) in the source MAC address of received
packets. OUI numbers are assigned to manufacturers and form the first threeoctets of device MAC addresses. The MAC OUI numbers for VoIP equipment canbe configured on the switch so that traffic from these devices is recognized as
VoIP.
 Setting a mask of FF-FF-FF-00-00-00 identifies all devices with the same OUI(the first three octets). Other masks restrict the MAC address range. Setting amask of FF-FF-FF-FF-FF-FF specifies a single MAC address.

– 607 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs
ExampleThe following example adds a MAC OUI to the OUI Telephony list.
Console(config)#voice vlan mac-address 00-12-34-56-78-90 mask ff-ff-ff-00-0000 description "A new phone"
Console(config)#

switchport voice vlan This command specifies the Voice VLAN mode for ports. Use the no form to disable
the Voice VLAN feature on the port.
Syntaxswitchport voice vlan {manual | auto}
no switchport voice vlanmanual - The Voice VLAN feature is enabled on the port, but the port must
be manually added to the Voice VLAN.
auto - The port will be added as a tagged member to the Voice VLAN when
VoIP traffic is detected on the port.
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage When auto is selected, you must select the method to use for detecting VoIP
traffic, either OUI or 802.1AB (LLDP) using the switchport voice vlan rulecommand. When OUI is selected, be sure to configure the MAC address ranges
in the Telephony OUI list using the voice vlan mac-address command.
 All ports are set to VLAN hybrid mode by default. Prior to enabling VoIP for aport (by setting the VoIP mode to Auto or Manual as described below), ensurethat VLAN membership is not set to access mode using the switchport mode
command.

ExampleThe following example sets port 1 to Voice VLAN auto mode.
Console(config)#interface ethernet 1/1
Console(config-if)#switchport voice vlan auto
Console(config-if)#– 608 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs

switchport voice vlan This command specifies a CoS priority for VoIP traffic on a port. Use the no form topriority restore the default priority on a port.
Syntaxswitchport voice vlan priority priority-value
no switchport voice vlan priority
priority-value - The CoS priority value. (Range: 0-6)
Default Setting
6
Command Mode
Interface Configuration
Command Usage
Specifies a CoS priority to apply to the port VoIP traffic on the Voice VLAN. The
priority of any received VoIP packet is overwritten with the new priority when the
Voice VLAN feature is active for the port.
ExampleThe following example sets the CoS priority to 5 on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#switchport voice vlan priority 5
Console(config-if)#switchport voice vlan This command selects a method for detecting VoIP traffic on a port. Use the norule form to disable the detection method on the port.
Syntax[no] switchport voice vlan rule {oui | lldp}
oui - Traffic from VoIP devices is detected by the Organizationally Unique
Identifier (OUI) of the source MAC address.
lldp - Uses LLDP to discover VoIP devices attached to the port.
Default Setting
OUI: Enabled
LLDP: Disabled
Command Mode
Interface Configuration– 609 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs
Command Usage When OUI is selected, be sure to configure the MAC address ranges in the
Telephony OUI list (see the voice vlan mac-address command). MAC address
OUI numbers must be configured in the Telephony OUI list so that the switch
recognizes the traffic as being from a VoIP device.
 LLDP checks that the “telephone bit” in the system capability TLV is turned on.

See “LLDP Commands” on page 799 for more information on LLDP.

ExampleThe following example enables the OUI method on port 1 for detecting VoIP traffic.
Console(config)#interface ethernet 1/1
Console(config-if)#switchport voice vlan rule oui
Console(config-if)#switchport voice vlan This command enables security filtering for VoIP traffic on a port. Use the no form
security to disable filtering on a port.
Syntax[no] switchport voice vlan security
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage Security filtering discards any non-VoIP packets received on the port that are
tagged with the voice VLAN ID. VoIP traffic is identified by source MAC
addresses configured in the Telephony OUI list, or through LLDP that discovers
VoIP devices attached to the switch. Packets received from non-VoIP sources
are dropped.
 When enabled, be sure the MAC address ranges for VoIP devices are configuredin the Telephony OUI list (voice vlan mac-address).

ExampleThe following example enables security filtering on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#switchport voice vlan security
Console(config-if)#– 610 –

Chapter 22 | VLAN Commands
Configuring Voice VLANs

show voice vlan This command displays the Voice VLAN settings on the switch and the OUITelephony list.
Syntaxshow voice vlan {oui | status}
oui - Displays the OUI Telephony list.
status - Displays the global and port Voice VLAN settings.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
When the switchport voice vlan command is set to auto mode, the remaining aging
time displayed by the show voice vlan command will be displayed (or “Not Start”
will be displayed). Otherwise, if the switchport voice vlan command is disabled or
set to manual mode, the remaining aging time will display “NA.”ExampleConsole#show voice vlan status
Global Voice VLAN Status
Voice VLAN Status: Enabled
Voice VLAN ID: 1234
Voice VLAN aging time : 1440 minutes
Voice VLAN Port Summary
Port
Mode
Security Rule

Priority Remaining Age(minutes)-------- -------- -------- --------- -------- ------------Eth 1/ 1 Auto
Enabled OUI
6 100
Eth 1/ 2 Disabled Disabled OUI
6 NA
Eth 1/ 3 Manual
Enabled OUI
5 100
Eth 1/ 4 Auto
Disabled OUI
6 Not Start
Eth 1/ 5 Disabled Disabled OUI
6 NA
Eth 1/ 6 Disabled Disabled OUI
6 NA
Eth 1/ 7 Disabled Disabled OUI
6 NA
.
.
.
Console#show voice vlan oui
OUI Address
Mask
Description----------------- ----------------- -----------------------------00-12-34-56-78-9A FF-FF-FF-00-00-00 old phones
00-11-22-33-44-55 FF-FF-FF-00-00-00 new phones
00-98-76-54-32-10 FF-FF-FF-FF-FF-FF Chris' phone
Console#– 611 –

Chapter 22 | VLAN Commands
Configuring Excluded VLANs

Configuring Excluded VLANs
Excluded VLANs provide port-based security and isolation between ports within an
assigned session. An Excluded VLAN session contains Uplink ports that cancommunicate with all other ports in the session, and Downlink ports that can only
communicate with Uplink ports in the session. The Uplink ports are intended toprovide open access to an external network, such as the Internet, while theDownlink ports provide restricted access to local users.
Table 120: Excluded VLAN Commands
CommandFunctionModeexcluded-vlan

Configures an excluded VLAN session, including VLANs,
uplink and downlink ports

GC

show excluded-vlan

Displays the configured excluded VLANs

PE

excluded-vlan This command configures an excluded VLAN session, including the VLAN ID, uplink

ports, and downlink ports. Use the no form of the command to remove an excluded
VLAN session.
Syntax[no] excluded-vlan [session session-id] [vlan-id [vlan-mask]] {uplink interfacelist [downlink interface-list] | downlink interface-list}
session-id - Specifies the session ID. (Range: 1-4)
vlan-id - Specifies a VLAN ID. (Range: 1-4094)
vlan-mask - Specifies a binary bitmask that is applied to the VLAN ID todefine a range of VLANs. When a bit of the VLAN Mask is 1, the value of thecorresponding bit of the VLAN ID remains the same. When a bit ofconfigured VLAN Mask is 0, the value of the corresponding bit of the VLAN
ID is ignored. For example, a VLAN ID of 1 (000000000001) with a VLAN
Mask of 4092 (111111111100) defines a range of VLAN IDs of 1-3. A VLAN
Mask of 4095 (111111111111) defines a single VLAN ID. (Range: 0-4095)
interface-list ethernet unit/port-list
unit - Unit identifier. (Range: 1)
port-list - Physical port number or list of port numbers. Separate
nonconsecutive port numbers with a comma and no spaces; or usea hyphen to designate a range of port numbers. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
No sessions configured.

– 612 –

Chapter 22 | VLAN Commands

Configuring Excluded VLANs

Command Mode
Global Configuration
Command Usage An Excluded VLAN session consists of defined Downlink ports, Uplink ports,
and VLANs. Up to 4 Excluded VLAN sessions can be configured on the switch,and up to 8 VLANs can be included in each session.
 Packets from a Downlink port can only be forwarded to Uplink ports in thesame session.

 Packets from Uplink ports can be forwarded to any ports in the same session.
 Uplink and Dowlink interfaces can include configured port trunks.
 A specified Uplink or Dowlink interface can only be assigned to one Excluded

VLAN session, it cannot be configured for multiple sessions at the same time.

ExampleConsole(config)#excluded-vlan session 1 5 4095 uplink ethernet 1/6 downlink
ethernet 1/5
Console(config)#show excluded-vlan This command displays the configured excluded VLANs on the switch.
Syntaxshow excluded-vlan
Command Mode
Privileged Exec
ExampleConsole#show excluded-vlan
Session
Uplink Ports
Downlink Ports
VLANs--------- ----------------------- ----------------------- ------------1
Ethernet 1/6
Ethernet 1/5
5/4095
Console#– 613 –

Chapter 22 | VLAN Commands
Configuring Excluded VLANs– 614 –

23

ERPS Commands

The G.8032 recommendation, also referred to as Ethernet Ring Protection
Switching (ERPS), can be used to increase the availability and robustness of
Ethernet rings.
This chapter describes commands used to configure ERPS.
Table 121: ERPS Commands
CommandFunction

Mode

erps

Enables ERPS globally on the switchGCerps node-id

Sets the MAC address for a ring nodeGCerps vlan-group

Creates ERPS VLAN groups to assign to rings or instancesGC

erps ring

Creates a physical ERPS ring and enters ERPS Ring Configuration GC
mode

erps instance

Creates an ERPS instance and enters ERPS InstanceConfiguration modering-port

Configures a node’s connection to the ring through the east or ERPS Ringwest interface

exclusion-vlan

Specifies the VLANS to be excluded from the ERPS protection
ring.

ERPS Ring

enable (ring)

Activates the current ERPS ring

ERPS Ring

enable (instance)

Activates the current ERPS instance

ERPS Inst

meg-level

Sets the Maintenance Entity Group level for a ring

ERPS Inst

control-vlan

Adds a Control VLAN to an ERPS ring

ERPS Instrpl owner

Configures a ring node to be the RPL owner

ERPS Instrpl neighbor

Configures a ring node to be the RPL neighbor

ERPS Inst

wtr-timer

Sets timer to verify that the ring has stabilized before blocking
the RPL after recovery from a signal failure

ERPS Inst

guard-timer

Sets the timer to prevent ring nodes from receiving outdated
R-APS messages

ERPS Instholdoff-timer

Sets the timer to filter out intermittent link faults

ERPS Instmajor-ringSpecifies the ERPS ring used for sending control packets

ERPS Instpropagate-tc

Enables propagation of topology change messages from asecondary ring to the primary ring

ERPS Inst

bpdu-tcn-notify

Enables the transmission of TCN BPDUs on an EPRS instance

ERPS Inst

non-revertive

Enables non-revertive mode, which requires the protection
state on the RPL to manually cleared

ERPS Inst– 615 –

GC

Chapter 23 | ERPS Commands

Table 121: ERPS Commands (Continued)
CommandFunctionModeraps-def-mac

Sets the switch’s MAC address to be used as the node identifier ERPS Instin R-APS messages

raps-without-vc

Terminates the R-APS channel at the primary ring to sub-ring
interconnection nodes

ERPS Inst

versionSpecifies compatibility with ERPS version 1 or 2

ERPS Inst

inclusion-vlan

Specifies the VLAN groups to be included in the ERPS protection ERPS Instring.

physical-ring

Associates an ERPS instance with an existing physical ring

ERPS Insterps forced-switch

Blocks the specified ring portPE

erps manual-switch

Blocks the specified ring port, in the absence of a failure or anerps forced-switch commandPE

erps clear

Manually clears protection state which has been invoked by a PE
Forced Switch or Manual Switch command, and the node isoperating under non-revertive mode; or before the WTR or WTB
timer expires when the node is operating in revertive mode

clear erps statistics

Clears statistics for all ERPS instances or a specific instanceshow erps statistics

Displays statistics for all configured instances, or for a specified PE
instance

show erps

Displays status information for all configured VLAN groups,
rings, or instances.

PE

PE

Configuration Guidelines for ERPS

1. Create an ERPS ring: Create a ring using the erps ring command. The ring nameis used as an index in the G.8032 database.

2. Configure the east and west interfaces: Each node on the ring connects to it

through two ring ports. Use the ring-port command to configure one port
connected to the next node in the ring to the east (or clockwise direction); andthen use the ring-port command again to configure another port facing west in
the ring.

3. Configure VLAN groups to assign to specific ERPS instances using the erps vlangroup command.

4. Configure ERPS instances using the erps instance command and then associate
the instances to a configured ring using the physical-ring command.

5. Configure the RPL owner: Configure one node in the ring as the Ring Protection

Link (RPL) owner using the rpl owner command. When this switch is configured
as the RPL owner, the west ring port is set as being connected to the RPL. Under
normal operations (Idle state), the RPL is blocked to ensure that a loop cannot
form in the ring. If a signal failure brings down any other link in the ring, the RPL
will be unblocked (Protection state) to ensure proper connectivity among all
ring nodes until the failure is recovered.
– 616 –

Chapter 23 | ERPS Commands

6. Configure ERPS timers: Use the guard-timer command to set the timer is used
to prevent ring nodes from receiving outdated R-APS messages, the holdofftimer command to filter out intermittent link faults, and the wtr-timer
command to verify that the ring has stabilized before blocking the RPL after
recovery from a signal failure.

7. Configure the ERPS Control VLAN (CVLAN): Use the control-vlan command tocreate the VLAN used to pass R-APS ring maintenance commands. The CVLAN
must NOT be configured with an IP address. In addition, only ring ports may be
added to the CVLAN (prior to configuring the VLAN as a CVLAN). No other ports
can be members of this VLAN (once set as a CVLAN). Also, the ring ports of the
CVLAN must be tagged. Failure to observe these restrictions can result in a loop
in the network.

8. Enable ERPS: Before enabling a ring as described in the next step, first use theerps command to globally enable ERPS on the switch. If ERPS has not yet beenenabled or has been disabled with the no erps command, no ERPS rings willwork.

9. Enable ERPS rings and instances: Before an ERPS ring can work, it must be

enabled using the enable (ring) command and specific instances enabled using
the enable (instance) command. When configuration is completed and the ringenabled, R-APS messages will start flowing in the control VLAN, and normal
traffic will begin to flow in the data VLANs. To stop a ring, it can be disabled on
any node using the no enable (ring) command.

10. Display ERPS status information: Use the show erps statistics command to

display general ERPS status information or detailed ERPS status information fora specific ring.

erps This command enables ERPS on the switch. Use the no form to disable this feature.
Syntax[no] erps
Default Setting
Disabled
Command Mode
Global Configuration
Command UsageERPS must be enabled globally on the switch before it can enabled on an ERPS ringusing the enable (ring) command.

– 617 –

Chapter 23 | ERPS Commands

ExampleConsole(config)#erps
Console(config)#

Related Commands
enable (ring) (622)erps node-id This command sets the MAC address for a ring node. Use the no form to restore thedefault setting.
Syntaxerps node-id mac-address
no erps node-id
mac-address – A MAC address unique to the ring node. The MAC address
must be specified in the format xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx.
Default Setting
CPU MAC address
Command Mode
Global Configuration
Command Usage The ring node identifier is used to identify a node in R-APS messages for bothautomatic and manual switching recovery operations.
For example, a node that has one ring port in SF condition and detects that thecondition has been cleared, will continuously transmit R-APS (NR) messages
with its own Node ID as priority information over both ring ports, informing its
neighbors that no request is present at this node. When another recovered
node holding the link blocked receives this message, it compares the Node ID
information with its own. If the received R-APS (NR) message has a higher
priority, this unblocks its ring ports. Otherwise, the block remains unchanged.
 The node identifier may also be used for debugging, such as to distinguishmessages when a node is connected to more than one ring.

ExampleConsole(config-erps)#node-id 00-12-CF-61-24-2D
Console(config-erps)#– 618 –

Chapter 23 | ERPS Commands

erps vlan-group This command creates or modifies an ERPS VLAN group. Use the no form of thiscommand to remove VLANs from a VLAN group or to delete a VLAN group.
Syntaxerps vlan-group vlan-group-name {add|remove} vlan-list
no erps vlan-group vlan-group-namevlan-group-name – Name of the VLAN group. (Range: 1-12 characters).
add – Adds VLANs to a group.
remove – Deletes VLANs from a group.
vlan-list – A single VLAN ID, a list of VLAN IDs separated by commas, or a
range of VLANs defined by two VLAN IDs separated by a hyphen.
Default Setting
None
Command Mode
Global Configuration
Command Usage

 A set of VLANs in an Ethernet ring can be grouped into several subsets andapplied to an ERPS instance.

 A VLAN group configuration is allowed to be deleted only if all associations are

removedExampleConsole(config)#erps vlan-group alpha add 2
Console(config)#

erps ring This command creates a physical ERPS ring and enters ERPS configuration mode forthe specified ring. Use the no form to delete a physical ring.
Syntax[no] erps ring ring-namering-name - Name of a specific ERPS ring. (Range: 1-12 characters)
Default Setting
None
Command Mode
Global Configuration– 619 –

Chapter 23 | ERPS Commands

ExampleConsole(config)#erps ring campus1
Console(config-erps-ring)#

erps instance This command creates an ERPS instance and enters ERPS instance configuration
mode. Use the no form to delete an ERPS instance.
Syntaxerps instance instance-name [id ring-id]
no erps instance instance-nameinstance-name - Name of a specific ERPS instance. (Range: 1-12 characters)
ring-id - ERPS ring identifier used in R-APS messages. (Range: 1-255)
Default Setting
None
Command Mode
Global Configuration
Command Usage
 Service Instances within each ring are based on a unique maintenanceassociation for the specific users, distinguished by the ring name, maintenancelevel, maintenance association’s name, and assigned VLAN.
 R-APS information is carried in an R-APS PDUs. The last octet of the MAC

address is designated as the Ring ID (01-19-A7-00-00-[Ring ID]). If use of thedefault MAC address is disabled with the no raps-def-mac command, then the
Ring ID configured by the erps instance command will be used in R-APS PDUs.

 You must disable a running instance before modifying a Ring ID.

ExampleConsole(config)#erps instance r&d id 1
Console(config-erps-inst)#– 620 –

Chapter 23 | ERPS Commands

ring-port This command configures a node’s connection to the ring through the east or west
interface. Use the no form to disassociate a node from the ring.
Syntaxring-port {east | west} interface interface
no ring-port {east | west}
east - Connects to next ring node to the east.
west - Connects to next ring node to the west.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
Not associatedCommand Mode
ERPS Ring Configuration
Command Usage Each node must be connected to two neighbors on the ring. For convenience,the ports connected are referred to as east and west ports. Alternatively, theclosest neighbor to the east should be the next node in the ring in a clockwise
direction, and the closest neighbor to the west should be the next node in thering in a counter-clockwise direction.
 Note that a ring port cannot be configured as a member of a spanning tree, adynamic trunk, or a static trunk.

 If a port channel (static trunk) is specified as a ring port, it can not be destroyed

before it is removed from the domain configuration.

 A static trunk will be treated as a signal fault, if it contains no member ports or

all of its member ports are in signal fault.

 If a static trunk is configured as a ring port prior to assigning any member ports,

spanning tree will be disabled for the first member port assigned to the static
trunk.

ExampleConsole(config-erps-ring)#ring-port east interface ethernet 1/12
Console(config-erps-ring)#– 621 –

Chapter 23 | ERPS Commands

exclusion-vlan Use this command to specify VLAN groups that are to be on the exclusion list of aphysical ERPS ring. Use the no form of the command to remove VLAN groups fromthe list.
Syntax[no] inclusion-vlan vlan-group-namevlan-group-name - Name of the VLAN group. (Range: 1-12 characters)
Default Setting
None
Command Mode
ERPS Ring Configuration
Command Usage VLANs that are on the exclusion list are not protected by the ERPS ring.
 Any VLAN not listed on either the inclusion or exclusion list will be blocked onring ports.

 Use the show erps statistics command to view the exclusion-vlan list of VLAN

IDs.

 Traffic from control VLANs, inclusion VLANs, and exclusion VLANs of an ERPS

ring will be forwarded by non-ERPS ring ports.

ExampleConsole(config-erps)#exclusion-vlan vlgroup3
Console(config-erps)#

enable (ring) This command activates the current ERPS ring. Use the no form to disable thecurrent ring.
Syntax[no] enable
Default Setting
Disabled
Command Mode
ERPS Ring Configuration
Command Usage Before enabling a ring, the global ERPS function should be enabled with theerps command, the east and west ring ports configured on each node with thering-port command, the RPL owner specified with the rpl owner command,and the control VLAN configured with the control-vlan command.
– 622 –

Chapter 23 | ERPS Commands

 Once enabled, the RPL owner node and non-owner node state machines will

start, and the ring will enter idle state if no signal failures are detected.

ExampleConsole(config-erps-ring)#enable
Console(config-erps-ring)#

Related Commands
erps (617)enable (instance) This command activates the current ERPS instance. Use the no form to disable thecurrent instance.
Syntax[no] enable
Default Setting
Disabled
Command Mode
ERPS Instance Configuration
Command Usage Before enabling an instance, the global ERPS function should be enabled withthe erps command, the ring enabled with the enable (ring) command, the east
and west ring ports configured on each node with the ring-port command, the
RPL owner specified with the rpl owner command, and the control VLAN
configured with the control-vlan command.
 Once enabled, the RPL owner node and non-owner node state machines will

start, and the instance will enter idle state if no signal failures are detected.

ExampleConsole(config-erps-inst)#enable
Console(config-erps-inst)#

Related Commands
erps (617)meg-level This command sets the Maintenance Entity Group level for an instance. Use the noform to restore the default setting.
Syntaxmeg-level level– 623 –

Chapter 23 | ERPS Commands

no meg-level
level - The maintenance entity group (MEG) level which provides acommunication channel for ring automatic protection switching (R-APS)
information. (Range: 0-7)
Default Setting
1
Command Mode
ERPS Instance Configuration
Command Usage This parameter is used to ensure that received R-APS PDUs are directed for thisinstance. A unique level should be configured for each local instance if there
are many R-APS PDUs passing through this switch.
ExampleConsole(config-erps)#meg-level 0Console(config-erps)#

control-vlan This command specifies a dedicated VLAN used for sending and receiving ERPS
protocol messages. Use the no form to remove the Control VLAN.
Syntaxcontrol-vlan vlan-id
no control-vlan
vlan-id - VLAN ID (Range: 1-4094)
Default Setting
None
Command Mode
ERPS Instance Configuration
Command Usage The Control VID must be included in one of inclusion VLAN groups.
 Configure one control VLAN for each ERPS instance. First create the VLAN to be

used as the control VLAN (vlan, page 571), add the VLAN to an ERPS VLAN
group (erps vlan-group), add the ring ports for the east and west interface astagged members to this VLAN (switchport allowed vlan, page 574), and thenuse the control-vlan command to add it to the ERPS instance.

 The following restrictions are recommended to avoid creating a loop in the

network or other problems which may occur under some situations:– 624 –

Chapter 23 | ERPS Commands



The Control VLAN must not be configured as a Layer 3 interface (with an IP
address), nor as a dynamic VLAN (with GVRP enabled).



In addition, only ring ports may be added to the Control VLAN. No otherports can be members of this VLAN.



Also, the ring ports of the Control VLAN must be tagged.

 Once the instance has been activated with the enable (instance) command, theconfiguration of the control VLAN cannot be modified. Use the no enable (ring)command to stop the ERPS instance before making any configuration changes
to the control VLAN.

ExampleConsole(config)#vlan database
Console(config-vlan)#vlan 2 name rdc media ethernet state active
Console(config-vlan)#exit
Console(config)#interface ethernet 1/12
Console(config-if)#switchport allowed vlan add 2 tagged
Console(config-if)#interface ethernet 1/11
Console(config-if)#switchport allowed vlan add 2 tagged
Console(config-if)#exit
Console(config)#erps vlan-group alpha add 2
Console(config)#erps instance rd1
Console(config-erps-inst)#control-vlan 2
Console(config-erps-inst)#

rpl owner This command configures a ring node to be the Ring Protection Link (RPL) owner.
Use the no form to restore the default setting.
Syntaxrpl ownerno rplDefault Setting
None (that is, neither owner nor neighbor)
Command Mode
ERPS Instance Configuration
Command Usage Only one RPL owner can be configured on an instance. The owner blocks traffic

on the RPL during Idle state, and unblocks it during Protection state (that is,when a signal fault is detected on the instance or the protection state isenabled with the erps forced-switch or erps manual-switch command).

 The east and west connections to the instance must be specified for all ringnodes using the ring-port command. When this switch is configured as the RPL
owner, the west ring port is automatically set as being connected to the RPL.

– 625 –

Chapter 23 | ERPS Commands

ExampleConsole(config-erps-inst)#rpl ownerConsole(config-erps-inst)#

rpl neighbor This command configures a ring node to be the Ring Protection Link (RPL)
neighbor. Use the no form to restore the default setting.
Syntaxrpl neighborno rplDefault Setting
None (that is, neither owner nor neighbor)
Command Mode
ERPS Instance Configuration
Command Usage The RPL neighbor node, when configured, is a ring node adjacent to the RPLthat is responsible for blocking its end of the RPL under normal conditions (i.e.,
the instance is established and no requests are present in the instance) inaddition to the block at the other end by the RPL Owner Node. The RPL
neighbor node may participate in blocking or unblocking its end of the RPL,
but is not responsible for activating the reversion behavior.

 Only one RPL owner can be configured on an instance. If the switch is set as the

RPL owner for an ERPS ring, the west ring port is set as one end of the RPL. If theswitch is set as the RPL neighbor for an ERPS ring, the east ring port is set as theother end of the RPL.

 The east and west connections to the ring must be specified for all ring nodes

using the ring-port command. When this switch is configured as the RPL
neighbor, the east ring port is set as being connected to the RPL.

 Note that is not mandatory to declare an RPL neighbor.

ExampleConsole(config-erps-inst)#rpl neighbor
Console(config-erps-inst)#– 626 –

Chapter 23 | ERPS Commands

wtr-timer This command sets the wait-to-restore timer which is used to verify that the ringhas stabilized before blocking the RPL after recovery from a signal failure. Use theno form to restore the default setting.
Syntaxwtr-timer minutes
no wtr-timer
minutes - The wait-to-restore timer is used to verify that the ring has
stabilized before blocking the RPL after recovery from a signal failure.
(Range: 1-12 minutes)

Default Setting
5 minutes
Command Mode
ERPS Instance Configuration
Command Usage
If the switch goes into ring protection state due to a signal failure, after the failure
condition is cleared, the RPL owner will start the wait-to-restore timer and wait until
it expires to verify that the ring has stabilized before blocking the RPL and returning
to the Idle (normal operating) state.
ExampleConsole(config-erps-inst)#wtr-timer 10
Console(config-erps-inst)#

guard-timer This command sets the guard timer to prevent ring nodes from receiving outdated
R-APS messages. Use the no form to restore the default setting.
Syntaxguard-timer milliseconds
no guard-timer
milliseconds - The guard timer is used to prevent ring nodes from receiving
outdated R-APS messages. During the duration of the guard timer, allreceived R-APS messages are ignored by the ring protection control
process, giving time for old messages still circulating on the ring to expire.
(Range: 10-2000 milliseconds, in steps of 10 milliseconds)
Default Setting
500 milliseconds
Command Mode
ERPS Instance Configuration– 627 –

Chapter 23 | ERPS Commands

Command Usage
The guard timer duration should be greater than the maximum expected
forwarding delay for an R-APS message to pass around the ring. A side-effect of theguard timer is that during its duration, a node will be unaware of new or existing
ring requests transmitted from other nodes.
ExampleConsole(config-erps-inst)#guard-timer 300
Console(config-erps-inst)#

holdoff-timer This command sets the timer to filter out intermittent link faults. Use the no form torestore the default setting.
Syntaxholdoff-timer milliseconds
no holdoff-timer
milliseconds - The hold-off timer is used to filter out intermittent link faults.
Faults will only be reported to the ring protection mechanism if this timer
expires. (Range: 0-10000 milliseconds, in steps of 100 milliseconds)
Default Setting
0 milliseconds
Command Mode
ERPS Instance Configuration
Command Usage
In order to coordinate timing of protection switches at multiple layers, a hold-off
timer may be required. Its purpose is to allow, for example, a server layer protection
switch to have a chance to fix the problem before switching at a client layer.
When a new defect or more severe defect occurs (new Signal Failure), this event will
not be reported immediately to the protection switching mechanism if theprovisioned hold-off timer value is non-zero. Instead, the hold-off timer will bestarted. When the timer expires, whether a defect still exists or not, the timer will bechecked. If one does exist, that defect will be reported to the protection switchingmechanism. The reported defect need not be the same one that started the timer.
ExampleConsole(config-erps-inst)#holdoff-timer 300
Console(config-erps-inst)#– 628 –

Chapter 23 | ERPS Commands

major-ring This command specifies the ERPS ring used for sending control packets. Use the noform to remove the current setting.
Syntaxmajor-ring instance-nameno major-ring
instance-name - Name of the ERPS instance used for sending control
packets. (Range: 1-12 characters)
Default Setting
None
Command Mode
ERPS Instance Configuration
Command Usage ERPS control packets can only be sent on one instance. This command is used

to indicate that the current instance is a secondary ring, and to specify the
major instance which will be used to send ERPS control packets.

 The Ring Protection Link (RPL) is the west port and can not be configured. So

the physical port on a secondary instance must be the west port. In otherwords, if a domain has two physical ring ports, this instance can only be a majorring, not a secondary ring (or sub-domain) which can have only one physicalring port. This command will therefore fail if the east port is already configured(see the ring-port command).

ExampleConsole(config-erps-inst)#major-domain rd0
Console(config-erps-inst)#

propagate-tc This command enables propagation of topology change messages for a secondary
ring to the primary ring. Use the no form to disable this feature.
Syntax[no] propagate-tc
Default Setting
Disabled
Command Mode
ERPS Instance Configuration– 629 –

Chapter 23 | ERPS Commands

Command Usage When a secondary ring detects a topology change, it can pass a message about
this event to the major ring. When the major ring receives this kind of message
from a secondary ring, it can clear the MAC addresses on its ring ports to help
the secondary ring restore its connections more quickly through protection
switching.
 When the MAC addresses are cleared, data traffic may flood onto the major

ring. The data traffic will become stable after the MAC addresses are learned
again. The major ring will not be broken, but the bandwidth of data traffic on
the major ring may suffer for a short period of time due to this flooding
behavior.

ExampleConsole(config-erps-inst)#propagate-tc
Console(config-erps-inst)#

bpdu-tcn-notify This command configures an ERPS instance to send BPDU TCN notifications. Use
the no form of this command to disable BPDU TCN notifications.
Syntax[no] bpdu-tcn-notify
Default Setting
Disabled
Command Mode
ERPS Instance Configuration
Command Usage
When enabled, Spanning Tree topology change notification (TCN) BPDUs aretransmitted when an ERPS forwarding database (FDB) flush occurs on a ring
instance.
ExampleConsole(config-erps-inst)#bpdu-tcn-notify
Console(config-erps-inst)#

non-revertive This command enables non-revertive mode, which requires the protection state on

the RPL to manually cleared. Use the no form to restore the default revertive mode.
Syntax[no] non-revertive– 630 –

Chapter 23 | ERPS Commands

Default Setting
Disabled
Command Mode
ERPS Instance Configuration
Command Usage Revertive behavior allows the switch to automatically return the RPL fromProtection state to Idle state through the exchange of protocol messages.
Non-revertive behavior for Protection, Forced Switch, and Manual Switch states
are basically the same. Non-revertive behavior requires the erps clear
command to used to return the RPL from Protection state to Idle state.
 Recovery for Protection Switching – A ring node that has one or more ring ports

in an SF (Signal Fail) condition, upon detecting the SF condition cleared, keeps
at least one of its ring ports blocked for the traffic channel and for the R-APS
channel, until the RPL is blocked as a result of ring protection reversion, or until
there is another higher priority request (e.g., an SF condition) in the ring.

A ring node that has one ring port in an SF condition and detects the SF
condition cleared, continuously transmits the R-APS (NR – no request) message
with its own Node ID as the priority information over both ring ports, informingthat no request is present at this ring node and initiates a guard timer. Whenanother recovered ring node (or nodes) holding the link block receives thismessage, it compares the Node ID information with its own Node ID. If thereceived R-APS (NR) message has the higher priority, this ring node unblocks its
ring ports. Otherwise, the block remains unchanged. As a result, there is only
one link with one end blocked.
The ring nodes stop transmitting R-APS (NR) messages when they accept an RAPS (NR, RB – RPL Blocked), or when another higher priority request is received.


Recovery with Revertive Mode – When all ring links and ring nodes haverecovered and no external requests are active, reversion is handled in thefollowing way:a. The reception of an R-APS (NR) message causes the RPL Owner Node tostart the WTR (Wait-to-Restore) timer.

b. The WTR timer is cancelled if during the WTR period a higher priority
request than NR is accepted by the RPL Owner Node or is declared
locally at the RPL Owner Node.

c. When the WTR timer expires, without the presence of any other higher

priority request, the RPL Owner Node initiates reversion by blocking its
traffic channel over the RPL, transmitting an R-APS (NR, RB) message
over both ring ports, informing the ring that the RPL is blocked, andperforming a flush FDB action.

d. The acceptance of the R-APS (NR, RB) message causes all ring nodes tounblock any blocked non-RPL link that does not have an SF condition. If– 631 –

Chapter 23 | ERPS Commands

it is an R-APS (NR, RB) message without a DNF (do not flush) indication,
all ring nodes flush the FDB.


Recovery with Non-revertive Mode – In non-revertive operation, the ring
does not automatically revert when all ring links and ring nodes haverecovered and no external requests are active. Non-revertive operation ishandled in the following way:a. The RPL Owner Node does not generate a response on reception of an
R-APS (NR) messages.

b. When other healthy ring nodes receive the NR (Node ID) message, noaction is taken in response to the message.

c. When the operator issues the erps clear command for non-revertivemode at the RPL Owner Node, the non-revertive operation is cleared,
the RPL Owner Node blocks its RPL port, and transmits an R-APS (NR,RB) message in both directions, repeatedly.

d. Upon receiving an R-APS (NR, RB) message, any blocking node should
unblock its non-failed ring port. If it is an R-APS (NR, RB) message
without a DNF indication, all ring nodes flush the FDB.

 Recovery for Forced Switching – An erps forced-switch command is removed

by issuing the erps clear command to the same ring node where Forced Switch
mode is in effect. The clear command removes any existing local operator
commands, and triggers reversion if the ring is in revertive behavior mode.
The ring node where the Forced Switch was cleared keeps the ring port
blocked for the traffic channel and for the R-APS channel, due to the previous
Forced Switch command. This ring port is kept blocked until the RPL is blocked
as a result of ring protection reversion, or until there is another higher priority
request (e.g., an SF condition) in the ring.
The ring node where the Forced Switch was cleared continuously transmits the
R-APS (NR) message on both ring ports, informing other nodes that no request
is present at this ring node. The ring nodes stop transmitting R-APS (NR)messages when they accept an RAPS (NR, RB) message, or when another higher
priority request is received.
If the ring node where the Forced Switch was cleared receives an R-APS (NR)message with a Node ID higher than its own Node ID, it unblocks any ring port
which does not have an SF condition and stops transmitting R-APS (NR)message over both ring ports.


Recovery with revertive mode is handled in the following way:a. The reception of an R-APS (NR) message causes the RPL Owner Node tostart the WTB timer.

b. The WTB timer is canceled if during the WTB period a higher priority
request than NR is accepted by the RPL Owner Node or is declared
locally at the RPL Owner Node.

c. When the WTB timer expires, in the absence of any other higher priority
request, the RPL Owner Node initiates reversion by blocking the traffic– 632 –

Chapter 23 | ERPS Commands

channel over the RPL, transmitting an R-APS (NR, RB) message overboth ring ports, informing the ring that the RPL is blocked, and flushes
the FDB.

d. The acceptance of the R-APS (NR, RB) message causes all ring nodes tounblock any blocked non-RPL that does not have an SF condition. If it isan R-APS (NR, RB) message without a DNF indication, all ring nodes
flush their FDB. This action unblocks the ring port which was blocked asa result of an operator command.



Recovery with non-revertive mode is handled in the following way:a. The RPL Owner Node, upon reception of an R-APS(NR) message and in
the absence of any other higher priority request does not perform any
action.

b. Then, after the operator issues the erps clear command at the RPL

Owner Node, this ring node blocks the ring port attached to the RPL,
transmits an R-APS (NR, RB) message on both ring ports, informing thering that the RPL is blocked, and flushes its FDB.

c. The acceptance of the R-APS (NR, RB) message triggers all ring nodes tounblock any blocked non-RPL which does not have an SF condition. If it
is an R-APS (NR, RB) message without a DNF indication, all ring nodes
flush their FDB. This action unblocks the ring port which was blocked as
result of an operator command.

 Recovery for Manual Switching – An erps manual-switch command is removed

by issuing the erps clear command at the same ring node where the Manual
Switch is in effect. The clear command removes any existing local operator
commands, and triggers reversion if the ring is in revertive behavior mode.

The ring node where the Manual Switch was cleared keeps the ring port
blocked for the traffic channel and for the R-APS channel, due to the previous
Manual Switch command. This ring port is kept blocked until the RPL is blocked
as a result of ring protection reversion, or until there is another higher priority
request (e.g., an SF condition) in the ring.
The Ethernet Ring Node where the Manual Switch was cleared continuouslytransmits the R-APS (NR) message on both ring ports, informing that no request
is present at this ring node. The ring nodes stop transmitting R-APS (NR)messages when they accept an RAPS (NR, RB) message, or when another higher
priority request is received.
If the ring node where the Manual Switch was cleared receives an R-APS (NR)message with a Node ID higher than its own Node ID, it unblocks any ring port
which does not have an SF condition and stops transmitting R-APS (NR)message on both ring ports.


Recovery with revertive mode is handled in the following way:a. The RPL Owner Node, upon reception of an R-APS (NR) message and in
the absence of any other higher priority request, starts the WTB timer
and waits for it to expire. While the WTB timer is running, any latent R-– 633 –

Chapter 23 | ERPS Commands

APS (MS) message is ignored due to the higher priority of the WTB
running signal.

b. When the WTB timer expires, it generates the WTB expire signal. The

RPL Owner Node, upon reception of this signal, initiates reversion byblocking the traffic channel on the RPL, transmitting an R-APS (NR, RB)message over both ring ports, informing the ring that the RPL isblocked, and flushes its FDB.

c. The acceptance of the R-APS (NR, RB) message causes all ring nodes tounblock any blocked non-RPL that does not have an SF condition. If it isan R-APS (NR, RB) message without a DNF indication, all Ethernet Ring
Nodes flush their FDB. This action unblocks the ring port which was
blocked as a result of an operator command.



Recovery with non-revertive mode is handled in the following way:a. The RPL Owner Node, upon reception of an R-APS (NR) message and in
the absence of any other higher priority request does not perform any
action.

b. Then, after the operator issues the erps clear command at the RPL

Owner Node, this ring node blocks the ring port attached to the RPL,
transmits an R-APS (NR, RB) message over both ring ports, informing
the ring that the RPL is blocked, and flushes its FDB.

c. The acceptance of the R-APS (NR, RB) message triggers all ring nodes tounblock any blocked non-RPL which does not have an SF condition. If it
is an R-APS (NR, RB) message without a DNF indication, all ring nodes
flush their FDB. This action unblocks the ring port which was blocked as
result of an operator command.

ExampleConsole(config-erps-inst)#non-revertive
Console(config-erps-inst)#

raps-def-mac This command sets the switch’s MAC address to be used as the node identifier in RAPS messages. Use the no form to use the node identifier specified in the G8032
standards.
Syntax[no] raps-def-mac
Default Setting
EnabledCommand Mode
ERPS Instance Configuration– 634 –

Chapter 23 | ERPS Commands

Command Usage When ring nodes running ERPSv1 and ERPSv2 co-exist on the same ring, theRing ID of each ring node must be configured as “1”.
 If this command is disabled, the following strings are used as the node

identifier:

ERPSv1: 01-19-A7-00-00-01



ERPSv2: 01-19-A7-00-00-[Ring ID]

ExampleConsole(config-erps-inst)#raps-def-mac
Console(config-erps-inst)#

raps-without-vc This command terminates the R-APS channel at the primary ring to sub-ring
interconnection nodes. Use the no form to restore the default setting.
Syntax[no] raps-without-vc
Default Setting
R-APS with Virtual Channel
Command Mode
ERPS Instance Configuration
Command Usage
 A sub-ring may be attached to a primary ring with or without a virtual channel.
A virtual channel is used to connect two interconnection points on the subring, tunneling R-APS control messages across an arbitrary Ethernet network
topology. If a virtual channel is not used to cross the intermediate Ethernet
network, data in the traffic channel will still flow across the network, but the all
R-APS messages will be terminated at the interconnection points.
 Sub-ring with R-APS Virtual Channel – When using a virtual channel to tunnel

R-APS messages between interconnection points on a sub-ring, the R-APS
virtual channel may or may not follow the same path as the traffic channel overthe network. R-APS messages that are forwarded over the sub-ring’s virtualchannel are broadcast or multicast over the interconnected network. For thisreason the broadcast/multicast domain of the virtual channel should be limited
to the necessary links and nodes. For example, the virtual channel could span
only the interconnecting rings or sub-rings that are necessary for forwarding
R-APS messages of this sub-ring. Care must also be taken to ensure that the
local RAPS messages of the sub-ring being transported over the virtual channel
into the interconnected network can be uniquely distinguished from those ofother interconnected ring R-APS messages. This can be achieved by, forexample, by using separate VIDs for the virtual channels of different sub-rings.
– 635 –

Chapter 23 | ERPS Commands

Note that the R-APS virtual channel requires a certain amount of bandwidth toforward R-APS messages on the interconnected Ethernet network where a subring is attached. Also note that the protection switching time of the sub-ring
may be affected if R-APS messages traverse a long distance over an R-APS
virtual channel.
Figure 8: Sub-ring with Virtual Channel
RPL Port

Interconnection NodeSub-ringwith Virtual
ChannelRing Node

Major Ring

VirtualChannel Sub-ring without R-APS Virtual Channel – Under certain circumstances it may

not be desirable to use a virtual channel to interconnect the sub-ring over anarbitrary Ethernet network. In this situation, the R-APS messages are
terminated on the interconnection points. Since the sub-ring does not provide
an R-APS channel nor R-APS virtual channel beyond the interconnection points,
R-APS channel blocking is not employed on the normal ring links to avoid
channel segmentation. As a result, a failure at any ring link in the sub-ring willcause the R-APS channel of the sub-ring to be segmented, thus preventing RAPS message exchange between some of the sub-ring’s ring nodes.
No R-APS messages are inserted or extracted by other rings or sub- rings at theinterconnection nodes where a sub-ring is attached. Hence there is no need for
either additional bandwidth or for different VIDs/Ring IDs for the ringinterconnection. Furthermore, protection switching time for a sub-ring is
independent from the configuration or topology of the interconnected rings. In
addition, this option always ensures that an interconnected network forms atree topology regardless of its interconnection configuration. This means that it
is not necessary to take precautions against forming a loop which is potentiallycomposed of a whole interconnected network.

– 636 –

Chapter 23 | ERPS Commands

Figure 9: Sub-ring without Virtual Channel
RPL Port

Interconnection NodeSub-ringwith Virtual
ChannelRing Node

Major Ring

ExampleConsole(config-erps-inst)#raps-without-vc
Console(config-erps-inst)#

version This command specifies compatibility with ERPS version 1 or 2.
Syntaxversion {1 | 2}
no version
1 - ERPS version 1 based on ITU-T G.8032/Y.1344.
2 - ERPS version 2 based on ITU-T G.8032/Y.1344 Version 2.
Default Setting
2
Command Mode
ERPS Instance Configuration
Command Usage In addition to the basic features provided by version 1, version 2 also supports:
Multi-ring/ladder network support

Revertive/Non-revertive recoveryForced Switch (FS) and Manual Switch (MS) commands for manually
blocking a particular ring port



Flush FDB (forwarding database) logic which reduces amount of flush FDB
operations in the ringSupport of multiple ERP instances on a single ring

 Version 2 is backward compatible with Version 1. If version 2 is specified, theinputs and commands are forwarded transparently. If set to version 1, MS andFS operator commands are filtered, and the switch set to revertive mode.
– 637 –

Chapter 23 | ERPS Commands

 The version number is automatically set to “1” when a ring node, supporting

only the functionalities of G.8032v1, exists on the same ring with other nodes
that support G.8032v2.

 When ring nodes running G.8032v1 and G.8032v2 co-exist on a ring, the ring ID

of each node is configured as “1”.

 In version 1, the MAC address 01-19-A7-00-00-01 is used for the node identifier.

The raps-def-mac command has no effect.

ExampleConsole(config-erps-inst)#version 1
Console(config-erps-inst)#

inclusion-vlan Use this command to specify VLAN groups that are to be on the inclusion list of an

ERPS instance. Use the no form of the command to removed the VLAN from the list.
Syntax[no] inclusion-vlan vlan-group-namevlan-group-name - Name of the VLAN group. (Range: 1-12 characters).
Default Setting
None
Command Mode
ERPS Instance Configuration
Command Usage VLANs that are on the inclusion list are protected by the ERPS instance.
 Any VLAN not listed on either the inclusion or exclusion list will be blocked onring ports.

 Use the show erps statistics command to view the inclusion-vlan list of VLAN

IDs.

 Traffic from control VLANs, inclusion VLANs, and exclusion VLANs of an ERPS

instance will be forwarded by non-ERPS ring ports.

ExampleConsole(config-erps-inst)#inclusion-vlan vlgroup3
Console(config-erps-inst)#– 638 –

Chapter 23 | ERPS Commands

physical-ring Use this command to associate an ERPS instance with an existing physical ring. Use
the no form of the command to removed the association.
Syntaxphysical-ring ring-nameno physical-ring
ring-name - Name of a specific ERPS ring. (Range: 1-12 characters)
Default Setting
None
Command Mode
ERPS Instance Configuration
Command Usage
The physical ring name must first be defined using the erps ring command.
ExampleConsole(config-erps-inst)#phyical-ring campus1
Console(config-erps-inst)#

erps forced-switch This command blocks the specified ring port.
Syntaxerps forced-switch instance instance-name {east | west}
instance-name - Name of a specific ERPS instance. (Range: 1-12 characters)
east - East ring port.
west - West ring port.
Command Mode
Privileged Exec
Command Usage A ring with no pending request has a logical topology with the traffic channel
blocked at the RPL and unblocked on all other ring links. In this situation, theerps forced-switch command triggers protection switching as follows:a. The ring node where a forced switch command was issued blocks the traffic
channel and R-APS channel on the ring port to which the command wasissued, and unblocks the other ring port.

b. The ring node where the forced switch command was issued transmits R-

APS messages indicating FS over both ring ports. R-APS (FS) messages are– 639 –

Chapter 23 | ERPS Commands

continuously transmitted by this ring node while the local FS command is
the ring node’s highest priority command (see Table 122 on page 640). The
R-APS (FS) message informs other ring nodes of the FS command and thatthe traffic channel is blocked on one ring port.

c. A ring node accepting an R-APS (FS) message, without any local higher

priority requests unblocks any blocked ring port. This action subsequently
unblocks the traffic channel over the RPL.

d. The ring node accepting an R-APS (FS) message, without any local higher
priority requests stops transmission of R-APS messages.

e. The ring node receiving an R-APS (FS) message flushes its FDB.
 Protection switching on a forced switch request is completed when the above

actions are performed by each ring node. At this point, traffic flows around thering are resumed. From this point on the following rules apply regarding
processing of further forced switch commands:
While an existing forced switch request is present in a ring, any new forced
switch request is accepted, except on a ring node having a prior local forced
switch request. The ring nodes where further forced switch commands areissued block the traffic channel and R-APS channel on the ring port at which
the forced switch was issued. The ring node where the forced switch command
was issued transmits an R-APS message over both ring ports indicating FS. RAPS (FS) messages are continuously transmitted by this ring node while thelocal FS command is the ring node’s highest priority command. As such, two or
more forced switches are allowed in the ring, which may inadvertently cause
the segmentation of an ring. It is the responsibility of the operator to prevent
this effect if it is undesirable.
Ring protection requests, commands and R-APS signals have the priorities as
specified in the following table.
Table 122: ERPS Request/State Priority
Request / State and Status

Type

Priority

Clear

local

highest

FS

local

|

R-APS (FS)remote|local SF*

local

|

local clear SF

local

|

R-APS (SF)remote|R-APS (MS)remote

|

MS

local

|

WTR Expires

local

|

WTR Running

local

|

– 640 –

Chapter 23 | ERPS Commands

Table 122: ERPS Request/State Priority (Continued)
Request / State and StatusType

WTB Expires

local

|

WTB Running

local

|

R-APS (NR, RB)remote|R-APS (NR)remotelowest*Priority

If an Ethernet Ring Node is in the Forced Switch state, local SF is ignored.

 Recovery for forced switching under revertive and non-revertive mode is

described under the Command Usage section for the non-revertive command.

 When a ring is under an FS condition, and the node at which an FS command

was issued is removed or fails, the ring remains in FS state because the FS
command can only be cleared at node where the FS command was issued. This
results in an unrecoverable FS condition.
When performing a maintenance procedure (e.g., replacing, upgrading) on aring node (or a ring link), it is recommended that FS commands be issued at thetwo adjacent ring nodes instead of directly issuing a FS command at the ringnode under maintenance in order to avoid falling into the above mentioned
unrecoverable situation.

ExampleConsole#erps forced-switch instance r&d west
Console#erps manual-switch This command blocks the specified ring port, in the absence of a failure or an erps
forced-switch command.
Syntaxerps manual-switch instance instance-name {east | west}
instance-name - Name of a specific ERPS instance. (Range: 1-12 characters)
east - East ring port.
west - West ring port.
Command Mode
Privileged Exec
Command Usage A ring with no request has a logical topology with the traffic channel blocked at
the RPL and unblocked on all other ring links. In this situation, the erps
manual-switch command triggers protection switching as follows:– 641 –

Chapter 23 | ERPS Commands

a. If no other higher priority commands exist, the ring node, where a manualswitch command was issued, blocks the traffic channel and R-APS channelon the ring port to which the command was issued, and unblocks the otherring port.

b. If no other higher priority commands exist, the ring node where themanual switch command was issued transmits R-APS messages over bothring ports indicating MS. R-APS (MS) message are continuously transmitted
by this ring node while the local MS command is the ring node’s highest
priority command (see Table 122 on page 640). The R-APS (MS) message
informs other ring nodes of the MS command and that the traffic channel isblocked on one ring port.

c. If no other higher priority commands exist and assuming the ring node wasin Idle state before the manual switch command was issued, the ring node
flushes its local FDB.

d. A ring node accepting an R-APS (MS) message, without any local higher

priority requests unblocks any blocked ring port which does not have an SF
condition. This action subsequently unblocks the traffic channel over the
RPL.

e. A ring node accepting an R-APS (MS) message, without any local higher
priority requests stops transmitting R-APS messages.

f. A ring node receiving an R-APS (MS) message flushes its FDB.
 Protection switching on a manual switch request is completed when the above

actions are performed by each ring node. At this point, traffic flows around thering are resumed. From this point on, the following rules apply regarding
processing of further manual switch commands:

a. While an existing manual switch request is present in the ring, any new

manual switch request is rejected. The request is rejected at the ring node
where the new request is issued and a notification is generated to informthe operator that the new MS request was not accepted.

b. A ring node with a local manual switch command which receives an R-APS(MS) message with a different Node ID clears its manual switch request andstarts transmitting R-APS (NR) messages. The ring node keeps the ring port
blocked due to the previous manual switch command.

c. An ring node with a local manual switch command that receives an R-APS
message or a local request of higher priority than R-APS (MS) clear its
manual switch request. The ring node then processes the new higher
priority request.

 Recovery for manual switching under revertive and non-revertive mode is

described under the Command Usage section for the non-revertive command.

– 642 –

Chapter 23 | ERPS Commands

ExampleConsole#erps manual-switch instance r&d west
Console#erps clear This command manually clears the protection state which has been invoked by aforced switch or manual switch command, and the node is operating under nonrevertive mode; or before the WTR or WTB timer expires when the node isoperating in revertive mode.
Syntaxerps clear instance instance-nameinstance-name - Name of a specific ERPS instance. (Range: 1-12 characters)
Command Mode
Privileged Exec
Command Usage Two steps are required to make a ring operating in non-revertive mode returnto Idle state from forced switch or manual switch state:

1.Issue an erps clear command to remove the forced switch command on thenode where a local forced switch command is active.

2.Issue an erps clear command on the RPL owner node to trigger thereversion.

 The erps clear command will also stop the WTR and WTB delay timers andreset their values.

 More detailed information about using this command for non-revertive mode

is included under the Command Usage section for the non-revertive command.

ExampleConsole#erps clear instance r&d
Console#clear erps statistics This command clears all statistics for a specific ERPS instance, or all instances.
Syntaxclear erps statistics [instance instance-name]instance-name - Name of a specific ERPS instance. (Range: 1-12 characters)– 643 –

Chapter 23 | ERPS Commands

Command Mode
Privileged Exec
ExampleConsole#clear erps statistics instance r&d
Console#show erps statistics This command displays statistics information for all configured instances, or for a
specified instance.
Syntaxshow erps statistics [instance instance-name]]
instance-name - Name of a specific ERPS instance. (Range: 1-12 characters)
Command Mode
Privileged Exec
ExampleThis example displays statistics for all configured ERPS instances.
Console#show erps statistics
ERPS statistics for instance r&d :Interface
Local SF
Local Clear SF------------ ---------- -------------(W) Eth 1/ 1 0
0
SF
NR
NR-RB
FS
MS
---------- ---------- ---------- ---------- ---------Sent
0
62
948
0
0
Received
00000Ignored
0
0
0
0
0
EVENT
HEALTH---------- ---------Sent
00
Received
00
Ignored00Interface
Local SF
Local Clear SF------------ ---------- -------------(E) Eth 1/ 3 0
0
SF
NR
NR-RB
FS
MS
---------- ---------- ---------- ---------- ---------Sent
0
62
948
0
0
Received
00000Ignored
0
0
0
0
0
EVENT
HEALTH---------- ---------Sent
00
Received
00
Ignored00Console#– 644 –

Chapter 23 | ERPS Commands

Table 123: show erps statistics - detailed display description
Field

Description

Interface

The direction, and port or trunk which is configured as a ring port.

Local SF

A signal fault generated on a link to the local node.

Local Clear SF

The number of times a clear command was issued to terminate
protection state entered through a forced switch or manual switch

SF

The number of signal fault messages

NR

The number of no request messages

NR-RB

The number no request - RPL blocked messages

FS

The number of forced switch messages

MS

The number of manual switch messages

EVENT

Any request/state message, excluding FS, SF, MS, and NR

HEALTHThe number of non-standard health-check messages

show erps This command displays status information for all configured VLAN groups, rings,
and instances, or for a specified VLAN group, ring, or instance.
Syntaxshow erps {[vlan-group vlan-group-name] | [ring ring-name] |[instance instance-name]}vlan-group - Keyword to display ERPS VLAN group settings.
vlan-group-name – Name of the VLAN group. (Range: 1-12 characters).
ring - Keyword to display ERPS ring configuration settings.
ring-name - Name of a specific ERPS ring. (Range: 1-12 characters)
instance - Keyword to display ERPS instance configuration settings.
instance-name - Name of a specific ERPS instance. (Range: 1-12 characters)
Command Mode
Privileged Exec
ExampleThis example displays a summary of all the ERPS VLAN groups configured on theswitch.
Console#show erps vlan-group
ERPS Status: Disabled
ERPS node-id: B8-6A-97-41-F3-83
Number of ERPS Vgroup : 1
VLAN-group
ID VLANs------------ --- ---------------------------------------vlgroup3
1 3,6,9– 645 –

Chapter 23 | ERPS Commands

Console#This example displays a summary of all the ERPS rings configured on the switch.
Console#show erps ring
ERPS Status: Enabled
ERPS node-id: B8-6A-97-41-F3-83
Number of ERPS Ring
: 2
Ring
ID Enabled West I/F EAST I/F------------ --- ------- --------- --------test1
1 No
campus1
2 Yes
Eth 1/1
Eth 1/3
Console#Table 124: show erps r ing - summary display description
Field

Description

ERPS Status

Shows whether ERPS is enabled on the switch.

ERPS node-id

ERPS node identifier used in R-APS messages.

Number of ERPS RingShows the number of ERPS rings configured on the switch.

Ring

Displays the name of each ring followed by a brief list of status
information

ID

ERPS ring identifier used in R-APS messages.

EnabledShows if the specified ring is enabled.

West I/F

Shows information on the west ring port for this node.

East I/F

Shows information on the east ring port for this node.

– 646 –

Chapter 23 | ERPS Commands

This example displays a summary of all the ERPS instances configured on theswitch.
Console#show erps instance
ERPS Status: Disabled
ERPS node-id: B8-6A-97-41-F3-83
Number of ERPS Inst: 1
Instance
ID Enabled Physical Ring Ctrl VLAN Node State Node Type------------ --- ------- ------------- --------- ---------- -----------test1
1 No
Init
None
W/E Interface Port State Local SF Local FS Local MS RPL---- --------- ---------- -------- -------- -------- ---West
Unknown
No
No
No
No
East
Unknown
No
No
No
No
Inclusion VLAN groups--------------------------------------------------------------None
Console#– 647 –

Chapter 23 | ERPS Commands– 648 –

24

Class of Service Commands

The commands described in this section allow you to specify which data packets
have greater precedence when traffic is buffered in the switch due to congestion.
This switch supports CoS with eight priority queues for each port. Data packets in aport’s high-priority queue will be transmitted before those in the lower-priority
queues. The default priority can be set for each interface, also the queue service
mode and the mapping of frame priority tags to the switch's priority queues can be
configured.
Table 125: Priority Commands
Command Group

Function

Priority Commands(Layer 2)

Configures the queue mode, queue weights, and default priority for
untagged frames

Priority Commands(Layer 3 and 4)

Sets the default priority processing method (CoS or DSCP), maps
priority tags for internal processing, maps values from internal priority
table to CoS values used in tagged egress packets for Layer 2 interfaces,
maps internal per hop behavior to hardware queues

Priority Commands (Layer 2)
This section describes commands used to configure Layer 2 traffic priority on theswitch.
Table 126: Priority Commands (Layer 2)
CommandFunctionModequeue mode

Sets the queue mode to Weighted Round-Robin (WRR),
strict priority, or a combination of strict and weighted
queuingGC

queue weight

Assigns round-robin weights to the priority queues

GC

switchport priority default

Sets a port priority for incoming untagged framesICshow interfaces switchport Displays the administrative and operational status of aninterfacePEshow queue mode

Shows the current queue modePEshow queue weightShows weights assigned to the weighted queuesPE– 649 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 2)

queue mode This command sets the scheduling mode used for processing each of the class ofservice (CoS) priority queues. The options include strict priority, Weighted RoundRobin (WRR), or a combination of strict and weighted queuing. Use the no form torestore the default value.
Syntaxqueue mode {strict | wrr | strict-wrr [queue-type-list]}
no queue mode
strict - Services the egress queues in sequential order, transmitting all
traffic in the higher priority queues before servicing lower priority queues.
This ensures that the highest priority packets are always serviced first,
ahead of all other traffic.
wrr - Weighted Round-Robin shares bandwidth at the egress ports by using
scheduling weights (based on the queue weight command), and servicing
each queue in a round-robin fashion.
strict-wrr - Uses strict or weighted service as specified for each queue.
queue-type-list - Indicates if the queue is a normal or strict type.
(Options: 0 indicates a normal queue, 1 indicates a strict queue)

Default Setting
WRR
Command Mode
Global Configuration
Command Usage The switch can be set to service the port queues based on strict priority, WRR,
or a combination of strict and weighted queuing.
 Strict priority requires all traffic in a higher priority queue to be processed

before lower priority queues are serviced.

 Weighted Round Robin (WRR) uses a predefined relative weight for each queuethat determines the percentage of service time the switch services each queue
before moving on to the next queue. This prevents the head-of-line blocking
that can occur with strict priority queuing. Use the queue weight command toassign weights for WRR queuing to the eight priority queues.

 If Strict and WRR mode is selected, a combination of strict and weighted service

is used as specified for each queue. The queues assigned to use strict or WRR
priority should be specified using the queue-type-list parameter.

 A weight can be assigned to each of the weighted queues (and thereby to thecorresponding traffic priorities). This weight sets the frequency at which eachqueue is polled for service, and subsequently affects the response time forsoftware applications assigned a specific priority value.

– 650 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 2)

 Service time is shared at the egress ports by defining scheduling weights for

WRR, or for the queuing mode that uses a combination of strict and weighted
queuing. Service time is allocated to each queue by calculating a precise
number of bytes per second that will be serviced on each round.

 The specified queue mode applies to all interfaces.

ExampleThe following example sets the queue mode to strict priority service mode:
Console(config)#queue mode strict
Console(config)#

Related Commands
queue weight (651)show queue mode (653)

queue weight This command assigns weights to the eight class of service (CoS) priority queues

when using weighted queuing, or one of the queuing modes that use acombination of strict and weighted queuing. Use the no form to restore the default
weights.
Syntaxqueue weight weight0...weight7
no queue weightweight0...weight7 - The ratio of weights for queues 0 - 7 determines theweights used by the WRR scheduler. (Range: 1-255)

Default Setting
Weights 1, 2, 4, 6, 8, 10, 12, 14 are assigned to queues 0 - 7 respectively.
Command Mode
Global Configuration
Command Usage This command shares bandwidth at the egress port by defining schedulingweights for Weighted Round-Robin, or for the queuing mode that uses a
combination of strict and weighted queuing (page 650).
 Bandwidth is allocated to each queue by calculating a precise number of bytes

per second that will be serviced on each round.

– 651 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 2)
ExampleThe following example shows how to assign round-robin weights of 1 - 8 to the CoS
priority queues 0 - 7.
Console(config)#queue weight 1 2 3 4 5 6 7 8
Console(config)#

Related Commands
queue mode (650)show queue weight (653)switchport priority This command sets a priority for incoming untagged frames. Use the no form todefault restore the default value.
Syntaxswitchport priority default default-priority-id
no switchport priority default
default-priority-id - The priority number for untagged ingress traffic. The
priority is a number from 0 to 7. Seven is the highest priority.
Default Setting
The priority is not set, and the default value for untagged frames received on theinterface is zero.
Command Mode
Interface Configuration (Ethernet)
Command Usage The precedence for priority mapping is IP DSCP, and then default switchport
priority.
 The default priority applies for an untagged frame received on a port set toaccept all frame types (i.e, receives both untagged and tagged frames). Thispriority does not apply to IEEE 802.1Q VLAN tagged frames. If the incoming
frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits
will be used.

 The switch provides eight priority queues for each port. It can be configured touse strict priority queuing, Weighted Round Robin (WRR), or a combination ofstrict and weighted queuing using the queue mode command. Inbound framesthat do not have VLAN tags are tagged with the input port's default ingressuser priority, and then placed in the appropriate priority queue at the output
port. The default priority for all ingress ports is zero. Therefore, any inboundframes that do not have priority tags will be placed in queue 2 of the output
port. (Note that if the output port is an untagged member of the associated
VLAN, these frames are stripped of all VLAN tags prior to transmission.)– 652 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 2)

ExampleThe following example shows how to set a default priority on port 3 to 5:
Console(config)#interface ethernet 1/3
Console(config-if)#switchport priority default 5
Console(config-if)#

Related Commands
show interfaces switchport (432)show queue mode This command shows the current queue mode.
Syntaxshow queue mode
Command Mode
Privileged Exec
ExampleConsole#show queue mode
Queue Mode : Weighted Round Robin
Console#show queue weight This command displays the weights used for the weighted queues.
Syntaxshow queue weight
Command Mode
Privileged Exec
ExampleConsole#show queue weight
Information of Eth 1/1
Queue ID Weight-------- -----0
1
1
2
2
4
3
6
4
8
5
10
6
12
7
14
...

– 653 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)

Priority Commands (Layer 3 and 4)
This section describes commands used to configure Layer 3 and 4 traffic priority
mapping on the switch.
Table 127: Priority Commands (Layer 3 and 4)
CommandFunctionModeqos map phb-queue

Maps internal per-hop behavior values to hardware queues IC

qos map cos-dscp

Maps CoS/CFI values in incoming packets to per-hop
behavior and drop precedence values for internal priority
processingIC

qos map dscp-mutation

Maps DSCP values in incoming packets to per-hop
behavior and drop precedence values for internal priority
processingIC

qos map ip-prec-dscp

Maps IP Precedence values in incoming packets to per-hop IC
behavior and drop precedence values for internal priority
processing

qos map trust-mode

Sets QoS mapping to DSCP or CoS

IC

show qos map cos-dscp

Shows ingress CoS to internal DSCP map

PEshow qos map
dscp-mutation

Shows ingress DSCP to internal DSCP map

PEshow qos map ip-prec-dscp Shows ingress IP Precedence to internal DSCP map

PEshow qos map phb-queue

Shows internal per-hop behavior to hardware queue map

PEshow qos map trust-mode

Shows the QoS mapping modePE

* The default settings used for mapping priority values to internal DSCP values and back to thehardware queues are designed to optimize priority services for the majority of network
applications. It should not be necessary to modify any of the default settings unless a queuingproblem occurs with a particular application.

qos map phb-queue This command determines the hardware output queues to use based on theinternal per-hop behavior value. Use the no form to restore the default settings.
Syntax
qos map phb-queue queue-id from phb0 ... phb7
no map phb-queue phb0 ... phb7
phb - Per-hop behavior, or the priority used for this router hop. (Range: 0-7)
queue-id - The ID of the priority queue. (Range: 0-7, where 7 is the highest
priority queue)
Default Setting
Table 128: Mapping Internal Per-hop Behavior to Hardware Queues
Per-hop Behavior

0

1

2

3

4

5

6

7

Hardware Queues

2

0

1

3

4

5

6

7

– 654 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)

Command Mode
Interface Configuration (Port, Static Aggregation)
Command Usage Enter a queue identifier, followed by the keyword “from” and then up to eightinternal per-hop behavior values separated by spaces.
 Egress packets are placed into the hardware queues according to the mapping

defined by this command.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#qos map phb-queue 0 from 1 2 3
Console(config-if)#

qos map cos-dscp This command maps CoS/CFI values in incoming packets to per-hop behavior anddrop precedence values for priority processing. Use the no form to restore thedefault settings.
Syntax
qos map cos-dscp phb drop-precedence from cos0 cfi0...cos7 cfi7
no qos map cos-dscp cos0 cfi0...cos7 cfi7
phb - Per-hop behavior, or the priority used for this router hop. (Range: 0-7)
drop-precedence - Drop precedence used for controlling traffic congestion.
(Range: 0 - Green, 3 - Yellow, 1 - Red)cos - CoS value in ingress packets. (Range: 0-7)
cfi - Canonical Format Indicator. Set to this parameter to “0” to indicate that
the MAC address information carried in the frame is in canonical format.
(Range: 0-1)
Default Setting
Table 129: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence
0

1

0

(0,0)

(0,0)

1

(1,0)

(1,0)

2

(2,0)

(2,0)

3

(3,0)

(3,0)

4

(4,0)

(4,0)

5

(5,0)

(5,0)

CoS

CFI

– 655 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)
Table 129: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence
CFI

0

1

6

(6,0)

(6,0)

7

(7,0)

(7,0)

CoS

Command Mode
Interface Configuration (Port, Static Aggregation)
Command Usage The default mapping of CoS to PHB values shown in Table 129 is based on therecommended settings in IEEE 802.1p for mapping CoS values to output
queues.
 Enter a value pair for the internal per-hop behavior and drop precedence,

followed by the keyword “from” and then up to eight CoS/CFI paired values
separated by spaces.

 If a packet arrives with a 802.1Q header but it is not an IP packet, then the CoS/

CFI-to-PHB/Drop Precedence mapping table is used to generate priority anddrop precedence values for internal processing. Note that priority tags in theoriginal packet are not modified by this command.

 The internal DSCP consists of three bits for per-hop behavior (PHB) which

determines the queue to which a packet is sent; and two bits for drop
precedence (namely color) which is used to control traffic congestion.

 The specified mapping applies to all interfaces.

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#qos map cos-dscp 0 0 from 0 1
Console(config-if)#– 656 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)

qos map This command maps DSCP values in incoming packets to per-hop behavior anddscp-mutation drop precedence values for priority processing. Use the no form to restore thedefault settings.
Syntax
qos map dscp-mutation phb drop-precedence from dscp0 ... dscp7
no qos map dscp-mutation dscp0 ... dscp7
phb - Per-hop behavior, or the priority used for this router hop. (Range: 0-7)
drop-precedence - Drop precedence used for in controlling traffic
congestion. (Range: 0 - Green, 3 - Yellow, 1 - Red)
dscp - DSCP value in ingress packets. (Range: 0-63)
Default Setting
Table 130: Default Mapping of DSCP Values to Internal PHB/Drop Values
ingressdscp1

0

1

2

3

4

5

6

7

8

9

0

0,0

0,1

0,0

0,3

0,0

0,1

0,0

0,3

1,0

1,1

1

1,0

1,3

1,0

1,1

1,0

1,3

2,0

2,1

2,0

2,3

2

2,0

2,1

2,0

2,3

3,0

3,1

3,0

3,3

3.0

3,1

3

3,0

3,3

4,0

4,1

4,0

4,3

4,0

4,1

4.0

4,3

4

5,0

5,1

5,0

5,3

5,0

5,1

6,0

5,3

6,0

6,1

5

6,0

6,3

6,0

6,1

6,0

6,3

7,0

7,1

7.0

7,3

6

7,0

7,1

7,0

7,3

ingressdscp10

The ingress DSCP is composed of ingress-dscp10 (most significant digit in the left column) andingress-dscp1 (least significant digit in the top row (in other words, ingress-dscp = ingress-dscp10 *10 + ingress-dscp1); and the corresponding internal-dscp is shown at the intersecting cell in thetable.
The ingress DSCP is bitwise ANDed with the binary value 11 to determine the drop precedence. If
the resulting value is 10 binary, then the drop precedence is set to 0.

Command Mode
Interface Configuration (Port, Static Aggregation)
Command Usage Enter a value pair for the internal per-hop behavior and drop precedence,
followed by the keyword “from” and then up to eight DSCP values separated by
spaces.
 This map is only used when the QoS mapping mode is set to “DSCP” by the qos

map trust-mode command, and the ingress packet type is IPv4.

 Two QoS domains can have different DSCP definitions, so the DSCP-to-PHB/

Drop Precedence mutation map can be used to modify one set of DSCP values– 657 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)
to match the definition of another domain. The mutation map should beapplied at the receiving port (ingress mutation) at the boundary of a QoS
administrative domain.
 The specified mapping applies to all interfaces.

ExampleThis example changes the priority for all packets entering port 1 which contain a
DSCP value of 1 to a per-hop behavior of 3 and a drop precedence of 1. Referring toTable 130, note that the DSCP value for these packets is now set to 25 (3x23+1) andpassed on to the egress interface.
Console(config)#interface ethernet 1/5
Console(config-if)#qos map dscp-mutation 3 1 from 1
Console(config-if)#

qos map ip-prec-dscp This command maps IP precedence values in incoming packets to per-hop

behavior and drop precedence values for priority processing. Use the no form torestore the default settings.
Syntax
qos map ip-prec-dscp phb0 drop-precedence0 ... phb7 drop-precedence7
no map ip-prec-dscp
phb - Per-hop behavior, or the priority used for this router hop. (Range: 0-7)
drop-precedence - Drop precedence used for controlling traffic congestion.
(Range: 0 - Green, 3 - Yellow, 1 - Red)
Default Setting
Table 131: Default Mapping of IP Precedence to Internal PHB/Drop Values
IP Precedence Value

0

1

2

3

4

5

6

7

Per-hop Behavior

0

1

2

3

4

5

6

7

Drop Precedence

0

0

0

0

0

0

0

0

Command Mode
Interface Configuration (Port, Static Aggregation)
Command Usage Enter up to eight paired values for per-hop behavior and drop precedence
separated by spaces. These values are used for internal priority processing, andcorrespond to IP Precedence values 0 - 7.
 If the QoS mapping mode is set the IP Precedence and the ingress packet typeis IPv4, then the IP Precedence-to-DSCP mapping table is used to generatepriority and drop precedence values for internal processing.
– 658 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)

ExampleConsole(config)#interface ethernet 1/5
Console(config-if)#qos map ip-prec-dscp 7 0 6 0 5 0 4 0 3 0 2 1 1 1 0 1
Console(config-if)#

qos map trust-mode This command sets QoS mapping to DSCP or CoS. Use the no form to restore thedefault setting.
Syntax
qos map trust-mode {cos | dscp | ip-precedence}no qos map trust-modecos - Sets the QoS mapping mode to CoS.
dscp - Sets the QoS mapping mode to DSCP.
ip-precedence - Sets the QoS mapping mode to IP Precedence.
Default Setting
CoS
Command Mode
Interface Configuration (Port)
Command Usage If the QoS mapping mode is set to IP Precedence with this command, and theingress packet type is IPv4, then priority processing will be based on the IP
Precedence value in the ingress packet.
 If the QoS mapping mode is set to DSCP with this command, and the ingress

packet type is IPv4, then priority processing will be based on the DSCP value inthe ingress packet.

 If the QoS mapping mode is set to either IP Precedence or DSCP, and a non-IP

packet is received, the packet's CoS and CFI (Canonical Format Indicator) values
are used for priority processing if the packet is tagged. For an untagged packet,
the default port priority (see page 652) is used for priority processing.

 If the QoS mapping mode is set to CoS with this command, and the ingress

packet type is IPv4, then priority processing will be based on the CoS and CFI
values in the ingress packet.
For an untagged packet, the default port priority (see page 652) is used forpriority processing.

– 659 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)
ExampleThis example sets the QoS priority mapping mode to use DSCP based on theconditions described in the Command Usage section.
Console(config)#interface ge1/1
Console(config-if)#qos map trust-mode dscp
Console(config-if)#show qos map This command shows ingress CoS/CFI to internal DSCP map.
cos-dscp
Syntaxshow qos map cos-dscp interface interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show qos map cos-dscp interface ethernet 1/5

CoS Information of Eth 1/5

CoS-DSCP map.(x,y),x: phb,y: drop precedence:
CoS : CFI 0
1--------------------------------0
(0,0)
(0,0)
1
(1,0)
(1,0)
2
(2,0)
(2,0)
3
(3,0)
(3,0)
4
(4,0)
(4,0)
5
(5,0)
(5,0)
6
(6,0)
(6,0)
7
(7,0)
(7,0)
Console#– 660 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)

show qos map This command shows the ingress DSCP to internal DSCP map.
dscp-mutation
Syntaxshow qos map dscp-mutation interface interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
Command Usage
This map is only used when the QoS mapping mode is set to “DSCP” by the qos
map trust-mode command, and the ingress packet type is IPv4.
ExampleThe ingress DSCP is composed of “d1” (most significant digit in the left column) and“d2” (least significant digit in the top row (in other words, ingress DSCP = d1 * 10 +d2); and the corresponding Internal DSCP and drop precedence is shown at theintersecting cell in the table.
Console#show qos map dscp-mutation interface ethernet 1/5
DSCP mutation map.(x,y),x: PHB,y: drop precedence:d1: d2 0
1
2
3
4
5
6
7
8
9
----------------------------------------------------------------0 :(0,0) (0,1) (0,0) (0,3) (0,0) (0,1) (0,0) (0,3) (1,0) (1,1)
1 :(1,0) (1,3) (1,0) (1,1) (1,0) (1,3) (2,0) (2,1) (2,0) (2,3)
2 :(2,0) (2,1) (2,0) (2,3) (3,0) (3,1) (3,0) (3,3) (3,0) (3,1)
3 :(3,0) (3,3) (4,0) (4,1) (4,0) (4,3) (4,0) (4,1) (4,0) (4,3)
4 :(5,0) (5,1) (5,0) (5,3) (5,0) (5,1) (6,0) (5,3) (6,0) (6,1)
5 :(6,0) (6,3) (6,0) (6,1) (6,0) (6,3) (7,0) (7,1) (7,0) (7,3)
6 :(7,0) (7,1) (7,0) (7,3)
Console#show qos map This command shows the ingress IP precedence to internal DSCP map.
ip-prec-dscp
Syntaxshow qos map ip-prec-dscp interface interface
interfaceethernet unit/port
unit - Stack unit. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)– 661 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)
Command Mode
Privileged Exec
Command Usage
If the QoS mapping mode is set to IP Precedence and the ingress packet type is
IPv4, then the IP Precedence-to-DSCP mapping table is used to generate per-hop
behavior and drop precedence values for internal processing.
ExampleConsole#show qos map ip-prec-dscp interface ethernet 1/5
Information of Eth 1/5
IP-prec-DSCP map:
IP-prec:
0
1
2
3
4
5
6
7
-----------------------------------------------------------PHB:
0
1
2
3
4
5
6
7
drop precedence: 0
0
0
0
0
0
0
0
Console#show qos map This command shows internal per-hop behavior to hardware queue map.
phb-queue
Syntaxshow qos map phb-queue interface interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show qos map phb-queue interface ethernet 1/5
Information of Eth 1/5
PHB-queue map:
PHB:
0
1
2
3
4
5
6
7
------------------------------------------------------queue:
2
0
1
3
4
5
6
7
Console#– 662 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)

show qos map This command shows the QoS mapping mode.
trust-mode
Syntaxshow qos map trust-mode interface interface
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleThe following shows that the trust mode is set to CoS:
Console#show qos map trust-mode interface ethernet 1/5
Information of Eth 1/5
CoS Map Mode:
CoS mode
Console#– 663 –

Chapter 24 | Class of Service Commands
Priority Commands (Layer 3 and 4)– 664 –

25

Quality of Service Commands

The commands described in this section are used to configure DifferentiatedServices (DiffServ) classification criteria and service policies. You can classify traffic
based on access lists, IP Precedence or DSCP values, or VLANs. Using access lists
allows you select traffic based on Layer 2, Layer 3, or Layer 4 information containedin each packet.
Table 132: Quality of Service Commands
CommandFunctionModeclass-map

Creates a class map for a type of trafficGC

description

Specifies the description of a class map

CM

match

Defines the criteria used to classify trafficCMrenameRedefines the name of a class map

CMpolicy-map

Creates a policy map for multiple interfacesGC

description

Specifies the description of a policy map

PM

class

Defines a traffic classification for the policy to act onPMrenameRedefines the name of a policy map

PMpolice flow

Defines an enforcer for classified traffic based on a metered PM-C
flow rate

police srtcm-color

Defines an enforcer for classified traffic based on a single
rate three color meter

police trtcm-color

Defines an enforcer for classified traffic based on a two rate PM-C
three color meterset cos

Services IP traffic by setting a class of service value formatching packets for internal processing

PM-C

set ip dscp

Services IP traffic by setting a IP DSCP value for matching
packets for internal processing

PM-C

set phbServices IP traffic by setting a per-hop behavior value formatching packets for internal processing

PM-C

service-policy

Applies a policy map defined by the policy-map command IC
to the input of a particular interface

show class-map

Displays the QoS class maps which define matching criteria PE
used for classifying trafficshow policy-map

Displays the QoS policy maps which define classification
criteria for incoming traffic, and may include policers forbandwidth limitations

PEshow policy-map interface

Displays the configuration of all classes configured for all
service policies on the specified interfacePE– 665 –

PM-C

Chapter 25 | Quality of Service Commands

To create a service policy for a specific category of ingress traffic, follow these steps:

1. Use the class-map command to designate a class name for a specific categoryof traffic, and enter the Class Map configuration mode.

2. Use the match command to select a specific type of traffic based on an access
list, an IPv4 DSCP value, IPv4 Precedence value, a VLAN, or a CoS value.

3. Use the policy-map command to designate a policy name for a specific mannerin which ingress traffic will be handled, and enter the Policy Map configurationmode.

4. Use the class command to identify the class map, and enter Policy Map Class
configuration mode. A policy map can contain up to 16 class maps.

5. Use the set phb or set cos or set ip dscp command to modify the per-hop

behavior, the class of service value in the VLAN tag, or the priority bits in the IP
header (IP DSCP value) for the matching traffic class, and use one of the police
commands to monitor parameters such as the average flow and burst rate, anddrop any traffic that exceeds the specified rate, or just reduce the DSCP service
level for traffic exceeding the specified rate.

6. Use the service-policy command to assign a policy map to a specific interface.
Note: Create a Class Map before creating a Policy Map.

class-map This command creates a class map used for matching packets to the specified class,and enters Class Map configuration mode. Use the no form to delete a class map.
Syntaxclass-map class-map-name match-any
no class-map class-map-nameclass-map-name - Name of the class map. (Range: 1-32 characters)
match-any - Match any condition within a class map.
Default Setting
None
Command Mode
Global Configuration– 666 –

Chapter 25 | Quality of Service Commands

Command Usage First enter this command to designate a class map and enter the Class Map
configuration mode. Then use match commands to specify the criteria foringress traffic that will be classified under this class map.
 One or more class maps can be assigned to a policy map (page 670). The policy

map is then bound by a service policy to an interface (page 680). A service
policy defines packet classification, service tagging, and bandwidth policing.

ExampleThis example creates a class map call “rd-class,” and sets it to match packets marked
for DSCP service value 3:
Console(config)#class-map rd-class match-any
Console(config-cmap)#match ip dscp 3
Console(config-cmap)#

Related Commands
show class-map (680)

description This command specifies the description of a class map or policy map.Use the noform of the command to remove the description.
Syntaxdescription string
no description
string - Description of the class map or policy map. (Range: 1-64 characters)
Command ModeClass Map Configuration
Policy Map Configuration
ExampleConsole(config)#class-map rd-class#1
Console(config-cmap)#description matches packets marked for DSCP service
value 3
Console(config-cmap)#– 667 –

Chapter 25 | Quality of Service Commands

match This command defines the criteria used to classify traffic. Use the no form to delete
the matching criteria.
Syntax[no] match {access-list acl-name | cos cos | ip dscp dscp |ip precedence ip-precedence | ipv6 dscp dscp | source-port interface |vlan vlan}
acl-name - Name of the access control list. Any type of ACL can be specified,including standard or extended IPv4/IPv6 ACLs and MAC ACLs.
(Range: 1-16 characters)cos - A Class of Service value. (Range: 0-7)
dscp - A Differentiated Service Code Point value. (Range: 0-63)
ip-precedence - An IP Precedence value. (Range: 0-7)
interface
unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
vlan - A VLAN. (Range:1-4094)
Default Setting
None
Command ModeClass Map Configuration
Command Usage First enter the class-map command to designate a class map and enter theClass Map configuration mode. Then use match commands to specify the fields
within ingress packets that must match to qualify for this class map.
 If an ingress packet matches an ACL specified by this command, any deny rules

included in the ACL will be ignored.

 If match criteria includes an IP ACL or IP priority rule, then a VLAN rule cannot

be included in the same class map.

 If match criteria includes a MAC ACL or VLAN rule, then neither an IP ACL nor IP

priority rule can be included in the same class map.

 Up to 16 match entries can be included in a class map.

– 668 –

Chapter 25 | Quality of Service Commands

ExampleThis example creates a class map called “rd-class#1,” and sets it to match packets
marked for DSCP service value 3.
Console(config)#class-map rd-class#1 match-any
Console(config-cmap)#match ip dscp 3
Console(config-cmap)#

This example creates a class map call “rd-class#2,” and sets it to match packets
marked for IP Precedence service value 5.
Console(config)#class-map rd-class#2 match-any
Console(config-cmap)#match ip precedence 5
Console(config-cmap)#

This example creates a class map call “rd-class#3,” and sets it to match packets
marked for VLAN 1.
Console(config)#class-map rd-class#3 match-any
Console(config-cmap)#match vlan 1
Console(config-cmap)#

rename This command redefines the name of a class map or policy map.
Syntaxrename map-namemap-name - Name of the class map or policy map. (Range: 1-32 characters)
Command ModeClass Map Configuration
Policy Map Configuration
ExampleConsole(config)#class-map rd-class#1
Console(config-cmap)#rename rd-class#9
Console(config-cmap)#– 669 –

Chapter 25 | Quality of Service Commands

policy-map This command creates a policy map that can be attached to multiple interfaces,and enters Policy Map configuration mode. Use the no form to delete a policy map.
Syntax[no] policy-map policy-map-namepolicy-map-name - Name of the policy map. (Range: 1-32 characters)

Default Setting
None
Command Mode
Global Configuration
Command Usage Use the policy-map command to specify the name of the policy map, and thenuse the class command to configure policies for traffic that matches the criteria
defined in a class map.
 A policy map can contain multiple class statements that can be applied to thesame interface with the service-policy command.

 Create a Class Map (page 670) before assigning it to a Policy Map.

ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set command to classify the service that
incoming packets will receive, and then uses the police flow command to limit the
average bandwidth to 100,000 Kbps, the burst rate to 4000 bytes, and configure theresponse to drop any violating packets.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set cos 0
Console(config-pmap-c)#police flow 10000 4000 conform-action transmit
violate-action drop
Console(config-pmap-c)#class This command defines a traffic classification upon which a policy can act, andenters Policy Map Class configuration mode. Use the no form to delete a class map.
Syntax[no] class class-map-nameclass-map-name - Name of the class map. (Range: 1-32 characters)
Default Setting
None– 670 –

Chapter 25 | Quality of Service Commands

Command Mode
Policy Map Configuration
Command Usage Use the policy-map command to specify a policy map and enter Policy Map
configuration mode. Then use the class command to enter Policy Map Class
configuration mode. And finally, use the set command and one of the police
commands to specify the match criteria, where the:

set phb command sets the per-hop behavior value in matching packets.
(This modifies packet priority for internal processing only.)

set cos command sets the class of service value in matching packets.
(This modifies packet priority in the VLAN tag.)

police commands define parameters such as the maximum throughput,burst rate, and response to non-conforming traffic.

 Up to 16 classes can be included in a policy map.

ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set phb command to classify the service
that incoming packets will receive, and then uses the police flow command to limit
the average bandwidth to 100,000 Kbps, the burst rate to 4,000 bytes, andconfigure the response to drop any violating packets.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set phb 3
Console(config-pmap-c)#police flow 10000 4000 conform-action transmit
violate-action drop
Console(config-pmap-c)#

police flow This command defines an enforcer for classified traffic based on the metered flow
rate. Use the no form to remove a policer.
Syntax[no] police flow committed-rate committed-burst
conform-action {transmit | new-dscp}
violate-action {drop | new-dscp}
committed-rate - Committed information rate (CIR) in kilobits per second.
(Range: 0-10000000 kbps or maximum port speed, whichever is lower)
committed-burst - Committed burst size (BC) in bytes.
(Range: 64-16000000 bytes)
conform-action - Action to take when packet is within the CIR and BC.
(There are enough tokens to service the packet, the packet is set green).
– 671 –

Chapter 25 | Quality of Service Commands

violate-action - Action to take when packet exceeds the CIR and BC. (There
are not enough tokens to service the packet, the packet is set red).
transmit - Transmits without taking any action.
drop - Drops packet as required by violate-action.
new-dscp - Differentiated Service Code Point (DSCP) value. (Range: 0-63)
Default Setting
None
Command Mode
Policy Map Class Configuration
Command Usage You can configure up to 16 policers (i.e., class maps) for ingress ports.
 Policing is based on a token bucket, where bucket depth (i.e., the maximum

burst before the bucket overflows) is by specified the committed-burst field, andthe average rate tokens are added to the bucket is by specified by thecommitted-rate option. Note that the token bucket functions similar to that
described in RFC 2697 and RFC 2698.

 The behavior of the meter is specified in terms of one token bucket (C), the rate

at which the tokens are incremented (CIR – Committed Information Rate), andthe maximum size of the token bucket (BC – Committed Burst Size).

The token bucket C is initially full, that is, the token count Tc(0) = BC. Thereafter,
the token count Tc is updated CIR times per second as follows:

If Tc is less than BC, Tc is incremented by one, else
Tc is not incremented.

When a packet of size B bytes arrives at time t, the following happens:

If Tc(t)-B  0, the packet is green and Tc is decremented by B down to theminimum value of 0, else
else the packet is red and Tc is not decremented.

ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set phb command to classify the service
that incoming packets will receive, and then uses the police flow command to limit
the average bandwidth to 100,000 Kbps, the burst rate to 4000 bytes, and configure
the response to drop any violating packets.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set phb 3– 672 –

Chapter 25 | Quality of Service Commands

Console(config-pmap-c)#police flow 100000 4000 conform-action transmit
violate-action drop
Console(config-pmap-c)#

police srtcm-color This command defines an enforcer for classified traffic based on a single rate threecolor meter (srTCM). Use the no form to remove a policer.
Syntax[no] police {srtcm-color-blind | srtcm-color-aware}committed-rate committed-burst excess-burst
conform-action {transmit | new-dscp}
exceed-action {drop | new-dscp}
violate action {drop | new-dscp}
srtcm-color-blind - Single rate three color meter in color-blind mode.
srtcm-color-aware - Single rate three color meter in color-aware mode.
committed-rate - Committed information rate (CIR) in kilobits per second.
(Range: 0-10000000 kbps or maximum port speed, whichever is lower)
committed-burst - Committed burst size (BC) in bytes.
(Range: 64-16000000 bytes)
excess-burst - Excess burst size (BE) in bytes. (Range: 64-16000000 bytes)
conform-action - Action to take when rate is within the CIR and BC. (Thereare enough tokens in bucket BC to service the packet, packet is set green).
exceed-action - Action to take when rate exceeds the CIR and BC but iswithin the BE. (There are enough tokens in bucket BE to service the packet,
the packet is set yellow.)
violate-action - Action to take when rate exceeds the BE. (There are notenough tokens in bucket BE to service the packet, the packet is set red.)transmit - Transmits without taking any action.
drop - Drops packet as required by exceed-action or violate-action.
new-dscp - Differentiated Service Code Point (DSCP) value. (Range: 0-63)
Default Setting
None
Command Mode
Policy Map Class Configuration
Command Usage You can configure up to 16 policers (i.e., class maps) for ingress ports.
 The srTCM as defined in RFC 2697 meters a traffic stream and processes its

packets according to three traffic parameters – Committed Information Rate
(CIR), Committed Burst Size (BC), and Excess Burst Size (BE).
– 673 –

Chapter 25 | Quality of Service Commands

 The PHB label is composed of five bits, three bits for per-hop behavior, and two

bits for the color scheme used to control queue congestion. A packet is marked
green if it doesn't exceed the CIR and BC, yellow if it does exceed the CIR andBC, but not the BE, and red otherwise.

 The meter operates in one of two modes. In the color-blind mode, the meterassumes that the packet stream is uncolored. In color-aware mode the meterassumes that some preceding entity has pre-colored the incoming packet
stream so that each packet is either green, yellow, or red. The marker (re)colors
an IP packet according to the results of the meter. The color is coded in the DS
field [RFC 2474] of the packet.

 The behavior of the meter is specified in terms of its mode and two token

buckets, C and E, which both share the common rate CIR. The maximum size ofthe token bucket C is BC and the maximum size of the token bucket E is BE.
The token buckets C and E are initially full, that is, the token count Tc(0) = BC
and the token count Te(0) = BE. Thereafter, the token counts Tc and Te are
updated CIR times per second as follows:

If Tc is less than BC, Tc is incremented by one, else
if Te is less then BE, Te is incremented by one, else
neither Tc nor Te is incremented.

When a packet of size B bytes arrives at time t, the following happens if srTCM isconfigured to operate in color-blind mode:

If Tc(t)-B  0, the packet is green and Tc is decremented by B down to theminimum value of 0, else
if Te(t)-B  0, the packets is yellow and Te is decremented by B down to theminimum value of 0,
else the packet is red and neither Tc nor Te is decremented.

When a packet of size B bytes arrives at time t, the following happens if srTCM isconfigured to operate in color-aware mode:

If the packet has been precolored as green and Tc(t)-B  0, the packet isgreen and Tc is decremented by B down to the minimum value of 0, else
If the packet has been precolored as yellow or green and if
Te(t)-B  0, the packets is yellow and Te is decremented by B down to theminimum value of 0, else the packet is red and neither Tc nor Te isdecremented.

The metering policy guarantees a deterministic behavior where the volume ofgreen packets is never smaller than what has been determined by the CIR andBC, that is, tokens of a given color are always spent on packets of that color.
Refer to RFC 2697 for more information on other aspects of srTCM.
ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set phb command to classify the service
that incoming packets will receive, and then uses the police srtcm-color-blind– 674 –

Chapter 25 | Quality of Service Commands

command to limit the average bandwidth to 100,000 Kbps, the committed burst
rate to 4000 bytes, the excess burst rate to 6000 bytes, to remark any packets
exceeding the committed burst size, and to drop any packets exceeding the excess
burst size.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set phb 3
Console(config-pmap-c)#police srtcm-color-blind 100000 4000 6000 conformaction transmit exceed-action 0 violate-action drop
Console(config-pmap-c)#

police trtcm-color This command defines an enforcer for classified traffic based on a two rate threecolor meter (trTCM). Use the no form to remove a policer.
Syntax[no] police {trtcm-color-blind | trtcm-color-aware}committed-rate committed-burst peak-rate peak-burst
conform-action {transmit | new-dscp}
exceed-action {drop | new-dscp}
violate action {drop | new-dscp}
trtcm-color-blind - Two rate three color meter in color-blind mode.
trtcm-color-aware - Two rate three color meter in color-aware mode.
committed-rate - Committed information rate (CIR) in kilobits per second.
(Range: 0-10000000 kbps or maximum port speed, whichever is lower)
committed-burst - Committed burst size (BC) in bytes.
(Range: 64-16000000 bytes)
peak-rate - Peak information rate (PIR) in kilobits per second.
(Range: 0-1000000 kbps or maximum port speed, whichever is lower)
peak-burst - Peak burst size (BP) in bytes. (Range: 64-16000000 bytes)
conform-action - Action to take when rate is within the CIR and BP. (Packet
size does not exceed BP and there are enough tokens in bucket BC toservice the packet, the packet is set green.)
exceed-action - Action to take when rate exceeds the CIR but is within the
PIR. (Packet size exceeds BC but there are enough tokens in bucket BP toservice the packet, the packet is set yellow.)
violate-action - Action to take when rate exceeds the PIR. (There are notenough tokens in bucket BP to service the packet, the packet is set red.)drop - Drops packet as required by exceed-action or violate-action.
transmit - Transmits without taking any action.
new-dscp - Differentiated Service Code Point (DSCP) value. (Range: 0-63)– 675 –

Chapter 25 | Quality of Service Commands

Default Setting
None
Command Mode
Policy Map Class Configuration
Command Usage You can configure up to 16 policers (i.e., class maps) for ingress ports.
 The trTCM as defined in RFC 2698 meters a traffic stream and processes its

packets based on two rates – Committed Information Rate (CIR) and Peak
Information Rate (PIR), and their associated burst sizes - Committed Burst Size(BC) and Peak Burst Size (BP).

 The PHB label is composed of five bits, three bits for per-hop behavior, and two

bits for the color scheme used to control queue congestion. A packet is marked
red if it exceeds the PIR. Otherwise it is marked either yellow or green
depending on whether it exceeds or doesn't exceed the CIR.
The trTCM is useful for ingress policing of a service, where a peak rate needs tobe enforced separately from a committed rate.

 The meter operates in one of two modes. In the color-blind mode, the meterassumes that the packet stream is uncolored. In color-aware mode the meterassumes that some preceding entity has pre-colored the incoming packet
stream so that each packet is either green, yellow, or red. The marker (re)colors
an IP packet according to the results of the meter. The color is coded in the DS
field [RFC 2474] of the packet.

 The behavior of the meter is specified in terms of its mode and two token

buckets, P and C, which are based on the rates PIR and CIR, respectively. The
maximum size of the token bucket P is BP and the maximum size of the token
bucket C is BC.

 The token buckets P and C are initially (at time 0) full, that is, the token countTp(0) = BP and the token count Tc(0) = BC. Thereafter, the token count Tp is
incremented by one PIR times per second up to BP and the token count Tc is
incremented by one CIR times per second up to BC.

When a packet of size B bytes arrives at time t, the following happens if trTCM isconfigured to operate in color-blind mode:

If Tp(t)-B < 0, the packet is red, else
if Tc(t)-B < 0, the packet is yellow and Tp is decremented by B, else
the packet is green and both Tp and Tc are decremented by B.

When a packet of size B bytes arrives at time t, the following happens if trTCM isconfigured to operate in color-aware mode:

If the packet has been precolored as red or if Tp(t)-B < 0, the packet is red,else

– 676 –

Chapter 25 | Quality of Service Commands



if the packet has been precolored as yellow or if Tc(t)-B < 0, the packet isyellow and Tp is decremented by B, else
the packet is green and both Tp and Tc are decremented by B.

 The trTCM can be used to mark a IP packet stream in a service, where different,

decreasing levels of assurances (either absolute or relative) are given to packets
which are green, yellow, or red. Refer to RFC 2698 for more information onother aspects of trTCM.

ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set phb command to classify the service
that incoming packets will receive, and then uses the police trtcm-color-blindcommand to limit the average bandwidth to 100,000 Kbps, the committed burst
rate to 4000 bytes, the peak information rate to 1,000,000 kbps, the peak burst size
to 6000, to remark any packets exceeding the committed burst size, and to drop
any packets exceeding the peak information rate.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set phb 3
Console(config-pmap-c)#police trtcm-color-blind 100000 4000 100000 6000
conform-action transmit exceed-action 0 violate-action drop
Console(config-pmap-c)#

set cos This command modifies the class of service (CoS) value for a matching packet (asspecified by the match command) in the packet’s VLAN tag. Use the no form to
remove this setting.
Syntax[no] set cos cos-value
cos-value - Class of Service value. (Range: 0-7)
Default Setting
None
Command Mode
Policy Map Class Configuration
Command Usage The set cos command is used to set the CoS value in the VLAN tag for matching
packets.
 The set cos and set phb command function at the same level of priority.

Therefore setting either of these commands will overwrite any action alreadyconfigured by the other command.

– 677 –

Chapter 25 | Quality of Service Commands

ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set cos command to classify the service
that incoming packets will receive, and then uses the police flow command to limit
the average bandwidth to 100,000 Kbps, the burst rate to 4000 bytes, and configure
the response to drop any violating packets.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set cos 3
Console(config-pmap-c)#police flow 100000 4000 conform-action transmit
violate-action drop
Console(config-pmap-c)#

set ip dscp This command modifies the IP DSCP value in a matching packet (as specified by thematch command). Use the no form to remove this traffic classification.
Syntax[no] set ip dscp new-dscp
new-dscp - New Differentiated Service Code Point (DSCP) value.
(Range: 0-63)
Default Setting
None
Command Mode
Policy Map Class Configuration
Command Usage
The set ip dscp command is used to set the priority values in the packet’s ToS field
for matching packets.
ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set ip dscp command to classify theservice that incoming packets will receive, and then uses the police flow command
to limit the average bandwidth to 100,000 Kbps, the burst rate to 4000 bytes, andconfigure the response to drop any violating packets.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set ip dscp 3
Console(config-pmap-c)#police flow 10000 4000 conform-action transmit
violate-action drop
Console(config-pmap-c)#– 678 –

Chapter 25 | Quality of Service Commands

set phb This command services IP traffic by setting a per-hop behavior value for a matching
packet (as specified by the match command) for internal processing. Use the noform to remove this setting.
Syntax[no] set phb phb-value
phb-value - Per-hop behavior value. (Range: 0-7)
Default Setting
None
Command Mode
Policy Map Class Configuration
Command Usage The set phb command is used to set an internal QoS value in hardware formatching packets (see Table 129, "Default Mapping of CoS/CFI to Internal PHB/
Drop Precedence"). The QoS label is composed of five bits, three bits for perhop behavior, and two bits for the color scheme used to control queue
congestion by the police srtcm-color command and police trtcm-colorcommand.

 The set cos and set phb command function at the same level of priority.

Therefore setting either of these commands will overwrite any action alreadyconfigured by the other command.

ExampleThis example creates a policy called “rd-policy,” uses the class command to specify
the previously defined “rd-class,” uses the set phb command to classify the service
that incoming packets will receive, and then uses the police flow command to limit
the average bandwidth to 100,000 Kbps, the burst rate to 4000 bytes, and configure
the response to drop any violating packets.
Console(config)#policy-map rd-policy
Console(config-pmap)#class rd-class
Console(config-pmap-c)#set phb 3
Console(config-pmap-c)#police flow 10000 4000 conform-action transmit
violate-action drop
Console(config-pmap-c)#– 679 –

Chapter 25 | Quality of Service Commands

service-policy This command applies a policy map defined by the policy-map command to theingress side of a particular interface. Use the no form to remove this mapping.

Syntax[no] service-policy {input | output} policy-map-name
input - Apply to the input traffic.
output - Apply to the output traffic.
policy-map-name - Name of the policy map for this interface.
(Range: 1-32 characters)
Default Setting
No policy map is attached to an interface.
Command Mode
Interface Configuration (Ethernet)
Command Usage Only one policy map can be assigned to an interface.
 First define a class map, then define a policy map, and finally use the service-policy command to bind the policy map to the required interface.

 The switch does not allow a policy map to be bound to an interface for egresstraffic.

ExampleThis example applies a service policy to an ingress interface.
Console(config)#interface ethernet 1/1
Console(config-if)#service-policy input rd-policy
Console(config-if)#show class-map This command displays the QoS class maps which define matching criteria used forclassifying traffic.
Syntaxshow class-map [class-map-name]class-map-name - Name of the class map. (Range: 1-32 characters)
Default Setting
Displays all class maps.
Command Mode
Privileged Exec
– 680 –

Chapter 25 | Quality of Service Commands

ExampleConsole#show class-map
Class Map match-any rd-class#1
Description:
Match IP DSCP 10
Match access-list rd-access
Match IP DSCP 0
Class Map match-any rd-class#2
Match IP Precedence 5Class Map match-any rd-class#3
Match VLAN 1
Console#show policy-map This command displays the QoS policy maps which define classification criteria forincoming traffic, and may include policers for bandwidth limitations.
Syntaxshow policy-map [policy-map-name [class class-map-name]]policy-map-name - Name of the policy map. (Range: 1-32 characters)
class-map-name - Name of the class map. (Range: 1-32 characters)
Default Setting
Displays all policy maps and all classes.
Command Mode
Privileged Exec
ExampleConsole#show policy-map
Policy Map rd-policy
Description:
class rd-classset phb 3
Console#show policy-map rd-policy class rd-class
Policy Map rd-policy
class rd-classset phb 3
Console#– 681 –

Chapter 25 | Quality of Service Commands

show policy-map This command displays the service policy assigned to the specified interface.
interface
Syntaxshow policy-map interface interface input
interface
unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show policy-map interface 1/5 input
Service-policy rd-policy
Console#– 682 –

26

Control Plane Commands

Network control packets that are received by the switch are handled by the CPU.
This traffic can potentially overwhelm the switch CPU and impact the overallsystem performance. To prevent the switch CPU from receiving too much traffic,
QoS class maps and policy maps can be defined and applied as a service policy toingress traffic on the CPU’s “control-plane” interface.
For details on configuring QoS class maps and policy maps, see “Quality of Service
Commands” on page 665.
Table 133: Control Plane Commands
CommandFunctionModecontrol-planeEnters control-plane interface mode

GC

service-policy

Applies a policy map to the input of the controlplane interface

CPshow policy-map
control-planeShows the configuration of service policies on thecontrol-plane interfacePE

control-plane Use this command to enter control-plane interface configuration mode.
Syntaxcontrol-plane
Command Mode
Global Configuration
Command Usage
You must enter control-plane interface configuration mode to bind a service policy
to the control-plane interface.
ExampleConsole(config)#control-plane
Console(config-cp)#– 683 –

Chapter 26 | Control Plane Commands

service-policy This command applies a QoS policy map defined by the policy-map command to
the ingress side of the control-plane interface. Use the no form to remove thismapping.
Syntax[no] service-policy input policy-map-name
input - Apply to the input traffic.
policy-map-name - Name of the policy map for this interface.
(Range: 1-32 characters)
Default Setting
No policy map is attached to the control-plane interface.
Command ModeControl-Plane Interface Configuration
Command Usage Only one policy map can be assigned to the control-plane interface.
 First define a class map, then define a policy map, and finally use the service-policy command to bind the policy map to the control-plane interface.

 The switch does not allow a policy map to be bound to an interface for egresstraffic.

ExampleThis example applies a service policy to the control-plane interface.
Console(config)#control-plane
Console(config-cp)#service-policy input cpu-policy
Console(config-cp)#

show policy-map This command displays the QoS policy map that defines classification criteria forcontrol-plane incoming traffic on the control-plane interface.
Syntaxshow policy-map control-plane input [class class-map-name] [hardware
counters]
class-map-name - Name of the class map. (Range: 1-32 characters)
hardware counters - Shows statistics for the policy or class.
Command Mode
Privileged Exec

– 684 –

Chapter 26 | Control Plane Commands

ExampleConsole#show policy-map control-plane input
Console# show policy-map control-plane input class cp-class hardware counters
Service-policy cpu-rate-limit-policy
Class-map cp-class
Receive Packets:
95
Drop Packets:
0
Console#– 685 –

Chapter 26 | Control Plane Commands– 686 –

27

Multicast Filtering Commands

This switch uses IGMP (Internet Group Management Protocol) to check for any
attached hosts that want to receive a specific multicast service. It identifies theports containing hosts requesting a service and sends data out to those ports only.
It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.
Table 134: Multicast Filtering Commands
Command Group

Function

IGMP Snooping

Configures multicast groups via IGMP snooping or static assignment,
sets the IGMP version, enables proxy reporting, displays current
snooping settings, and displays the multicast service and groupmembers

Static Multicast Routing

Configures static multicast router ports which forward all inboundmulticast traffic to the attached VLANs

IGMP Filtering andThrottling

Configures IGMP filtering and throttling

MLD Snooping

Configures multicast snooping for IPv6

MLD Filtering andThrottling

Configures MLD filtering and throttling for IPv6.

MVR for IPv4

Configures a single network-wide multicast VLAN shared by hosts
residing in other standard or private VLAN groups, preserving security
and data isolation for normal traffic

MVR for IPv6

Configures a single network-wide multicast VLAN shared by hosts
residing in other standard or private VLAN groups, preserving security
and data isolation for normal traffic

IGMP Snooping
This section describes commands used to configure IGMP snooping on the switch.
Table 135: IGMP Snooping Commands
CommandFunctionMode

ip igmp snooping

Enables IGMP snoopingGC

ip igmp snooping mrouter- Restricts multicast stream forwarding to joined groups
forward-mode dynamic
only

GC

ip igmp snooping
proxy-reporting

Enables IGMP Snooping with Proxy ReportingGC

ip igmp snooping reportsuppression

Configures report suppression for IGMP SnoopingGC– 687 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
Table 135: IGMP Snooping Commands (Continued)
CommandFunctionMode

ip igmp snooping querier

Allows this device to act as the querier for IGMP snooping GC

ip igmp snooping routeralert-option-check

Discards any IGMPv2/v3 packets that do not include theRouter Alert optionGC

ip igmp snooping
router-port-expire-time

Configures the querier timeoutGC

ip igmp snooping tcn-flood Floods multicast traffic when a Spanning Tree topology
change occurs

GC

ip igmp snooping
tcn-query-solicit

Sends an IGMP Query Solicitation when a Spanning Tree
topology change occurs

GC

ip igmp snooping
unregistered-data-flood

Floods unregistered multicast traffic into the attached
VLAN

GC

ip igmp snooping
unsolicited-report-intervalSpecifies how often the upstream interface should
transmit unsolicited IGMP reports (when reportsuppression/proxy reporting is enabled)GC

ip igmp snooping version

Configures the IGMP version for snoopingGC

ip igmp snooping
version-exclusive

Discards received IGMP messages which use a version
different to that currently configuredGC

ip igmp snooping vlan
Suppresses general queries except for ports attached togeneral-query-suppression downstream multicast hosts
ip igmp snooping vlan
immediate-leaveGC

Immediately deletes a member port of a multicast service GC
if a leave packet is received at that port and immediateleave is enabled for the parent VLAN

ip igmp snooping vlan last- Configures the number of IGMP proxy query messages that GC
memb-query-countare sent out before the system assumes there are no local
members
ip igmp snooping vlan last- Configures the last-member-query intervalmemb-query-intvl

GC

ip igmp snooping vlan mrd Sends multicast router solicitation messages

GC

ip igmp snooping vlan
proxy-address

Configures a static address for proxy IGMP query andreportingGC

ip igmp snooping vlan
proxy-reporting

Enables IGMP Snooping with Proxy ReportingGC

ip igmp snooping vlan
query-interval

Configures the interval between sending IGMP generalqueriesGC

ip igmp snooping vlan
query-resp-intvl

Configures the maximum time the system waits for a
response to general queriesGC

ip igmp snooping vlan
staticAdds an interface as a member of a multicast groupGC

ip igmp snooping
vlan version

Configures the IGMP version for snoopingGC

ip igmp snooping
vlan version-exclusive

Discards received IGMP messages which use a version
different to that currently configured

GC

clear ip igmp snoopinggroups dynamic

Clears multicast group information dynamically learned
through IGMP snoopingPE– 688 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

Table 135: IGMP Snooping Commands (Continued)
CommandFunctionModeclear ip igmp snooping
statistics

Clears IGMP snooping statistics

PEshow ip igmp snooping

Shows the IGMP snooping, proxy, and query configuration PE

show ip igmp snooping
group

Shows known multicast group, source, and host port
mappingPEshow ip igmp snooping
mrouterShows multicast router portsPEshow ip igmp snooping
statistics

Shows IGMP snooping protocol statistics for the specified
interfacePE

ip igmp snooping This command enables IGMP snooping globally on the switch or on a selected
VLAN interface. Use the no form to disable it.
Syntax[no] ip igmp snooping [vlan vlan-id]
vlan-id - VLAN ID (Range: 1-4094)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When IGMP snooping is enabled globally, the per VLAN interface settings for

IGMP snooping take precedence.

 When IGMP snooping is disabled globally, snooping can still be configured per

VLAN interface, but the interface settings will not take effect until snooping is
re-enabled globally.

ExampleThe following example enables IGMP snooping globally.
Console(config)#ip igmp snooping
Console(config)#– 689 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping

ip igmp snooping This command configures multicast router ports to forward multicast streams only
mrouter-forward- when multicast groups are joined. Use the no form to disable it.
mode dynamic
Syntaxip igmp snooping mrouter-forward dynamic
no ip igmp snooping mrouter-forward
Default Setting
Disabled
Command Mode
Global Configuration
ExampleThe following example enables IGMP dynamic forwarding.
Console(config)#ip igmp snooping mrouter-forward dynamic
Console(config)#

ip igmp snooping This command enables IGMP Snooping with Proxy Reporting. Use the no form toproxy-reporting restore the default setting.
Syntax[no] ip igmp snooping proxy-reporting
ip igmp snooping vlan vlan-id proxy-reporting {enable | disable}
no ip igmp snooping vlan vlan-id proxy-reporting
vlan-id - VLAN ID (Range: 1-4094)
enable - Enable on the specified VLAN.
disable - Disable on the specified VLAN.
Default Setting
Global: Disabled
VLAN: Based on global setting
Command Mode
Global Configuration
Command Usage When proxy reporting is enabled with this command, reports received fromdownstream hosts are summarized and used to build internal membershipstates. Proxy-reporting devices may use the all-zeros IP source address when
forwarding any summarized reports upstream. For this reason, IGMP
membership reports received by the snooping switch must not be rejected
because the source IP address is set to 0.0.0.0.
– 690 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping When proxy reporting is enabled with this command, the switch performs“IGMP Snooping with Proxy Reporting” (as defined in DSL Forum TR-101, April2006), including report suppression, last leave, and query suppression. Reportsuppression intercepts, absorbs and summarizes IGMP reports coming fromdownstream hosts. Last leave sends out a proxy query when the last member
leaves a multicast group, and query suppression means that specific queries
are not forwarded from an upstream multicast router to hosts downstream
from this device.

 If the IGMP proxy reporting is configured on a VLAN, this setting takes

precedence over the global configuration.

ExampleConsole(config)#ip igmp snooping proxy-reporting
Console(config)#

ip igmp snooping This command enables IGMP snooping with report suppression. Use the no form toreport-suppression restore the default setting.
Syntax[no] ip igmp snooping report-suppression
ip igmp snooping vlan vlan-id report-suppression {enable | disable}
no ip igmp snooping vlan vlan-id report-suppressionvlan-id - VLAN ID (Range: 1-4094)
enable - Enable on the specified VLAN.
disable - Disable on the specified VLAN.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When IGMP snooping report suppression is enabled with this command, theswitch performs report suppression (as defined in DSL Forum TR-101, April2006). If proxy reporting is enabled (see ip igmp snooping proxy-reporting),
report suppression will still be enabled, regardless of the configuration setting
for the report suppression command.
 IGMP reports are relayed to the router port only when necessary; that is, when

the first user joins a multicast group, and once only per multicast group in
response to an IGMP query.

– 691 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping When report suppression and proxy reporting are both disabled, all IGMP

reports received by the switch are forwarded natively to the upstream multicast
routers.

ExampleConsole(config)#ip igmp snooping vlan 1 report-suppression enable
Console(config)#

ip igmp snooping This command enables the switch as an IGMP querier. Use the no form to disable it.
querier
Syntax[no] ip igmp snooping querier
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
If enabled, the switch will serve as querier if elected. The querier is responsible forasking hosts if they want to receive multicast traffic.
ExampleConsole(config)#ip igmp snooping querier
Console(config)#

ip igmp snooping This command discards any IGMPv2/v3 packets that do not include the Routerrouter-alert-option- Alert option. Use the no form to ignore the Router Alert Option when receiving
check IGMP messages.
Syntax[no] ip igmp snooping router-alert-option-check
Default Setting
Disabled
Command Mode
Global Configuration
Command UsageAs described in Section 9.1 of RFC 3376 for IGMP Version 3, the Router Alert Option
can be used to protect against DOS attacks. One common method of attack is– 692 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

launched by an intruder who takes over the role of querier, and starts overloading
multicast hosts by sending a large number of group-and-source-specific queries,
each with a large source list and the Maximum Response Time set to a large value.
To protect against this kind of attack, (1) routers should not forward queries. This iseasier to accomplish if the query carries the Router Alert option. (2) Also, when theswitch is acting in the role of a multicast host (such as when using proxy routing), it
should ignore version 2 or 3 queries that do not contain the Router Alert option.
ExampleConsole(config)#ip igmp snooping router-alert-option-check
Console(config)#

ip igmp snooping This command configures the querier timeout. Use the no form to restore therouter-port- default.
expire-time
Syntaxip igmp snooping router-port-expire-time seconds
no ip igmp snooping router-port-expire-time
seconds - The time the switch waits after the previous querier stops before
it considers it to have expired. (Range: 1-65535;
Recommended Range: 300-500)
Default Setting
300 seconds
Command Mode
Global Configuration
ExampleThe following shows how to configure the timeout to 400 seconds:
Console(config)#ip igmp snooping router-port-expire-time 400
Console(config)#

ip igmp snooping This command enables flooding of multicast traffic if a spanning tree topology
tcn-flood change notification (TCN) occurs. Use the no form to disable flooding.
Syntax[no] ip igmp snooping tcn-flood
Default Setting
Disabled– 693 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
Command Mode
Global Configuration
Command Usage When a spanning tree topology change occurs, the multicast membership
information learned by the switch may be out of date. For example, a host
linked to one port before the topology change (TC) may be moved to anotherport after the change. To ensure that multicast data is delivered to all receivers,
by default, a switch in a VLAN (with IGMP snooping enabled) that receives a
Bridge Protocol Data Unit (BPDU) with the TC bit set (by the root bridge) willenter into “multicast flooding mode” for a period of time until the topology has
stabilized and the new locations of all multicast receivers are learned.
 If a topology change notification (TCN) is received, and all the uplink ports aresubsequently deleted, a timeout mechanism is used to delete all of thecurrently learned multicast channels.

 When a new uplink port starts up, the switch sends unsolicited reports for all

current learned channels out through the new uplink port.

 By default, the switch immediately enters into “multicast flooding mode” whena spanning tree topology change occurs. In this mode, multicast traffic will be
flooded to all VLAN ports. If many ports have subscribed to different multicast
groups, flooding may cause excessive loading on the link between the switch
and the end host. Flooding may be disabled to avoid this, causing multicast
traffic to be delivered only to those ports on which multicast group members
have been learned.

 When the spanning tree topology changes, the root bridge sends a proxyquery to quickly re-learn the host membership/port relations for multicast
channels. The root bridge also sends an unsolicited Multicast Router Discover(MRD) request to quickly locate the multicast routers in this VLAN.
The proxy query and unsolicited MRD request are flooded to all VLAN ports
except for the receiving port when the switch receives such packets.

ExampleThe following example enables TCN flooding.
Console(config)#ip igmp snooping tcn-flood
Console(config)#– 694 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

ip igmp snooping This command instructs the switch to send out an IGMP general query solicitation
tcn-query-solicit when a spanning tree topology change notification (TCN) occurs. Use the no form
to disable this feature.
Syntax[no] ip igmp snooping tcn-query-solicit
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When the root bridge in a spanning tree receives a topology change
notification for a VLAN where IGMP snooping is enabled, it issues a global IGMP
leave message (query solicitation). When a switch receives this solicitation, it
floods it to all ports in the VLAN where the spanning tree change occurred.
When an upstream multicast router receives this solicitation, it will also
immediately issues an IGMP general query.
 The ip igmp snooping tcn query-solicit command can be used to send aquery solicitation whenever it notices a topology change, even if the switch is
not the root bridge in the spanning tree.

ExampleThe following example instructs the switch to issue an IGMP general query
whenever it receives a spanning tree topology change notification.
Console(config)#ip igmp snooping tcn-query-solicit
Console(config)#

ip igmp snooping This command floods unregistered multicast traffic into the attached VLAN. Use theunregistered-data- no form to drop unregistered multicast traffic.
flood
Syntax[no] ip igmp snooping unregistered-data-flood

Default Setting
Disabled
Command Mode
Global Configuration– 695 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
Command Usage
Once the table used to store multicast entries for IGMP snooping and multicast
routing is filled, no new entries are learned. If no router port is configured in theattached VLAN, and unregistered-flooding is disabled, any subsequent multicast
traffic not found in the table is dropped, otherwise it is flooded throughout the
VLAN.
ExampleConsole(config)#ip igmp snooping unregistered-data-flood
Console(config)#

ip igmp snooping This command specifies how often the upstream interface should transmit
unsolicited-report- unsolicited IGMP reports when report suppression/proxy reporting is enabled. Useinterval the no form to restore the default value.
Syntaxip igmp snooping unsolicited-report-interval seconds
no ip igmp snooping unsolicited-report-interval
seconds - The interval at which to issue unsolicited reports. (Range: 1-65535
seconds)
Default Setting
400 seconds
Command Mode
Global Configuration
Command Usage When a new upstream interface (that is, uplink port) starts up, the switch sends
unsolicited reports for all currently learned multicast channels out through the
new upstream interface.
 This command only applies when report suppression/proxy reporting isenabled (see page 691 and page 690).

ExampleConsole(config)#ip igmp snooping unsolicited-report-interval 5
Console(config)#– 696 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

ip igmp snooping This command configures the IGMP snooping version. Use the no form to restore
version the default.
Syntaxip igmp snooping [vlan vlan-id] version {1 | 2 | 3}
no ip igmp [vlan vlan-id] snooping version
vlan-id - VLAN ID (Range: 1-4094)
1 - IGMP Version 1
2 - IGMP Version 2
3 - IGMP Version 3
Default Setting
Global: IGMP Version 2
VLAN: Not configured, based on global setting
Command Mode
Global Configuration
Command Usage This command configures the IGMP report/query version used by IGMP
snooping. Versions 1 - 3 are all supported, and versions 2 and 3 are backward
compatible, so the switch can operate with other devices, regardless of thesnooping version employed.
 If the IGMP snooping version is configured on a VLAN, this setting takes

precedence over the global configuration.

ExampleThe following configures the global setting for IGMP snooping to version 1.
Console(config)#ip igmp snooping version 1
Console(config)#

ip igmp snooping This command discards any received IGMP messages (except for multicast protocol
version-exclusive packets) which use a version different to that currently configured by the ip igmp
snooping version command. Use the no form to disable this feature.
Syntaxip igmp snooping [vlan vlan-id] version-exclusive
no ip igmp snooping version-exclusivevlan-id - VLAN ID (Range: 1-4094)– 697 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
Default Setting
Global: Disabled
VLAN: Using Global Status
Command Mode
Global Configuration
VLAN Configuration
Command Usage If version exclusive is disabled on a VLAN, then this setting is based on the
global setting. If it is enabled on a VLAN, then this setting takes precedence
over the global setting.
 When this function is disabled, the currently selected version is backward

compatible (see the ip igmp snooping version command.

ExampleConsole(config)#ip igmp snooping version-exclusive
Console(config)#

ip igmp snooping vlan This command suppresses general queries except for ports attached togeneral-query- downstream multicast hosts. Use the no form to flood general queries to all ports
suppression except for the multicast router port.
Syntax[no] ip igmp snooping vlan vlan-id general-query-suppressionvlan-id - VLAN ID (Range: 1-4094)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage By default, general query messages are flooded to all ports, except for themulticast router through which they are received.

 If general query suppression is enabled, then these messages are forwarded

only to downstream ports which have joined a multicast service.

ExampleConsole(config)#ip igmp snooping vlan 1 general-query-suppression
Console(config)#– 698 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

ip igmp snooping vlan This command immediately deletes a member port of a multicast service if a leave
immediate-leave packet is received at that port and immediate-leave is enabled for the parent VLAN.
Use the no form to restore the default.
Syntaxip igmp snooping vlan vlan-id immediate-leave [by-host-ip]
no ip igmp snooping vlan vlan-id immediate-leavevlan-id - VLAN ID (Range: 1-4094)
by-host-ip - Specifies that the member port will be deleted only when
there are no hosts joining this group.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage If immediate-leave is not used, a multicast router (or querier) will send a groupspecific query message when an IGMPv2/v3 group leave message is received.
The router/querier stops forwarding traffic for that group only if no host replies
to the query within the timeout period. (The timeout for this release is definedby Last Member Query Interval (fixed at one second) * Robustness Variable(fixed at 2) as defined in RFC 2236.)
 If immediate-leave is used, the switch assumes that only one host is connectedto the interface. Therefore, immediate leave should only be enabled on aninterface if it is connected to only one IGMP-enabled device, either a service
host or a neighbor running IGMP snooping.

 If the “by-host-ip” option is used, the router/querier will not send out a group-

specific query when an IGMPv2/v3 leave message is received. But will check if
there are other hosts joining the multicast group. Only when all hosts on thatport leave the group will the member port be deleted.

 This command is only effective if IGMP snooping is enabled, and IGMPv2 or

IGMPv3 snooping is used.

ExampleThe following shows how to enable immediate leave.
Console(config)#ip igmp snooping vlan 1 immediate-leave
Console(config)#– 699 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping

ip igmp snooping vlan This command configures the number of IGMP proxy group-specific or group-andlast-memb-query- source-specific query messages that are sent out before the system assumes there
count are no more local members. Use the no form to restore the default.
Syntaxip igmp snooping vlan vlan-id last-memb-query-count countno ip igmp snooping vlan vlan-id last-memb-query-countvlan-id - VLAN ID (Range: 1-4094)
count - The number of proxy group-specific or group-and-source-specificquery messages to issue before assuming that there are no more groupmembers. (Range: 1-255)
Default Setting
2
Command Mode
Global Configuration
Command Usage
This command will take effect only if IGMP snooping proxy reporting or IGMP
querier is enabled (page 690).
ExampleConsole(config)#ip igmp snooping vlan 1 last-memb-query-count 7
Console(config)#

ip igmp snooping vlan This command configures the last-member-query interval. Use the no form tolast-memb-query- restore the default.
intvl
Syntaxip igmp snooping vlan vlan-id last-memb-query-intvl interval
no ip igmp snooping vlan vlan-id last-memb-query-intvl
vlan-id - VLAN ID (Range: 1-4094)
interval - The interval to wait for a response to a group-specific or groupand-source-specific query message. (Range: 1-31744 tenths of a second)
Default Setting
10 (1 second)Command Mode
Global Configuration– 700 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

Command Usage When a multicast host leaves a group, it sends an IGMP leave message. Whenthe leave message is received by the switch, it checks to see if this host is thelast to leave the group by sending out an IGMP group-specific or group-andsource-specific query message, and starts a timer. If no reports are received
before the timer expires, the group record is deleted, and a report is sent to the
upstream multicast router.
 A reduced value will result in reduced time to detect the loss of the last

member of a group or source, but may generate more bursty traffic.

 This command will take effect only if IGMP snooping proxy reporting is enabled(page 690).

ExampleConsole(config)#ip igmp snooping vlan 1 last-memb-query-intvl 700
Console(config)#

ip igmp snooping vlan This command enables sending of multicast router solicitation messages. Use themrd no form to disable these messages.
Syntax[no] ip igmp snooping vlan vlan-id mrd
vlan-id - VLAN ID (Range: 1-4094)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Multicast Router Discovery (MRD) uses multicast router advertisement,
multicast router solicitation, and multicast router termination messages todiscover multicast routers. Devices send solicitation messages in order to solicit
advertisement messages from multicast routers. These messages are used to
discover multicast routers on a directly attached link. Solicitation messages arealso sent whenever a multicast forwarding interface is initialized or reinitialized. Upon receiving a solicitation on an interface with IP multicast
forwarding and MRD enabled, a router will respond with an advertisement.
 Advertisements are sent by routers to advertise that IP multicast forwarding isenabled. These messages are sent unsolicited periodically on all routerinterfaces on which multicast forwarding is enabled. They are sent upon the
expiration of a periodic timer, as a part of a router's start up procedure, during
the restart of a multicast forwarding interface, and on receipt of a solicitation– 701 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
message. When the multicast services provided to a VLAN is relatively stable,
the use of solicitation messages is not required and may be disabled using theno ip igmp snooping vlan mrd command.
 This command may also be used to disable multicast router solicitation

messages when the upstream router does not support MRD, to reduce theloading on a busy upstream router, or when IGMP snooping is disabled in a
VLAN.

ExampleThis example disables sending of multicast router solicitation messages on VLAN 1.
Console(config)#no ip igmp snooping vlan 1 mrd
Console(config)#

ip igmp snooping vlan This command configures a static source address for locally generated query andproxy-address report messages used by IGMP proxy reporting. Use the no form to restore thedefault source address.
Syntaxno ip igmp snooping vlan vlan-id proxy-address source-address
no ip igmp snooping vlan vlan-id proxy-address
vlan-id - VLAN ID (Range: 1-4094)
source-address - The source address used for proxied IGMP query andreport, and leave messages. (Any valid IP unicast address)
Default Setting
0.0.0.0
Command Mode
Global Configuration
Command Usage
IGMP Snooping uses a null IP address of 0.0.0.0 for the source of IGMP query
messages which are proxied to downstream hosts to indicate that it is not theelected querier, but is only proxying these messages as defined in RFC 4541. The
switch also uses a null address in IGMP reports sent to upstream ports.
Many hosts do not implement RFC 4541, and therefore do not understand query
messages with the source address of 0.0.0.0. These hosts will therefore not reply tothe queries, causing the multicast router to stop sending traffic to them.
To resolve this problem, the source address in proxied IGMP query and reportmessages can be replaced with any valid unicast address (other than the router's
own address) using this command.

– 702 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

Rules Used for Proxy Reporting
When IGMP Proxy Reporting is disabled, the switch will use a null IP address for thesource of IGMP query and report messages unless a proxy query address has been
set.
When IGMP Proxy Reporting is enabled, the source address is based on thefollowing criteria:
 If a proxy query address is configured, the switch will use that address as thesource IP address in general and group-specific query messages sent todownstream hosts, and in report and leave messages sent upstream from themulticast router port.

 If a proxy query address is not configured, the switch will use the VLAN’s IP

address as the IP source address in general and group-specific query messages
sent downstream, and use the source address of the last IGMP message
received from a downstream host in report and leave messages sent upstream
from the multicast router port.

ExampleThe following example sets the source address for proxied IGMP query messages to
10.0.1.8.
Console(config)#ip igmp snooping vlan 1 proxy-address 10.0.1.8
Console(config)#

ip igmp snooping vlan This command configures the interval between sending IGMP general queries. Use
query-interval the no form to restore the default.
Syntaxip igmp snooping vlan vlan-id query-interval interval
no ip igmp snooping vlan vlan-id query-intervalvlan-id - VLAN ID (Range: 1-4094)
interval - The interval between sending IGMP general queries.
(Range: 2-31744 seconds)
Default Setting
125 seconds
Command Mode
Global Configuration
Command Usage An IGMP general query message is sent by the switch at the interval specified
by this command. When this message is received by downstream hosts, allreceivers build an IGMP report for the multicast groups they have joined.

– 703 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping This command applies when the switch is serving as the querier (page 692), or

as a proxy host when IGMP snooping proxy reporting is enabled (page 690).

ExampleConsole(config)#ip igmp snooping vlan 1 query-interval 150
Console(config)#

ip igmp snooping vlan This command configures the maximum time the system waits for a response toquery-resp-intvl general queries. Use the no form to restore the default.
Syntaxip igmp snooping vlan vlan-id query-resp-intvl interval
no ip igmp snooping vlan vlan-id query-resp-intvl
vlan-id - VLAN ID (Range: 1-4094)
interval - The maximum time the system waits for a response to generalqueries. (Range: 10-31740 tenths of a second)
Default Setting
100 (10 seconds)
Command Mode
Global Configuration
Command Usage
This command applies when the switch is serving as the querier (page 692), or as aproxy host when IGMP snooping proxy reporting is enabled (page 690).
ExampleConsole(config)#ip igmp snooping vlan 1 query-resp-intvl 20
Console(config)#– 704 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

ip igmp snooping vlan This command adds a port to a multicast group. Use the no form to remove thestatic port.
Syntax[no] ip igmp snooping vlan vlan-id static ip-address interfacevlan-id - VLAN ID (Range: 1-4094)
ip-address - IP address for multicast groupinterfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
uplink - specifies an
Default Setting
None
Command Mode
Global Configuration
Command Usage Static multicast entries are never aged out.
 When a multicast entry is assigned to an interface in a specific VLAN, thecorresponding traffic can only be forwarded to ports within that VLAN.

ExampleThe following shows how to statically configure a multicast group on a port.
Console(config)#ip igmp snooping vlan 1 static 228.0.0.15 ethernet 1/5
Console(config)#

clear ip igmp This command clears multicast group information dynamically learned throughsnooping groups IGMP snooping.
dynamic
Syntaxclear ip igmp snooping groups dynamic
Command Mode
Privileged Exec

– 705 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
Command Usage
This command only clears entries learned though IGMP snooping. Staticallyconfigured multicast address are not cleared.
ExampleConsole#clear ip igmp snooping groups dynamic
Console#clear ip igmp This command clears IGMP snooping statistics.
snooping statistics
Syntaxclear ip igmp snooping statistics [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN identifier (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#clear ip igmp snooping statistics
Console#show ip igmp This command shows the IGMP snooping, proxy, and query configuration settings.
snooping
Syntaxshow ip igmp snooping [vlan vlan-id]
vlan-id - VLAN ID (1-4094)
Command Mode
Privileged Exec
Command Usage
This command displays global and VLAN-specific IGMP configuration settings.

– 706 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

ExampleThe following shows the current IGMP snooping configuration:
Console#show ip igmp snooping
IGMP Snooping
Router Port Expire Time
Router Alert Check
Router Port ModeTCN Flood
TCN Query Solicit
Unregistered Data Flood
802.1p Forwarding Priority
Unsolicited Report Interval
Version Exclusive
VersionProxy Reporting
Report Suppression
Querier: Disabled: 300 s: Disabled: Forward: Disabled: Disabled: Disabled: Disabled: 400 s: Disabled: 2: Disabled: Disabled: Disabled

VLAN 1:-------IGMP Snooping
IGMP Snooping Running Status
VersionVersion Exclusive
Immediate Leave
Last Member Query Interval
Last Member Query Count
General Query Suppression
Query Interval
Query Response Interval
Proxy Query Address
Proxy Reporting
Report Suppression
Multicast Router Discovery: Disabled: Inactive: Using global Version (2): Using global status (Disabled): Disabled: 10 (unit: 1/10s): 2: Disabled: 125: 100 (unit: 1/10s): 0.0.0.0: Using global status (Disabled): Using global status (Disabled): Disabled

VLAN Static GroupPort
M: static group is for member port
U: static group is for uplink---- --------------- -------1
224.1.1.1
Eth 1/ 1(M).
.

show ip igmp This command shows known multicast group, source, and host port mappings forsnooping group the specified VLAN interface, or for all interfaces if none is specified.
Syntaxshow ip igmp snooping group [host-ip-addr [ip-address | interface [ipaddress] | vlan-id [interface [ip-address]] | igmpsnp | sort-by-port [ip-address |interface [ip-address] | vlan-id [interface [ip-address]] | user | vlan vlan-id[user | igmpsnp]]
ip-address - IP address for multicast group– 707 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
igmpsnp - Display only entries learned through IGMP snooping.
sort-by-port - Display entries sorted by port.
user - Display only the user-configured multicast entries.
vlan-id - VLAN ID (1-4094)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Member types displayed include IGMP or USER, depending on selected options.
ExampleThe following shows the multicast entries learned through IGMP snooping for
VLAN 1.
Console#show ip igmp snooping group vlan 1
Bridge Multicast Forwarding Entry Count:1
Flag: R - Router port, M - Group member port
H - Host counts (number of hosts join the group on this port).
P - Port counts (number of ports join the group).
Up time: Group elapsed time (d:h:m:s).
Expire : Group remaining time (m:s).
VLAN GroupPort
Up timeExpire Count---- --------------- ----------- ----------- ------ -------1 224.1.1.1
00:00:00:37
2(P)Eth 1/ 1(R)Eth 1/ 2(M)0(H)
Console#show ip igmp This command displays information on statically configured and dynamicallysnooping mrouter learned multicast router ports.
Syntaxshow ip igmp snooping mrouter [vlan vlan-id]
vlan-id - VLAN ID (Range: 1-4094)– 708 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

Default Setting
Displays multicast router ports for all configured VLANs.
Command Mode
Privileged Exec
Command Usage
Multicast router port types displayed include Static or Dynamic.
ExampleThe following shows the ports in VLAN 1 which are attached to multicast routers.
Console#show ip igmp snooping mrouter vlan 1
VLAN M'cast Router Port Type
Expire---- ------------------ ------- -------1
Eth 1/4
Dynamic 0:4:28
1
Eth 1/10
StaticConsole#show ip igmp This command shows IGMP snooping protocol statistics for the specified interface.
snooping statistics
Syntaxshow ip igmp snooping statistics{input [interface interface] |output [interface interface] |query [vlan vlan-id]}
input - Specifies to display statistics for messages received by the interface.
output - Specifies to display statistics for messages sent by the interface.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN ID (Range: 1-4094)
query - Displays IGMP snooping-related statistics.
Default Setting
None
Command Mode
Privileged Exec

– 709 –

Chapter 27 | Multicast Filtering Commands
IGMP Snooping
ExampleThe following shows IGMP protocol statistics input:
Console#show ip igmp snooping statistics input interface ethernet 1/1
Input Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Join Succ Group--------- -------- -------- -------- ------------- -------- --------- -----Eth 1/ 1
23
11
4
10
5
14
5
Console#Table 136: show ip igmp snooping statistics input - display description
Field

Description

InterfaceShows interface.

Report

The number of IGMP membership reports received on this interface.

Leave

The number of leave messages received on this interface.

G Query

The number of general query messages received on this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query
messages received on this interface.

Drop

The number of times a report, leave or query was dropped. Packets may
be dropped due to invalid format, rate limiting, or packet content notallowed.

Join Succ

The number of times a multicast group was successfully joined.

Group

The number of multicast groups active on this interface.

The following shows IGMP protocol statistics output:
Console#show ip igmp snooping statistics output interface ethernet 1/1
Output Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Group---------- -------- -------- -------- ------------- -------- -----Eth 1/ 1
12
0
1
0
0
0
Console#Table 137: show ip igmp snooping statistics output - display description
Field

Description

InterfaceShows interface.

Report

The number of IGMP membership reports sent from this interface.

Leave

The number of leave messages sent from this interface.

G Query

The number of general query messages sent from this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query
messages sent from this interface.

– 710 –

Chapter 27 | Multicast Filtering Commands

IGMP Snooping

Table 137: show ip igmp snooping statistics output - display description
Field

Description

Drop

The number of times a report, leave or query was dropped. Packets may
be dropped due to invalid format, rate limiting, or packet content notallowed.

Group

The number of multicast groups active on this interface.

The following shows IGMP query-related statistics for VLAN 1:
Console#show ip igmp snooping statistics query vlan 1
Other Querier: NoneOther Querier Expire: 0(m):0(s)Other Querier Uptime: 0(h):0(m):0(s)Self Querier: 192.168.2.12
Self Querier Expire: 0(m):0(s)Self Querier Uptime: 0(h):0(m):0(s)General Query Received: 0
General Query Sent
: 0
Specific Query Received: 0
Specific Query Sent
: 0
Warn Rate Limit: 0 sec.
V1 Warning Count: 0
V2 Warning Count: 0
V3 Warning Count: 0
Console#Table 138: show ip igmp snooping statistics vlan query - display description
Field

Description

Other Querier

IP address of remote querier on this interface.

Other Querier Expire

Time after which remote querier is assumed to have expired.

Other Querier Uptime

Time remote querier has been up.

Self Querier

IP address of local querier on this interface.

Self Querier Expire

Time after which local querier is assumed to have expired.

Self Querier Uptime

Time local querier has been up.

General Query Received

The number of general queries received on this interface.

General Query Sent

The number of general queries sent from this interface.

Specific Query Received

The number of specific queries received on this interface.

Specific Query Sent

The number of specific queries sent from this interface.

Warn Rate Limit

The rate at which received query messages of the wrong version typecause the Vx warning count to increment. Note that “0 sec” means that
the Vx warning count is incremented for each wrong message version
received.

V1 Warning CountThe number of times the query version received (Version 1) does notmatch the version configured for this interface.

– 711 –

Chapter 27 | Multicast Filtering Commands
Static Multicast Routing
Table 138: show ip igmp snooping statistics vlan query - display description
Field

Description

V2 Warning CountThe number of times the query version received (Version 2) does notmatch the version configured for this interface.

V3 Warning CountThe number of times the query version received (Version 3) does notmatch the version configured for this interface.

Static Multicast RoutingThis section describes commands used to configure static multicast routing on
the switch.
Table 139: Static Multicast Interface Commands
CommandFunctionMode

ip igmp snooping vlanmrouter

Adds a multicast router portGC

show ip igmp snooping
mrouterShows multicast router portsPE

ip igmp snooping vlan This command statically configures a (Layer 2) multicast router port on the
mrouter specified VLAN. Use the no form to remove the configuration.
Syntax[no] ip igmp snooping vlan vlan-id mrouter interfacevlan-id - VLAN ID (Range: 1-4094)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
No static multicast router ports are configured.
Command Mode
Global Configuration
Command Usage Depending on your network connections, IGMP snooping may not always beable to locate the IGMP querier. Therefore, if the IGMP querier is a known
multicast router or switch connected over the network to an interface (port or– 712 –

Chapter 27 | Multicast Filtering Commands

IGMP Filtering and Throttlingtrunk) on this switch, that interface can be manually configured to join all thecurrent multicast groups.
 IGMP Snooping must be enabled globally on the switch (using the ip igmp

snooping command) before a multicast router port can take effect.

ExampleThe following shows how to configure port 10 as a multicast router port within VLAN
1.
Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/10
Console(config)#

IGMP Filtering and Throttling
In certain switch applications, the administrator may want to control the multicast
services that are available to end users. For example, an IP/TV service based on a
specific subscription plan. The IGMP filtering feature fulfills this requirement by
restricting access to specified multicast services on a switch port, and IGMP
throttling limits the number of simultaneous multicast groups a port can join.
Table 140: IGMP Filtering and Throttling Commands
CommandFunctionMode

ip igmp filter

Enables IGMP filtering and throttling on the switchGC

ip igmp profile

Sets a profile number and enters IGMP filter profile
configuration modeGC

permit, denySets a profile access mode to permit or deny

IPC

range

Specifies one or a range of multicast addresses for a profile IPC

ip igmp authentication

Enables RADIUS authentication for IGMP JOIN requests.

IC

ip igmp filter

Assigns an IGMP filter profile to an interfaceIC

ip igmp max-groups

Specifies an IGMP throttling number for an interfaceIC

ip igmp max-groups action Sets the IGMP throttling action for an interfaceIC

ip igmp query-drop

Drops any received IGMP query packetsIC

ip multicast-data-drop

Drops all multicast data packets

ICshow ip igmp
authentication

Displays IGMP authentication settings for interfaces

PEshow ip igmp filter

Displays the IGMP filtering statusPE

show ip igmp profile

Displays IGMP profiles and settingsPEshow ip igmp query-drop

Shows if the interface is configured to drop IGMP query
packetsPE– 713 –

Chapter 27 | Multicast Filtering Commands
IGMP Filtering and Throttling
Table 140: IGMP Filtering and Throttling Commands (Continued)
CommandFunctionModeshow ip igmp throttleinterface

Displays the IGMP throttling setting for interfaces

PEshow ip multicast-datadrop

Shows if the interface is configured to drop multicast data PE
packets

ip igmp filter This command globally enables IGMP filtering and throttling on the switch. Use the(Global Configuration) no form to disable the feature.

Syntax[no] ip igmp filter
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage IGMP filtering enables you to assign a profile to a switch port that specifies
multicast groups that are permitted or denied on the port. An IGMP filter profile
can contain one or more, or a range of multicast addresses; but only one profile
can be assigned to a port. When enabled, IGMP join reports received on theport are checked against the filter profile. If a requested multicast group ispermitted, the IGMP join report is forwarded as normal. If a requested multicast
group is denied, the IGMP join report is dropped.
 IGMP filtering and throttling only applies to dynamically learned multicast

groups, it does not apply to statically configured groups.

 The IGMP filtering feature operates in the same manner when MVR is used toforward multicast traffic.

ExampleConsole(config)#ip igmp filter
Console(config)#– 714 –

Chapter 27 | Multicast Filtering Commands

IGMP Filtering and Throttling

ip igmp profile This command creates an IGMP filter profile number and enters IGMP profile
configuration mode. Use the no form to delete a profile number.
Syntax[no] ip igmp profile profile-number
profile-number - An IGMP filter profile number. (Range: 1-4294967295)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
A profile defines the multicast groups that a subscriber is permitted or denied tojoin. The same profile can be applied to many interfaces, but only one profile canbe assigned to one interface. Each profile has only one access mode; either permit
or deny.
ExampleConsole(config)#ip igmp profile 19
Console(config-igmp-profile)#

permit, deny This command sets the access mode for an IGMP filter profile.
Syntax{permit | deny}
Default Setting
DenyCommand Mode
IGMP Profile Configuration
Command Usage Each profile has only one access mode; either permit or deny.
 When the access mode is set to permit, IGMP join reports are processed when amulticast group falls within the controlled range. When the access mode is set
to deny, IGMP join reports are only processed when a multicast group is not in
the controlled range.

– 715 –

Chapter 27 | Multicast Filtering Commands
IGMP Filtering and Throttling
ExampleConsole(config)#ip igmp profile 19
Console(config-igmp-profile)#permit
Console(config-igmp-profile)#

range This command specifies multicast group addresses for a profile. Use the no form todelete addresses from a profile.
Syntax[no] range low-ip-address high-ip-address
low-ip-address - A valid IP address of a multicast group or start of a group
range.
high-ip-address - A valid IP address for the end of a multicast group range.
Default Setting
None
Command Mode
IGMP Profile Configuration
Command UsageEnter this command multiple times to specify more than one multicast address oraddress range for a profile.
ExampleConsole(config)#ip igmp profile 19
Console(config-igmp-profile)#range 239.2.3.1 239.2.3.100
Console(config-igmp-profile)#

ip igmp This command enables IGMP authentication on the specified interface. Whenauthentication enabled and an IGMP JOIN request is received, an authentication request is sent toa configured RADIUS server. Use the no form to disable IGMP authentication.
Syntax[no] ip igmp authentication
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)– 716 –

Chapter 27 | Multicast Filtering Commands

IGMP Filtering and Throttling

Command Usage If IGMP authentication is enabled on an interface, and a join report is received
on the interface, the switch will send an access request to the RADIUS server toperform authentication.
 Only when the RADIUS server responds with an authentication successmessage will the switch learn the group report. Once the group is learned, theswitch will not send an access request to the RADIUS server when receiving thesame report again within a one (1) day period.

 If the RADIUS server responds that authentication failed or the timer expires,the report will be dropped and the group will not be learned. The entry (hostMAC, port number, VLAN ID, and group IP) will be put in the “authentication
failed list”.

 The “authentication failed list” is valid for the period of the interval defined by

the command ip igmp snooping vlan query-interval. When receiving the same
report during this interval, the switch will not send the access request to the
RADIUS server.

 If the interface leaves the group and subsequently rejoins the same group, thejoin report needs to again be authenticated.

 When receiving an IGMP v3 report message, the switch will send the accessrequest to the RADIUS server only when the record type is either IS_EX or
TO_EX, and the source list is empty. Other types of packets will not initiate
RADIUS authentication.

IS_EX (MODE_IS_EXCLUDE) - Indicates that the interface’s filter mode is
EXCLUDE for the specified multicast address. The Source Address fields in thisGroup Record contain the interface's source list for the specified multicast
address, if not empty.
TO_EX (CHANGE_TO_EXCLUDE_MODE) - Indicates that the interface haschanged to EXCLUDE filter mode for the specified multicast address. The
Source Address fields in this Group Record contain the interface's new source
list for the specified multicast address, if not empty.
 When a report is received for the first time and is being authenticated, whether

authentication succeeds or fails, the report will still be sent to the multicastrouter port.

 The following table shows the RADIUS server Attribute Value Pairs used forauthentication:

Table 141: IGMP Authentication RADIUS Attribute Value Pairs
Attribute Name

AVP Type

Entry

USER_NAME

1

User MAC address

USER_PASSWORD

2User MAC address

NAS_IP_ADDRESS

4

Switch IP address– 717 –

Chapter 27 | Multicast Filtering Commands
IGMP Filtering and Throttling
Table 141: IGMP Authentication RADIUS Attribute Value Pairs
Attribute Name

AVP Type

Entry

NAS_PORT

5

User Port Number

FRAMED_IP_ADDRESS

8Multicast Group ID

ExampleThis example shows how to enable IGMP Authentication on all of the switch’s
Ethernet interfaces.
Console(config)#interface ethernet 1/1-28
Console(config-if)#ip igmp authentication
Console#Related Commands
show ip igmp authentication

ip igmp filter This command assigns an IGMP filtering profile to an interface on the switch. Use(Interface Configuration) the no form to remove a profile from an interface.

Syntaxip igmp filter profile-number
no ip igmp filter
profile-number - An IGMP filter profile number. (Range: 1-4294967295)
Default Setting
None
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage The IGMP filtering profile must first be created with the ip igmp profile
command before being able to assign it to an interface.
 Only one profile can be assigned to an interface.
 A profile can also be assigned to a trunk interface. When ports are configured as

trunk members, the trunk uses the filtering profile assigned to the first port
member in the trunk.

– 718 –

Chapter 27 | Multicast Filtering Commands

IGMP Filtering and Throttling

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip igmp filter 19
Console(config-if)#

ip igmp max-groups This command sets the IGMP throttling number for an interface on the switch. Use
the no form to restore the default setting.
Syntaxip igmp max-groups number
no ip igmp max-groups
number - The maximum number of multicast groups an interface can join at
the same time. (Range: 1-1024)
Default Setting
1024
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage IGMP throttling sets a maximum number of multicast groups that a port canjoin at the same time. When the maximum number of groups is reached on aport, the switch can take one of two actions; either “deny” or “replace” (see theip igmp max-groups action command). If the action is set to deny, any new
IGMP join reports will be dropped. If the action is set to replace, the switch
randomly removes an existing group and replaces it with the new multicast
group.
 IGMP throttling can also be set on a trunk interface. When ports are configured

as trunk members, the trunk uses the throttling settings of the first port
member in the trunk.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip igmp max-groups 10
Console(config-if)#– 719 –

Chapter 27 | Multicast Filtering Commands
IGMP Filtering and Throttling

ip igmp This command sets the IGMP throttling action for an interface on the switch. Use
max-groups action the no form of the command to restore the action to the default value.
Syntaxip igmp max-groups action {deny | replace}no ip igmp max-groups action
deny - The new multicast group join report is dropped.
replace - The new multicast group replaces an existing group.
Default Setting
DenyCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
When the maximum number of groups is reached on a port, the switch can takeone of two actions; either “deny” or “replace.” If the action is set to deny, any new
IGMP join reports will be dropped. If the action is set to replace, the switch
randomly removes an existing group and replaces it with the new multicast group.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip igmp max-groups action replace
Console(config-if)#

ip igmp query-drop This command drops any received IGMP query packets. Use the no form to restore
the default setting.
Syntax[no] ip igmp query-drop [vlan vlan-id]
vlan-id - VLAN ID (Range: 1-4094)
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This command can be used to drop any query packets received on the specified
interface. If this switch is acting as a Querier, this prevents it from being affected bymessages received from another Querier.

– 720 –

Chapter 27 | Multicast Filtering Commands

IGMP Filtering and Throttling

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip igmp query-drop
Console(config-if)#

ip multicast-data-drop This command drops all multicast data packets. Use the no form to disable thisfeature.

Syntax[no] ip multicast-data-drop
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This command can be used to stop multicast services from being forwarded tousers attached to the downstream port (i.e., the interfaces specified by thiscommand).
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ip multicast-data-drop
Console(config-if)#show ip igmp This command displays the interface settings for IGMP authentication.
authentication
Syntaxshow ip igmp authentication interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
– 721 –

Chapter 27 | Multicast Filtering Commands
IGMP Filtering and Throttling
Command Usage
Using this command without specifying an interface displays information for all
interfaces.
ExampleConsole#show ip igmp authentication
Ethernet 1/1: Enabled
Ethernet 1/2: Enabled
Ethernet 1/3: Enabled.
.
.
Ethernet 1/27: Enabled
Ethernet 1/28: Enabled
Other ports/port channels are Disable
Console#show ip igmp filter This command displays the global and interface settings for IGMP filtering.
Syntaxshow ip igmp filter [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show ip igmp filter
IGMP Filter enabled
Console#show ip igmp filter interface ethernet 1/1
Ethernet 1/1 information--------------------------------IGMP Profile 19
Deny
Range 239.1.1.1 239.1.1.1
Range 239.2.3.1 239.2.3.100
Console#– 722 –

Chapter 27 | Multicast Filtering Commands

IGMP Filtering and Throttlingshow ip igmp profile This command displays IGMP filtering profiles created on the switch.
Syntaxshow ip igmp profile [profile-number]profile-number - An existing IGMP filter profile number.
(Range: 1-4294967295)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show ip igmp profile
IGMP Profile 19
Deny
Range 239.1.1.1
239.1.1.1
Range 239.2.3.1
239.2.3.100
IGMP Profile 50
Deny
Range 239.1.1.1
239.1.1.12
Console#show ip igmp profile 19
IGMP Profile 19
Deny
Range 239.1.1.1
239.1.1.1
Range 239.2.3.1
239.2.3.100
Console#show ip igmp This command shows if the specified interface is configured to drop IGMP query
query-drop packets.
Syntaxshow ip igmp query-drop [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec

– 723 –

Chapter 27 | Multicast Filtering Commands
IGMP Filtering and Throttling
Command Usage
Using this command without specifying an interface displays the query drop
configuration for all interfaces.
ExampleConsole#show ip igmp query-drop interface ethernet 1/1
Ethernet 1/1: Enabled
Console#show ip igmp throttle This command displays the interface settings for IGMP throttling.
interface
Syntaxshow ip igmp throttle interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Using this command without specifying an interface displays information for all
interfaces.
ExampleConsole#show ip igmp throttle interface ethernet 1/1
Eth 1/1 Information
Status : FALSE
Action : Deny
Max Multicast Groups : 1024
Current Multicast Groups : 0
Console#– 724 –

Chapter 27 | Multicast Filtering Commands

MLD Snoopingshow ip This command shows if the specified interface is configured to drop multicast data
multicast-data-drop packets.
Syntaxshow ip multicast-data-drop [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Using this command without specifying an interface displays information for all
interfaces.
ExampleConsole#show ip multicast-data-drop interface ethernet 1/1
Ethernet 1/1: Enabled
Console#MLD Snooping
Multicast Listener Discovery (MLD) snooping operates on IPv6 traffic and performs
a similar function to IGMP snooping for IPv4. That is, MLD snooping dynamicallyconfigures switch ports to limit IPv6 multicast traffic so that it is forwarded only toports with users that want to receive it. This reduces the flooding of IPv6 multicast
packets in the specified VLANs.
There are two versions of the MLD protocol, version 1 and version 2. MLDv1 control
packets include Listener Query, Listener Report, and Listener Done messages(equivalent to IGMPv2 query, report, and leave messages). MLDv2 control packets
include MLDv2 query and report messages, as well as MLDv1 report and done
messages.
Remember that IGMP Snooping and MLD Snooping are independent functions,and can therefore both function at the same time.

– 725 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
Table 142: MLD Snooping Commands
CommandFunctionMode

ipv6 mld snooping

Enables MLD Snooping globallyGC

ipv6 mld snooping
proxy-reporting

Enables MLD Snooping with Proxy ReportingGC

ipv6 mld snooping querier

Allows the switch to act as the querier for MLD snoopingGC

ipv6 mld snooping
query-interval

Configures the interval between sending MLD generalquery messages

GC

ipv6 mld snooping querymax-response-time

Configures the maximum response time for a generalqueriesGC

ipv6 mld snooping
robustness

Configures the robustness variableGC

ipv6 mld snooping
router-port-expire-time

Configures the router port expire timeGC

ipv6 mld snooping
unknown-multicast mode

Sets an action for unknown multicast packets

GC

ipv6 mld snooping
unsolicited-report-intervalSpecifies how often the upstream interface should
transmit unsolicited MLD snooping reports (when proxy
reporting is enabled)GC

ipv6 mld snooping version

Configures the MLD Snooping version

GC

ipv6 mld snooping vlan
immediate-leave

Removes a member port of an IPv6 multicast service if aleave packet is received at that port and MLD immediateleave is enabled for the parent VLAN

GC

ipv6 mld snooping vlanmrouter

Adds an IPv6 multicast router port

GC

ipv6 mld snooping vlan
staticAdds an interface as a member of a multicast group

GC

clear ipv6 mld snoopinggroups dynamic

Clears multicast group information dynamically learned
through MLD snoopingPE

clear ipv6 mld snooping
statistics

Clears MLD snooping statistics

PEshow ipv6 mld snooping

Displays MLD Snooping configuration

PEshow ipv6 mld snooping
group

Displays the learned groups

PEshow ipv6 mld snoopinggroup source-list

Displays the learned groups and corresponding source list PE

show ipv6 mld snooping
mrouter

Displays the information of multicast router portsPEshow ipv6 mld snooping
statistics

Shows IGMP snooping protocol statistics for the specified
interfacePE– 726 –

Chapter 27 | Multicast Filtering Commands

MLD Snooping

ipv6 mld snooping This command enables MLD Snooping globally on the switch. Use the no form todisable MLD Snooping.
Syntax[no] ipv6 mld snooping
Default Setting
Disabled
Command Mode
Global Configuration
ExampleThe following example enables MLD Snooping:
Console(config)#ipv6 mld snooping
Console(config)#

ipv6 mld snooping This command enables MLD Snooping with Proxy Reporting. Use the no form toproxy-reporting restore the default setting.
Syntax[no] ipv6 mld snooping proxy-reporting
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage When proxy reporting is enabled with this command, reports received fromdownstream hosts are summarized and used to build internal membershipstates. Proxy-reporting devices may use the IPv6 address configured on thisVLAN or Source IP address from received report message as source addresswhen forwarding any summarized reports upstream.
ExampleConsole(config)#ipv6 mld snooping proxy-reporting
Console(config)#– 727 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping

ipv6 mld snooping This command allows the switch to act as the querier for MLDv2 snooping. Use thequerier no form to disable this feature.
Syntax[no] ipv6 mld snooping querier
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible
for asking hosts if they want to receive multicast traffic.
 An IPv6 address must be configured on the VLAN interface from which thequerier will act if elected. When serving as the querier, the switch uses its own
IPv6 address as the query source address.

 The querier will not start or will disable itself after having started if it detects an

IPv6 multicast router on the network.

ExampleConsole(config)#ipv6 mld snooping querier
Console(config)#

ipv6 mld snooping This command configures the interval between sending MLD general queries. Use
query-interval the no form to restore the default.
Syntaxipv6 mld snooping query-interval interval
no ipv6 mld snooping query-intervalinterval - The interval between sending MLD general queries.
(Range: 60-125 seconds)
Default Setting
125 seconds
Command Mode
Global Configuration
Command Usage This command applies when the switch is serving as the querier.

– 728 –

Chapter 27 | Multicast Filtering Commands

MLD Snooping An MLD general query message is sent by the switch at the interval specified bythis command. When this message is received by downstream hosts, allreceivers build an MLD report for the multicast groups they have joined.

ExampleConsole(config)#ipv6 mld snooping query-interval 150
Console(config)#

ipv6 mld snooping This command configures the maximum response time advertised in MLD generalquery-max-response- queries. Use the no form to restore the default.
time
Syntaxipv6 mld snooping query-max-response-time seconds
no ipv6 mld snooping query-max-response-time
seconds - The maximum response time allowed for MLD general queries.
(Range: 5-25 seconds)
Default Setting
10 seconds
Command Mode
Global Configuration
Command Usage
This command controls how long the host has to respond to an MLD Querymessage before the switch deletes the group if it is the last member.
ExampleConsole(config)#ipv6 mld snooping query-max-response-time 15
Console(config)#

ipv6 mld snooping This command configures the MLD Snooping robustness variable. Use the no form
robustness to restore the default value.
Syntaxipv6 mld snooping robustness value
no ipv6 mld snooping robustness
value - The number of the robustness variable. (Range: 2-10)
Default Setting
2– 729 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
Command Mode
Global Configuration
Command Usage
A port will be removed from the receiver list for a multicast service when no MLD
reports are detected in response to a number of MLD queries. The robustness
variable sets the number of queries on ports for which there is no report.
ExampleConsole(config)#ipv6 mld snooping robustness 2
Console(config)#

ipv6 mld snooping This command configures the MLD query timeout. Use the no form to restore therouter-port- default.
expire-time
Syntaxipv6 mld snooping router-port-expire-time time
no ipv6 mld snooping router-port-expire-timetime - Specifies the timeout of a dynamically learned router port.
(Range: 300-500 seconds)
Default Setting
300 seconds
Command Mode
Global Configuration
Command Usage
The router port expire time is the time the switch waits after the previous querierstops before it considers the router port (i.e., the interface that had been receiving
query packets) to have expired.
ExampleConsole(config)#ipv6 mld snooping router-port-expire-time 300
Console(config)#– 730 –

Chapter 27 | Multicast Filtering Commands

MLD Snooping

ipv6 mld snooping This command sets the action for dealing with unknown multicast packets. Use theunknown-multicast no form to restore the default.
mode
Syntaxipv6 mld snooping unknown-multicast mode {flood | to-router-port}
no ipv6 mld snooping unknown-multicast mode
flood - Floods the unknown multicast data packets to all ports.
to-router-port - Forwards the unknown multicast data packets to router
ports.
Default Setting
to-router-port
Command Mode
Global Configuration
Command Usage When set to “flood,” any received IPv6 multicast packets that have not beenrequested by a host are flooded to all ports in the VLAN.
 When set to “router-port,” any received IPv6 multicast packets that have notbeen requested by a host are forwarded to ports that are connected to a
detected multicast router.

ExampleConsole(config)#ipv6 mld snooping unknown-multicast mode flood
Console(config)#

ipv6 mld snooping This command specifies how often the upstream interface should transmit
unsolicited-report- unsolicited MLD snooping reports when proxy reporting is enabled. Use the nointerval form to restore the default value.
Syntaxipv6 mld snooping unsolicited-report-interval seconds
no ipv6 mld snooping unsolicited-report-interval
seconds - The interval at which to issue unsolicited reports.
(Range: 1-65535 seconds)
Default Setting
400 seconds
Command Mode
Global Configuration– 731 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
Command Usage When a new upstream interface (that is, uplink port) starts up, the switch sends
unsolicited reports for all currently learned multicast channels out through the
new upstream interface.
 This command only applies when ipv6 mld snooping proxy-reporting isenabled.

ExampleConsole(config)#ipv6 mld snooping unsolicited-report-interval 5
Console(config)#

ipv6 mld snooping This command configures the MLD snooping version. Use the no form to restore
version the default.
Syntaxipv6 mld snooping version {1 | 2}
no ipv6 mld snooping version
1 - MLD version 1.
2 - MLD version 2.
Default Setting
Version 1
Command Mode
Global Configuration
ExampleConsole(config)#ipv6 mld snooping version 2
Console(config)#

ipv6 mld snooping This command immediately deletes a member port of an IPv6 multicast service
vlan immediate-leave when a leave packet is received at that port and immediate-leave is enabled for theparent VLAN. Use the no form to restore the default.
Syntaxipv6 mld snooping vlan vlan-id immediate-leave [by-host-ip]
no ipv6 mld snooping vlan vlan-id immediate-leave– 732 –

Chapter 27 | Multicast Filtering Commands

MLD Snooping

vlan-id - VLAN ID (Range: 1-4094)
by-host-ip - Specifies that the member port will be deleted only when
there are no hosts joining this group.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage If MLD immediate-leave is not used, a multicast router (or querier) will send agroup-specific query message when an MLD group leave message is received.
The router/querier stops forwarding traffic for that group only if no host replies
to the query within the specified timeout period.
 If MLD immediate-leave is enabled, the switch assumes that only one host isconnected to the interface. Therefore, immediate leave should only be enabledon an interface if it is connected to only one MLD-enabled device, either aservice host or a neighbor running MLD snooping.

 If the “by-host-ip” option is used, the router/querier will not send out a group-

specific query when an MLD leave message is received, but will check if there
are other hosts joining the multicast group. Only when all hosts on that port
leave the group will the member port be deleted.

ExampleThe following shows how to enable MLD immediate leave.
Console(config)#ipv6 mld snooping vlan 1 immediate-leave
Console(config)#

ipv6 mld snooping This command statically configures an IPv6 multicast router port. Use the no form
vlan mrouter to remove the configuration.
Syntax[no] ipv6 mld snooping vlan vlan-id mrouter interfacevlan-id - VLAN ID (Range: 1-4094)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)– 733 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
Default Setting
No static multicast router ports are configured.
Command Mode
Global Configuration
Command Usage
Depending on your network connections, MLD snooping may not always be able
to locate the MLD querier. Therefore, if the MLD querier is a known multicast router/switch connected over the network to an interface (port or trunk) on the switch,
you can manually configure that interface to join all the current multicast groups.
ExampleThe following shows how to configure port 1 as a multicast router port within VLAN
1:Console(config)#ipv6 mld snooping vlan 1 mrouter ethernet 1/1
Console(config)#

ipv6 mld snooping This command adds a port to an IPv6 multicast group. Use the no form to remove
vlan static the port.
Syntax[no] ipv6 mld snooping vlan vlan-id static ipv6-address interface
vlan - VLAN ID (Range: 1-4094)
ipv6-address - An IPv6 address of a multicast group. (Format: X:X:X:X::X)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#ipv6 mld snooping vlan 1 static ff05:0:1:2:3:4:5:6 ethernet
1/6
Console(config)#– 734 –

Chapter 27 | Multicast Filtering Commands

MLD Snooping

clear ipv6 mld This command clears multicast group information dynamically learned throughsnooping groups MLD snooping.
dynamic
Syntaxclear ipv6 mld snooping groups dynamic
Command Mode
Privileged Exec
Command Usage
This command only clears entries learned though MLD snooping. Staticallyconfigured multicast address are not cleared.
ExampleConsole#clear ipv6 mld snooping groups dynamic
Console#clear ipv6 mld This command clears MLD snooping statistics.
snooping statistics
Syntaxclear ipv6 mld snooping statistics [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN identifier (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#clear ipv6 mld snooping statistics
Console#– 735 –

Chapter 27 | Multicast Filtering Commands
MLD Snoopingshow ipv6 This command shows the current global MLD Snooping configuration and can be
mld snooping used with the vlan keyword to show the VLAN specific configuration.
Syntaxshow ipv6 mld snooping [vlan [vlan-id]]vlan vlan-id - VLAN ID (1-4094)
Command Mode
Privileged Exec
Command Usage
This command displays global and VLAN-specific MLD snooping configuration
settings.
ExampleThe following shows MLD Snooping configuration information using the global
form of the command first and then the command is executed with keyword vlan
to show specific VLAN MLD configuration.
Console#show ipv6 mld snooping
Service Status: Disabled
Proxy Reporting: Disabled
Querier Status: Disabled
Robustness: 2
Query Interval: 125 sec
Query Max Response Time
: 10 sec
Router Port Expiry Time
: 300 sec
Unsolicit Report Interval: 400 sec
Immediate Leave: Disabled on all VLAN
Immediate Leave By Host
: Disabled on all VLAN
Unknown Flood Behavior: To Router Port
MLD Snooping Version: Version 2
VLAN Group IPv6 AddressPort---- --------------------------------------- --------1
ff05:0:1:2:3:4:5:6 Eth 1/1
Console#show ipv6 mld snooping vlan
VLAN 1
Immediate Leave: Disabled
Unknown Flood Behavior : To Router Port
Console#– 736 –

Chapter 27 | Multicast Filtering Commands

MLD Snoopingshow ipv6 mld This command shows known multicast groups, member ports, and the means bysnooping group which each group was learned.
Syntaxshow ipv6 mld snooping group [mld-group | host-ip-addr | sort-by-port |vlan vlan-id]
mld-group - X:X:X:X::X show only the groups by the specified IPv6
address
host-ip-addr - Displays the ip address of the subscribers of each group.
sort-by-port - Displays groups sorted by port number.
vlan vlan-id - VLAN ID (1-4094), displays the groups of the specified
VLAN.
Command Mode
Privileged Exec
ExampleThe following shows MLD Snooping group configuration information:
Console#show ipv6 mld snooping group
Total Entries 3, limit 255
VLAN Multicast IPv6 Address
Member Port Type---- --------------------------------------- ----------- --------------1
FF02::01:01:01:01 Eth 1/1
MLD Snooping
1
FF02::01:01:01:02 Eth 1/1
Multicast Data1
FF02::01:01:01:02 Eth 1/1
User
Console#show ipv6 mld This command shows known multicast groups, member ports, the means by whichsnooping group each group was learned, and the corresponding source list.
source-list
Syntaxshow ipv6 mld snooping group source-list [ipv6-address | vlan vlan-id]
ipv6-address - An IPv6 address of a multicast group. (Format: X:X:X:X::X)
vlan-id - VLAN ID (1-4094)
Command Mode
Privileged Exec

– 737 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
ExampleThe following shows MLD Snooping group mapping information:
Console#show ipv6 mld snooping group source-list
VLAN ID
Mutlicast IPv6 Address
Member Port
MLD Snooping
Filter Mode
(if exclude filter mode)
Filter Timer Elapse
Request List
Exclude List
(if include filter mode)
Include List

: 1
: FF02::01:01:01:01: Eth 1/1
: Multicast Data
: Include: 10 sec.
: ::01:02:03:04, ::01:02:03:05, ::01:02:03:06,::01:02:03:07: ::02:02:03:04, ::02:02:03:05, ::02:02:03:06,::02:02:03:07: ::02:02:03:04, ::02:02:03:05, ::02:02:03:06,::02:02:03:06

Option:Filter Mode: Include, Exclude
Console#show ipv6 mld This command shows MLD Snooping multicast router information.
snooping mrouter
Syntaxshow ipv6 mld snooping mrouter [vlan vlan-id}
vlan-id - A VLAN identification number. (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#show ipv6 mld snooping mrouter vlan 1
VLAN Multicast Router Port Type
Expire---- --------------------- --------- -----1 Eth 1/ 2
StaticConsole#– 738 –

Chapter 27 | Multicast Filtering Commands

MLD Snoopingshow ipv6 mld This command shows MLD snooping protocol statistics for the specified interface.
snooping statistics
Syntaxshow ipv6 mld snooping statistics{input [interface interface] |output [interface interface] |query [vlan vlan-id] |summary interface interface}
input - Specifies to display statistics for messages received by the interface.
output - Specifies to display statistics for messages sent by the interface.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN ID (Range: 1-4094)
query - Displays MLD snooping query-related statistics.
Default Setting
None
Command Mode
Privileged Exec
ExampleThe following shows MLD snooping input-related message statistics:
Console#show ipv6 mld snooping statistics input interface ethernet 1/1
Input Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Join Succ Group--------- -------- -------- -------- ------------- -------- --------- -----Eth 1/ 1
4
0
0
0
0
0
2
Console#Table 143: show ipv6 MLD snooping statistics input - display description
Field

Description

Interface

The unit/port or VLAN interface.

Report

The number of MLD membership reports received on this interface.

Leave

The number of leave messages received on this interface.

G Query

The number of general query messages received on this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query
messages received on this interface.

– 739 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
Table 143: show ipv6 MLD snooping statistics input - display description
Field

Description

Drop

The number of times a report, leave or query was dropped. Packets may
be dropped due to invalid format, rate limiting, packet content notallowed, or MLD group report received.

Join Succ

The number of times a multicast group was successfully joined.

Group

The number of MLD groups active on this interface.

The following shows MLD snooping output-related message statistics:
Console#show ipv6 mld snooping statistics output interface ethernet 1/1
Output Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Group--------- -------- -------- -------- ------------- -------- -----Eth 1/ 1
0
0
5
0
0
2
Console#Table 144: show ipv6 MLD snooping statistics output - display description
Field

Description

Interface

The unit/port or VLAN interface.

Report

The number of MLD membership reports transmitted from thisinterface.

Leave

The number of leave messages transmitted from this interface.

G Query

The number of general query messages transmitted from this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query
messages transmitted from this interface.

Drop

The number of times a report, leave or query was dropped. Packets may
be dropped due to invalid format, rate limiting, packet content notallowed, or MLD group report received.

Join Succ

The number of times a multicast group was successfully joined.

Group

The number of MLD groups active on this interface.

The following shows MLD snooping query-related message statistics:
Console#show ipv6 mld snooping statistics query vlan 1
Other Querier Address: NoneOther Querier Expire: 0(m):0(s)Other Querier Uptime: 0(h):0(m):0(s)Self Querier Address: ::Self Querier Expire Time : 1(m):49(s)Self Querier UpTime: 0(h):9(m):6(s)General Query Received: 0
General Query Sent
: 6
Specific Query Received: 0
Specific Query Sent
: 0
Console#– 740 –

Chapter 27 | Multicast Filtering Commands

MLD Snooping

Table 145: show ipv6 MLD snooping statistics query - display description
Field

Description

Other Querier Address

IP address of remote querier on this interface.

Other Querier Expire

Time after which remote querier is assumed to have expired.

Other Querier Uptime

Time remote querier has been up.

Self Querier

IP address of local querier on this interface.

Self Querier Expire

Time after which local querier is assumed to have expired.

Self Querier Uptime

Time local querier has been up.

General Query Received

The number of general queries received on this interface.

General Query Sent

The number of general queries sent from this interface.

Specific Query Received

The number of group specific queries received on this interface.

Specific Query Sent

The number of group specific queries sent from this interface.

The following shows MLD snooping summary statistics:
Console#show ipv6 mld snooping statistics summary interface e 1/1
Number of Groups: 1
Querier::
Report & Leave::
Transmit:
Transmit:
General: 6
Report: 0Group Specific: 0
Leave
: 0
Recieved:
Recieved:
General: 0
Report: 4Group Specific: 0
Leave
: 0
join Success: 0
Filter Drop
: 0
Source Port Drop: 0
Others Drop
: 0
Console#show ipv6 mld snooping statistics summary interface vlan 1
Number of Groups: 1
Querier::
Report & Leave::
Other Querier : None
Host Addr: NoneOther Uptime: 0(h):0(m):0(s)Unsolicit Expire : 0 sec
Other Expire: 0(m):0(s)Self Addr: NoneSelf Expire: 2(m): 3(s)Self Uptime: 0(h):10(m):58(s)Transmit:
Transmit:
General: 7
Report: 0Group Specific: 0
Leave
: 0
Recieved:
Recieved:
General: 0
Report: 4Group Specific: 0
Leave
: 0
join Success: 0
Filter Drop
: 0
Source Port Drop: 0
Others Drop
: 0
Console#– 741 –

Chapter 27 | Multicast Filtering Commands
MLD Snooping
Table 146: show ipv6 MLD snooping statistics summary - display description
Field

Description

Number of Groups

Number of active MLD groups active on the specified interface.

Physical Interface (Port/Trunk)
Querier:
Transmit
GeneralThe number of general queries sent from this interface.

Group Specific

The number of group specific queries sent from this interface.

Recieved
GeneralThe number of general queries received on this interface.

Group Specific

The number of group specific queries received on this interface.

Report & Leave
Transmit
Report

The number of MLD membership reports sent from this interface.

Leave

The number of leave messages sent from this interface.

Recieved
Report

The number of MLD membership reports received on this interface.

Leave

The number of leave messages received on this interface.

join Success

The number of times a multicast group was successfully joined.

Filter Drop

The number of messages dropped by an MLD filtering profile.

Source Port Drop

The number of dropped messages that are received on MVR source
port or mrouter port.

Others Drop

The number of received invalid messages.

Logical Interface (VLAN)

The following additional parameters are included for a VLAN interface

Querier:
Other Querier

IPv6 address of remote querier on this interface.

Other Uptime

Time remote querier has been up.

Other Expire

Time after which remote querier is assumed to have expired.

Self Addr

IPv6 address of local querier on this interface.

Self Expire

Time after which local querier is assumed to have expired.

Self Uptime

Time local querier has been up.

Report & Leave
Host Addr

The link-local or global IPv6 address that is assigned on that VLAN.

Unsolicit Expire

The number of group leaves resulting from timeouts instead of explicit
leave messages.

– 742 –

Chapter 27 | Multicast Filtering Commands

MLD Filtering and Throttling

MLD Filtering and Throttling
In certain switch applications, the administrator may want to control the multicast
services that are available to end users. For example, an IP/TV service based on a
specific subscription plan. The MLD filtering feature fulfills this requirement by
restricting access to specified multicast services on a switch port, and MLD
throttling limits the number of simultaneous multicast groups a port can join.
Table 147: MLD Filtering and Throttling Commands
CommandFunctionMode

ipv6 mld filter

Enables MLD filtering and throttling on the switch

GC

ipv6 mld profile

Sets a profile number and enters MLD filter profile
configuration modeGC

permit, denySets a profile access mode to permit or deny

IPC

range

Specifies one or a range of multicast addresses for a profile IPC

ipv6 mld filter

Assigns an MLD filter profile to an interface

IC

ipv6 mld max-groups

Specifies an M:D throttling number for an interface

IC

ipv6 mld max-groups
actionSets the MLD throttling action for an interface

IC

ipv6 mld query-drop

Drops any received MLD query packets

IC

ipv6 multicast-data-drop

Enable multicast data guard mode on a port interface

ICshow ipv6 mld filter

Displays the MLD filtering statusPE

show ipv6 mld profile

Displays MLD profiles and settingsPEshow ipv6 mld query-drop

Shows if the interface is configured to drop MLD query
packets

PE

show ipv6 mld throttleinterface

Displays the MLD throttling setting for interfacesPE

ipv6 mld filter This command globally enables MLD filtering and throttling on the switch. Use the(Global Configuration) no form to disable the feature.

Syntax[no] ipv6 mld filter
Default Setting
Disabled
Command Mode
Global Configuration– 743 –

Chapter 27 | Multicast Filtering Commands
MLD Filtering and Throttling
Command Usage
 MLD filtering enables you to assign a profile to a switch port that specifies
multicast groups that are permitted or denied on the port. An MLD filter profile
can contain one or more, or a range of multicast addresses; but only one profile
can be assigned to a port. When enabled, MLD join reports received on the port
are checked against the filter profile. If a requested multicast group ispermitted, the MLD join report is forwarded as normal. If a requested multicast
group is denied, the MLD join report is dropped.
 MLD filtering and throttling only applies to dynamically learned multicast

groups, it does not apply to statically configured groups.

 The MLD filtering feature operates in the same manner when MVR6 is used toforward multicast traffic.

ExampleConsole(config)#ipv6 mld filter
Console(config)#

Related Commands
show ipv6 mld filter

ipv6 mld profile This command creates an MLD filter profile number and enters MLD profile
configuration mode. Use the no form to delete a profile number.
Syntax[no] ipv6 mld profile profile-number
profile-number - An MLD filter profile number. (Range: 1-4294967295)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
A profile defines the multicast groups that a subscriber is permitted or denied tojoin. The same profile can be applied to many interfaces, but only one profile canbe assigned to one interface. Each profile has only one access mode; either permit
or deny.
ExampleConsole(config)#ipv6 mld profile 19
Console(config-mld-profile)#– 744 –

Chapter 27 | Multicast Filtering Commands

MLD Filtering and Throttling

Related Commands
show ipv6 mld profile

permit, deny This command sets the access mode for an MLD filter profile.
Syntax{permit | deny}
Default Setting
denyCommand Mode
MLD Profile Configuration
Command Usage Each profile has only one access mode; either permit or deny.
 When the access mode is set to permit, MLD join reports are processed when amulticast group falls within the controlled range. When the access mode is set
to deny, MLD join reports are only processed when a multicast group is not in
the controlled range.

ExampleConsole(config)#ipv6 mld profile 19
Console(config-mld-profile)#permit
Console(config-mld-profile)#

range This command specifies multicast group addresses for a profile. Use the no form todelete addresses from a profile.
Syntax[no] range low-ipv6-address high-ipv6-address
low-ipv6-address - A valid IPv6 address (X:X:X:X::X) of a multicast group or
start of a group range.
high-ipv6-address - A valid IPv6 address (X:X:X:X::X) for the end of amulticast group range.
Default Setting
None
Command Mode
MLD Profile Configuration– 745 –

Chapter 27 | Multicast Filtering Commands
MLD Filtering and Throttling
Command UsageEnter this command multiple times to specify more than one multicast address oraddress range for a profile.
ExampleConsole(config-mld-profile)#range ff01::0101 ff01::0202
Console(config-mld-profile)#

ipv6 mld filter This command assigns an MLD filtering profile to an interface on the switch. Use(Interface Configuration) the no form to remove a profile from an interface.

Syntaxipv6 mld filter profile-number
no ipv6 mld filter
profile-number - An MLD filter profile number. (Range: 1-4294967295)
Default Setting
None
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage The MLD filtering profile must first be created with the ipv6 mld profile
command before being able to assign it to an interface.
 Only one profile can be assigned to an interface.
 A profile can also be assigned to a trunk interface. When ports are configured as

trunk members, the trunk uses the filtering profile assigned to the first port
member in the trunk.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ipv6 mld filter 19
Console(config-if)#– 746 –

Chapter 27 | Multicast Filtering Commands

MLD Filtering and Throttling

ipv6 mld max-groups This command configures the maximum number of MLD groups that an interface
can join. Use the no form to restore the default setting.
Syntaxipv6 mld max-groups number
no ipv6 mld max-groups
number - The maximum number of multicast groups an interface can join at
the same time. (Range: 1-255)
Default Setting
255
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
 MLD throttling sets a maximum number of multicast groups that a port can join
at the same time. When the maximum number of groups is reached on a port,
the switch can take one of two actions; either “deny” or “replace.” If the action is
set to deny, any new MLD join reports will be dropped. If the action is set to
replace, the switch randomly removes an existing group and replaces it with
the new multicast group.
 MLD throttling can also be set on a trunk interface. When ports are configured

as trunk members, the trunk uses the throttling settings of the first port
member in the trunk.

 If the maximum number of MLD groups is set to the default value, the runningstatus of MLD throttling will change to false. This means that any configuration
for MLD throttling will have no effect until the maximum number of MLD
groups is configured to another value.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ipv6 mld max-groups 10
Console(config-if)#

ipv6 mld max-groups This command sets the MLD throttling action for an interface on the switch. Use theaction no form of the command to set the action to the default.
Syntaxipv6 mld max-groups action {deny | replace}no ipv6 mld max-groups action– 747 –

Chapter 27 | Multicast Filtering Commands
MLD Filtering and Throttlingdeny - The new multicast group join report is dropped.
replace - The new multicast group replaces an existing group.
Default Setting
DenyCommand Mode
Interface Configuration (Ethernet)
Command Usage
When the maximum number of groups is reached on a port, the switch can takeone of two actions; either “deny” or “replace.” If the action is set to deny, any new
MLD join reports will be dropped. If the action is set to replace, the switch randomly
removes an existing group and replaces it with the new multicast group.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ipv6 mld max-groups action replace
Console(config-if)#

ipv6 mld query-drop This command drops any received MLD query packets. Use the no form to restore
the default setting.
Syntax[no] ipv6 mld query-drop
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This command can be used to drop any query packets received on the specified
interface. If this switch is acting as a Querier, this prevents it from being affected bymessages received from another Querier.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ipv6 mld query-drop
Console(config-if)#– 748 –

Chapter 27 | Multicast Filtering Commands

MLD Filtering and Throttling

ipv6 Use this command to enable multicast data drop mode on a port interface. Use themulticast-data-drop no form of the command to disable multicast data drop.
Syntax[no] ipv6 multicast-data-drop
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet)
ExampleConsole(config)#interface ethernet 1/3
Console(config-if)#ipv6 multicast-data-drop
Console(config-if)#show ipv6 mld filter This command displays the global and interface settings for MLD filtering.
Syntaxshow ipv6 mld filter [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show ipv6 mld filter
MLD filter Enabled
Console#show ipv6 mld filter interface ethernet 1/3
Ethernet 1/3 information--------------------------------MLD Profile 19
Deny
Range ff01::101
ff01::faa
Console#– 749 –

Chapter 27 | Multicast Filtering Commands
MLD Filtering and Throttlingshow ipv6 mld profile This command displays MLD filtering profiles created on the switch.
Syntaxshow ipv6 mld profile [profile-number]profile-number - An existing MLD filter profile number.
(Range: 1-4294967295)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show ipv6 mld profile
MLD Profile 19
MLD Profile 50
Console#show ipv6 mld profile 19
MLD Profile 19
Deny
Range ff01::101
ff01::faa
Console#show ipv6 mld This command shows if the specified interface is configured to drop MLD query
query-drop packets.
Syntaxshow ipv6 mld query-drop [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Using this command without specifying an interface displays all interfaces.

– 750 –

Chapter 27 | Multicast Filtering Commands

MLD Filtering and Throttling

ExampleConsole#show ipv6 mld query-drop interface ethernet 1/1
Ethernet 1/1: Enabled
Console#show ipv6 mld throttle This command displays the interface settings for MLD throttling.
interface
Syntaxshow ipv6 mld throttle interface [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Using this command without specifying an interface displays information for all
interfaces.
ExampleConsole#show ipv6 mld throttle interface ethernet 1/3
Eth 1/3 Information
Status: TRUE
Action: Replace
Max Multicast Groups: 10
Current Multicast Groups : 0
Console#– 751 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

MVR for IPv4
This section describes commands used to configure Multicast VLAN Registration for
IPv4 (MVR). A single network-wide VLAN can be used to transmit multicast traffic(such as television channels) across a service provider’s network. Any multicast
traffic entering an MVR VLAN is sent to all subscribers. This can significantly reduceto processing overhead required to dynamically monitor and establish the
distribution tree for a normal multicast VLAN. Also note that MVR maintains theuser isolation and data security provided by VLAN segregation by passing only
multicast traffic into other VLANs to which the subscribers belong.
Table 148: Multicast VLAN Registration for IPv4 Commands
CommandFunction

Mode

mvr

Globally enables MVR

GC

mvr associated-profile

Binds the MVR group addresses specified in a profile to an GC
MVR domain

mvr domain

Enables MVR for a specific domainGC

mvr profile

Maps a range of MVR group addresses to a profileGC

mvr proxy-query-interval

Configures the interval at which the receiver port sends out GC
general queries.

mvr proxy-switching

Enables MVR proxy switching, where the source port acts GC
as a host, and the receiver port acts as an MVR router with
querier service enabled

mvr robustness-value

Configures the expected packet loss, and thereby the
number of times to generate report and group-specificqueriesGC

mvr source-port-mode

Configures the switch to only forward multicast streams
that a source port has dynamically joinedGC

mvr upstream-source-ip

Configures the source IP address assigned to all control
packets sent upstreamGC

mvr vlanSpecifies the VLAN through which MVR multicast data isreceivedGC

mvr immediate-leave

Enables immediate leave capabilityIC

mvr type

Configures an interface as an MVR receiver or source portIC

mvr vlan group

Statically binds a multicast group to a portIC

clear mvr groups dynamic

Clears multicast group information dynamically learned
through MVR

PE

clear mvr statistics

Clears MVR statistics

PEshow mvr

Shows information about MVR domain settings, including PE
MVR operational status, the multicast VLAN, the current
number of group addresses, and the upstream source IP
address

show mvr
associated-profileShows the profiles bound the specified domain– 752 –PE

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

Table 148: Multicast VLAN Registration for IPv4 Commands (Continued)
CommandFunctionModeshow mvr interface

Shows MVR settings for interfaces attached to the MVR
VLAN

PE

show mvr members

Shows information about the current number of entries in PE
the forwarding database, or detailed information about aspecific multicast address

show mvr profileShows all configured MVR profiles

PEshow mvr statistics

Shows MVR protocol statistics for the specified interfacePE

mvr This command enables Multicast VLAN Registration (MVR) globally on the switch.
Use the no form of this command to globally disable MVR.
Syntax[no] mvr
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
Only IGMP version 2 or 3 hosts can issue multicast join or leave messages. If MVR
must be configured for an IGMP version 1 host, the multicast groups must be
statically assigned using the mvr vlan group command.
ExampleThe following example enables MVR globally.
Console(config)#mvr
Console(config)#

mvr associated-profile This command binds the MVR group addresses specified in a profile to an MVR
domain. Use the no form of this command to remove the binding.
Syntax[no] mvr domain domain-id associated-profile profile-namedomain-id - An independent multicast domain. (Range: 1-5)
profile-name - The name of a profile containing one or more MVR groupaddresses. (Range: 1-21 characters)– 753 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Default Setting
Disabled
Command Mode
Global Configuration
ExampleThe following an MVR group address profile to domain 1:
Console(config)#mvr domain 1 associated-profile rdConsole(config)#

Related Commands
mvr profile (755)

mvr domain This command enables Multicast VLAN Registration (MVR) for a specific domain.
Use the no form of this command to disable MVR for a domain.
Syntax[no] mvr domain domain-id
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
Only IGMP version 2 or 3 hosts can issue multicast join or leave messages. If MVR
must be configured for an IGMP version 1 host, the multicast groups must be
statically assigned using the mvr vlan group command.
ExampleThe following example enables MVR for domain 1:
Console(config)#mvr domain 1
Console(config)#– 754 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

mvr profile This command maps a range of MVR group addresses to a profile. Use the no formof this command to remove the profile.
Syntax
mvr profile profile-name start-ip-address end-ip-addressno mvr profile profile-nameprofile-name - The name of a profile containing one or more MVR groupaddresses. (Range: 1-21 characters)
start-ip-address - Starting IPv4 address for an MVR multicast group.
(Range: 224.0.1.0 - 239.255.255.255)
end-ip-address - Ending IPv4 address for an MVR multicast group.
(Range: 224.0.1.0 - 239.255.255.255)
Default Setting
No profiles are defined
Command Mode
Global Configuration
Command Usage Use this command to statically configure all multicast group addresses that will

join the MVR VLAN. Any multicast data associated an MVR group is sent from all
source ports to all receiver ports that have registered to receive data from thatmulticast group.

 The IP address range from 224.0.0.0 to 239.255.255.255 is used for multicast

streams. MVR group addresses cannot fall within the reserved IP multicast
address range of 224.0.0.x.

 IGMP snooping and MVR share a maximum number of 1024 groups. Any

multicast streams received in excess of this limitation will be flooded to all ports
in the associated domain.

ExampleThe following example maps a range of MVR group addresses to a profile:
Console(config)#mvr profile rd 228.1.23.1 228.1.23.10
Console(config)#

mvr proxy-query- This command configures the interval at which the receiver port sends out generalinterval queries. Use the no form to restore the default setting.

– 755 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Syntax
mvr proxy-query-interval interval
no mvr proxy-query-intervalinterval - The interval at which the receiver port sends out general queries.
(Range: 2-31744 seconds)
Default Setting
125 seconds
Command Mode
Global Configuration
Command Usage
This command sets the general query interval at which active receiver ports sendout general queries. This interval is only effective when proxy switching is enabledwith the mvr proxy-switching command.
ExampleThis example sets the proxy query interval for MVR proxy switching.
Console(config)#mvr proxy-query-interval 250
Console(config)#

mvr proxy-switching This command enables MVR proxy switching, where the source port acts as a host,and the receiver port acts as an MVR router with querier service enabled. Use theno form to disable this function.
Syntax[no] mvr proxy-switching
Default Setting
EnabledCommand Mode
Global Configuration
Command Usage When MVR proxy-switching is enabled, an MVR source port serves as the
upstream or host interface. The source port performs only the host portion of
MVR by sending summarized membership reports, and automatically disables
MVR router functions.
 Receiver ports are known as downstream or router interfaces. These interfaces

perform the standard MVR router functions by maintaining a database of all– 756 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

MVR subscriptions on the downstream interface. Receiver ports must therefore
be configured on all downstream interfaces which require MVR proxy service.
 When the source port receives report and leave messages, it only forwards

them to other source ports.

 When receiver ports receive any query messages, they are dropped.
 When changes occurring in the downstream MVR groups are learned by thereceiver ports through report and leave messages, an MVR state change report
is created and sent to the upstream source port, which in turn forwards thisinformation upstream.

 When MVR proxy switching is disabled:Any membership reports received from receiver/source ports areforwarded to all source ports.

When a source port receives a query message, it will be forwarded to all
downstream receiver ports.

When a receiver port receives a query message, it will be dropped.

ExampleThe following example enable MVR proxy switching.
Console(config)#mvr proxy-switching
Console(config)#

Related Commands
mvr robustness-value (757)

mvr robustness-value This command configures the expected packet loss, and thereby the number oftimes to generate report and group-specific queries. Use the no form to restore thedefault setting.
Syntax
mvr robustness-value value
no mvr robustness-value
value - The robustness used for all interfaces. (Range: 1-255)

Default Setting
2
Command Mode
Global Configuration– 757 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Command Usage This command is used to set the number of times report messages are sent
upstream when changes are learned about downstream groups, and thenumber of times group-specific queries are sent to downstream receiver ports.
 This command only takes effect when MVR proxy switching is enabled.

ExampleConsole(config)#mvr robustness-value 5
Console(config)#

Related Commands
mvr proxy-switching (756)

mvr source-port- This command configures the switch to forward only multicast streams that amode source port has dynamically joined or to forward all multicast groups. Use the noform to restore the default setting.
Syntax
mvr source-port-mode {dynamic | forward}
no mvr source-port-mode
dynamic - Configures source ports to only forward dynamically-joined
MVR group multicast streams.
forward - Configures source ports to always forward MVR groups.
Default Setting
Forwards all multicast streams which have been specified in a profile and bound toa domain.
Command Mode
Global Configuration
Command Usage By default, the switch forwards any multicast streams within the address range

set by a profile, and bound to a domain. The multicast streams are sent to all
source ports on the switch and to all receiver ports that have elected to receive
data on that multicast address.

 When the mvr source-port-mode dynamic command is used, the switch only

forwards multicast streams which the source port has dynamically joined. In
other words, both the receiver port and source port must subscribe to a
multicast group before a multicast stream is forwarded to any attached client.
Note that the requested streams are still restricted to the address range which
has been specified in a profile and bound to a domain.

– 758 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

ExampleConsole(config)#mvr source-port-mode dynamic
Console(config)#

mvr upstream- This command configures the source IP address assigned to all MVR control packets
source-ip sent upstream on all domains or on a specified domain. Use the no form to restore
the default setting.
Syntaxmvr [domain domain-id] upstream-source-ip source-ip-addressno mvr [domain domain-id] upstream-source-ip
domain-id - An independent multicast domain. (Range: 1-5)
source-ip-address – The source IPv4 address assigned to all MVR control
packets sent upstream.
Default Setting
All MVR reports sent upstream use a null source IP address
Command Mode
Global Configuration
ExampleConsole(config)#mvr domain 1 upstream-source-ip 192.168.0.3
Console(config)#

mvr vlan This command specifies the VLAN through which MVR multicast data is received.
Use the no form of this command to restore the default MVR VLAN.
Syntaxmvr [domain domain-id] vlan vlan-id
no mvr [domain domain-id] vlandomain-id - An independent multicast domain. (Range: 1-5)
vlan-id - Specifies the VLAN through which MVR multicast data is received.
This is also the VLAN to which all source ports must be assigned.
(Range: 1-4094)
Default Setting
VLAN 1
Command Mode
Global Configuration– 759 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Command Usage This command specifies the VLAN through which MVR multicast data isreceived. This is the VLAN to which all source ports must be assigned.
 The VLAN specified by this command must be an existing VLAN configured

with the vlan command.

 MVR source ports can be configured as members of the MVR VLAN using theswitchport allowed vlan command and switchport native vlan command, but
MVR receiver ports should not be statically configured as members of thisVLAN.

ExampleThe following example sets the MVR VLAN to VLAN 2:
Console(config)#mvr
Console(config)#mvr domain 1 vlan 2
Console(config)#

mvr immediate-leave This command causes the switch to immediately remove an interface from amulticast stream as soon as it receives a leave message for that group. Use the noform to restore the default settings.
Syntaxmvr [domain domain-id] immediate-leave [by-host-ip]
no mvr [domain domain-id] immediate-leavedomain-id - An independent multicast domain. (Range: 1-5)
by-host-ip - Specifies that the member port will be deleted only when
there are no hosts joining this group.
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
 Immediate leave applies only to receiver ports. When enabled, the receiver port
is immediately removed from the multicast group identified in the leavemessage. When immediate leave is disabled, the switch follows the standard
rules by sending a group-specific query to the receiver port and waiting for a
response to determine if there are any remaining subscribers for that multicast
group before removing the port from the group list.
 If the “by-host-ip” option is used, the router/querier will not send out a group-

specific query when an IGMPv2/v3 leave message is received (the same as it– 760 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

would without this option having been used). Instead of immediately deletingthat group, it will look up the record, and only delete the group if there are noother subscribers for it on the member port. Only when all hosts on that port
leave the group will the member port be deleted.
 Using immediate leave can speed up leave latency, but should only be enabled

on a port attached to only one multicast subscriber to avoid disrupting services
to other group members attached to the same interface.

 Immediate leave does not apply to multicast groups which have been staticallyassigned to a port with the mvr vlan group command.

ExampleThe following enables immediate leave on a receiver port.
Console(config)#interface ethernet 1/5
Console(config-if)#mvr domain 1 immediate-leave
Console(config-if)#

mvr type This command configures an interface as an MVR receiver or source port. Use theno form to restore the default settings.
Syntax[no] mvr [domain domain-id] type {receiver | source}
domain-id - An independent multicast domain. (Range: 1-5)
receiver - Configures the interface as a subscriber port that can receive
multicast data.
source - Configures the interface as an uplink port that can send andreceive multicast data for the configured multicast groups.
Default Setting
The port type is not defined.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage A port which is not configured as an MVR receiver or source port can use IGMP
snooping to join or leave multicast groups using the standard rules for
multicast filtering.
 Receiver ports can belong to different VLANs, but should not normally be

configured as a member of the MVR VLAN. IGMP snooping can also be used toallow a receiver port to dynamically join or leave multicast groups not sourced
through the MVR VLAN. Also, note that VLAN membership for MVR receiverports cannot be set to access mode (see the switchport mode command).
– 761 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

 One or more interfaces may be configured as MVR source ports. A source port isable to both receive and send data for multicast groups which it has joined
through the MVR protocol or which have been assigned through the mvr vlangroup command.

 Only IGMP version 2 or 3 hosts can issue multicast join or leave messages. If

MVR must be configured for an IGMP version 1 host, the multicast groups must
be statically assigned using the mvr vlan group command.

ExampleThe following configures one source port and several receiver ports on the switch.
Console(config)#interface ethernet 1/5
Console(config-if)#mvr domain 1 type source
Console(config-if)#exit
Console(config)#interface ethernet 1/6
Console(config-if)#mvr domain 1 type receiver
Console(config-if)#exit
Console(config)#interface ethernet 1/7
Console(config-if)#mvr domain 1 type receiver
Console(config-if)#

mvr vlan group This command statically binds a multicast group to a port which will receive longterm multicast streams associated with a stable set of hosts. Use the no form torestore the default settings.
Syntax[no] mvr [domain domain-id] vlan vlan-id group ip-address
domain-id - An independent multicast domain. (Range: 1-5)
vlan-id - Receiver VLAN to which the specified multicast traffic is flooded.
(Range: 1-4094)
group - Defines a multicast service sent to the selected port.
ip-address - Statically configures an interface to receive multicast traffic
from the IPv4 address specified for an MVR multicast group.
(Range: 224.0.1.0 - 239.255.255.255)
Default Setting
No receiver port is a member of any configured multicast group.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Multicast groups can be statically assigned to a receiver port using thiscommand.

– 762 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

 The IP address range from 224.0.0.0 to 239.255.255.255 is used for multicast

streams. MVR group addresses cannot fall within the reserved IP multicast
address range of 224.0.0.x.

 Only IGMP version 2 or 3 hosts can issue multicast join or leave messages. If

MVR must be configured for an IGMP version 1 host, the multicast groups must
be statically assigned using the mvr vlan group command.

 The MVR VLAN cannot be specified as the receiver VLAN for static bindings.

ExampleThe following statically assigns a multicast group to a receiver port:
Console(config)#interface ethernet 1/7
Console(config-if)#mvr domain 1 type receiver
Console(config-if)#mvr domain 1 vlan 3 group 225.0.0.5
Console(config-if)#clear mvr groups This command clears multicast group information dynamically learned throughdynamic MVR.
Syntaxclear mvr groups dynamic [domain-id]
domain-id - The MVR domain ID - Range: 1-5
Command Mode
Privileged Exec
Command Usage
This command only clears entries learned though MVR. Statically configured
multicast address are not cleared.
ExampleConsole#clear mvr groups dynamic
Console#– 763 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

clear mvr statistics This command clears MVR statistics.
Syntaxclear mvr statistics [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN identifier (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#clear mvr statistics
Console#show mvr This command shows information about MVR domain settings, including MVR

operational status, the multicast VLAN, the current number of group addresses, andthe upstream source IP address.
Syntaxshow mvr [domain domain-id]
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Displays configuration settings for all MVR domains.
Command Mode
Privileged Exec
ExampleThe following shows the MVR settings:
Console#show mvr
MVR Proxy Switching
MVR Robustness ValueMVR Proxy Query Interval
MVR Source Port Mode

: Enabled: 1: 125(sec.): Always Forward

MVR Domain
MVR Config Status
MVR Running Status: 1: Enabled: Active– 764 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

MVR Multicast VLANMVR Current Learned Groups
MVR Upstream Source IP
.
.
.

: 1
: 10
: 192.168.0.3

Table 149: show mvr - display description
Field

Description

MVR Proxy Switching

Shows if MVR proxy switching is enabled

MVR Robustness Value

Shows the number of reports or query messages sent when proxyswitching is enabled

MVR Proxy Query Interval

Shows the interval at which the receiver port sends out general queries

MVR Source Port Mode

Shows if the switch forwards all multicast streams, or only those which
the source port has dynamically joined

MVR Domain

An independent multicast domain.

MVR Config Status

Shows if MVR is globally enabled on the switch.

MVR Running Status

Indicates whether or not all necessary conditions in the MVR
environment are satisfied. (Running status is true as long as MVR Statusis enabled, and the specified MVR VLAN exists.)

MVR Multicast VLAN

Shows the VLAN used to transport all MVR multicast traffic.

MVR Current Learned
Groups

The current number of MVR group addresses

MVR Upstream Source IP

The source IP address assigned to all upstream control packets.

show mvr This command shows the profiles bound the specified domain.
associated-profile
Syntaxshow mvr [domain domain-id] associated-profile
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Displays profiles bound to all MVR domains.
Command Mode
Privileged Exec
ExampleThe following displays the profiles bound to domain 1:
Console#show mvr domain 1 associated-profile
Domain ID : 1
MVR Profile Name
Start IP Addr. End IP Addr.
-------------------- --------------- --------------rd
228.1.23.1
228.1.23.10– 765 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

testing
Console#228.2.23.1

228.2.23.10

show mvr interface This command shows MVR configuration settings for interfaces attached to the
MVR VLAN.
Syntaxshow mvr [domain domain-id] interface
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Displays configuration settings for all attached interfaces.
Command Mode
Privileged Exec
ExampleThe following displays information about the interfaces attached to the MVR VLAN
in domain 1:
Console#show mvr domain 1 interface
MVR Domain : 1
Flag: H - Immediate Leave By Host IP
Port
Type
StatusImmediate
Static Group Address-------- -------- ------------------- ------------- -----------------------Eth 1/ 1 Source
Active/Forwarding
Eth 1/ 2 Receiver Inactive/Discarding Disabled
234.5.6.8(VLAN2)
Eth 1/ 3 Source
Inactive/Discarding
Eth 1/ 1 Receiver Active/Forwarding
Disabled
225.0.0.1(VLAN1)
225.0.0.9(VLAN3)
Eth 1/ 4 Receiver Active/Discarding
Disabled
Console#Table 150: show mvr interface - display description
Field

Description

MVR Domain

An independent multicast domain.

Port

Shows interfaces attached to the MVR.

Type

Shows the MVR port type.

StatusShows the MVR status and interface status. MVR status for source ports
is “ACTIVE” if MVR is globally enabled on the switch. MVR status forreceiver ports is “ACTIVE” only if there are subscribers receiving
multicast traffic from one of the MVR groups, or a multicast group has
been statically assigned to an interface. Also shows if MVR traffic isbeing forwarded or discarded.

Immediate

Shows if immediate leave is enabled or disabled.

Static Group Address

Shows any static MVR group assigned to an interface, and the receiver
VLAN.

– 766 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

show mvr members This command shows information about the current number of entries in theforwarding database, detailed information about a specific multicast address, the IP
address of the hosts subscribing to all active multicast groups, or the multicast
groups associated with each port.
Syntaxshow mvr [domain domain-id] members [ip-address |host-ip-address [ip-address | ds-vlan vlan-id [ip-address | interface ip-address]| interface ip-address ] | igmp | sort-by-port [ip-address | ds-vlan vlan-id [ipaddress | interface ip-address] | interface ip-address ]| unknown | user]
domain-id - An independent multicast domain. (Range: 1-5)
ip-address - IPv4 address for an MVR multicast group.
(Range: 224.0.1.0 - 239.255.255.255)
members - The multicast groups assigned to the MVR VLAN.
host-ip-address - The subscriber IP addresses.
ds-vlan - Downstream VLAN ID (Range: 1-4094)
igmp - Entry created by IGMP protocol.
sort-by-port - The multicast groups associated with an interface.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
unknown - Entry created by receiving a multicast stream.
user - Snooping entry learned from user’s configuration settings.
Default Setting
Displays configuration settings for all domains and all forwarding entries.
Command Mode
Privileged Exec
ExampleThe following shows information about the number of multicast forwarding entries
currently active in domain 1:
Console#show mvr domain 1 members
MVR Domain : 1
MVR Forwarding Entry Count :1
Flag: S - Source port, R - Receiver port.
H - Host counts (number of hosts joined to group on this port).
P - Port counts (number of ports joined to group).
Up time: Group elapsed time (d:h:m:s).
Expire : Group remaining time (m:s).

– 767 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Group Address
VLAN PortUp timeExpire Count--------------- ---- ----------- ----------- ------ -------234.5.6.7
1
00:00:09:17
2(P)1 Eth 1/ 1(S)
2 Eth 1/ 2(R)Console#The following example shows detailed information about a specific multicast
address:
Console#show mvr domain 1 members 234.5.6.7
MVR Domain : 1
MVR Forwarding Entry Count :1
Flag: S - Source port, R - Receiver port.
H - Host counts (number of hosts joined to group on this port).
P - Port counts (number of ports joined to group).
Up time: Group elapsed time (d:h:m:s).
Expire : Group remaining time (m:s).
Group Address
VLAN PortUp timeExpire Count--------------- ---- ----------- ----------- ------ -------234.5.6.7
12(P)1 Eth 1/ 1(S)
2 Eth 1/ 2(R)Console#Table 151: show mvr members - display description
Field

Description

Group Address

Multicast group address.

VLAN

VLAN to which this address is forwarded.

Port

Port to which this address is forwarded.

UptimeTime that this multicast group has been known.

Expire

The time until this entry expires.

Count

The number of times this address has been learned by IGMP snooping.

– 768 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

show mvr profile This command shows all configured MVR profiles.
Command Mode
Privileged Exec
ExampleThe following shows all configured MVR profiles:
Console#show mvr profile
MVR Profile Name
Start IP Addr. End IP Addr.
-------------------- --------------- --------------rd
228.1.23.1
228.1.23.10
testing228.2.23.1
228.2.23.10
Console#show mvr statistics This command shows MVR protocol-related statistics for the specified interface.
Syntaxshow mvr [domain domain-id] statistics{input [interface interface] | output [interface interface] |query | summary interface [interface | mvr-vlan]]}input - Specifies to display statistics for messages received by the interface.
output - Specifies to display statistics for messages sent by the interface.
domain-id - An independent multicast domain. (Range: 1-5)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN ID (Range: 1-4094)
query - Displays MVR query-related statistics.
summary - Displays summary of MVR statistics.
mvr vlan - Displays summary statistics for the MVR VLAN.
Default Setting
Displays statistics for all domains.
Command Mode
Privileged Exec

– 769 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

ExampleThe following shows MVR protocol-related statistics received:
Console#show mvr domain 1 statistics input
MVR Domain : 1 , MVR VLAN: 2
Input Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Join Succ Group--------- -------- -------- -------- ------------- -------- --------- -----Eth 1/ 1
23
11
4
10
5
20
9
Eth 1/ 2
12
15
8
3
5
19
4
DVLAN
1
2
0
0
2
2
20
9
MVLAN
1
2
0
0
2
2
20
9
Console#Table 152: show mvr statistics input - display description
Field

Description

InterfaceShows interfaces attached to the MVR.

Report

The number of IGMP membership reports received on this interface.

Leave

The number of leave messages received on this interface.

G Query

The number of general query messages received on this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query
messages received on this interface.

Drop

The number of times a report, leave or query was dropped. Packets may
be dropped due to invalid format, rate limiting, packet content notallowed, or MVR group report received

Join Succ

The number of times a multicast group was successfully joined.

Group

The number of MVR groups active on this interface.

The following shows MVR protocol-related statistics sent:
Console#show mvr domain 1 statistics output
MVR Domain : 1 , MVR VLAN: 2
Output Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Group---------- -------- -------- -------- ------------- -------- -----Eth 1/ 1
12
0
1
0
0
0
Eth 1/ 1
12
0
1
0
0
0
Eth 1/ 2
5
1
4
1
0
0
DVLAN
1
7
2
3
0
0
0
MVLAN
1
7
2
3
0
0
0
Console#Table 153: show mvr statistics output - display description
Field

Description

InterfaceShows interfaces attached to the MVR.

Report

The number of IGMP membership reports sent from this interface.

– 770 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

Table 153: show mvr statistics output - display description (Continued)
Field

Description

Leave

The number of leave messages sent from this interface.

G Query

The number of general query messages sent from this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query
messages sent from this interface.

Drop

The number of times a report, leave or query was dropped. Packets may
be dropped due to invalid format, rate limiting, or packet content notallowed.

Group

The number of multicast groups active on this interface.

The following shows MVR query-related statistics:
Console#show mvr domain 1 statistics query
Domain 1:
Other Querier: NoneOther Querier Expire: 0(m):0(s)Other Querier Uptime: 0(h):0(m):0(s)Self Querier: 192.168.2.4
Self Querier Expire: 0(m):30(s)Self Querier Uptime: 0(h):9(m):55(s)General Query Received: 0
General Query Sent
: 0
Specific Query Received: 0
Specific Query Sent
: 0
Warn Rate Limit: 0 sec.
V1 Warning Count: 0
V2 Warning Count: 0
V3 Warning Count: 0
Console#Table 154: show mvr statistics query - display description
Field

Description

Other Querier

The IP address of the querier on this interface.

Other Querier Expire

The time after which this querier is assumed to have expired.

Other Querier Uptime

Other querier’s time up.

Self QuerierThis querier’s IP address.

Self Querier Expire

This querier’s expire time.

Self Querier Uptime

This querier’s time up.

General Query Received

The number of general queries received on this interface.

General Query Sent

The number of general queries sent from this interface.

Specific Query Received

The number of specific queries received on this interface.

Specific Query Sent

The number of specific queries sent from this interface.

– 771 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Table 154: show mvr statistics query - display description (Continued)
Field

Description

Warn Rate Limit

Count down from 15 seconds after receiving a Query different from theconfigured version.

V# Warning Count

Number of queries received on MVR that were configured for IGMP
version 1, 2 or 3.

The following shows MVR summary statistics for an interface:
Console#show mvr domain 1 statistics summary interface ethernet 1/1
Domain 1:
Number of Groups: 0
Querier::
Report & Leave::
Transmit:
Transmit:
General: 0
Report: 7Group Specific : 0
Leave
: 4
Received:
Received:
General: 0
Report: 0Group Specific : 0
Leave
: 0
V1 Warning Count: 0
Join Success: 0
V2 Warning Count: 0
Filter Drop: 0
V3 Warning Count: 0
Source Port Drop: 0
Others Drop
: 0
Console#Table 155: show mvr statistics summary interface - display description
Field

Description

DomainAn independent multicast domain.

Number of Groups

Number of groups learned on this port.

Querier
Transmit
General

Number of general queries transmitted.

Group Specific

Number of group specific queries transmitted.

Received
General

Number of general queries received.

Group Specific

Number of group specific queries received.

V# Warning Count

Number of queries received on MVR that were configured for IGMP
version 1, 2 or 3.

Report & Leave
Transmit
ReportNumber of transmitted reports.

Leave

Number of transmitted leaves.

Received– 772 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv4

Table 155: show mvr statistics summary interface - display description
Field

Description

ReportNumber of reports received.

Leave

Number of leaves received.

Join Success

Number of join reports processed successfully.

Filter Drop

Number of report/leave messages dropped by IGMP filter.

Source Port Drop

Number of report/leave messages dropped by MVR source port.

Others Drop

Number of report/leave messages dropped for other reasons.

The following shows MVR summary statistics for the MVR VLAN:
Console#show mvr domain 1 statistics summary interface mvr-vlan
Domain 1:
Number of Groups: 0
Querier::
Report & Leave::
Other Querier: NoneHost IP Addr
: 192.168.0.66
Other Expire: 0(m):0(s)Unsolicit Expire : 5(m):4(s)Other Uptime: 0(h):0(m):0(s)Self Querier: NoneSelf Expire: 1(m):45(s):Self Uptime: 0(h):14(m):54(s)Transmit:
Transmit:
General: 11
Report: 7Group Specific : 3
Leave
: 4
Received:
Received:
General: 0
Report: 6Group Specific : 0
Leave
: 0
V1 Warning Count: 0
Join Success: 6
V2 Warning Count: 0
Filter Drop: 0
V3 Warning Count: 0
Source Port Drop: 0
Others Drop
: 0
Console#Table 156: show mvr statistics summary interface mvr vlan - description
Field

Description

DomainAn independent multicast domain.

Number of Groups

Number of groups learned on this port.

Querier
Other Querier

Other IGMP querier’s IP address.

Other Expire

Other querier’s expire time.

Other Uptime

Other querier’s time up.

Self QuerierThis querier’s IP address.

Self Expire

This querier’s expire time.

Self Uptime

This querier’s time up.

Transmit– 773 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv4

Table 156: show mvr statistics summary interface mvr vlan - description
Field

Description

General

Number of general queries sent from receiver port.

Group Specific

Number of group specific queries sent from receiver port.

Received
General

Number of general queries received.

Group Specific

Number of group specific queries received.

V# Warning Count

Number of queries received on MVR that were configured by IGMP
version 1, 2 or 3.

Report & Leave
Host IP Addr

Source IP address used to send report/leave messages from source
port.

Unsolicit Expire

Expiration time for unsolicit reports sent out from source port

Transmit
ReportNumber of reports sent out from source port.

Leave

Number of leaves sent out from source port.

Received
ReportNumber of reports received.

Leave

Number of leaves received.

Join Success

Number of join reports processed successfully.

Filter Drop

Number of report/leave messages dropped by IGMP filter.

Source Port Drop

Number of report/leave messages dropped by MVR source port.

Others Drop

Number of report/leave messages dropped for other reasons.

– 774 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

MVR for IPv6
This section describes commands used to configure Multicast VLAN Registration forIPv6 (MVR6). A single network-wide VLAN can be used to transmit multicast traffic(such as television channels) across a service provider’s network. Any multicast
traffic entering an MVR6 VLAN is sent to all subscribers. This can significantly reduceto processing overhead required to dynamically monitor and establish the
distribution tree for a normal multicast VLAN. Also note that MVR6 maintains theuser isolation and data security provided by VLAN segregation by passing only
multicast traffic into other VLANs to which the subscribers belong.
Table 157: Multicast VLAN Registration for IPv6 Commands
CommandFunctionMode

mvr6 associated-profile

Binds the MVR6 group addresses specified in a profile to an
MVR6 domainGC

mvr6 domain

Enables MVR6 for a specific domainGC

mvr6 profile

Maps a range of MVR6 group addresses to a profileGC

mvr6 proxy-query-interval

Configures the interval at which the receiver port sends out
general queries.

GC

mvr6 proxy-switching

Enables MVR6 proxy switching, where the source port acts as GCa host, and the receiver port acts as an MVR6 router with
querier service enabled

mvr6 robustness-value

Configures the expected packet loss, and thereby the number GC
of times to generate report and group-specific queries

mvr6 source-port-mode
dynamic

Configures the switch to only forward multicast streams
which the source port has dynamically joinedGC

mvr6 upstream-source-ip

Configures the source IP address assigned to all control
packets sent upstreamGC

mvr6 vlan

Specifies the VLAN through which MVR6 multicast data isreceivedGC

mvr6 immediate-leave

Enables immediate leave capabilityIC

mvr6 type

Configures an interface as an MVR6 receiver or source portIC

mvr6 vlan group

Statically binds a multicast group to a portIC

clear mvr6 groups dynamic Clears multicast group information dynamically learned
through MVR6

PE

clear mvr6 statistics

Clears the MVR6 statistics globally or on a per-interface basis PE

show mvr6

Shows information about MVR6 domain settings, including
MVR6 operational status, the multicast VLAN, the current
number of group addresses, and the upstream source IP
addressPE

show mvr6 associatedprofileShows the profiles bound the specified domainPEshow mvr6 interface

Shows MVR6 settings for interfaces attached to the MVR6
VLAN

PE

– 775 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

Table 157: Multicast VLAN Registration for IPv6 Commands (Continued)
CommandFunctionModeshow mvr6 members

Shows information about the current number of entries in the PE
forwarding database, or detailed information about a specificmulticast address in all domain IDs

show mvr6 domain

Shows information about the current number of entries in theforwarding database, or detailed information about a specificmulticast address for a specific domain ID.

show mvr6 profileShows all configured MVR6 profiles

PEshow mvr6 statistics

Shows MVR6 protocol statistics for the specified interfacePE

mvr6 associated- This command binds the MVR6 group addresses specified in a profile to an MVR6
profile domain. Use the no form of this command to remove the binding.
Syntax[no] mvr6 domain domain-id associated-profile profile-namedomain-id - An independent multicast domain. (Range: 1-5)
profile-name - The name of a profile containing one or more MVR6 groupaddresses. (Range: 1-21 characters)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
MVR6 domains can be associated with more than one MVR6 profile. But since MVR6
domains cannot share the group range, an MVR6 profile can only be associatedwith one MVR6 domain.
ExampleThe following an MVR6 group address profile to domain 1:
Console(config)#mvr6 domain 1 associated-profile rdConsole(config)#

mvr6 domain This command enables Multicast VLAN Registration for IPv6 (MVR6) for a specificdomain. Use the no form of this command to disable MVR6 for a domain.

– 776 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

Syntax[no] mvr6 domain domain-id
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
When MVR6 is enabled on a domain, any multicast data associated with an MVR6
group is sent from all designated source ports, to all receiver ports that haveregistered to receive data from that multicast group.
ExampleThe following example enables MVR6 for domain 1:
Console(config)#mvr6 domain 1
Console(config)#

mvr6 profile This command maps a range of MVR6 group addresses to a profile. Use the no formof this command to remove the profile.
Syntaxmvr6 profile profile-name start-ip-address end-ip-addressno mvr6 profile profile-nameprofile-name - The name of a profile containing one or more MVR6 groupaddresses. (Range: 1-21 characters)
start-ip-address - Starting IPv6 address for an MVR6 multicast group. Thisparameter must be a full IPv6 address including the network prefix andhost address bits.
end-ip-address - Ending IPv6 address for an MVR6 multicast group. Thisparameter must be a full IPv6 address including the network prefix andhost address bits.
Default Setting
No profiles are defined
Command Mode
Global Configuration– 777 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

Command Usage Use this command to statically configure all multicast group addresses that will
join the MVR6 VLAN. Any multicast data associated with an MVR6 group is sentfrom all source ports, and to all receiver ports that have registered to receive
data from that multicast group.
 IGMP snooping and MVR6 share a maximum number of 1024 groups. Any

multicast streams received in excess of this limitation will be flooded to all ports
in the associated domain.

 All IPv6 addresses must be according to RFC 2373 “IPv6 Addressing

Architecture,” using 8 colon-separated 16-bit hexadecimal values. One doublecolon may be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields. (Note that the IP address ff02::X is reserved.)

 The MVR6 group address range assigned to a profile cannot overlap with thegroup address range of any other profile.

ExampleThe following example maps a range of MVR6 group addresses to a profile:
Console(config)#mvr6 profile rd ff01:0:0:0:0:0:0:fe ff01:0:0:0:0:0:0:ff
Console(config)#

mvr6 proxy-query- This command configures the interval at which the receiver port sends out generalinterval queries. Use the no form to restore the default setting.
Syntaxmvr6 proxy-query-interval interval
no mvr6 proxy-query-intervalinterval - The interval at which the receiver port sends out general queries.
(Range: 2-31744 seconds)
Default Setting
125 seconds
Command Mode
Global Configuration
Command Usage
This command sets the general query interval at which active receiver ports sendout general queries. This interval is only effective when proxy switching is enabledwith the mvr6 proxy-switching command.

– 778 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

ExampleThis example sets the proxy query interval for MVR6.
Console(config)#mvr6 proxy-query-interval 1000
Console(config)#

mvr6 proxy-switching This command enables MVR6 proxy switching, where the source port acts as a host,and the receiver port acts as an MVR6 router with querier service enabled. Use theno form to disable this function.
Syntax[no] mvr6 proxy-switching
Default Setting
EnabledCommand Mode
Global Configuration
Command Usage When MVR6 proxy-switching is enabled, an MVR6 source port serves as the
upstream or host interface, and the MVR6 receiver port serves as the querier.
The source port performs only the host portion of MVR6 by sending
summarized membership reports, and automatically disables MVR6 routerfunctions.
 Receiver ports are known as downstream or router interfaces. These interfaces

perform the standard MVR6 router functions by maintaining a database of all
MVR6 subscriptions on the downstream interface. Receiver ports must
therefore be configured on all downstream interfaces which require MVR6
proxy service.

 When the source port receives report and leave messages, it only forwards

them to other source ports.

 When receiver ports receive any query messages, they are dropped.
 When changes occurring in the downstream MVR6 groups are learned by thereceiver ports through report and leave messages, an MVR6 state changereport is created and sent to the upstream source port, which in turn forwards
this information upstream.

 When MVR6 proxy switching is disabled:Any membership reports received from receiver/source ports areforwarded to all source ports.

– 779 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

When a source port receives a query message, it will be forwarded to all
downstream receiver ports.

When a receiver port receives a query message, it will be dropped.

ExampleThe following example enable MVR6 proxy switching.
Console(config)#mvr6 proxy-switching
Console(config)#

Related Commands
mvr6 robustness-value (780)

mvr6 robustness- This command configures the expected packet loss, and thereby the number ofvalue times to generate report and group-specific queries. Use the no form to restore thedefault setting.
Syntaxmvr6 robustness-value value
no mvr6 robustness-value
value - The robustness used for all interfaces. (Range: 1-10)
Default Setting
2
Command Mode
Global Configuration
Command Usage This command sets the number of times report messages are sent upstream
when changes are learned about downstream groups, and the number of times
group-specific queries are sent to downstream receiver ports.
 This command only takes effect when MVR6 proxy switching is enabled.

ExampleConsole(config)#mvr6 robustness-value 5
Console(config)#

Related Commands
mvr6 proxy-switching (779)– 780 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

mvr6 source-port- This command configures the switch to only forward multicast streams which themode dynamic source port has dynamically joined. Use the no form to restore the default setting.
Syntaxmvr6 source-port-mode dynamic
no mvr6 source-port-mode
Default Setting
Forwards all multicast streams which have been specified in a profile and bound toa domain.
Command Mode
Global Configuration
Command Usage By default, the switch forwards any multicast streams within the address range
set by a profile, and bound to a domain. The multicast streams are sent to all
source ports on the switch and to all receiver ports that have elected to receive
data on that multicast address.
 When the mvr6 source-port-mode dynamic command is used, the switch

only forwards multicast streams which the source port has dynamically joined.
In other words, both the receiver port and source port must subscribe to a
multicast group before a multicast stream is forwarded to any attached client.
Note that the requested streams are still restricted to the address range which
has been specified in a profile and bound to a domain.

ExampleConsole(config)#mvr6 source-port-mode dynamic
Console(config)#

mvr6 upstream- This command configures the source IPv6 address assigned to all MVR6 control
source-ip packets sent upstream on the specified domain. Use the no form to restore thedefault setting.
Syntaxmvr6 domain domain-id upstream-source-ip source-ip-addressno mvr6 domain domain-id upstream-source-ip
domain-id - An independent multicast domain. (Range: 1-5)
source-ip-address – The source IPv6 address assigned to all MVR6 control
packets sent upstream. This parameter must be a full IPv6 address
including the network prefix and host address bits.

– 781 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

Default Setting
All MVR6 reports sent upstream use a null source IP address
Command Mode
Global Configuration
Command UsageAll IPv6 addresses must be according to RFC 2373 “IPv6 Addressing Architecture,”using 8 colon-separated 16-bit hexadecimal values. One double colon may be usedin the address to indicate the appropriate number of zeros required to fill the
undefined fields. (Note that the IP address ff02::X is reserved.)
ExampleConsole(config)#mvr6 domain 1 upstream-source-ip 2001:DB8:2222:7223::72
Console(config)#

mvr6 vlan This command specifies the VLAN through which MVR6 multicast data is received.
Use the no form of this command to restore the default MVR6 VLAN.
Syntaxmvr6 domain domain-id vlan vlan-id
no mvr6 domain domain-id vlandomain-id - An independent multicast domain. (Range: 1-5)
vlan-id - Specifies the VLAN through which MVR6 multicast data is received.
This is also the VLAN to which all source ports must be assigned.
(Range: 1-4094)
Default Setting
VLAN 1
Command Mode
Global Configuration
Command Usage
MVR6 source ports can be configured as members of the MVR6 VLAN using theswitchport allowed vlan command and switchport native vlan command, but
MVR6 receiver ports should not be statically configured as members of this VLAN.
ExampleThe following example sets the MVR6 VLAN to VLAN 1:
Console(config)#mvr6 domain 1 vlan 1
Console(config)#– 782 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

mvr6 immediate-leave This command causes the switch to immediately remove an interface from amulticast stream as soon as it receives a leave message for that group. Use the noform to restore the default settings.
Syntax[no] mvr6 domain domain-id immediate-leave [by-host-ip]
domain-id - An independent multicast domain. (Range: 1-5)
by-host-ip - Specifies that the member port will be deleted only when
there are no hosts joining this group.

Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
 Immediate leave applies only to receiver ports. When enabled, the receiver port
is immediately removed from the multicast group identified in the leavemessage. When immediate leave is disabled, the switch follows the standard
rules by sending a group-specific query to the receiver port and waiting for a
response to determine if there are any remaining subscribers for that multicast
group before removing the port from the group list.
 If the “by-host-ip” option is used, the router/querier will not send out a group-

specific query when an MLDv1/v2 Listener Done message is received (the sameas it would without this option having been used). Instead of immediately
deleting that group, it will look up the record, and only delete the group if there
are no other subscribers for it on the member port. Only when all hosts on thatport leave the group will the member port be deleted.

 Using immediate leave can speed up leave latency, but should only be enabled

on a port attached to only one multicast subscriber to avoid disrupting services
to other group members attached to the same interface.

 Immediate leave does not apply to multicast groups which have been staticallyassigned to a port with the mvr6 vlan group command.

ExampleThe following enables immediate leave on a receiver port.
Console(config)#interface ethernet 1/5
Console(config-if)#mvr6 domain 1 immediate-leave
Console(config-if)#– 783 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

mvr6 type This command configures an interface as an MVR6 receiver or source port. Use theno form to restore the default settings.
Syntaxmvr6 domain domain-id type {receiver | source}
no mvr6 domain domain-id typedomain-id - An independent multicast domain. (Range: 1-5)
receiver - Configures the interface as a subscriber port that can receive
multicast data.
source - Configures the interface as an uplink port that can send andreceive multicast data for the configured multicast groups. Note that thesource port must be manually configured as a member of the MVR6 VLAN
using the switchport allowed vlan command.
Default Setting
The port type is not defined.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage A port configured as an MVR6 receiver or source port can join or leave multicast
groups configured under MVR6. A port which is not configured as an MVR6
receiver or source port can use MLD snooping to join or leave multicast groups
using the standard rules for multicast filtering (see “MLD Snooping” onpage 725).
 Receiver ports can belong to different VLANs, but should not be configured as amember of the MVR6 VLAN. MLD snooping can be used to allow a receiver port
to dynamically join or leave multicast groups not sourced through the MVR6
VLAN. Also, note that VLAN membership for MVR6 receiver ports cannot be set
to access mode (see the switchport mode command).

 One or more interfaces may be configured as MVR6 source ports. A source port

is able to both receive and send data for multicast groups which it has joined
through the MVR6 protocol or which have been assigned through the mvr6
vlan group command.
All source ports must belong to the MVR6 VLAN.
Subscribers should not be directly connected to source ports.

 The same port cannot be configured as a source port in one MVR6 domain andas a receiver port in another domain.

– 784 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

ExampleThe following configures one source port and several receiver ports on the switch.
Console(config)#interface ethernet 1/5
Console(config-if)#mvr6 domain 1 type source
Console(config-if)#exit
Console(config)#interface ethernet 1/6
Console(config-if)#mvr6 domain 1 type receiver
Console(config-if)#exit
Console(config)#interface ethernet 1/7
Console(config-if)#mvr6 domain 1 type receiver
Console(config-if)#

mvr6 vlan group This command statically binds a multicast group to a port which will receive longterm multicast streams associated with a stable set of hosts. Use the no form torestore the default settings.
Syntax[no] mvr6 domain domain-id vlan vlan-id group ip-address
domain-id - An independent multicast domain. (Range: 1-5)
vlan-id - Receiver VLAN to which the specified multicast traffic is flooded.
(Range: 1-4094)
group - Defines a multicast service sent to the selected port.
ip-address - Statically configures an interface to receive multicast traffic
from the IPv6 address specified for an MVR6 multicast group. Thisparameter must be a full IPv6 address including the network prefix andhost address bits.
Default Setting
No receiver port is a member of any configured multicast group.
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Multicast groups can be statically assigned to a receiver port using thiscommand. The assigned address must fall within the range set by the mvr6
associated-profile command.
 All IPv6 addresses must be according to RFC 2373 “IPv6 Addressing

Architecture,” using 8 colon-separated 16-bit hexadecimal values. One doublecolon may be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields. (Note that the IP address ff02::X is reserved.)

 The MVR6 VLAN cannot be specified as the receiver VLAN for static bindings.

– 785 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

ExampleThe following statically assigns a multicast group to a receiver port:
Console(config)#interface ethernet 1/2
Console(config-if)#mvr6 domain 1 type receiver
Console(config-if)#mvr6 domain 1 vlan 2 group ff00::1
Console(config-if)#clear mvr6 groups This command clears multicast group information dynamically learned throughdynamic MVR6.
Syntaxclear mvr6 groups dynamic domain-id
domain-id - An independent multicast domain. (Range: 1-5)
Command Mode
Privileged Exec
Command Usage
This command only clears entries learned though MVR6. Statically configured
multicast addresses are not cleared.
ExampleConsole#clear mvr6 groups dynamic
Console#clear mvr6 statistics This command clears MVR6 statistics.
Syntaxclear mvr6 statistics [interface interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN identifier (Range: 1-4094)
Command Mode
Privileged Exec

– 786 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

Command Usage
If the interface option is not used then all MVR6 statistics are cleared. Otherwise
using the interface option will only clear MVR6 statistics for the specified interface.
ExampleConsole#clear mvr6 statistics
Console#show mvr6 This command shows information about MVR6 domain settings, including MVR6

operational status, the multicast VLAN, the current number of group addresses, andthe upstream source IP address.
Syntaxshow mvr6 [domain domain-id]
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Displays configuration settings for all MVR6 domains.
Command Mode
Privileged Exec
ExampleThe following shows the MVR6 settings:
Console#show mvr6
MVR6 Proxy Switching
MVR6 Robustness Value
MVR6 Proxy Query Interval
MVR6 Source Port Mode

: Enabled: 1: 125(sec.): Always Forward

Domain: 1
MVR6 Config Status: Enabled
MVR6 Running Status: Active
MVR6 Multicast VLAN
: 1
MVR6 Current Learned Groups : 0
MVR6 Upstream Source IP: FF05::25
Console#Table 158: show mvr6 - display description
Field

Description

MVR6 Proxy Switching

Shows if MVR6 proxy switching is enabled

MVR6 Robustness Value

Shows the number of reports or query messages sent when proxyswitching is enabled

MVR6 Proxy Query
Interval

The interval at which the receiver port sends out general queries– 787 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

Table 158: show mvr6 - display description (Continued)
Field

Description

MVR6 Source Port Mode Shows if the switch only forwards multicast streams which the source port
has dynamically joined or always forwards multicast streams
DomainAn independent multicast domain.

MVR6 Config Status

Shows if MVR6 is globally enabled on the switch.

MVR6 Running Status

Indicates whether or not all necessary conditions in the MVR6
environment are satisfied. (Running status is true as long as MVR6 Status isenabled, and the specified MVR6 VLAN exists, and a source port with avalid link has been configured (using the mvr6 type command.)

MVR6 Multicast VLAN

Shows the VLAN used to transport all MVR6 multicast traffic.

MVR Current Learned
Groups

The current number of MVR group addresses

MVR6 Upstream Source
IP

The source IP address assigned to all upstream control packets.

show mvr6 This command shows the profiles bound the specified domain.
associated-profile
Syntaxshow mvr6 [domain domain-id] associated-profile
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Displays profiles bound to all MVR6 domains.
Command Mode
Privileged Exec
ExampleThe following displays the profiles bound to domain 1:
Console#show mvr6 domain 1 associated-profile
Domain ID : 1
MVR6 Profile Name
Start IPv6 Addr.
End IPv6 Addr.
--------------------- ------------------------- ------------------------rd
ff01::fe
ff01::ff
Console#– 788 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

show mvr6 interface This command shows MVR6 configuration settings for interfaces attached to the
MVR6 VLAN.
Syntaxshow mvr6 [domain domain-id] interface
domain-id - An independent multicast domain. (Range: 1-5)
Default Setting
Displays configuration settings for all attached interfaces.
Command Mode
Privileged Exec
ExampleThe following displays information about the interfaces attached to the MVR6VLAN in domain 1:
Console#show mvr6 domain 1 interface
MVR6 Domain : 1
Port
Type
StatusImmediate Leave Static Group Address-------- -------- ------------------- ---------------- ---------------Eth1/ 1 Source
Active/Forwarding
Eth1/ 2 Receiver Active/Forwarding
Disabled
ff00::1(VLAN1)
Console#Table 159: show mvr6 interface - display description
Field

Description

Port

Shows interfaces attached to the MVR6.

Type

Shows the MVR6 port type.

StatusShows the MVR6 status and interface status. MVR6 status for source ports is“ACTIVE” if MVR6 is globally enabled on the switch. MVR6 status for receiverports is “ACTIVE” only if there are subscribers receiving multicast traffic fromone of the MVR6 groups, or a multicast group has been statically assigned to
an interface.

Immediate Leave

Shows if immediate leave is enabled or disabled.

Static Group Address

Shows any static MVR6 group assigned to an interface, and the receiver
VLAN.

show mvr6 members This command shows information about the current number of entries in theforwarding database, or detailed information about a specific multicast address.
show mvr6 members { [ip-address]| host-ip-address [ip-address | ds-vlan vlanid [ip-address | interface ip-address] | interface ip-address ] | mld | sort-by-port[ip-address | ds-vlan vlan-id [ip-address | interface ip-address] | interface ipaddress ] | unknown]}– 789 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

ip-address - IPv6 address for an MVR6 multicast group.
host-ip-address - Show entries by subscriber IPv6 address
mld - Show entries created by MLD protocol.
sort-by-port - Show entries with groups sorted by port.
unknown - Show entries created by receiving multicast streams.
user - Show user configured entries.
ds-vlan - Downstream VLAN ID (Range: 1-4094)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
Displays configuration settings for all domains and all forwarding entries.
Command Mode
Privileged Exec
ExampleThe following shows information about the current number of multicast
forwarding entries in all domains.
Console#show mvr6 members
MVR6 Domain : 1
MVR6 Forwarding Entry Count :0
MVR6 Domain : 2
MVR6 Forwarding Entry Count :0
MVR6 Domain : 3
MVR6 Forwarding Entry Count :0
MVR6 Domain : 4
MVR6 Forwarding Entry Count :0
MVR6 Domain : 5
MVR6 Forwarding Entry Count :0
Console#– 790 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

show mvr6 domain This command shows information about the current number of entries in theforwarding database, or detailed information about a specific multicast address fora specific domain ID.
Syntaxshow mvr6 domain domain-id] {members [ip-address]| host-ip-address [ipaddress | ds-vlan vlan-id [ip-address | interface ip-address] | interface ip-address] | mld | sort-by-port [ip-address | ds-vlan vlan-id [ip-address | interface ipaddress] | interface ip-address ] | unknown]}
domain-id - An independent multicast domain. (Range 1-5)
ip-address - IPv6 address for an MVR6 multicast group.
host-ip-address - Show entries by subscriber IPv6 address
mld - Show entries created by MLD protocol.
sort-by-port - Show entries with groups sorted by port.
unknown - Show entries created by receiving multicast streams.
user - Show user configured entries.
ds-vlan - Downstream VLAN ID (Range: 1-4094)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
Displays configuration settings for the specified domain and all its forwarding
entries.
Command Mode
Privileged Exec
ExampleThe following shows information about the number of multicast forwarding entries
currently active in domain 1:
Console#show mvr6 domain 1 members
MVR6 Domain : 1
MVR6 Forwarding Entry Count :1
Flag: S - Source port, R - Receiver port.
H - Host counts (number of hosts join the group on this port).
P - Port counts (number of forwarding ports).
Up time: Group elapsed time (d:h:m:s).
Expire : Group remaining time (m:s).
Group Address
VLAN PortUp timeExpire Count------------------------------ ---- ----------- ----------- ------ --------– 791 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

ff05::101

2
2
1

00:00:00:19
Eth1/ 1(S)Eth1/ 2(R)

2(P)
0(H)

Console#The following example shows detailed information about a specific multicast
address:
Console#show mvr6 domain 1 members ff00::1
MVR6 Domain : 1
MVR6 Forwarding Entry Count :1
Flag: S - Source port, R - Receiver port.
H - Host counts (number of hosts join the group on this port).
P - Port counts (number of forwarding ports).
Up time: Group elapsed time (d:h:m:s).
Expire : Group remaining time (m:s).
Group Address
VLAN PortUp timeExpire Count------------------------------ ---- ----------- ----------- ------ -------ff05::1
2
00:00:03:18
2(P)2 Eth1/ 2(S)1 Eth1/ 4(R)0(H)
Console#Table 160: show mvr6 members - display description
Field

Description

Group Address

Multicast group address.

VLAN

VLAN to which this address is forwarded.

Port

Port to which this address is forwarded.

Up timeTime that this multicast group has been known.

Expire

The time until this entry expires.

Count

The number of times this address has been learned by MVR6.

show mvr6 profile This command shows all configured MVR6 profiles.
Command Mode
Privileged Exec
ExampleThe following shows all configured MVR6 profiles:
Console#show mvr6 profile
MVR6 Profile Name
Start IPv6 Addr.
End IPv6 Addr.
--------------------- ------------------------- ------------------------rd
ff01::fe
ff01::ff
Console#– 792 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

show mvr6 statistics This command shows MVR6 protocol-related statistics for the specified interface.
Syntaxshow mvr6 [domain domain-id] statistics {input [interface interface] |output [interface interface] | query | summary {interface [ethernet unit/
port | mvr-vlan | port-channel channel-id]}}
input - Specifies to display statistics for messages received by the interface.
output - Specifies to display statistics for messages sent by the interface.
domain-id - An independent multicast domain. (Range: 1-5)
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
vlan vlan-id - VLAN ID (Range: 1-4094)
query - Displays MVR query-related statistics.
summary - Displays MVR6 summary information.
mvr vlan - Displays summary statistics for the MVR6 VLAN.
Default Setting
Displays statistics for all domains.
Command Mode
Privileged Exec
ExampleThe following shows MVR6 protocol-related statistics received:
Console#show mvr6 domain 1 statistics input
MVR6 Domain 1, MVR6 VLAN 2:
Input Statistics:
Interface Report
Leave
G Query G(-S)-S Query Drop
Join Succ Group--------- -------- -------- -------- ------------- -------- --------- -----Eth 1/ 1
23
11
4
10
5
20
9
Eth 1/ 2
12
15
8
3
5
19
4
2
20
9
DVLAN
1
2
0
0
2
MVLAN
2
2
0
0
2
2
20
9
Console#– 793 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

Table 161: show mvr6 statistics input - display description
Field

Description

InterfaceShows interfaces attached to the MVR6.

Report

The number of IGMP membership reports received on this interface.

Leave

The number of leave messages received on this interface.

G Query

The number of general query messages received on this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query messages
received on this interface.

Drop

The number of times a report, leave or query was dropped. Packets may be
dropped due to invalid format, rate limiting, packet content not allowed, or MVR6
group report received

Join Succ

The number of times a multicast group was successfully joined.

Group

The number of MVR6 groups active on this interface.

The following shows MVR6 protocol-related statistics sent:
Console#show mvr6 domain 1 statistics output
MVR6 Domain 1, MVR6 VLAN 2:
Output Statistics:
Interface Report
Done
G Query G(-S)-S Query Drop
Group---------- -------- -------- -------- ------------- -------- -----Eth 1/ 1
12
0
1
0
0
0
Eth 1/ 3
5
1
4
1
0
0
DVLAN
1
7
2
3
0
0
0
MVLAN
2
7
2
3
0
0
0
Console#Table 162: show mvr6 statistics output - display description
Field

Description

InterfaceShows interfaces attached to the MVR6.

Report

The number of IGMP membership reports sent from this interface.

Leave

The number of leave messages sent from this interface.

G Query

The number of general query messages sent from this interface.

G(-S)-S QueryThe number of group specific or group-and-source specific query messages sentfrom this interface.

Group

The number of MVR6 groups active on this interface.

The following shows MVR6 query-related statistics:
Console#show mvr6 domain 1 statistics query
Other Querier Address: NoneOther Querier Uptime: 0(h):0(m):0(s)Other Querier Expire Time : 0(m):0(s)Self Querier Address: 2001:db8:2222:7272::
Self Querier Uptime: 0(h):0(m):0(s)– 794 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

Self Querier Expire Time
General Query Received
General Query Sent
Specific Query Received
Specific Query Sent
Console#: 0(m):0(s)
: 0
: 0
: 0
: 0

Table 163: show mvr6 statistics query - display description
Field

Description

Other Querier Address

The IPv6 address of the querier on this interface.

Other Querier Uptime

Other querier’s time up.

Other Querier Expire TimeThe time after which this querier is assumed to have expired.

Self Querier AddressThis querier’s IPv6 address.

Self Querier Uptime

This querier’s time up.

Self Querier Expire Time

This querier’s expire time.

General Query Received

The number of general queries received on this interface.

General Query Sent

The number of general queries sent from this interface.

Specific Query Received

The number of specific queries received on this interface.

Specific Query Sent

The number of specific queries sent from this interface.

The following shows MVR6 summary statistics for an interface:
Console#show mvr6 domain 1 statistics summary interface ethernet 1/1
Domain 1:
Number of Groups: 0
Querier::
Report & Leave::
Transmit:
Transmit:
General: 0
Report: 7Group Specific : 0
Leave
: 4
Recieved:
Recieved:
General: 0
Report: 0Group Specific : 0
Leave
: 0
Join Success: 0
Filter Drop
: 0
Source Port Drop: 0
Others Drop
: 0
Console#Table 164: show mvr6 statistics summary interface - display description
Field

Description

DomainAn independent multicast domain.

Number of Groups

Number of groups learned on this port.

Querier
Transmit
General

Number of general queries transmitted.

– 795 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

Table 164: show mvr6 statistics summary interface - display description
Field

Description

Group Specific

Number of group specific queries transmitted.

Received
General

Number of general queries received.

Group Specific

Number of group specific queries received.

Report & Leave
Transmit
ReportNumber of transmitted reports.

Leave

Number of transmitted leaves.

Received
ReportNumber of reports received.

Leave

Number of leaves received.

Join Success

Number of join reports processed successfully.

Filter Drop

Number of report/leave messages dropped by IGMP filter.

Source Port Drop

Number of report/leave messages dropped by MVR source port.

Others Drop

Number of report/leave messages dropped for other reasons.

The following shows MVR6 summary statistics for the MVR6 VLAN:
Console#show mvr6 domain 1 statistics summary interface mvr-vlan
Domain 1:
Number of Groups: 0
Querier::
Report & Leave::
Other Addr
: NoneHost Addr: NoneOther Expire: 0(m): 0(s)Unsolicit Expire : 0 sec
Other Uptime: 0(h): 0(m): 0(s)Self Addr: NoneSelf Expire: 0(m): 0(s)Self Uptime: 0(h): 0(m): 0(s)Transmit:
Transmit:
General: 0
Report: 0Group Specific : 0
Leave
: 0
Recieved:
Recieved:
General: 0
Report: 0Group Specific : 0
Leave
: 0
join Success: 0
Filter Drop
: 0
Source Port Drop: 0
Others Drop
: 0
Console#– 796 –

Chapter 27 | Multicast Filtering Commands
MVR for IPv6

Table 165: show mvr6 statistics summary interface mvr vlan - description
Field

Description

DomainAn independent multicast domain.

Number of Groups

Number of groups learned on this port.

Querier
Other Addr

Other IGMP querier’s IP address.

Other Expire

Other querier’s expire time.

Other Uptime

Other querier’s time up.

Self Addr

This querier’s IP address.

Self Expire

This querier’s expire time.

Self Uptime

This querier’s time up.

Transmit
General

Number of general queries sent from receiver port.

Group Specific

Number of group specific queries sent from receiver port.

Received
General

Number of general queries received.

Group Specific

Number of group specific queries received.

Report & Leave
Host Addr

Source IP address used to send report/leave messages from source
port.

Unsolicit Expire

Expiration time for unsolicit reports sent out from source port

Transmit
ReportNumber of reports sent out from source port.

Leave

Number of leaves sent out from source port.

Received

Field header

ReportNumber of reports received.

Leave

Number of leaves received.

Join Success

Number of join reports processed successfully.

Filter Drop

Number of report/leave messages dropped by IGMP filter.

Source Port Drop

Number of report/leave messages dropped by MVR source port.

Others Drop

Number of report/leave messages dropped for other reasons.

– 797 –

Chapter 27 | Multicast Filtering Commands

MVR for IPv6

– 798 –

28

LLDP Commands

Link Layer Discovery Protocol (LLDP) is used to discover basic information aboutneighboring devices on the local broadcast domain. LLDP is a Layer 2 protocol thatuses periodic broadcasts to advertise information about the sending device.
Advertised information is represented in Type Length Value (TLV) format according
to the IEEE 802.1AB standard, and can include details such as device identification,
capabilities and configuration settings. LLDP also defines how to store andmaintain information gathered about the neighboring network nodes it discovers.
Link Layer Discovery Protocol - Media Endpoint Discovery (LLDP-MED) is anextension of LLDP intended for managing endpoint devices such as Voice over IP
phones and network switches. The LLDP-MED TLVs advertise information such as
network policy, power, inventory, and device location details. LLDP and LLDP-MED
information can be used by SNMP applications to simplify troubleshooting,enhance network management, and maintain an accurate network topology.
Table 166: LLDP Commands
CommandFunction

Mode

lldp

Enables LLDP globally on the switchGC

lldp holdtime-multiplierConfigures the time-to-live (TTL) value sent in LLDP
advertisements

GC

lldp
med-fast-start-countConfigures how many medFastStart packets are transmittedGC

lldp notification-interval Configures the allowed interval for sending SNMP
notifications about LLDP changes

GC

lldp refresh-interval

Configures the periodic transmit interval for LLDP
advertisements

GC

lldp reinit-delay

Configures the delay before attempting to re-initialize after
LLDP ports are disabled or the link goes downGC

lldp tx-delay

Configures a delay between the successive transmission ofadvertisements initiated by a change in local LLDP MIB
variablesGC

lldp admin-status

Enables LLDP transmit, receive, or transmit and receive mode IC
on the specified port

lldp basic-tlv
Configures an LLDP-enabled port to advertise themanagement-ip-address management address for this deviceIClldp basic-tlv
management-ipv6address

Configures an LLDP-enabled port to advertise themanagement address for this deviceIClldp basic-tlv
port-description

Configures an LLDP-enabled port to advertise its port
description

IC– 799 –

Chapter 28 | LLDP Commands

Table 166: LLDP Commands (Continued)
CommandFunctionModelldp basic-tlv
system-capabilities

Configures an LLDP-enabled port to advertise its systemcapabilities

IC

lldp basic-tlv
system-description

Configures an LLDP-enabled port to advertise the systemdescriptionIC

lldp basic-tlv
system-name

Configures an LLDP-enabled port to advertise its system name IC

lldp dot1-tlv proto-ident* Configures an LLDP-enabled port to advertise the supported
protocolsIC

lldp dot1-tlv proto-vid*

Configures an LLDP-enabled port to advertise port-based
protocol related VLAN informationIC

lldp dot1-tlv pvid*

Configures an LLDP-enabled port to advertise its default VLAN IC
ID

lldp dot1-tlv vlan-name* Configures an LLDP-enabled port to advertise its VLAN nameIC

lldp dot3-tlv link-agg

Configures an LLDP-enabled port to advertise its linkaggregation capabilities

IC

lldp dot3-tlv mac-phy

Configures an LLDP-enabled port to advertise its MAC andphysical layer specifications

IC

lldp dot3-tlv max-frame

Configures an LLDP-enabled port to advertise its maximum
frame sizeIC

lldp dot3-tlv poe

Configures an LLDP-enabled port to advertise its Power-over- IC
Ethernet capabilities

lldp med-location
civic-addr

Configures an LLDP-MED-enabled port to advertise its
location identification detailsIC

lldp med-notification

Enables the transmission of SNMP trap notifications about
LLDP-MED changes

IC

lldp med-tlv ext-poe

Configures an LLDP-MED-enabled port to advertise its
extended Power over Ethernet configuration and usage
informationIC

lldp med-tlv inventory

Configures an LLDP-MED-enabled port to advertise its
inventory identification detailsIC

lldp med-tlv location

Configures an LLDP-MED-enabled port to advertise its
location identification detailsIC

lldp med-tlv med-cap

Configures an LLDP-MED-enabled port to advertise its Media
Endpoint Device capabilities

IC

lldp med-tlv
network-policy

Configures an LLDP-MED-enabled port to advertise its
network policy configurationIC

lldp notification

Enables the transmission of SNMP trap notifications about
LLDP changes

ICshow lldp config

Shows LLDP configuration settings for all portsPEshow lldp info
local-device

Shows LLDP global and interface-specific configuration
settings for this devicePEshow lldp info
remote-device

Shows LLDP global and interface-specific configuration
settings for remote devices

PEshow lldp info statistics

Shows statistical counters for all LLDP-enabled interfaces

PE*

Vendor-specific options may or may not be advertised by neighboring devices.

– 800 –

Chapter 28 | LLDP Commands

lldp This command enables LLDP globally on the switch. Use the no form to disable
LLDP.

Syntax[no] lldp
Default Setting
EnabledCommand Mode
Global Configuration
ExampleConsole(config)#lldp
Console(config)#

lldp This command configures the time-to-live (TTL) value sent in LLDP advertisements.
holdtime-multiplier Use the no form to restore the default setting.
Syntaxlldp holdtime-multiplier value
no lldp holdtime-multipliervalue - Calculates the TTL in seconds based on the following rule:
minimum of ((Transmission Interval * Holdtime Multiplier), or65536)(Range: 2 - 10)
Default Setting
Holdtime multiplier: 4
TTL: 4*30 = 120 seconds
Command Mode
Global Configuration
Command Usage The time-to-live tells the receiving LLDP agent how long to retain all
information pertaining to the sending LLDP agent if it does not transmit
updates in a timely manner.
ExampleConsole(config)#lldp holdtime-multiplier 10
Console(config)#– 801 –

Chapter 28 | LLDP Commands

lldp This command specifies the amount of MED Fast Start LLDPDUs to transmit during
med-fast-start-count the activation process of the LLDP-MED Fast Start mechanism. Use the no form torestore the default setting.
Syntaxlldp med-fast-start-count packet-number
no lldp med-fast-start-countpacket-number - Amount of packets. (Range: 1-10 packets;
Default: 4 packets)
Default Setting
4 packets
Command Mode
Global Configuration
Command Usage
This parameter is part of the timer which ensures that the LLDP-MED Fast Startmechanism is active for the port. LLDP-MED Fast Start is critical to the timely
startup of LLDP, and therefore integral to the rapid availability of Emergency Call
Service.
ExampleConsole(config)#lldp med-fast-start-count 6
Console(config)#

lldp This command configures the allowed interval for sending SNMP notifications
notification-interval about LLDP MIB changes. Use the no form to restore the default setting.
Syntaxlldp notification-interval seconds
no lldp notification-interval
seconds - Specifies the periodic interval at which SNMP notifications aresent. (Range: 5 - 3600 seconds)
Default Setting
5 seconds
Command Mode
Global Configuration
Command Usage This parameter only applies to SNMP applications which use data stored in the
LLDP MIB for network monitoring or management.
– 802 –

Chapter 28 | LLDP Commands

 Information about changes in LLDP neighbors that occur between SNMP

notifications is not transmitted. Only state changes that exist at the time of a
notification are included in the transmission. An SNMP agent should therefore
periodically check the value of lldpStatsRemTableLastChangeTime to detect
any lldpRemTablesChange notification-events missed due to throttling ortransmission loss.

ExampleConsole(config)#lldp notification-interval 30
Console(config)#

lldp refresh-interval This command configures the periodic transmit interval for LLDP advertisements.
Use the no form to restore the default setting.
Syntaxlldp refresh-interval seconds
no lldp refresh-delay
seconds - Specifies the periodic interval at which LLDP advertisements aresent. (Range: 5 - 32768 seconds)
Default Setting
30 seconds
Command Mode
Global Configuration
ExampleConsole(config)#lldp refresh-interval 60
Console(config)#

lldp reinit-delay This command configures the delay before attempting to re-initialize after LLDP
ports are disabled or the link goes down. Use the no form to restore the default
setting.
Syntaxlldp reinit-delay seconds
no lldp reinit-delay
seconds - Specifies the delay before attempting to re-initialize LLDP.
(Range: 1 - 10 seconds)
Default Setting
2 seconds– 803 –

Chapter 28 | LLDP Commands

Command Mode
Global Configuration
Command Usage
When LLDP is re-initialized on a port, all information in the remote systems LLDPMIB associated with this port is deleted.
ExampleConsole(config)#lldp reinit-delay 10
Console(config)#

lldp tx-delay This command configures a delay between the successive transmission ofadvertisements initiated by a change in local LLDP MIB variables. Use the no form
to restore the default setting.
Syntaxlldp tx-delay seconds
no lldp tx-delay
seconds - Specifies the transmit delay. (Range: 1 - 8192 seconds)
Default Setting
2 seconds
Command Mode
Global Configuration
Command Usage The transmit delay is used to prevent a series of successive LLDP transmissions

during a short period of rapid changes in local LLDP MIB objects, and toincrease the probability that multiple, rather than single changes, are reported
in each transmission.

 This attribute must comply with the following rule:(4 * tx-delay) refresh-interval

ExampleConsole(config)#lldp tx-delay 10
Console(config)#– 804 –

Chapter 28 | LLDP Commands

lldp admin-status This command enables LLDP transmit, receive, or transmit and receive mode on thespecified port. Use the no form to disable this feature.
Syntaxlldp admin-status {rx-only | tx-only | tx-rx}
no lldp admin-status
rx-only - Only receive LLDP PDUs.
tx-only - Only transmit LLDP PDUs.
tx-rx - Both transmit and receive LLDP Protocol Data Units (PDUs).
Default Setting
tx-rx
Command Mode
Interface Configuration (Ethernet, Port Channel)
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp admin-status rx-only
Console(config-if)#lldp basic-tlv This command configures an LLDP-enabled port to advertise the management
management-ip- address for this device. Use the no form to disable this feature.
address
Syntax[no] lldp basic-tlv management-ip-address
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage The management address protocol packet includes the IPv4 address of theswitch. If no management address is available, the address should be the MAC
address for the CPU or for the port sending this advertisement.
 The management address TLV may also include information about the specificinterface associated with this address, and an object identifier indicating thetype of hardware component or protocol entity associated with this address.
The interface number and OID are included to assist SNMP applications toperform network discovery by indicating enterprise specific or other starting
points for the search, such as the Interface or Entity MIB.
– 805 –

Chapter 28 | LLDP Commands

 Since there are typically a number of different addresses associated with aLayer 3 device, an individual LLDP PDU may contain more than one
management address TLV.

 Every management address TLV that reports an address that is accessible on aport and protocol VLAN through the particular port should be accompanied bya port and protocol VLAN TLV that indicates the VLAN identifier (VID)
associated with the management address reported by this TLV.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp basic-tlv management-ip-address
Console(config-if)#lldp basic-tlv This command configures an LLDP-enabled port to advertise the management
management-ipv6- IPv6 address for this device. Use the no form to disable this feature.
address
Syntax[no] lldp basic-tlv management-ipv6-address
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage If both the management-ip-address and the IPv4 address of a VLAN interface isconfigured, the primary IPv4 address of the VLAN ID will be sent in theManagement Address TLV of the LLDP PDU transmitted.
 If both the management-ipv6-address and the IPv6 address of a VLAN interface

is configured, the IPv6 address of the VLAN ID will be sent in the Management
Address TLV of the LLDP PDU transmitted.

 Two Management Address TLVs in the LLDP PDU will be sent if both of the two

conditions below are true:The interface has both commands configured i.e. management-ip-address
and management-ipv6-address.



The VLAN interface has both IPv4 and IPv6 addresses set.

One address will be the IPv4 address and the other will be the IPv6 address.
 If either or both the management-ip-address or management-ipv6-address are

configured- and -

– 806 –

Chapter 28 | LLDP Commands

Neither the IPv4 address nor the IPv6 address of a VLAN interface is configured.
The CPU MAC address (or device MAC address) will be sent in the Management
Address TLV of the LLDP PDU transmitted.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp basic-tlv management-ipv6-address
Console(config-if)#lldp basic-tlv This command configures an LLDP-enabled port to advertise its port description.
port-description Use the no form to disable this feature.
Syntax[no] lldp basic-tlv port-description
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
The port description is taken from the ifDescr object in RFC 2863, which includes
information about the manufacturer, the product name, and the version of theinterface hardware/software.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp basic-tlv port-description
Console(config-if)#lldp basic-tlv This command configures an LLDP-enabled port to advertise its systemsystem-capabilities capabilities. Use the no form to disable this feature.
Syntax[no] lldp basic-tlv system-capabilities
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 807 –

Chapter 28 | LLDP Commands

Command Usage
The system capabilities identifies the primary function(s) of the system andwhether or not these primary functions are enabled. The information advertised bythis TLV is described in IEEE 802.1AB.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp basic-tlv system-capabilities
Console(config-if)#lldp basic-tlv This command configures an LLDP-enabled port to advertise the systemsystem-description description. Use the no form to disable this feature.
Syntax[no] lldp basic-tlv system-description
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
The system description is taken from the sysDescr object in RFC 3418, which
includes the full name and version identification of the system's hardware type,software operating system, and networking software.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp basic-tlv system-description
Console(config-if)#lldp basic-tlv This command configures an LLDP-enabled port to advertise the system name. Use
system-name the no form to disable this feature.
Syntax[no] lldp basic-tlv system-nameDefault Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 808 –

Chapter 28 | LLDP Commands

Command Usage
The system name is taken from the sysName object in RFC 3418, which contains thesystem’s administratively assigned name, and is in turn based on the hostname
command.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp basic-tlv system-nameConsole(config-if)#lldp dot1-tlv This command configures an LLDP-enabled port to advertise the supported
proto-ident protocols. Use the no form to disable this feature.
Syntax[no] lldp dot1-tlv proto-ident
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This option advertises the protocols that are accessible through this interface.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot1-tlv proto-ident
Console(config-if)#lldp dot1-tlv proto-vid This command configures an LLDP-enabled port to advertise port-based protocol
VLAN information. Use the no form to disable this feature.
Syntax[no] lldp dot1-tlv proto-vid
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 809 –

Chapter 28 | LLDP Commands

Command Usage
This option advertises the port-based protocol VLANs configured on this interface(see “Configuring Protocol-based VLANs” on page 596).
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot1-tlv proto-vid
Console(config-if)#lldp dot1-tlv pvid This command configures an LLDP-enabled port to advertise its default VLAN ID.
Use the no form to disable this feature.
Syntax[no] lldp dot1-tlv pvid
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
The port’s default VLAN identifier (PVID) indicates the VLAN with which untaggedor priority-tagged frames are associated (see the switchport native vlan command).
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot1-tlv pvid
Console(config-if)#lldp dot1-tlv This command configures an LLDP-enabled port to advertise its VLAN name. Use
vlan-name the no form to disable this feature.
Syntax[no] lldp dot1-tlv vlan-nameDefault Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 810 –

Chapter 28 | LLDP Commands

Command Usage
This option advertises the name of all VLANs to which this interface has been
assigned. See “switchport allowed vlan” on page 574 and “protocol-vlan protocolgroup (Configuring Interfaces)” on page 598.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot1-tlv vlan-nameConsole(config-if)#lldp dot3-tlv link-agg This command configures an LLDP-enabled port to advertise link aggregation
capabilities. Use the no form to disable this feature.
Syntax[no] lldp dot3-tlv link-agg
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This option advertises link aggregation capabilities, aggregation status of the link,
and the 802.3 aggregated port identifier if this interface is currently a linkaggregation member.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot3-tlv link-agg
Console(config-if)#lldp dot3-tlv mac-phy This command configures an LLDP-enabled port to advertise its MAC and physicallayer capabilities. Use the no form to disable this feature.
Syntax[no] lldp dot3-tlv mac-phy
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 811 –

Chapter 28 | LLDP Commands

Command Usage
This option advertises MAC/PHY configuration/status which includes information
about auto-negotiation support/capabilities, and operational Multistation Access
Unit (MAU) type.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#no lldp dot3-tlv mac-phy
Console(config-if)#lldp dot3-tlv This command configures an LLDP-enabled port to advertise its maximum frame
max-frame size. Use the no form to disable this feature.
Syntax[no] lldp dot3-tlv max-frame
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
Refer to “Frame Size” on page 125 for information on configuring the maximum
frame size for this switch.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot3-tlv max-frame
Console(config-if)#lldp dot3-tlv poe This command configures an LLDP-enabled port to advertise its Power-overEthernet (PoE) capabilities. Use the no form to disable this feature.
Syntax[no] lldp dot3-tlv poe
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)– 812 –

Chapter 28 | LLDP Commands

Command Usage This command only applies to the ECS4150-28P.
 This option advertises Power-over-Ethernet capabilities, including whether or

not PoE is supported, currently enabled, if the port pins through which power isdelivered can be controlled, the port pins selected to deliver power, and thepower class.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp dot3-tlv poe
Console(config-if)#lldp med-location This command configures an LLDP-MED-enabled port to advertise its location
civic-addr identification details. Use the no form to restore the default settings.
Syntaxlldp med-location civic-addr [[country country-code] | [what device-type] |[ca-type ca-value]]
no lldp med-location civic-addr [[country] | [what] | [ca-type]]
country-code – The two-letter ISO 3166 country code in capital ASCII letters.
(Example: DK, DE or US)
device-type – The type of device to which the location applies.
0 – Location of DHCP server.
1 – Location of network element closest to client.
2 – Location of client.
ca-type – A one-octet descriptor of the data civic address value.
(Range: 0-255)
ca-value – Description of a location. (Range: 1-32 characters)
Default Setting
Not advertised
No description
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage Use this command without any keywords to advertise location identification
details.

– 813 –

Chapter 28 | LLDP Commands

 Use the ca-type to advertise the physical location of the device, that is the city,

street number, building and room information. The address location is
specified as a type and value pair, with the civic address (CA) type being
defined in RFC 4776. The following table describes some of the CA type
numbers and provides examples.
Table 167: LLDP MED Location CA Types
CA TypeDescription

CA Value Example

0

The ISO 639 language code used for presenting the address en
information.

1

National subdivisions (state, canton, province)

California

2County, parish

Orange3

City, township

Irvine4

City division, borough, city district

West Irvine

5

Neighborhood, block

Riverside

6

Group of streets below the neighborhood level

Exchange

18

Street suffix or type

Avenue19

House number

320

20

House number suffix

A

21

Landmark or vanity address

Tech Center

26

Unit (apartment, suite)

Apt 519

27

Floor

5

28

Room

509B

Any number of CA type and value pairs can be specified for the civic address
location, as long as the total does not exceed 250 characters.
 For the location options defined for device-type, normally option 2 is used to

specify the location of the client device. In situations where the client device
location is not known, 0 and 1 can be used, providing the client device is
physically close to the DHCP server or network element.

ExampleThe following example enables advertising location identification details.
Console(config)#interface ethernet 1/1
Console(config-if)#lldp med-location civic-addr
Console(config-if)#lldp med-location civic-addr 1 California
Console(config-if)#lldp med-location civic-addr 2 Orange
Console(config-if)#lldp med-location civic-addr 3 Irvine
Console(config-if)#lldp med-location civic-addr 4 West Irvine
Console(config-if)#lldp med-location civic-addr 6 Exchange
Console(config-if)#lldp med-location civic-addr 18 Avenue
Console(config-if)#lldp med-location civic-addr 19 320
Console(config-if)#lldp med-location civic-addr 27 5

– 814 –

Chapter 28 | LLDP Commands

Console(config-if)#lldp med-location civic-addr 28 509B
Console(config-if)#lldp med-location civic-addr country US
Console(config-if)#lldp med-location civic-addr what 2
Console(config-if)#lldp med-notification This command enables the transmission of SNMP trap notifications about LLDPMED changes. Use the no form to disable LLDP-MED notifications.
Syntax[no] lldp med-notification
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This option sends out SNMP trap notifications to designated target stations at
the interval specified by the lldp notification-interval command. Trap
notifications include information about state changes in the LLDP MIB (IEEE802.1AB), the LLDP-MED MIB (ANSI/TIA 1057), or organization-specific LLDPEXT-DOT1 and LLDP-EXT-DOT3 MIBs.
 SNMP trap destinations are defined using the snmp-server host command.
 Information about additional changes in LLDP neighbors that occur between

SNMP notifications is not transmitted. Only state changes that exist at the timeof a trap notification are included in the transmission. An SNMP agent should
therefore periodically check the value of lldpStatsRemTableLastChangeTime todetect any lldpRemTablesChange notification-events missed due to throttlingor transmission loss.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp med-notification
Console(config-if)#lldp med-tlv ext-poe This command configures an LLDP-MED-enabled port to advertise and accept

Extended Power-over-Ethernet configuration and usage information. Use the noform to disable this feature.
Syntax[no] lldp med-tlv ext-poe– 815 –

Chapter 28 | LLDP Commands

Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This command only applies to the ECS4150-28P.
 This option advertises extended Power-over-Ethernet capability details, such as

power availability from the switch, and power state of the switch, including
whether the switch is operating from primary or backup power (the Endpoint
Device could use this information to decide to enter power conservationmode). Note that this device does not support PoE capabilities.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#no lldp med-tlv ext-poe
Console(config-if)#lldp med-tlv inventory This command configures an LLDP-MED-enabled port to advertise its inventory
identification details. Use the no form to disable this feature.
Syntax[no] lldp med-tlv inventory
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This option advertises device details useful for inventory management, such as
manufacturer, model, software version and other pertinent information.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp med-tlv inventory
Console(config-if)#– 816 –

Chapter 28 | LLDP Commands

lldp med-tlv location This command configures an LLDP-MED-enabled port to advertise its location
identification details. Use the no form to disable this feature.
Syntax[no] lldp med-tlv location
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This option advertises location identification details.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp med-tlv location
Console(config-if)#lldp med-tlv med-cap This command configures an LLDP-MED-enabled port to advertise its Media
Endpoint Device capabilities. Use the no form to disable this feature.
Syntax[no] lldp med-tlv med-cap
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This option advertises LLDP-MED TLV capabilities, allowing Media Endpoint andConnectivity Devices to efficiently discover which LLDP-MED related TLVs aresupported on the switch.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp med-tlv med-cap
Console(config-if)#– 817 –

Chapter 28 | LLDP Commands

lldp med-tlv This command configures an LLDP-MED-enabled port to advertise its network
network-policy policy configuration. Use the no form to disable this feature.
Syntax[no] lldp med-tlv network-policy
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage
This option advertises network policy configuration information, aiding in the
discovery and diagnosis of VLAN configuration mismatches on a port. Improper
network policy configurations frequently result in voice quality degradation orcomplete service disruption.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp med-tlv network-policy
Console(config-if)#lldp notification This command enables the transmission of SNMP trap notifications about LLDP
changes in remote neighbors. Use the no form to disable LLDP notifications.
Syntax[no] lldp notification
Default Setting
Disabled
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage This option sends out SNMP trap notifications to designated target stations at
the interval specified by the lldp notification-interval command. Trap
notifications include information about state changes in the LLDP MIB (IEEE802.1AB), or organization-specific LLDP-EXT-DOT1 and LLDP-EXT-DOT3 MIBs.
 SNMP trap destinations are defined using the snmp-server host command.
 Information about additional changes in LLDP neighbors that occur between

SNMP notifications is not transmitted. Only state changes that exist at the timeof a trap notification are included in the transmission. An SNMP agent should– 818 –

Chapter 28 | LLDP Commands

therefore periodically check the value of lldpStatsRemTableLastChangeTime todetect any lldpRemTablesChange notification-events missed due to throttlingor transmission loss.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#lldp notification
Console(config-if)#show lldp config This command shows LLDP configuration settings for all ports.
Syntaxshow lldp config [detail interface]detail - Shows configuration summary.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleThe following example shows the basic LLDP parameters for Port 1.
Console#show lldp config detail ethernet 1/1
LLDP Port Configuration DetailPort
Admin Status
Notification Enabled
Basic TLVs Advertised: Eth 1/1
: Tx-Rx: True: port-description
system-namesystem-description
system-capabilities
management-ip-address
802.1 specific TLVs Advertised : port-vid
vlan-nameproto-vlan
proto-ident
802.3 specific TLVs Advertised : mac-phy
link-agg
max-frame
MED Notification Status: Disabled
MED Enabled TLVs Advertised: med-cap
network-policy
location
inventory– 819 –

Chapter 28 | LLDP Commands

MED Location Identification
Location Data Format : Civic Address LCICountry Name
: DK
What
: 2 - DHCP Client
CA Type 1: 12
CA Type 13: 13
Console#show lldp info This command shows LLDP global and interface-specific configuration settings for
local-device this device.
Syntaxshow lldp info local-device [detail interface]detail - Shows configuration summary.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show lldp info local-device
LLDP Local Global Information
Chassis Type : MAC Address
Chassis ID: 00-01-02-03-04-05
System Name :System Description : ECS4150-28T
System Capabilities Support : Bridge
System Capabilities Enabled : Bridge
Management Address : 192.168.0.101 (IPv4)
LLDP Port Information
Port
Port ID TypePort ID
Port Description-------- ---------------- ----------------- -------------------------------Eth 1/1 MAC Address
00-12-CF-DA-FC-E9 Ethernet Port on unit 1, port 1
Eth 1/2 MAC Address
00-12-CF-DA-FC-EA Ethernet Port on unit 1, port 2
Eth 1/3 MAC Address
00-12-CF-DA-FC-EB Ethernet Port on unit 1, port 3
Eth 1/4 MAC Address
00-12-CF-DA-FC-EC Ethernet Port on unit 1, port 4.
.
.
Console#show lldp info local-device detail ethernet 1/1
LLDP Local Port Information DetailPort: Eth 1/1
Port ID Type
: MAC Address
Port ID: 00-12-CF-DA-FC-E9
Port Description : Ethernet Port on unit 1, port 1
MED Capability: LLDP-MED Capabilities
Network Policy
Location Identification– 820 –

Chapter 28 | LLDP Commands

Inventory
Console#show lldp info This command shows LLDP global and interface-specific configuration settings forremote-device remote devices attached to an LLDP-enabled port.
Syntaxshow lldp info remote-device [detail interface]detail - Shows detailed information.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleNote that an IP phone or other end-node device which advertises LLDP-MED
capabilities must be connected to the switch for information to be displayed in the“LLDP-MED Capability” and other related fields.
Console#show lldp info remote-device
LLDP Remote Devices Information
Local Port Chassis ID
Port ID
System Name---------- ----------------- ----------------- ---------------------------Eth 1/1
00-E0-0C-00-00-FD 00-E0-0C-00-01-02
Console#show lldp info remote-device detail ethernet 1/1
LLDP Remote Devices Information Detail--------------------------------------------------------------Index: 2
Chassis Type
: MAC Address
Chassis ID: 70-72-CF-91-1C-B2Port ID Type
: MAC Address
Port ID: 70-72-CF-91-1C-B4Time To Live: 120 seconds
Port Description: Ethernet Port on unit 1, port 2
System Description: ECS4150-28T
System Capabilities : Bridge
Enabled Capabilities : Bridge
Management Address : 192.168.0.4 (IPv4)
Port VLAN ID : 1
Port and Protocol VLAN ID : supported, disabled
VLAN Name : VLAN

1 - DefaultVlan– 821 –

Chapter 28 | LLDP Commands

Protocol Identity (Hex) : 88-CC
MAC/PHY Configuration/Status
Port Auto-neg Supported: Yes
Port Auto-neg Enabled: Yes
Port Auto-neg Advertised Cap (Hex) : 6C00
Port MAU Type: 16
Power via MDIPower Class: PSE
Power MDI Supported: Yes
Power MDI Enabled: Yes
Power Pair Controllable : No
Power Pairs: SparePower Classification: Class 1
Link Aggregation
Link Aggregation Capable : Yes
Link Aggregation Enable : No
Link Aggregation Port ID : 0
Max Frame Size : 1522
Console#The following example shows information which is displayed for end-node device
which advertises LLDP-MED TLVs.
...
LLDP-MED Capability :Device Class
Supported Capabilities

Current Capabilities

Location Identification :Location Data Format
Country Name
What
Extended Power via MDI :Power TypePower Source
Power Priority
Power Value
Inventory:
Hardware Revision
Firmware Revision
Software Revision
Serial Number
Manufacture Name
Model Name
Asset ID
Console#– 822 –: Network Connectivity: LLDP-MED Capabilities
Network Policy
Location Identification
Extended Power via MDI - PSE
Inventory: LLDP-MED Capabilities
Location Identification
Extended Power via MDI - PSE
Inventory: Civic Address LCI
: TW
: 2
: PSE
: Unknown: Unknown: 0 Watts: R0A: 1.2.6.0: 1.2.6.0: S123456: Prye: VP101: 340937

Chapter 28 | LLDP Commands

show lldp info This command shows statistics based on traffic received through all attached LLDPstatistics enabled interfaces.
Syntaxshow lldp info statistics [detail interface]detail - Shows configuration summary.
interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show lldp info statistics
LLDP Global Statistics
Neighbor Entries List Last Updated : 485 seconds
New Neighbor Entries Count: 2
Neighbor Entries Deleted Count: 1
Neighbor Entries Dropped Count: 0
Neighbor Entries Ageout Count: 1
LLDP Port Statistics
Port
NumFramesRecvd NumFramesSent NumFramesDiscarded-------- -------------- ------------- -----------------Eth 1/1
12120
Eth 1/217170
Eth 1/3000Eth 1/4000
Eth 1/5000.
.
.
Console#show lldp info statistics detail ethernet 1/1
LLDP Port Statistics DetailPort Name: Eth 1/1
Frames Discarded : 0
Frames Invalid: 0
Frames Received: 12
Frames Sent
: 12
TLVs Unrecognized : 0
TLVs Discarded: 0
Neighbor Ageouts : 1
Console#– 823 –

Chapter 28 | LLDP Commands– 824 –

29

CFM Commands

Connectivity Fault Management (CFM) is an OAM protocol that includes proactive
connectivity monitoring using continuity check messages, fault verification
through loop back messages, and fault isolation by examining end-to-end
connections between provider edge devices or between customer edge devices.
CFM is implemented as a service level protocol based on service instances which
encompass only that portion of the metropolitan area network supporting a
specific customer. CFM can also provide controlled management access to ahierarchy of maintenance domains (such as the customer, service provider, andequipment operator).
The following list of commands support functions for defining the CFM structure,including domains, maintenance associations, and maintenance access points. It
also provides commands for fault detection through continuity check messages for
all known maintenance points, and cross-check messages for statically configured
maintenance points located on other devices. Fault verification is supported
through loop back messages, and fault isolation through link trace messages. Fault
notification is also provided by SNMP alarms which are automatically generated bymaintenance points when connectivity faults or configuration errors are detectedin the local maintenance domain.
Table 168: CFM Commands
CommandFunctionMode

ethernet cfm ais level

Configures the maintenance level at which Alarm
Indication Signal information will be sentGC

ethernet cfm ais ma

Enables the MEPs within the specified MA to send frameswith AIS informationGC

ethernet cfm ais period

Configures the interval at which AIS information is sentGC

ethernet cfm ais suppress
alarm

Suppresses AIS messages following the detection of
defect conditions

GC

ethernet cfm domain

Defines a CFM maintenance domain, sets the authorized GC
maintenance level, and enters CFM configuration mode;
also specifies the MIP creation method for MAs within thisdomainethernet cfm enable

Enables CFM processing globally on the switch

ma index nameCreates a maintenance association within the current
CFM
maintenance domain, maps it to a customer service
instance, and sets the manner in which MIPs are created forthis service instanceDefining CFM Structures– 825 –

GC

Chapter 29 | CFM Commands

Table 168: CFM Commands (Continued)
CommandFunctionModema index name-format

Specifies the name format for the maintenance association CFM
as IEEE 802.1ag character based, or ITU-T SG13/SG15 Y.1731
defined ICC-based format

ethernet cfm mep

Sets an interface as a domain boundary, defines it as amaintenance end point (MEP), and sets direction of the
MEP in regard to sending and receiving CFM messages

ICethernet cfm port-enable

Enables CFM processing on an interface

ICclear ethernet cfm ais mpid Clears AIS defect information for the specified MEPPEshow ethernet cfm
configuration

Displays CFM configuration settings, including global
settings, SNMP traps, and interface settingsPEshow ethernet cfm md

Displays configured maintenance domains

PEshow ethernet cfm ma

Displays configured maintenance associations

PEshow ethernet cfm
maintenance-points local

Displays maintenance points configured on this devicePEshow ethernet cfm
maintenance-points local
detail mep

Displays detailed CFM information about a specified local
MEP in the continuity check databasePEshow ethernet cfm
maintenance-points
remote detail

Displays detailed CFM information about a specified
remote MEP in the continuity check databasePE

ethernet cfm cc ma interval Sets the transmission delay between continuity checkmessages

GC

Continuity Check Operations

ethernet cfm cc enable

Enables transmission of continuity check messages within GC
a specified maintenance associationsnmp-server enable traps
ethernet cfm cc

Enables SNMP traps for CFM continuity check eventsGC

mep archive-hold-time

Sets the time that data from a missing MEP is kept in thecontinuity check database before being purged

CFM

clear ethernet cfm
maintenance-points
remoteClears the contents of the continuity check databasePE

clear ethernet cfm errors

Clears continuity check errors logged for the specified
maintenance domain and maintenance levelPEshow ethernet cfm errors

Displays CFM continuity check errors logged on this device PE

Cross Check Operations
ethernet cfm mep
crosscheck start-delay

Sets the maximum delay that a device waits for remote
GC
MEPs to come up before starting the cross-check operationsnmp-server enable traps
ethernet cfm crosscheck

Enables SNMP traps for CFM continuity check events, in
relation to the cross-check operations between staticallyconfigured MEPs and those learned via continuity checkmessagesGC

mep crosscheck mpid

Statically defines a remote MEP in a maintenanceassociation

CFM– 826 –

Chapter 29 | CFM Commands

Table 168: CFM Commands (Continued)
CommandFunctionMode

ethernet cfm mep
crosscheck

Enables cross-checking between the list of configured
remote MEPs within a maintenance association and MEPs
learned through continuity check messages

PEshow ethernet cfm
maintenance-points
remote crosscheck

Displays information about remote maintenance points
configured statically in a cross-check list

PE

ethernet cfm linktrace
cache

Enables caching of CFM data learned through link trace
messagesGC

ethernet cfm linktrace
cache hold-time

Sets the hold time for CFM link trace cache entries

GC

ethernet cfm linktrace
cache size

Sets the maximum size for the link trace cacheGC

ethernet cfm linktrace

Sends CFM link trace messages to the MAC address for a
MEP

PEclear ethernet cfm
linktrace-cache

Clears link trace messages logged on this devicePEshow ethernet cfm
linktrace-cache

Displays the contents of the link trace cachePE

Link Trace Operations

Loopback Operations
ethernet cfm loopback

Sends CFM loopback messages to a MAC address for a MEP PE
or MIP

Fault Generator Operations
mep fault-notify alarm-time Sets the time a defect must exist before a fault alarm isissuedmep fault-notify lowestpriority

CFM

Sets the lowest priority defect that is allowed to generate a CFM
fault alarm

mep fault-notify reset-time Configures the time after a fault alarm has been issued, and CFM
no defect exists, before another fault alarm can be issued
show ethernet cfm faultnotify-generator

Displays configuration settings for the fault notification
generator

PE

Delay Measure Operations
ethernet cfm delaymeasure two-way

Sends periodic delay-measure requests to a specified MEP PE
within a maintenance association

Basic Configuration Steps for CFM

1. Configure the maintenance domains with the ethernet cfm domain command.
2. Configure the maintenance associations with the ma index name command.
3. Configure the local maintenance end points (MEPs) which will serve as thedomain service access points for the specified maintenance association using
the ethernet cfm mep command.

– 827 –

Chapter 29 | CFM Commands
Defining CFM Structures

4. Enter a static list of MEPs assigned to other devices within the same

maintenance association using the mep crosscheck mpid command. This
allows CFM to automatically verify the functionality of these remote end points
by cross-checking the static list configured on this device against information
learned through continuity check messages.

5. Enable CFM globally on the switch with the ethernet cfm enable command.
6. Enable CFM on the local MEPs with the ethernet cfm port-enable command.
7. Enable continuity check operations with the ethernet cfm cc enable command.
8. Enable cross-check operations with the ethernet cfm mep crosscheckcommand.

Other configuration changes may be required for your particular environment,such as adjusting the interval at which continuity check messages are sent
(page 845), or setting the start-up delay for the cross-check operation (page 851).
You can also enable SNMP traps for events discovered by continuity checkmessages (page 847) or cross-check messages (page 851).
Defining CFM Structures

ethernet cfm ais level This command configures the maintenance level at which Alarm Indication Signal(AIS) information will be sent within the specified MA. Use the no form restore thedefault setting.
Syntaxethernet cfm ais level level-id md domain-name ma ma-nameno ethernet cfm ais level md domain-name ma ma-namelevel-id – Maintenance level at which AIS information will be sent.
(Range: 0-7)
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)

Default Setting
Level 0Command Mode
Global Configuration
Command Usage
The configured AIS level must be higher than the maintenance level of the domain
containing the specified MA.

– 828 –

Chapter 29 | CFM Commands
Defining CFM Structures

ExampleThis example sets the maintenance level for sending AIS messages within thespecified MA.
Console(config)#ethernet cfm ais level 4 md voip ma rd
Console(config)#

ethernet cfm ais ma This command enables the MEPs within the specified MA to send frames with AIS
information following detection of defect conditions. Use the no form to disable
this feature.
Syntax[no] ethernet cfm ais md domain-name ma ma-namedomain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name16. (Range: 1-43 alphanumericcharacters)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Each MA name must be unique within the CFM domain.
 Frames with AIS information can be issued at the client’s maintenance level by

a MEP upon detecting defect conditions. For example, defect conditions may
include:

Signal failure conditions if continuity checks are enabled.

AIS condition or LCK condition if continuity checks are disabled.

 A MEP continues to transmit periodic frames with AIS information until thedefect condition is removed.

ExampleThis example enables the MEPs within the specified MA to send frames with AIS
information.
Console(config)#ethernet cfm ais md voip ma rd
Console(config)#

16. The total length of the MD name and MA name cannot exceed 44 characters.

– 829 –

Chapter 29 | CFM Commands
Defining CFM Structures

ethernet cfm ais This command configures the interval at which AIS information is sent. Use the noperiod form to restore the default setting.
Syntaxethernet cfm ais period period md domain-name ma ma-nameno ethernet cfm ais period md domain-name ma ma-nameperiod – The interval at which AIS information is sent.
(Options: 1 second, 60 seconds)
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
Default Setting
1 second
Command Mode
Global Configuration
ExampleThis example sets the interval for sending frames with AIS information at 60
seconds.
Console(config)#ethernet cfm ais period 60 md voip ma rd
Console(config)#

ethernet cfm ais This command suppresses sending frames containing AIS information following
suppress alarm the detection of defect conditions. Use the no form to restore the default setting.
Syntax[no] ethernet cfm ais suppress alarm md domain-name ma ma-namedomain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
Default Setting
Suppression is disabled
Command Mode
Global Configuration
Command Usage For multipoint connectivity, a MEP cannot determine the specific maintenancelevel entity that has encountered defect conditions upon receiving a frame– 830 –

Chapter 29 | CFM Commands
Defining CFM Structureswith AIS information. More importantly, it cannot determine the associatedsubset of its peer MEPs for which it should suppress alarms since the received
AIS information does not contain that information. Therefore, upon receptionof a frame with AIS information, the MEP will suppress alarms for all peer MEPs
whether there is still connectivity or not.
 However, for a point-to-point connection, a MEP has only a single peer MEP for

which to suppress alarms when it receives frames with AIS information.

 If suppression is enabled by this command, upon receiving a frame with AIS

information, a MEP detects an AIS condition and suppresses loss of continuity
alarms associated with all its peer MEPs. A MEP resumes loss of continuity alarm
generation upon detecting loss of continuity defect conditions in the absenceof AIS messages.

ExampleThis example suppresses sending frames with AIS information.
Console(config)#ethernet cfm ais suppress alarm md voip ma rd
Console(config)#

ethernet cfm domain This command defines a CFM maintenance domain, sets the authorized

maintenance level, and enters CFM configuration mode. Use the no form to delete
a CFM maintenance domain.
Syntaxethernet cfm domain index index name domain-name level level-id[mip-creation type]no ethernet cfm domain index index
index – Domain index. (Range: 1-65535)
domain-name – Domain name. (Range: 1-43 alphanumeric characters)level-id – Authorized maintenance level for this domain. (Range: 0-7)
type – Specifies the CFM protocol’s creation method for maintenanceintermediate points (MIPs) in this domain:
default – MIPs can be created for any maintenance association (MA)
configured in this domain on any bridge port through which the MA’s
VID can pass.
explicit – MIPs can be created for any MA configured in this domain
only on bridge ports through which the MA’s VID can pass, and only if amaintenance end point (MEP) is created at some lower MA Level.
none – No MIP can be created for any MA configured in this domain.

– 831 –

Chapter 29 | CFM Commands
Defining CFM Structures
Default Setting
No maintenance domains are configured.
No MIPs are created for any MA in the specified domain.
Command Mode
Global Configuration
Command Usage A domain can only be configured with one name.
 Where domains are nested, an upper-level hierarchical domain must have ahigher maintenance level than the ones it encompasses. The higher to lower
level domain types commonly include entities such as customer, service
provider, and operator.

 More than one domain can be configured at the same maintenance level, but asingle domain can only be configured with one maintenance level.

 If MEPs or MAs are configured for a domain using the ethernet cfm mep

command or ma index name command, they must first be removed before you
can remove the domain.

 Maintenance domains are designed to provide a transparent method ofverifying and resolving connectivity problems for end-to-end connections. By
default, these connections run between the domain service access points(DSAPs) within each MA defined for a domain, and are manually configured
using the ethernet cfm mep command.
In contrast, MIPs are interconnection points that make up all possible paths
between the DSAPs within an MA. MIPs are automatically generated by the
CFM protocol when the mip-creation option in this command is set to “default”
or “explicit,” and the MIP creation state machine is invoked (as defined in IEEE
802.1ag). The default option allows MIPs to be created for all interconnection
points within an MA, regardless of the domain’s level in the maintenancehierarchy (e.g., customer, provider, or operator). While the explicit option only
generates MIPs within an MA if its associated domain is not at the bottom of themaintenance hierarchy. This option is used to hide the structure of network at
the lowest domain level.
The diagnostic functions provided by CFM can be used to detect connectivity
failures between any pair of MEPs in an MA. Using MIPs allows these failures tobe isolated to smaller segments of the network.
Allowing the CFM to generate MIPs exposes more of the network structure tousers at higher domain levels, but can speed up the process of fault detection
and recovery. This trade-off should be carefully considered when designing a
CFM maintenance structure.
Also note that while MEPs are active agents which can initiate consistency
check messages (CCMs), transmit loop back or link trace messages, andmaintain the local CCM database. MIPs, on the other hand are passive agents– 832 –

Chapter 29 | CFM Commands
Defining CFM Structures

which can only validate received CFM messages, and respond to loop back andlink trace messages.
The MIP creation method defined by the ma index name command takes
precedence over the method defined by this command.
ExampleThis example creates a maintenance domain set to maintenance level 3, and enters
CFM configuration mode for this domain.
Console(config)#ethernet cfm domain index 1 name voip level 3 mip-creation
explicit
Console(config-ether-cfm)#

Related Commands
ma index name (834)

ethernet cfm enable This command enables CFM processing globally on the switch. Use the no form todisable CFM processing globally.
Syntax[no] ethernet cfm enable
Default Setting
EnabledCommand Mode
Global Configuration
Command Usage To avoid generating an excessive number of traps, the complete CFM
maintenance structure and process parameters should be configured prior to
globally enabling CFM processing with this command. Specifically, themaintenance domains, maintenance associations, and MEPs should be
configured on each participating bridge.
 When CFM is enabled, hardware resources are allocated for CFM processing.

ExampleThis example enables CFM globally on the switch.
Console(config)#ethernet cfm enable
Console(config)#– 833 –

Chapter 29 | CFM Commands
Defining CFM Structuresma index name This command creates a maintenance association (MA) within the current

maintenance domain, maps it to a customer service instance (S-VLAN), and sets themanner in which MIPs are created for this service instance. Use the no form withthe vlan keyword to remove the S-VLAN from the specified MA. Or use the no form
with only the index keyword to remove the MA from the current domain.
Syntaxma index index name ma-name [vlan vlan-list [mip-creation type]]
no ma index index [vlan vlan-list]
index – MA identifier. (Range: 1-2147483647)
ma-name – MA name. (Range: 1-43 alphanumeric characters)vlan-list - Separate nonconsecutive VLAN identifiers with a comma and nospaces; use a hyphen to designate a range of IDs. (Range: 1-4094).
type – Specifies the CFM protocol’s creation method for maintenanceintermediate points (MIPs) in this MA:
default – MIPs can be created for this MA on any bridge port throughwhich the MA’s VID can pass.
explicit – MIPs can be created this MA only on bridge ports throughwhich the MA’s VID can pass, and only if a maintenance end point (MEP)
is created at some lower MA Level.
none – No MIP can be created for this MA.

Default Setting
None
Command Mode
CFM Domain Configuration
Command Usage The maintenance domain used to enter CFM domain configuration mode, theMA name and VLAN identifier specified by this command, and the DSAPs
configured with the mep crosscheck mpid command create a unique service
instance for each customer.
 If only the MA index and name are entered for this command, the MA will berecorded in the domain database, but will not function. No MEPs can becreated until the MA is associated with a service VLAN.

 Note that multiple domains at the same maintenance level (see the ethernet

cfm domain command) cannot have an MA on the same VLAN. Also, each MA
name must be unique within the CFM-managed network.

 The first VLAN entered in the list by this command is the primary VLAN, and is

the VLAN on which all CFM functions are executed.

– 834 –

Chapter 29 | CFM Commands
Defining CFM Structures Before removing an MA, first remove all the MEPs configured for it (see the mep

crosscheck mpid command).

 If the MIP creation method is not defined by this command, the creation

method defined by the ethernet cfm domain command is applied to this MA.
For a detailed description of the MIP types, refer to the Command Usage
section under the ethernet cfm domain command.

ExampleThis example creates a maintenance association, binds it to VLAN 1, and allows
MIPs to be created within this MA using the default method.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#ma index 1 name rd vlan 1 mip-creation default
Console(config-ether-cfm)#

ma index This command specifies the name format for the maintenance association as IEEE
name-format 802.1ag character based, or ITU-T SG13/SG15 Y.1731 defined ICC-based format. Use
the no form to restore the default setting.
Syntaxma index index name-format {character-string | icc-based}
no ma index index name-format
index – MA identifier. (Range: 1-2147483647)
character-string – IEEE 802.1ag defined character string format. This is an
IETF RFC 2579 DisplayString.
icc-based – ITU-T SG13/SG15 Y.1731 defined ICC based format.
Default Setting
character-string
Command Mode
CFM Domain Configuration
ExampleThis example specifies the name format as character string.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#ma index 1 name-format character-string
Console(config-ether-cfm)#– 835 –

Chapter 29 | CFM Commands
Defining CFM Structures

ethernet cfm mep This command sets an interface as a domain boundary, defines it as a maintenanceend point (MEP), and sets direction of the MEP in regard to sending and receiving
CFM messages. Use the no form to delete a MEP.
Syntaxethernet cfm mep mpid mpid md domain-name ma ma-name [up]no ethernet cfm mep mpid mpid ma ma-namempid – Maintenance end point identifier. (Range: 1-8191)
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
up – Indicates that the MEP faces inward toward the switch cross-connect
matrix, and transmits CFM messages towards, and receives them from, thedirection of the internal bridge relay mechanism. If the up keyword is notincluded in this command, then the MEP is facing away from the switch,and transmits CFM messages towards, and receives them from, thedirection of the physical medium.
Default Setting
No MEPs are configured.
The MEP faces outward (down).
Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage CFM elements must be configured in the following order: (1) maintenancedomain at the same level as the MEP to be configured (using the ethernet cfm
domain command), (2) maintenance association within the domain (using the
ma index name command), and (3) finally the MEP using this command.

 An interface may belong to more than one domain. This command can be used

to configure an interface as a MEP for different MAs in different domains.

 To change the MEP’s MA or the direction it faces, first delete the MEP, and thencreate a new one.

ExampleThis example sets port 1 as a DSAP for the specified maintenance association.
Console(config)#interface ethernet 1/1
Console(config-if)#ethernet cfm mep mpid 1 md voip ma rd
Console(config-if)#– 836 –

Chapter 29 | CFM Commands
Defining CFM Structures

ethernet cfm This command enables CFM processing on an interface. Use the no form to disable
port-enable CFM processing on an interface.
Syntax[no] ethernet cfm port-enable
Default Setting
EnabledCommand Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage An interface must be enabled before a MEP can be created with the ethernet
cfm mep command.
 If a MEP has been configured on an interface with the ethernet cfm mep

command, it must first be deleted before CFM can be disabled on thatinterface.

 When CFM is disabled, hardware resources previously used for CFM processing

on that interface are released, and all CFM frames entering that interface areforwarded as normal data traffic.

ExampleThis example enables CFM on port 1.
Console(config)#interface ethernet 1/1
Console(config-if)#ethernet cfm port-enable
Console(config-if)#clear ethernet cfm This command clears AIS defect information for the specified MEP.
ais mpid
Syntaxclear ethernet cfm ais mpid mpid md domain-name ma ma-namempid – Maintenance end point identifier. (Range: 1-8191)
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
Default Setting
None
Command Mode
Privileged Exec
– 837 –

Chapter 29 | CFM Commands
Defining CFM Structures
Command Usage
This command can be used to clear AIS defect entries if a MEP does not exit the AIS
state when all errors are resolved.
ExampleThis example clears AIS defect entries on port 1.
Console#clear ethernet cfm ais mpid 1 md voip ma rd
Console#show ethernet cfm This command displays CFM configuration settings, including global settings,
configuration SNMP traps, and interface settings.
Syntaxshow ethernet cfm configuration {global | traps | interface interface}
global – Displays global settings including CFM global status, cross-check
start delay, and link trace parameters.
traps – Displays the status of all continuity check and cross-check traps.
interface – Displays CFM status for the specified interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Default Setting
None
Command Mode
Privileged Exec
ExampleThis example shows the global settings for CFM.
Console#show ethernet cfm configuration global
CFM Global Status: Enabled
Crosscheck Start Delay: 10 seconds
Linktrace Cache Status: Enabled
Linktrace Cache Hold Time : 100 minutes
Linktrace Cache Size
: 100 entries
Console#– 838 –

Chapter 29 | CFM Commands
Defining CFM Structures

This example shows the configuration status for continuity check and cross-checktraps.
Console#show ethernet cfm configuration traps
CC MEP Up Trap
:Disabled
CC MEP Down Trap
:Disabled
CC Configure Trap
:Disabled
CC Loop Trap
:Disabled
Cross Check MEP Unknown Trap :Disabled
Cross Check MEP Missing Trap :Disabled
Cross Check MA Up:Disabled
Console#Table 169: show ethernet cfm configuration traps - display description
Field

Description

CC MEP Up Trap

Sends a trap if a remote MEP is discovered and added to the local
database, the port state of a previously discovered remote MEP changes,
or a CCM is received from a remote MEP which as an expired entry in thearchived database.

CC Mep Down Trap

Sends a trap if this device loses connectivity with a remote MEP, orconnectivity has been restored to a remote MEP which has recovered froman error condition.

CC Configure Trap

Sends a trap if this device receives a CCM with the same MPID as its own
but with a different source MAC address, indicating that a CFM
configuration error exists.

CC Loop Trap

Sends a trap if this device receives a CCM with the same source MAC
address and MPID as its own, indicating that a forwarding loop exists.

Cross Check MEP
Unknown Trap

A CCM is received from a MEP that has not been configured as a DSAP (seethe ethernet cfm mep command), manually configured as a remote MEP(see the mep crosscheck mpid command), nor learned through previous
CCM messages.

Cross Check MEP Missing This device failed to receive three consecutive CCMs from another MEP in
Trap
the same MA.
Cross Check MA Up

Generates a trap when all remote MEPs belonging to an MA come up.

This example shows the CFM status for port 1.
Console#show ethernet cfm configuration interface ethernet 1/1
Ethernet 1/1 CFM Status:Enabled
Console#– 839 –

Chapter 29 | CFM Commands
Defining CFM Structures

show ethernet cfm md This command displays the configured maintenance domains.
Syntaxshow ethernet cfm md [level level]
level – Maintenance level. (Range: 0-7)
Default Setting
None
Command Mode
Privileged Exec
ExampleThis example shows all configured maintenance domains.
Console#show ethernet cfm md
MD Index MD Name-------- -------------------1 rd
Console#

Level
----0

MIP Creation-----------default

Archive Hold Time (m.)---------------------100

show ethernet cfm ma This command displays the configured maintenance associations.
Syntaxshow ethernet cfm ma [level level]
level – Maintenance level. (Range: 0-7)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
For a description of the values displayed in the CC Interval field, refer to theethernet cfm cc ma interval command.
ExampleThis example shows all configured maintenance associations.
Console#show ethernet cfm ma
MD Name
MA Index MA Name
Primary VID CC Interval MIP Creation--------------- -------- --------------- ----------- ----------- -----------steve
1 voip1
4 Default
Console#– 840 –

Chapter 29 | CFM Commands
Defining CFM Structures

show ethernet cfm This command displays the maintenance points configured on this device.
maintenance-points
local Syntax
show ethernet cfm maintenance-points local{mep [domain domain-name | interface interface | level level-id] | mip[domain domain-name | level level-id]}
mep – Displays only local maintenance end points.
mip – Displays only local maintenance intermediate points.
domain-name – Domain name. (Range: 1-43 alphanumeric characters)interface – Displays CFM status for the specified interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
level-id – Maintenance level for this domain. (Range: 0-7)
Default Setting
None
Command Mode
Privileged Exec
Command Usage Use the mep keyword with this command to display the MEPs configured on

this device as DSAPs through the ethernet cfm mep command.

 Using the mip keyword with this command to display the MIPs generated on

this device by the CFM protocol when the mip-creation method is set to either“default” or “explicit” by the ethernet cfm domain command or the ma index
name command.

ExampleThis example shows all MEPs configured on this device for maintenance domain rd.
Console#show ethernet cfm maintenance-points local mep
MPID MD Name
Level Direct VLAN Port
CC Status MAC Address---- ---------------- ----- ------ ---- -------- --------- ----------------1 rd
0 UP
1 Eth 1/ 1 Enabled
00-12-CF-3A-A8-C0
Console#– 841 –

Chapter 29 | CFM Commands
Defining CFM Structures

show ethernet cfm This command displays detailed CFM information about a local MEP in themaintenance-points continuity check database.
local detail mep
Syntaxshow ethernet cfm maintenance-points local detail mep[domain domain-name | interface interface | level level-id]
domain-name – Domain name. (Range: 1-43 alphanumeric characters)interface – Displays CFM status for the specified interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
level-id – Maintenance level for this domain. (Range: 0-7)
Default Setting
None
Command Mode
Privileged Exec
ExampleThis example shows detailed information about the local MEP on port 1.
Console#show ethernet cfm maintenance-points local detail mep interface
ethernet 1/1
MEP Settings:------------MPID: 1
MD Name: vopuMA Name: r&d
MA Name Format: Character String
Level
: 0
Direction: Up
Interface: Eth 1/ 1
CC Status: Enabled
MAC Address: 00-E0-0C-00-00-FD
Defect Condition: No DefectReceived RDI: FalseAIS Status: Enabled
AIS Period: 1 seconds
AIS Transmit Level: Default
Suppress Alarm: Disabled
Suppressing Alarms: Disabled
Console#– 842 –

Chapter 29 | CFM Commands
Defining CFM Structures

Table 170: show ethernet cfm maintenance-points local detail mep - display
Field

Description

MPID

MEP identifier

MD Name

The maintenance domain for this entry.

MA Name

Maintenance association to which this remote MEP belongs

MA Name Format

The format of the Maintenance Association name, including primary VID,
character string, unsigned Integer 16, or RFC 2865 VPN ID

Level

Maintenance level of the local maintenance point

Direction

The direction in which the MEP faces on the Bridge port (up or down).

Interface

The port to which this MEP is attached.

CC Status

Shows if the MEP will generate CCM messages.

MAC Address

MAC address of the local maintenance point. (If a CCM for the specified
remote MEP has never been received or the local MEP record times out,
the address will be set to the initial value of all Fs.)

Defect Condition

Shows the defect detected on the MEP.

Received RDI

Receive status of remote defect indication (RDI) messages on the MEP.

AIS Status

Shows if MEPs within the specified MA are enabled to send frames withAIS information following detection of defect conditions.

AIS Period

The interval at which AIS information is sent.

AIS Transmit Level

The maintenance level at which AIS information will be sent for the
specified MEP.

Suppress Alarm

Shows if the specified MEP is configured to suppress sending frames
containing AIS information following the detection of defect conditions.

Suppressing Alarms

Shows if the specified MEP is currently suppressing sending frames
containing AIS information following the detection of defect conditions.

show ethernet cfm This command displays detailed CFM information about a remote MEP in themaintenance-points continuity check database.
remote detail
Syntaxshow ethernet cfm maintenance-points remote detail{mac mac-address | mpid mpid}[domain domain-name | level level-id]
mac-address – MAC address of a remote maintenance point.
This address can be entered in either of the following formats: xx-xx-xx-xxxx-xx or xxxxxxxxxxxx
mpid – Maintenance end point identifier. (Range: 1-8191)
domain-name – Domain name. (Range: 1-43 alphanumeric characters)level-id – Authorized maintenance level for this domain. (Range: 0-7)

– 843 –

Chapter 29 | CFM Commands
Defining CFM Structures
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Use the mpid keyword with this command to display information about a specificmaintenance point, or use the mac keyword to display information about all
maintenance points that have the specified MAC address.
ExampleThis example shows detailed information about the remote MEP designated by
MPID 2.
Console#show ethernet cfm maintenance-points remote detail mpid 2
MAC Address: 00-0D-54-FC-A2-73
Domain/Level: voip / 3
MA Name: rdPrimary VLAN
: 1
MPID
: 2
Incoming Port
: Eth 1/ 2
CC Lifetime: 645 seconds
Age of Last CC Message : 2 seconds
Frame Loss
: 137
CC Packet Statistics: 647/1
Port State: Up
Interface State: Up
Crosscheck Status: Enabled
Console#Table 171: show ethernet cfm maintenance-points remote detail - display
Field

Description

MAC Address

MAC address of the remote maintenance point. (If a CCM for the specified
remote MEP has never been received or the remote MEP record times out,
the address will be set to the initial value of all Fs.)

Domain/Level

Maintenance domain and level of the remote maintenance point

MA Name

Maintenance association to which this remote MEP belongs

Primary VLAN

VLAN to which this MEP belongs

MPID

MEP identifier

Incoming Port

Port to which this remote MEP is attached.

CC Lifetime

Length of time to hold messages about this MEP in the CCM databaseAge of Last CC Message

Length of time the last CCM message about this MEP has been in the CCM
database

Frame Loss

Percentage of transmitted frames lost

CC Packet Statistics(received/error)

The number of CCM packets received successfully and those with errors– 844 –

Chapter 29 | CFM Commands
Continuity Check Operations

Table 171: show ethernet cfm maintenance-points remote detail - display
Field

Description

Port StatePort states include:
Up – The port is functioning normally.
Blocked – The port has been blocked by the Spanning Tree Protocol.
No port state – Either no CCM has been received, or nor port status TLV
was received in the last CCM.

Interface State

Interface states include:
No Status – Either no CCM has been received, or no interface status TLV
was received in the last CCM.
Up – The interface is ready to pass packets.
Down – The interface cannot pass packets.
Testing – The interface is in some test mode.
Unknown – The interface status cannot be determined for some reason.
Dormant – The interface is not in a state to pass packets but is in a pending
state, waiting for some external event.
Not Present – Some component of the interface is missing.
isLowerLayerDown – The interface is down due to state of the lower layerinterfaces.

Crosscheck Status

Shows if crosscheck function has been enabled.

Continuity Check Operations

ethernet cfm cc ma This command sets the transmission delay between continuity check messages
interval (CCMs). Use the no form to restore the default settings.
Syntaxethernet cfm cc md domain-name ma ma-name interval interval-levelno ethernet cfm cc ma ma-name interval
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)interval-level – The transmission delay between connectivity checkmessages. The setting for this parameter is expressed as levels 4 through 7,
which in turn map to specific intervals of time. (CCM interval field options:
4 - 1 second, 5 - 10 seconds, 6 - 1 minute, 7 - 10 minutes)
Default Setting
4 (1 second)Command Mode
Global Configuration
Command Usage CCMs provide a means to discover other MEPs and to detect connectivity

failures in an MA. If any MEP fails to receive three consecutive CCMs from anyother MEPs in its MA, a connectivity failure is registered. The interval at which– 845 –

Chapter 29 | CFM Commands
Continuity Check Operations
CCMs are issued should therefore be configured to detect connectivity
problems in a timely manner, as dictated by the nature and size of the MA.
 The maintenance of a MIP CCM database by a MIP presents some difficulty forbridges carrying a large number of Service Instances, and for whose MEPs are
issuing CCMs at a high frequency. For this reason, slower CCM transmission
rates may have to be used.

ExampleThis example sets the transmission delay for continuity check messages to level 7(60 seconds).
Console(config)#ethernet cfm cc md voip ma rd interval 7
Console(config)#

Related Commands
ethernet cfm cc enable (846)

ethernet cfm cc This command enables the transmission of continuity check messages (CCMs)
enable within a specified maintenance association. Use the no form to disable thetransmission of these messages.
Syntax[no] ethernet cfm cc enable md domain-name ma ma-namedomain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
Default Setting
EnabledCommand Mode
Global Configuration
Command Usage CCMs are multicast periodically by a MEP in order to discover other MEPs in thesame MA, and to assure connectivity to all other MEPs/MIPs in the MA.
 Each CCM received is checked to verify that the MEP identifier field sent in themessage does not match its own MEPID, which would indicate a duplicate MEPor network loop. If these error types are not found, the CCM is stored in the
MEP’s local database until aged out.

 If a maintenance point fails to receive three consecutive CCMs from any other

MEP in the same MA, a connectivity failure is registered.

– 846 –

Chapter 29 | CFM Commands
Continuity Check Operations

 If a maintenance point receives a CCM with an invalid MEPID or MA level or an

MA level lower than its own, a failure is registered which indicates aconfiguration error or cross-connect error (i.e., overlapping MAs).

ExampleThis example enables continuity check messages for the specified maintenanceassociation.
Console(config)#ethernet cfm cc enable md voip ma rd
Console(config)#

snmp-server enable This command enables SNMP traps for CFM continuity check events. Use the notraps ethernet cfm cc form to disable these traps.
Syntax[no] snmp-server enable traps ethernet cfm cc [config | loop | mep-down |mep-up]config – Sends a trap if this device receives a CCM with the same MPID as its
own but with a different source MAC address, indicating that a CFM
configuration error exists.
loop – Sends a trap if this device receives a CCM with the same source MAC
address and MPID as its own, indicating that a forwarding loop exists.
mep-down – Sends a trap if this device loses connectivity with a remote
MEP, or connectivity has been restored to a remote MEP which has
recovered from an error condition.
mep-up – Sends a trap if a remote MEP is discovered and added to the local
database, the port state of a previously discovered remote MEP changes, ora CCM is received from a remote MEP which as an expired entry in thearchived database.
Default Setting
All continuity checks are disabled.
Command Mode
Global Configuration
Command Usage
All mep-up traps are suppressed when cross-checking of MEPs is enabled because
cross-check traps include more detailed status information.

– 847 –

Chapter 29 | CFM Commands
Continuity Check Operations
ExampleThis example enables SNMP traps for mep-up events.
Console(config)#snmp-server enable traps ethernet cfm cc mep-up
Console(config)#

Related Commands
ethernet cfm mep crosscheck (853)

mep archive-hold- This command sets the time that data from a missing MEP is retained in thetime continuity check message (CCM) database before being purged. Use the no form torestore the default setting.
Syntax
mep archive-hold-time hold-timehold-time – The time to retain data for a missing MEP.
(Range: 1-65535 minutes)
Default Setting
100 minutes
Command Mode
CFM Domain Configuration
Command Usage
A change to the hold time only applies to entries stored in the database after thiscommand is entered.
ExampleThis example sets the aging time for missing MEPs in the CCM database to 30
minutes.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#mep archive-hold-time 30
Console(config-ether-cfm)#

clear ethernet cfm This command clears the contents of the continuity check database.
maintenance-points
remote Syntax
clear ethernet cfm maintenance-points remote [domain domain-name |level level-id]
domain-name – Domain name. (Range: 1-43 alphanumeric characters)level-id – Maintenance level. (Range: 0-7)
– 848 –

Chapter 29 | CFM Commands
Continuity Check Operations

Default Setting
None
Command Mode
Privileged Exec
Command Usage
Use this command without any keywords to clear all entries in the CCM database.
Use the domain keyword to clear the CCM database for a specific domain, or thelevel keyword to clear it for a specific maintenance level.
ExampleConsole#clear ethernet cfm maintenance-points remote domain voip
Console#clear ethernet cfm This command clears continuity check errors logged for the specified maintenanceerrors domain or maintenance level.
Syntaxclear ethernet cfm errors [domain domain-name | level level-id]
domain-name – Domain name. (Range: 1-43 alphanumeric characters)level-id – Maintenance level. (Range: 0-7)
Default Setting
None
Command Mode
Privileged Exec
Command Usage
Use this command without any keywords to clear all entries in the error database.
Use the domain keyword to clear the error database for a specific domain, or thelevel keyword to clear it for a specific maintenance level.
ExampleConsole#clear ethernet cfm errors domain voip
Console#– 849 –

Chapter 29 | CFM Commands
Continuity Check Operations

show ethernet cfm This command displays the CFM continuity check errors logged on this device.
errorsSyntaxshow ethernet cfm errors [domain domain-name | level level-id]
domain-name – Domain name. (Range: 1-43 alphanumeric characters)level-id – Authorized maintenance level for this domain. (Range: 0-7)
Default Setting
None
Command Mode
Privileged Exec
ExampleConsole#show ethernet cfm errors
Level VLAN MPID Interface Remote MAC
ReasonMA Name----- ---- ---- --------- ----------------- ---------------- ---------------5
240 Eth 1/1
ab.2f.9c.00.05.01 LEAK
provider_1_2
Console#Table 172: show ethernet cfm errors - display description
Field

Description

Level

Maintenance level associated with this entry.

VLAN

VLAN in which this error occurred.

MPID

Identifier of remote MEP.

Interface

Port at which the error was recorded

Remote MAC

MAC address of remote MEP.

ReasonError types include:
LEAK – MA x is associated with a specific VID list*, one or more of the VIDs
in this MA can pass through the bridge port, no MEP is configured facing
outward (down) on any bridge port for this MA, and some other MA y, at ahigher maintenance level, and associated with at least one of the VID(s)also in MA x, does have a MEP configured on the bridge port.
VIDS – MA x is associated with a specific VID list* on this MA on the bridge
port, and some other MA y, associated with at least one of the VID(s) also
in MA x, also has an Up MEP configured facing inward (up) on some bridge
port.
EXCESS_LEV – The number of different MD levels at which MIPs are to becreated on this port exceeds the bridge's capabilities.
OVERLAP_LEV – A MEP is created for one VID at one maintenance level,
but a MEP is configured on another VID at an equivalent or higher level,
exceeding the bridge's capabilities.

MA

The maintenance association for this entry.

* This definition is based on the IEEE 802.1ag standard. Current software for this switch only supports a single
VLAN per MA. However, since it may interact with other devices which support multiple VLAN assignments per
MA, this error message may be reported.

– 850 –

Chapter 29 | CFM Commands
Cross Check Operations

Cross Check Operations

ethernet cfm mep This command sets the maximum delay that a device waits for remote MEPs tocrosscheck start-delay come up before starting the cross-check operation. Use the no form to restore thedefault setting.
Syntaxethernet cfm mep crosscheck start-delay delay
no ethernet cfm mep crosscheck start-delay
delay – The time a device waits for remote MEPs to come up before thecross-check is started. (Range: 1-65535 seconds)
Default Setting
10 seconds
Command Mode
Global Configuration
Command Usage This command sets the delay that a device waits for a remote MEP to come up,
and it starts cross-checking the list of statically configure remote MEPs in thelocal maintenance domain against the MEPs learned through CCMs.
 The cross-check start delay should be configured to a value greater than orequal to the continuity check message interval to avoid generating
unnecessary traps.

ExampleThis example sets the maximum delay before starting the cross-check process.
Console(config)#ethernet cfm mep crosscheck start-delay 60
Console(config)#

snmp-server enable This command enables SNMP traps for CFM continuity check events, in relation totraps ethernet cfm the cross-check operations between statically configured MEPs and those learned
crosscheck via continuity check messages (CCMs). Use the no form to restore disable thesetraps.

Syntax[no] snmp-server enable traps ethernet cfm crosscheck [ma-up |mep-missing | mep-unknown]
ma-up – Sends a trap when all remote MEPs in an MA come up.
mep-missing – Sends a trap if the cross-check timer expires and no CCMs
have been received from a remote MEP configured in the static list.
– 851 –

Chapter 29 | CFM Commands
Cross Check Operations
mep-unknown – Sends a trap if an unconfigured MEP comes up.
Default Setting
All continuity checks are enabled.
Command Mode
Global Configuration
Command Usage For this trap type to function, cross-checking must be enabled on the required

maintenance associations using the ethernet cfm mep crosscheck command.

 A mep-missing trap is sent if cross-checking is enabled (with the ethernet cfm

mep crosscheck command), and no CCM is received for a remote MEP
configured in the static list (with the mep crosscheck mpid command).

 A mep-unknown trap is sent if cross-checking is enabled, and a CCM is received

from a remote MEP that is not configured in the static list.

 A ma-up trap is sent if cross-checking is enabled, and a CCM is received from all

remote MEPs configured in the static list for this maintenance association.

ExampleThis example enables SNMP traps for mep-unknown events detected in crosscheck operations.
Console(config)#snmp-server enable traps ethernet cfm crosscheck mep-unknown
Console(config)#

mep crosscheck mpid This command statically defines a remote MEP in a maintenance association. Use
the no form to remove a remote MEP.
Syntax[no] mep crosscheck mpid mpid ma ma-namempid – Identifier for a maintenance end point which exists on another CFMenabled device within the same MA. (Range: 1-8191)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
Default Setting
No remote MEPs are configured.
Command Mode
CFM Domain Configuration– 852 –

Chapter 29 | CFM Commands
Cross Check Operations

Command Usage Use this command to statically configure remote MEPs that exist inside themaintenance association. These remote MEPs are used in the cross-check
operation to verify that all endpoints in the specified MA are operational.
 Remote MEPs can only be configured with this command if domain service

access points (DSAPs) have already been created with the ethernet cfm mep
command at the same maintenance level and in the same MA. DSAPs are MEPs
that exist on the edge of the domain, and act as primary service access points
for end-to-end cross-check, loop-back, and link-trace functions.

ExampleThis example defines a static MEP for the specified maintenance association.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#ma index 1 name rd vlan 1
Console(config-ether-cfm)#mep crosscheck mpid 2 ma rd
Console(config-ether-cfm)#

ethernet cfm mep This command enables cross-checking between the static list of MEPs assigned tocrosscheck other devices within the same maintenance association and the MEPs learned
through continuity check messages (CCMs). Use the disable keyword to stop the
cross-check process.
Syntaxethernet cfm mep crosscheck {enable | disable} md domain-namema ma-nameenable – Starts the cross-check process.
disable – Stops the cross-check process.
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – MA name. (Range: 1-43 alphanumeric characters)
Default Setting
EnabledCommand Mode
Privileged Exec
Command Usage Before using this command to start the cross-check process, first configure theremote MEPs that exist on other devices inside the maintenance association
using the mep crosscheck mpid command. These remote MEPs are used in the
cross-check operation to verify that all endpoints in the specified MA are
operational.

– 853 –

Chapter 29 | CFM Commands
Link Trace Operations
 The cross-check process is disabled by default, and must be manually started

using this command with the enable keyword.

ExampleThis example enables cross-checking within the specified maintenance association.
Console#ethernet cfm mep crosscheck enable md voip ma rd
Console#show ethernet cfm This command displays information about remote MEPs statically configured in a
maintenance-points cross-check list.
remote crosscheck
Syntaxshow ethernet cfm maintenance-points remote crosscheck[domain domain-name | mpid mpid]
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
mpid – Maintenance end point identifier. (Range: 1-8191)
Default Setting
None
Command Mode
Privileged Exec
ExampleThis example shows all remote MEPs statically configured on this device.
Console#show ethernet cfm maintenance-points remote crosscheck
MPID MA Name
Level VLAN MEP Up Remote MAC---- -------------------- ----- ---- ------ -----------------2 downtown
4
2 Yes
00-0D-54-FC-A2-73
Console#Link Trace Operations

ethernet cfm linktrace This command enables caching of CFM data learned through link trace messages.
cache Use the no form to disable caching.
Syntax[no] ethernet cfm linktrace cache
Default Setting
Enabled– 854 –

Chapter 29 | CFM Commands
Link Trace Operations

Command Mode
Global Configuration
Command Usage A link trace message is a multicast CFM frame initiated by a MEP, and forwarded
from MIP to MIP, with each MIP generating a link trace reply, up to the point at
which the link trace message reaches its destination or can no longer be
forwarded.
 Use this command to enable the link trace cache to store the results of link

trace operations initiated on this device. Use the ethernet cfm linktracecommand to transmit a link trace message.

 Link trace responses are returned from each MIP along the path and from thetarget MEP. Information stored in the cache includes the maintenance domain
name, MA name, MEPID, sequence number, and TTL value.

ExampleThis example enables link trace caching.
Console(config)#ethernet cfm linktrace cacheConsole(config)#

ethernet cfm linktrace This command sets the hold time for CFM link trace cache entries. Use the no form
cache hold-time to restore the default setting.
Syntaxethernet cfm linktrace cache hold-time minutes
no ethernet cfm linktrace cache hold-timeminutes – The aging time for entries stored in the link trace cache.
(Range: 1-65535 minutes)
Default Setting
100 minutes
Command Mode
Global Configuration
Command Usage
Before setting the aging time for cache entries, the cache must first be enabledwith the ethernet cfm linktrace cache command.

– 855 –

Chapter 29 | CFM Commands
Link Trace Operations
ExampleThis example sets the aging time for entries in the link trace cache to 60 minutes.
Console(config)#ethernet cfm linktrace cache hold-time 60
Console(config)#

ethernet cfm linktrace This command sets the maximum size for the link trace cache. Use the no form tocache size restore the default setting.
Syntaxethernet cfm linktrace cache size entries
no ethernet cfm linktrace cache size
entries – The number of link trace responses stored in the link trace cache.
(Range: 1-4095 entries)
Default Setting
100 entries
Command Mode
Global Configuration
Command Usage Before setting the cache size, the cache must first be enabled with the ethernet
cfm linktrace cache command.
 If the cache reaches the maximum number of specified entries, or the size is set

to a value less than the current number of stored entries, no new entries areadded. To add additional entries, the cache size must first be increased with thiscommand, or purged with the clear ethernet cfm linktrace-cache command.

ExampleThis example limits the maximum size of the link trace cache to 500 entries.
Console(config)#ethernet cfm linktrace cache size 500
Console(config)#– 856 –

Chapter 29 | CFM Commands
Link Trace Operations

ethernet cfm linktrace This command sends CFM link trace messages to the MAC address of a remote MEP.
Syntaxethernet cfm linktrace {dest-mep destination-mpid | src-mep source-mpid{dest-mep destination-mpid | mac-address} | mac-address} md domain-namema ma-name [ttl number | priority level]
destination-mpid – The identifier of a remote MEP that is the target of thelink trace message. (Range: 1-8191)
source-mpid – The identifier of a source MEP that will send the link trace
message. (Range: 1-8191)
mac-address – MAC address of a remote MEP that is the target of the link
trace message. This address can be entered in either of the following
formats: xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
number – The time to live of the linktrace message. (Range: 0-255 hops)
level - The priority level for sending the link trace messages. (Range: 0-7, 7
highest)Default Setting
None
Command Mode
Privileged Exec
Command Usage Link trace messages can be targeted to MEPs, not MIPs. Before sending a link
trace message, be sure you have configured the target MEP for the specifiedMA.
 If the MAC address of target MEP has not been learned by any local MEP, thenthe linktrace may fail. Use the show ethernet cfm maintenance-points remote
crosscheck command to verify that a MAC address has been learned for thetarget MEP.

 Link trace messages (LTMs) are sent as multicast CFM frames, and forwarded

from MIP to MIP, with each MIP generating a link trace reply, up to the point at
which the LTM reaches its destination or can no longer be forwarded.

 Link trace messages are used to isolate faults. However, this task can be difficultin an Ethernet environment, since each node is connected through multipointlinks. Fault isolation is even more challenging since the MAC address of thetarget node can age out in several minutes. This can cause the traced path tovary over time, or connectivity lost if faults cause the target MEP to be isolated
from other MEPs in an MA.
– 857 –

Chapter 29 | CFM Commands
Link Trace Operations
 When using the command line or web interface, the source MEP used by tosend a link trace message is chosen by the CFM protocol. However, when using
SNMP, the source MEP can be specified by the user.

ExampleThis example sends a link trace message to the specified MEP with a maximum hopcount of 25.
Console#linktrace ethernet dest-mep 2 md voip ma rd ttl 25
Console#clear ethernet cfm This command clears link trace messages logged on this device.
linktrace-cacheCommand Mode
Privileged Exec
ExampleConsole#clear ethernet cfm linktrace-cacheConsole#show ethernet cfm This command displays the contents of the link trace cache.
linktrace-cacheCommand Mode
Privileged Exec
ExampleConsole#show ethernet cfm linktrace-cache
Hops MA
IP / Alias
Ingress MAC
Ing. Action Relay
Forwarded
Egress MAC
Egr. Action---- -------------- ----------------------- ----------------- ----------- ----2 rd
192.168.0.6
00-12-CF-12-12-2D ingOk
Hit
Not Forwarded
Console#Table 173: show ethernet cfm linktrace-cache - display description
Field

Description

Hops

The number hops taken to reach the target MEP.

MA

Name of the MA to which this device belongs.

IP/Alias

IP address or alias of the target device’s CPU.

Forwarded

Shows whether or not this link trace message was forwarded. A message
is not forwarded if received by the target MEP.

Ingress MAC

MAC address of the ingress port on the target device.

Egress MAC

MAC address of the egress port on the target device.

– 858 –

Chapter 29 | CFM Commands
Loopback Operations

Table 173: show ethernet cfm linktrace-cache - display description (Continued)
Field

Description

Ing. Action

Action taken on the ingress port:
IngOk – The target data frame passed through to the MAC Relay Entity.
IngDown – The bridge port’s MAC_Operational parameter is false. Thisvalue could be returned, for example, by an operationally Down MEP thathas another Down MEP at a higher MD level on the same bridge port thatis causing the bridge port’s MAC_Operational parameter to be false.
IngBlocked – The ingress port can be identified, but the target data frame
was not forwarded when received on this port due to active topology
management, i.e., the bridge port is not in the forwarding state.
IngVid – The ingress port is not in the member set of the LTM’s VIDs, andingress filtering is enabled, so the target data frame was filtered by ingressfiltering.

Egr. Action

Action taken on the egress port:
EgrOk – The targeted data frame was forwarded.
EgrDown – The Egress Port can be identified, but that bridge port’s
MAC_Operational parameter is false.
EgrBlocked – The egress port can be identified, but the data frame was notpassed through the egress port due to active topology management, i.e.,the bridge port is not in the forwarding state.
EgrVid – The Egress Port can be identified, but the bridge port is not in the
LTM’s VID member set, and was therefore filtered by egress filtering.

Relay

Relay action:
FDB – Target address found in forwarding database.
MPDB – Target address found in the maintenance point database.
HIT – Target located on this device.

Loopback Operations

ethernet cfm This command sends CFM loopback messages to a MAC address for a MEP or MIP.
loopback
Syntaxethernet cfm loopback {dest-mep destination-mpid | src-mep source-mpid{dest-mep destination-mpid | mac-address} | mac-address} md domain-namema ma-name [count transmit-count] [pattern padding-value][priority priority-value] [size packet-size]
destination-mpid – The identifier of a MEP that is the target of the loopback
message. (Range: 1-8191)
source-mpid – The identifier of a source MEP that will send the loopback
message. (Range: 1-8191)
mac-address – MAC address of the remote maintenance point that is thetarget of the loopback message. This address can be entered in either ofthe following formats: xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)– 859 –

Chapter 29 | CFM Commands
Loopback Operationstransmit-count – The number of times the loopback message is sent.
(Range: 1-1024)
padding-value – Padding characters used to fill the data TLV in a loopback
message. (Range: Any hexadecimal characters; Default: 0x0)
priority-value – Priority assigned to the loopback message (Range:0-7;
Default: 7)
packet-size – The size of the loopback message. (Range: 64-1518 bytes)
Default Setting
Loop back count: One loopback message is sent.
Loop back size: 64 bytes
Command Mode
Privileged Exec
Command Usage Use this command to test the connectivity between maintenance points. If thecontinuity check database does not have an entry for the specified
maintenance point, an error message will be displayed.
 The point from which the loopback message is transmitted (i.e., the DSAP) andthe target maintenance point specified in this command must be within thesame MA.

 Loop back messages can be used for fault verification and isolation after

automatic detection of a fault or receipt of some other error report. Loopback
messages can also used to confirm the successful restoration or initiation ofconnectivity. The receiving maintenance point should respond to the loop backmessage with a loopback reply.

 When using the command line or web interface, the source MEP used by tosend a loopback message is chosen by the CFM protocol. However, when using
SNMP, the source MEP can be specified by the user.

ExampleThis example sends a loopback message to the specified remote MEP.
Console#ethernet cfm loopback dest-mep 2 md rd2 ma rd2
Type ESC to abort.
Source MA Name
: rd2
Destination Address : 00-00-09-98-00-00
Transmitted LBM: 5
Received LBR In Time : 5
Console#– 860 –

Chapter 29 | CFM Commands
Fault Generator Operations

Fault Generator Operations

mep fault-notify This command sets the time a defect must exist before a fault alarm is issued. Use
alarm-time the no form to restore the default setting.
Syntaxmep fault-notify alarm-time alarm-time
no fault-notify alarm-time
alarm-time – The time that one or more defects must be present before afault alarm is generated. (Range: 3-10 seconds)
Default Setting
3 seconds
Command Mode
CFM Domain Configuration
Command Usage
A fault alarm is issued when the MEP fault notification generator state machine
detects that a time period configured by this command has passed with one ormore defects indicated, and fault alarms are enabled at or above the priority levelset by the mep fault-notify lowest-priority command.
ExampleThis example set the delay time before generating a fault alarm.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#mep fault-notify alarm-time 10
Console(config-ether-cfm)#

mep fault-notify This command sets the lowest priority defect that is allowed to generate a fault
lowest-priority alarm. Use the no form to restore the default setting.
Syntaxmep fault-notify lowest-priority priority
no fault-notify lowest-priority
priority – Lowest priority default allowed to generate a fault alarm.
(Range: 1-6)
Default Setting
Priority level 2
Command Mode
CFM Domain Configuration– 861 –

Chapter 29 | CFM Commands
Fault Generator Operations
Command Usage
 A fault alarm can generate an SNMP notification. It is issued when the MEP fault
notification generator state machine detects that a configured time period (seethe mep fault-notify alarm-time command) has passed with one or more
defects indicated, and fault alarms are enabled at or above the priority level set
by this command. The state machine transmits no further fault alarms until it isreset by the passage of a configured time period (see the mep fault-notify
reset-time command) without a defect indication. The normal procedure uponreceiving a fault alarm is to inspect the reporting MEP’s managed objects using
an appropriate SNMP software tool, diagnose the fault, correct it, re-examine
the MEP’s managed objects to see whether the MEP fault notification generator
state machine has been reset, and repeat those steps until the fault is resolved.
 Only the highest priority defect currently detected is reported in the fault

alarm.

 Priority defects include the following items:

Table 174: Remote MEP Priority Levels
Priority Level

Level Name

Description

1

allDef

All defects.

2

macRemErrXcon

DefMACstatus, DefRemoteCCM, DefErrorCCM, or
DefXconCCM.

3

remErrXcon

DefErrorCCM, DefXconCCM or DefRemoteCCM.

4

errXconDefErrorCCM or DefXconCCM.

5

xcon

DefXconCCM

6

noXconNo defects DefXconCCM or lower are to be reported.

Table 175: MEP Defect Descriptions
Field

Description

DefMACstatus

Either some remote MEP is reporting its Interface Status TLV as not
isUp, or all remote MEPs are reporting a Port Status TLV that contains
some value other than psUp.

DefRemoteCCM

The MEP is not receiving valid CCMs from at least one of the remote
MEPs.

DefErrorCCM

The MEP has received at least one invalid CCM whose CCM Interval has
not yet timed out.

DefXconCCM

The MEP has received at least one CCM from either another MAID or alower MD Level whose CCM Interval has not yet timed out.

– 862 –

Chapter 29 | CFM Commands
Fault Generator Operations

ExampleThis example sets the lowest priority defect that will generate a fault alarm.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#mep fault-notify lowest-priority 1
Console(config-ether-cfm)#

mep fault-notify This command configures the time after a fault alarm has been issued, and noreset-time defect exists, before another fault alarm can be issued. Use the no form to restore
the default setting.
Syntaxmep fault-notify reset-time reset-time
no fault-notify reset-time
reset-time – The time that must pass without any further defects indicatedbefore another fault alarm can be generated. (Range: 3-10 seconds)
Default Setting
10 seconds
Command Mode
CFM Domain Configuration
ExampleThis example sets the reset time after which another fault alarm can be generated.
Console(config)#ethernet cfm domain index 1 name voip level 3
Console(config-ether-cfm)#mep fault-notify reset-time 7
Console(config-ether-cfm)#

show ethernet cfm This command displays configuration settings for the fault notification generator.
fault-notify-generator
Syntaxshow ethernet cfm fault-notify-generator mep mpid
mpid – Maintenance end point identifier. (Range: 1-8191)
Default Setting
None
Command Mode
Privileged Exec

– 863 –

Chapter 29 | CFM Commands
Delay Measure Operations
ExampleThis example shows the fault notification settings configured for one MEP.
Console#show ethernet cfm fault-notify-generator mep 1
MD Name
MA NameHighest Defect Lowest Alarm Alarm Time Reset Time------------ ------------ -------------- ------------- ---------- ---------voip
rdnone
macRemErrXcon
3sec.
10sec.
Console#Table 176: show fault-notify-generator - display description
Field

Description

MD Name

The maintenance domain for this entry.

MA Name

The maintenance association for this entry.

Hihest DefectThe highest defect that will generate a fault alarm. (This is disabled bydefault.)

Lowest Alarm

The lowest defect that will generate a fault alarm (see the mep fault-notify
lowest-priority command).

Alarm TimeThe time a defect must exist before a fault alarm is issued (see the mep
fault-notify alarm-time, command).

Reset TimeThe time after a fault alarm has been issued, and no defect exists, before
another fault alarm can be issued (see the mep fault-notify reset-timecommand).

Delay Measure Operations

ethernet cfm delay- This command sends periodic delay-measure requests to a specified MEP within ameasure two-way maintenance association.
Syntaxethernet cfm delay-measure two-way [src-mep source-mpid] {dest-mep
destination-mpid | mac-address} md domain-name ma ma-name[count transmit-count] [interval interval] [size packet-size] [timeout timeout]
source-mpid – The identifier of a source MEP that will send the delaymeasure message. (Range: 1-8191)
destination-mpid – The identifier of a remote MEP that is the target of thedelay-measure message. (Range: 1-8191)
mac-address – MAC address of a remote MEP that is the target of the delaymeasure message. This address can be entered in either of the following
formats: xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx
domain-name – Domain name. (Range: 1-43 alphanumeric characters)
ma-name – Maintenance association name. (Range: 1-43 alphanumericcharacters)
count – The number of times to retry sending the message if no response isreceived before the specified timeout. (Range: 1-5)
– 864 –

Chapter 29 | CFM Commands
Delay Measure Operations

interval – The transmission delay between delay-measure messages.
(Range: 1-5 seconds)
packet-size – The size of the delay-measure message. (Range: 64-1518
bytes)
timeout - The timeout to wait for a response. (Range: 1-5 seconds)
Default Setting
Count: 5
Interval: 1 second
Size: 64 bytes
Timeout: 5 seconds
Command Mode
Privileged Exec
Command Usage Delay measurement can be used to measure frame delay and frame delay
variation between MEPs.
 A local MEP must be configured for the same MA before you can use thiscommand.

 If a MEP is enabled to generate frames with delay measurement (DM)information, it periodically sends DM frames to its peer MEP in the same MA.,and expects to receive DM frames back from it.

 Frame delay measurement can be made only for two-way measurements,

where the MEP transmits a frame with DM request information with the
TxTimeStampf (Timestamp at the time of sending a frame with DM request
information), and the receiving MEP responds with a frame with DM reply
information with TxTimeStampf copied from the DM request information,
RxTimeStampf (Timestamp at the time of receiving a frame with DM request
information), and TxTimeStampb (Timestamp at the time of transmitting aframe with DM reply information):
Frame Delay=(RxTimeStampb-TxTimeStampf )-(TxTimeStampb-RxTimeStampf ) The MEP can also make two-way frame delay variation measurements based on

its ability to calculate the difference between two subsequent two-way frame
delay measurements.

ExampleThis example sends periodic delay-measure requests to a remote MEP.
Console#ethernet cfm delay-measure two-way dest-mep 1 md voip ma rd
Type ESC to abort.
Sending 5 Ethernet CFM delay measurement message, timeout is 5 sec.
Sequence Delay Time (ms.) Delay Variation (ms.)-------- ---------------- --------------------1< 10
0– 865 –

Chapter 29 | CFM Commands
Delay Measure Operations
2
3
4
5

< 10
0
< 10
0
40
40
< 10
40
Success rate is 100% (5/5), delay time min/avg/max=0/8/40 ms.
Average frame delay variation is 16 ms.
Console#– 866 –30

OAM Commands

The switch provides OAM (Operation, Administration, and Maintenance) remotemanagement tools required to monitor and maintain the links to subscriber CPEs
(Customer Premise Equipment). This section describes functions including
enabling OAM for selected ports, loop back testing, and displaying device
information.
Table 177: OAM Commands
CommandFunctionModeefm oamEnables OAM servicesIC

efm oam critical-link-event

Enables reporting of critical event or dying gaspIC

efm oamlink-monitor frame

Enables reporting of errored frame link eventsIC

efm oam link-monitor
frame threshold

Sets the threshold for errored frame link eventsIC

efm oam link-monitor
frame window

Sets the monitor period for errored frame link eventsIC

efm oam mode

Sets the OAM operational mode to active or passive

ICclear efm oam counters

Clears statistical counters for various OAMPDU message
types

PE

clear efm oam event-log

Clears all entries from the OAM event log for the specified PE
port

efm oam remote-loopback

Initiates or terminates remote loopback testPE

efm oam remote-loopback
test

Performs remote loopback test, sending a specified
number of packets

PEshow efm oam counters
interface

Displays counters for various OAM PDU message types

PEshow efm oam event-log
interface

Displays OAM event log

PEshow efm oam remoteloopback interface

Displays results of OAM remote loopback testPEshow efm oam
status interface

Displays OAM configuration settings and event counters

PEshow efm oam status
remote interface

Displays information about attached OAM-enabled
devicesPE– 867 –

Chapter 30 | OAM Commands

efm oam This command enables OAM functions on the specified port. Use the no form todisable this function.
Syntax[no] efm oam
Default Setting
Disabled
Command Mode
Interface Configuration
Command Usage If the remote device also supports OAM, both exchange Information OAMPDUs
to establish an OAM link.
 Not all CPEs support OAM functions, and OAM is therefore disabled by default.

If the CPE attached to a port supports OAM, then this functionality must first be
enabled by the efm oam command to gain access to other remoteconfiguration functions.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#efm oam
Console(config-if)#

efm oam This command enables reporting of critical event or dying gasp. Use the no form tocritical-link-event disable this function.
Syntax[no] efm oam critical-link-event {critical-event | dying-gasp}
critical-event - If a critical event occurs, the local OAM entity (this switch)
indicates this to its peer by setting the appropriate flag in the next
OAMPDU to be sent and stores this information in its OAM event log.
dying-gasp - If an unrecoverable condition occurs, the local OAM entity
indicates this by immediately sending a trap message.
Default Setting
EnabledCommand Mode
Interface Configuration– 868 –

Chapter 30 | OAM Commands

Command Usage Critical events are vendor-specific and may include various failures, such asabnormal voltage fluctuations, out-of-range temperature detected, fan failure,
CRC error in flash memory, insufficient memory, or other hardware faults.
 Dying gasp events are caused by an unrecoverable failure, such as a power

failure or device reset.

Note: When system power fails, the switch will always send a dying gasp trap
message prior to power down.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#efm oam critical-link-event dying-gasp
Console(config-if)#

efm oam This command enables reporting of errored frame link events. Use the no form tolink-monitor frame disable this function.
Syntax[no] efm oam link-monitor frame
Default Setting
EnabledCommand Mode
Interface Configuration
Command Usage An errored frame is a frame in which one or more bits are errored.
 If this feature is enabled and an errored frame link event occurs, the local OAM

entity (this switch) sends an Event Notification OAMPDU.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#efm oam link-monitor frame
Console(config-if)#– 869 –

Chapter 30 | OAM Commands

efm oam link-monitor This command sets the threshold for errored frame link events. Use the no form toframe threshold restore the default setting.
Syntaxefm oam link-monitor frame threshold countno efm oam link-monitor frame thresholdcount - The threshold for errored frame link events. (Range: 1-65535)
Default Setting
1
Command Mode
Interface Configuration
Command Usage
If this feature is enabled, an event notification message is sent if the threshold isreached or exceeded within the period specified by the efm oam link-monitor
frame window command. The Errored Frame Event TLV includes the number of
errored frames detected during the specified period.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#efm oam link-monitor frame threshold 5
Console(config-if)#

efm oam link-monitor This command sets the monitor period for errored frame link events. Use the noframe window form to restore the default setting.
Syntaxefm oam link-monitor frame window size
no efm oam link-monitor frame window
size - The period of time in which to check the reporting threshold forerrored frame link events. (Range: 10-65535 units of 100 milliseconds)
Default Setting
10 (units of 100 milliseconds) = 1 second
Command Mode
Interface Configuration
Command Usage
If this feature is enabled, an event notification message is sent if the thresholdspecified by the efm oam link-monitor frame threshold command is reached or– 870 –

Chapter 30 | OAM Commands

exceeded within the period specified by this command. The Errored Frame Event
TLV includes the number of errored frames detected during the specified period.
ExampleThis example set the window size to 5 seconds.
Console(config)#interface ethernet 1/1
Console(config-if)#efm oam link-monitor frame window 50
Console(config-if)#

efm oam mode This command sets the OAM mode on the specified port. Use the no form torestore the default setting.
Syntaxefm oam mode {active | passive}no efm oam mode
active - All OAM functions are enabled.
passive - All OAM functions are enabled, except for OAM discovery, andsending loopback control OAMPDUs.
Default Setting
ActiveCommand Mode
Interface Configuration
Command Usage
When set to active mode, the selected interface will initiate the OAM discovery
process. When in passive mode, it can only respond to discovery messages.
ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#efm oam mode active
Console(config-if)#– 871 –

Chapter 30 | OAM Commands

clear efm oam This command clears statistical counters for various OAMPDU message types.
counters
Syntaxclear efm oam counters [interface-list]
interface-list - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#clear efm oam counters
Console#Related Commands
show efm oam counters interface (875)clear efm oam This command clears all entries from the OAM event log for the specified port.
event-log
Syntaxclear efm oam event-log [interface-list]
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate nonconsecutive
port identifiers with a comma and no spaces; use a hyphen to designate a
range of ports. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#clear efm oam event-log
Console#– 872 –

Chapter 30 | OAM Commands

efm oam This command starts or stops OAM loopback test mode to the attached CPE.
remote-loopback
Syntaxefm oam remote-loopback {start | stop} interface
start - Starts remote loopback test mode.
stop - Stops remote loopback test mode.
interface - unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
Default Setting
None
Command Mode
Privileged Exec
Command Usage OAM remote loop back can be used for fault localization and link performance

testing. Statistics from both the local and remote DTE can be queried andcompared at any time during loop back testing.

 Use the efm oam remote-loopback start command to start OAM remote loop

back test mode on the specified port. Afterwards, use the efm oam remoteloopback test command to start sending test packets. Then use the efm oam
remote loopback stop command to terminate testing (if test packets are still
being sent) and to terminate loop back test mode.

 The port that you specify to run this test must be connected to a peer OAM

device capable of entering into OAM remote loopback mode.

 During a remote loopback test, the remote OAM entity loops back every frame

except for OAMPDUs and pause frames.

 During loopback testing, both the switch and remote device are permitted tosend OAMPDUs to the peer device and to process any OAMPDUs received fromthe peer.

ExampleConsole#efm oam remote-loopback start 1/1
Loopback operation is processing, please wait.
Enter loopback mode succeeded.
Console#– 873 –

Chapter 30 | OAM Commands

efm oam remote- This command performs a remote loopback test, sending a specified number ofloopback test packets.
Syntaxefm oam remote-loopback test interface [number-of-packets [packet-size]]
interface - unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
number-of-packets - Number of packets to send. (Range: 1-99999999)
packet-size - Size of packets to send. (Range: 64-1518 bytes)
Default Setting
Number of packets: 10,000
Packet size: 64 bytes
Command Mode
Privileged Exec
Command Usage You can use this command to perform an OAM remote loopback test on thespecified port. The port that you specify to run this test must be connected to apeer OAM device capable of entering into OAM remote loopback mode.
 During a remote loopback test, the remote OAM entity loops back every frame

except for OAMPDUs and pause frames.

 OAM remote loopback can be used for fault localization and link performance

testing. Statistics from both the local and remote DTE can be queried andcompared at any time during loopback testing.

 A summary of the test is displayed after it is finished.

ExampleConsole#efm oam remote-loopback test 1/2
Loopback test is processing, press ESC to suspend.
....
Port OAM loopback Tx OAM loopback Rx Loss Rate---- --------------- --------------- --------1/2
1990
1016
48.94 %
Console#– 874 –

Chapter 30 | OAM Commands

show efm oam This command displays counters for various OAM PDU message types.
counters interface
Syntaxshow efm oam counters interface [interface-list]
interface-list - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show efm oam counters interface 1/1
Port OAMPDU Type
TX
RX---- --------------------- ---------- ---------1/1 Information
1121
1444
1/1 Event Notification
00
1/1 Loopback Control
10
1/1 Organization Specific 760Console#show efm oam This command displays the OAM event log for the specified port(s) or for all ports
event-log interface that have logs.
show efm oam event-log interface [interface-list]
interface-list - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
Command Mode
Privileged Exec
Command Usage When a link event occurs, no matter whether the location is local or remote, thisinformation is entered in the OAM event log.
 When the log system becomes full, older events are automatically deleted tomake room for new entries.

– 875 –

Chapter 30 | OAM Commands

ExampleConsole#show efm oam event-log interface 1/1
OAM event log of Eth 1/1:
00:24:07 2001/01/01"Unit 1, Port 1: Dying Gasp at Remote"
Console#This command can show OAM link status changes for link partner as shown in thisexample.
Console#show efm oam event-log interface 1/1
OAM event log of Eth 1/1:
10:22:55 2013/09/13"Unit 1, Port 1: Connection to remote device is up at Local"
10:22:44 2013/09/13"Unit 1, Port 1: Connection to remote device is down at Local"<--- When the link is down,this event will be written to OAM event-log
10:20:02 2013/09/13"Unit 1, Port 1: Connection to remote device is up at Local"<--- When the link is up,this event will be written to OAM event-log,
Console#clear efm oam event-log<--- Use he "clear efm oam event-log” command to clear the event-log.
Console#show efm oam event-log interface 1/1
Console#This command can show OAM dying gasp changes for link partner as shown in thisexample.
Console#show efm oam event-log interface 1/1<--- When dying gasp happens and the switch get these packets, it will log
this event in OAM event-log.
OAM event log of Eth 1/1:
10:27:21 2013/09/13"Unit 1, Port 1: Connection to remote device is down at Local"
10:27:20 2013/09/13"Unit 1, Port 1: Dying Gasp occurred at Remote"
Console#show efm oam event-log interface 1/1
OAM event log of Eth 1/1:
10:28:31 2013/09/13"Unit 1, Port 1: Connection to remote device is up at Local"
10:28:28 2013/09/13"Unit 1, Port 1: Dying Gasp clear occurred at Remote"<--- When the remote device comes up, the switch will get OAM packets
without the dying gasp bit and display "dying gasp event clear".
Console#– 876 –

Chapter 30 | OAM Commands

show efm oam This command displays the results of an OAM remote loopback test.
remote-loopback
interface Syntax
show efm oam remote-loopback interface [interface-list]
interface-list - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show efm oam remote-loopback interface 1/1
Port OAM loopback Tx OAM loopback Rx Loss Rate---- --------------- --------------- --------1/1
2300
2250
0.01 %
Console#show efm oam This command displays OAM configuration settings and event counters.
status interface
Syntaxshow efm oam status interface [interface-list] [brief]interface - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
brief - Displays a brief list of OAM configuration states.
Command Mode
Privileged Exec
ExampleConsole#show efm oam status interface 1/1
OAM information of Eth 1/1:
Basic Information:
Admin State: Enabled
Operation State: Operational
Mode: Active
Remote Loopback: Disabled
Remote Loopback Status: No loopback
Dying Gasp
: Enabled
Critical Event: Enabled– 877 –

Chapter 30 | OAM Commands

Link Monitor (Errored Frame): Enabled
Link Monitor:
Errored Frame Window (100msec) : 10
Errored Frame Threshold: 1
Console#show efm oam status interface 1/1 brief$ = local OAM in loopback* = remote OAM in loopback
Port Admin
ModeRemoteDying
Critical Errored
State
Loopback Gasp
Event
Frame
---- ------- ------- -------- ------- -------- ------1/1 Enabled Active Disabled Enabled Enabled Enabled
Console#show efm oam status This command displays information about attached OAM-enabled devices.
remote interface
Syntaxshow efm oam status remote interface [interface-list]
interface-list - unit/port
unit - Unit identifier. (Range: 1)
port - Port number or list of ports. To enter a list, separate
nonconsecutive port identifiers with a comma and no spaces; use ahyphen to designate a range of ports. (Range: 1-28/54)
Command Mode
Privileged Exec
ExampleConsole#show efm oam status remote interface 1/1
Port MAC Address
OUI
RemoteUnidirectional Link
MIB Variable
Loopback
Monitor Retrieval---- ----------------- ------ -------- -------------- ------- -----------1/1 00-12-CF-6A-07-F6 000084 Enabled Disabled
Enabled Disabled
Console#– 878 –

31

Domain Name Service
Commands
These commands are used to configure Domain Naming System (DNS) services.
Entries can be manually configured in the DNS domain name to IP address
mapping table, default domain names configured, or one or more name servers
specified to use for domain name to address translation.
Note that domain name services will not be enabled until at least one name serveris specified with the ip name-server command and domain lookup is enabled with
the ip domain-lookup command.
The switch performs both as a DNS client and a DNS server/proxy in the following
manner:PC (DNS Client) <------> Switch (DNS client1, server/proxy2) <------> Server (anotherserver/proxy)
1 For the case that the switch performs as a DNS client and an incomplete hostname is received, it will work through the domain list, appending each domainname in the list to the host name, and checking with the specified name servers
for a match.

2 Otherwise, the switch acts as a DNS server/proxy when an outside host (namely, a

DNS client) intends to get an IP address for a host name through the switch. In
this case, it will not add the domain suffix to query name servers). That meansthat the DNS client is responsible for adding the domain suffix.

Table 178: Address Table Commands
CommandFunctionMode

ip domain-list

Defines a list of default domain names for incomplete host
names

GC

ip domain-lookup

Enables DNS-based host name-to-address translationGC

ip domain-nameDefines a default domain name for incomplete host names

GC

ip hostCreates a static IPv4 host name-to-address mappingGC

ip name-server

Specifies the address of one or more name servers to use forhost name-to-address translationGC

ipv6 host

Creates a static IPv6 host name-to-address mappingGC

clear dns cache

Clears all entries from the DNS cachePEshow dns

Displays the configuration for DNS services

PEshow dns cache

Displays entries in the DNS cachePEshow hosts

Displays the static host name-to-address mapping table

PE

DNS

– 879 –

Chapter 31 | Domain Name Service Commands
DNS Commands
Table 178: Address Table Commands
CommandFunctionMode

ip mdns

Enables multicast DNS

GCshow ip mdns

Shows configuration state for multicast DNS

GC

mDNS

DNS Commands
ip domain-list This command defines a list of domain names that can be appended to incomplete
host names (i.e., host names passed from a client that are not formatted withdotted notation). Use the no form to remove a name from this list.
Syntax[no] ip domain-list namename - Name of the host. Do not include the initial dot that separates thehost name from the domain name. (Range: 1-127 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage Domain names are added to the end of the list one at a time.
 When an incomplete host name is received by the DNS service on this switch, itwill work through the domain list, appending each domain name in the list to
the host name, and checking with the specified name servers for a match.

 If there is no domain list, the domain name specified with the ip domain-namecommand is used. If there is a domain list, the default domain name is not used.

ExampleThis example adds two domain names to the current list and then displays the list.
Console(config)#ip domain-list sample.com.jp
Console(config)#ip domain-list sample.com.uk
Console(config)#end
Console#show dns
Domain Lookup Status:
DNS Disabled
Default Domain Name:
sample.com– 880 –

Chapter 31 | Domain Name Service Commands
DNS Commands

Domain Name List:
sample.com.jp
sample.com.uk
Name Server List:
Console#Related Commands
ip domain-name (882)

ip domain-lookup This command enables DNS host name-to-address translation. Use the no form todisable DNS.
Syntax[no] ip domain-lookup
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage At least one name server must be specified before DNS can be enabled.
 If one or more name servers are configured, but DNS is not yet enabled and theswitch receives a DHCP packet containing a DNS field with a list of DNS servers,
then the switch will automatically enable DNS host name-to-addresstranslation.

 If all name servers are deleted, DNS will automatically be disabled.

ExampleThis example enables DNS and then displays the configuration.
Console(config)#ip domain-lookup
Console(config)#end
Console#show dns
Domain Lookup Status:
DNS Enabled
Default Domain Name:
sample.com
Domain Name List:
sample.com.jp
sample.com.uk
Name Server List:
192.168.1.55
10.1.0.55
Console#– 881 –

Chapter 31 | Domain Name Service Commands
DNS Commands
Related Commands
ip domain-name (882)
ip name-server (883)

ip domain-name This command defines the default domain name appended to incomplete hostnames (i.e., host names passed from a client that are not formatted with dotted
notation). Use the no form to remove the current domain name.
Syntax
ip domain-name nameno ip domain-namename - Name of the host. Do not include the initial dot that separates thehost name from the domain name. (Range: 1-127 characters)
Default Setting
None
Command Mode
Global Configuration
ExampleConsole(config)#ip domain-name sample.com
Console(config)#end
Console#show dns
Domain Lookup Status:
DNS Disabled
Default Domain Name:
sample.com
Domain Name List:
Name Server List:
Console#Related Commands
ip domain-list (880)
ip name-server (883)
ip domain-lookup (881)

ip host This command creates a static entry in the DNS table that maps a host name to an
IPv4 address. Use the no form to remove an entry.
Syntax[no] ip host name address
name - Name of an IPv4 host. (Range: 1-127 characters)
address - Corresponding IPv4 address.

– 882 –

Chapter 31 | Domain Name Service Commands
DNS Commands

Default Setting
No static entries
Command Mode
Global Configuration
Command Usage
Use the no ip host command to clear static entries.
ExampleThis example maps an IPv4 address to a host name.
Console(config)#ip host rd5 192.168.1.55
Console(config)#end
Console#show hosts
No. Flag TypeIP Address
TTL
Host---- ---- ------- -------------------- ----- -----------------------------0
2 Address 192.168.1.55
rd5
Console#ip name-server This command specifies the address of one or more domain name servers to use forname-to-address resolution. Use the no form to remove a name server from thislist.
Syntax[no] ip name-server server-address1 [server-address2 …
server-address6]
server-address1 - IPv4 or IPv6 address of domain-name server.
server-address2 … server-address6 - IPv4 or IPv6 address of additional
domain-name servers.
Default Setting
None
Command Mode
Global Configuration
Command Usage
The listed name servers are queried in the specified sequence until a response isreceived, or the end of the list is reached with no response.
ExampleThis example adds two domain-name servers to the list and then displays the list.
Console(config)#ip name-server 192.168.1.55 10.1.0.55
Console(config)#end
Console#show dns– 883 –

Chapter 31 | Domain Name Service Commands
DNS Commands
Domain Lookup Status:
DNS disabled
Default Domain Name:
sample.com
Domain Name List:
sample.com.jp
sample.com.uk
Name Server List:
192.168.1.55
10.1.0.55
Console#Related Commands
ip domain-name (882)
ip domain-lookup (881)

ipv6 host This command creates a static entry in the DNS table that maps a host name to an
IPv6 address. Use the no form to remove an entry.
Syntax[no] ipv6 host name ipv6-address
name - Name of an IPv6 host. (Range: 1-127 characters)
ipv6-address - Corresponding IPv6 address. This address must be enteredaccording to RFC 2373 “IPv6 Addressing Architecture,” using 8 colonseparated 16-bit hexadecimal values. One double colon may be used in theaddress to indicate the appropriate number of zeros required to fill the
undefined fields.
Default Setting
No static entries
Command Mode
Global Configuration
ExampleThis example maps an IPv6 address to a host name.
Console(config)#ipv6 host rd6 2001:0db8:1::12
Console(config)#end
Console#show hosts
No. Flag TypeIP Address
TTL
Domain---- ---- ------- -------------------- ----- ------------------------------0
2 Address 192.168.1.55
rd5
1
2 Address 2001:DB8:1::12
rd6
Console#– 884 –

Chapter 31 | Domain Name Service Commands
DNS Commands

clear dns cache This command clears all entries in the DNS cache.
Command Mode
Privileged Exec
ExampleConsole#clear dns cacheConsole#show dns cache
No.
Flag
Type
IP Address
TTL
Host------- ------- ------- --------------- ------- -------Console#

show dns This command displays the configuration of the DNS service.
Command Mode
Privileged Exec
ExampleConsole#show dns
Domain Lookup Status:
DNS enabled
Default Domain Name:
sample.com
Domain Name List:
sample.com.jp
sample.com.uk
Name Server List:
192.168.1.55
10.1.0.55
Console#show dns cache This command displays entries in the DNS cache.
Command Mode
Privileged Exec
ExampleConsole#show dns cache
No.
Flag
Type
IP Address
TTL
Host------- ------- ------- --------------- ------- -------0
4 Host52.196.118.60
3501 www.accton.com
1
4 Host166.62.56.229
21540 www.edge-core.com
2
4 Host35.201.87.174
1787 ignitenet.com
3
4 CNAME
POINTER TO:2
1787 www.ignitenet.com
Console#– 885 –

Chapter 31 | Domain Name Service Commands
DNS Commands
Table 179: show dns cache - display description
Field

Description

No.

The entry number for each resource record.

Flag

The flag is always “4” indicating a cache entry and therefore unreliable.

Type

This field includes “Host” which specifies the primary name for the owner, and“CNAME” which specifies multiple domain names (or aliases) which aremapped to the same IP address as an existing entry.

IP Address

The IP address associated with this record.

TTL

The time to live reported by the name server.

Host

The host name associated with this record.

show hosts This command displays the static host name-to-address mapping table.
Command Mode
Privileged Exec
ExampleNote that a host name will be displayed as an alias if it is mapped to the same
address(es) as a previously configured entry.
Console#show hosts

No. Flag TypeIP Address---- ---- ------- -------------------0
2 Address 192.168.2.1
1
4 Address 52.196.118.60
24 Address 166.62.56.229
3
4 Address 35.201.87.174
4
4 CNAME
POINTER TO:3

Console#TTL
Host----- ---------------------------------rdrouter
3341 www.accton.com
21381 www.edge-core.com
1627 ignitenet.com
1628 www.ignitenet.com

Table 180: show hosts - display description
Field

Description

No.

The entry number for each resource record.

Flag

The field displays “2” for a static entry, or “4” for a dynamic entry stored in thecache.

Type

This field includes “Address” which specifies the primary name for the owner,and “CNAME” which specifies multiple domain names (or aliases) which aremapped to the same IP address as an existing entry.

IP Address

The IP address associated with this record.

TTL

The time to live reported by the name server. This field is always blank for static
entries.

Host

The host name associated with this record.

– 886 –

Chapter 31 | Domain Name Service Commands

Multicast DNS Commands

Multicast DNS Commands
ip mdns This command enables multicast DNS. Use the no form to disable this feature.
Syntax[no] ip mdns
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
Use this command to enable multicast DNS host name-to-address mapping on thelocal network without the need for a dedicated DNS server. For more informationon this command refer to the Web Management Guide.
ExampleConsole(config)#ip mdns
Console(config)#show ip mdns This command displays the configuration state multicast DNS service.
Command Mode
Privileged Exec
ExampleConsole#show ip mdns
Multicast DNS Status : Enabled
Console#– 887 –

Chapter 31 | Domain Name Service Commands
Multicast DNS Commands– 888 –

32

DHCP Commands

These commands are used to configure Dynamic Host Configuration Protocol(DHCP) client, relay, and server functions. Any VLAN interface can be configured toautomatically obtain an IPv4 address through DHCP. This switch can also be
configured to relay DHCP client configuration requests to a DHCP server on anothernetwork.
Table 181: DHCP Commands
Command Group

Function

DHCP Client

Allows interfaces to dynamically acquire IP address information

DHCP Relay

Relays DHCP requests from local hosts to a remote DHCP server

DHCP Server

Configures DHCP service using address pools or static bindings

DHCP Client
Use the commands in this section to allow the switch’s VLAN interfaces todynamically acquire IP address information.
Table 182: DHCP Client Commands
CommandFunctionMode

ip dhcp dynamic-provision

Enables dynamic provision via DHCP

GC

ip dhcp client class-id

Specifies the DHCP client identifier for an interfaceIC

ip dhcp inform

Enables DHCP Inform on a VLAN interfaceIC

ip dhcp restart client

Submits a BOOTP or DHCP client request

PEshow ip dhcp
dynamic-provision

Shows the status of dynamic provision via DHCPPE

DHCP for IPv4

DHCP for IPv6
ipv6 dhcp client
rapid-commit vlan

Specifies the Rapid Commit option for DHCPv6 message GC
exchange

ipv6 dhcp restart client vlan

Submits a DHCPv6 client request

PE

ipv6 dhcp dynamic-provision

Enables dynamic provision via DHCPv6

GC

show ipv6 dhcp duidShows the DHCP Unique Identifier for this switchPE– 889 –

Chapter 32 | DHCP Commands

DHCP Client

Table 182: DHCP Client Commands
CommandFunctionModeshow ipv6 dhcp vlan

Shows DHCPv6 information for specified interface

PEshow ipv6 dhcp
dynamic-provision

Shows the status of dynamic provision via DHCPv6

PE

DHCP for IPv4

ip dhcp This command enables dynamic provisioning via DHCP. Use the no form to disable
dynamic-provision this feature.
Syntax[no] ip dhcp dynamic-provision
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
DHCPD is the daemon used by Linux to dynamically configure TCP/IP information
for client systems. To support DHCP option 66/67, you have to add corresponding
statements to the configuration file of DHCPD. Information on how to complete
this process are described in “Downloading a Configuration File and Other
Parameters from a DHCP Server” on page 70.
The following are some alternative commands which can be added to the DHCPD
to complete the dynamic provisioning process.
By default, the parameters for DHCP option 66/67 are not carried by the reply sentfrom the DHCP server. To ask for a DHCP reply with option 66/67, the client can
inform the server that it is interested in option 66/67 by sending a DHCP requestthat includes a 'parameter request list' option. Besides this, the client can also senda DHCP request that includes a 'vendor class identifier' option to the server so thatthe DHCP server can identify the device, and determine what information should
be given to requesting device.
The following are two additional sample configurations of the dhcpd.conf file forthe server version dhcp-3.0.4rc1, you can choose either one of them.

1. Define the conditions in subnet section:
shared-network Sample1 {subnet 192.168.1.0 netmask 255.255.255.0 {# option 55
option dhcp-parameter-request-list 1,66,67;# option 66
option tftp-server-name "192.168.1.1";– 890 –

Chapter 32 | DHCP Commands

DHCP Client# option 67
option bootfile-name "dhcp_config.cfg ";}}2. Define the conditions in class section:
class "OPT66_67" { # for option 66/67# option 124
match if option vendor-class-identifier = "Edgecore";# option 55
option dhcp-parameter-request-list 1,66,67;# option 66
option tftp-server-name "192.168.1.1";# option 67
option bootfile-name "dhcp_config.cfg";}
shared-network Sample2 {subnet 192.168.1.0 netmask 255.255.255.0 {}pool {
allow members of "OPT66_67";
range 192.168.1.10 192.168.1.20;}}
ExampleIn the following example enables dhcp dynamic provisioning.
Console(config)#ip dhcp dynamic-provision
Console(config)#

ip dhcp client class-id This command specifies the DCHP client vendor class identifier for the current

interface. Use the no form to remove the class identifier from the DHCP packet.
Syntax
ip dhcp client class-id [text text | hex hex]
no ip dhcp client class-id
text - A text string. (Range: 1-32 characters)hex - A hexadecimal value. (Range: 1-64 characters)
Default Setting
Class identifier option enabled, using the model number as the string– 891 –

Chapter 32 | DHCP Commands

DHCP Client

Command Mode
Interface Configuration (VLAN)
Command Usage Use this command without any keyword to restore the default setting.
 This command is used to identify the vendor class and configuration of theswitch to the DHCP server, which then uses this information to decide on how
to service the client or the type of information to return.

 The general framework for this DHCP option is set out in RFC 2132 (Option 60).

This information is used to convey configuration settings or other identification
information about a client, but the specific string to use should be supplied byyour service provider or network administrator. Options 60, 66 and 67
statements can be added to the server daemon’s configuration file.
Table 183: Options 60, 66 and 67 Statements
OptionStatement
KeywordParameter

60

vendor-class-identifiera string indicating the vendor class identifier

66

tftp-server-namea string indicating the tftp server name67

bootfile-namea string indicating the bootfile name

 By default, DHCP option 66/67 parameters are not carried in a DHCP server

reply. To ask for a DHCP reply with option 66/67 information, the DHCP client
request sent by this switch includes a “parameter request list” asking for thisinformation. Besides, the client request also includes a “vendor class identifier”
set by the ip dhcp client class-id command that allows the DHCP server to
identify the device, and select the appropriate configuration file for download.
This information is included in Option 55 and 124.
Table 184: Options 55 and 124 Statements
OptionStatement
KeywordParameter55

dhcp-parameter-request-lista list of parameters, separated by ','124

vendor-class-identifiera string indicating the vendor class identifier The server should reply with Option 66 attributes, including the TFTP server

name and boot file name.

 Note that the vendor class identifier can be formatted in either text orhexadecimal using the ip dhcp client class-id command, but the format usedby both the client and server must be the same.

– 892 –

Chapter 32 | DHCP Commands

DHCP Client

ExampleConsole(config)#interface vlan 2
Console(config-if)#ip dhcp client class-id hex 0000e8666572
Console(config-if)#

Related Commands
ip dhcp restart client (894)

ip dhcp inform This command enables DHCP client information to be received on a VLAN interface
that has a user-configured IP address. Use the no form to disable the feature.
Syntax[no] ip dhcp inform
Default Setting
Disabled
Command Mode
Interface Configuration (VLAN)
Command Usage A DHCP Inform message enables a client to obtain information from a DHCP
server without requesting an IP address. When a client enables DHCP Inform, it
must have a static IP address configured on the specified VLAN interface.
Additional parameters are requested by sending a DHCP Inform packet with aparameter request list option. Once the DHCP server receives this DHCP Informpacket, it replies with a DHCP “ack” packet with the supported option
parameters.
 Only Option 3 (router) and Option 6 (domain name server) is supported forclient configuration via DHCP Inform.

 If DHCP Inform is enabled when an interface’s address mode is not user

configured or no IP address is configured, a warning message is displayed.

ExampleConsole(config)#interface vlan 1
Console(config-if)#ip dhcp inform
Console(config-if)#– 893 –

Chapter 32 | DHCP Commands

DHCP Client

ip dhcp restart client This command submits a DHCP client request.
Default Setting
None
Command Mode
Privileged Exec
Command Usage This command issues a DHCP client request for any IP interface that has been
set to DHCP mode through the ip address command.
 DHCP requires the server to reassign the client’s last address if available.
 If the DHCP server has been moved to a different domain, the network portionof the address provided to the client will be based on this new domain.

ExampleIn the following example, the device is reassigned the same address.
Console(config)#interface vlan 1
Console(config-if)#ip address dhcp
Console(config-if)#exit
Console#ip dhcp restart client
Console#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is 00-E0-00-00-00-01
Index: 1001, MTU: 1500
Address Mode is DHCP
IP Address: 192.168.0.2 Mask: 255.255.255.0
Proxy ARP is disabled
DHCP Client Vendor Class ID (text): ECS4150-28P
DHCP Inform is disabled
DHCP Relay Server:
Console#Related Commands
ip address (922)show ip dhcp This command shows the status of dynamic provision via DHCP.
dynamic-provision
Command Mode
Privileged Exec
ExampleConsole#show ip dhcp dynamic-provision
Dynamic Provision via DHCP Status:
Disabled
Console#– 894 –

Chapter 32 | DHCP Commands

DHCP Client

DHCP for IPv6

ipv6 dhcp client This command specifies the Rapid Commit option for DHCPv6 message exchange
rapid-commit vlan for all DHCPv6 client requests submitted from the specified interface. Use the noform to disable this option.
Syntax[no] ipv6 dhcp client rapid-commit vlan vlan-list
vlan-list - VLAN ID, specified as a single number, a range of consecutive
numbers separated by a hyphen, or multiple numbers separated bycommas. (Range: 1-4094; Maximum command length: 300 characters)
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage DHCPv6 clients can obtain configuration parameters from a server through anormal four-message exchange (solicit, advertise, request, reply), or through arapid two-message exchange (solicit, reply). The rapid-commit option must be
enabled on both client and server for the two-message exchange to be used.

 This command allows two-message exchange method for prefix delegation.

When enabled, DCHPv6 client requests submitted from the specified interface
will include the rapid commit option in all solicit messages.

 If the rapid commit option has been enabled on the switch with this command,and on the DHCPv6 server, message exchange can be reduced from the normal
four step process to a two-step exchange of only solicit and reply messages.

ExampleConsole(config)#ipv6 dhcp client rapid-commit vlan 2
Console(config)#

ipv6 dhcp restart This command submits a DHCPv6 client request.
client vlan
Syntaxipv6 dhcp restart client vlan vlan-id
vlan-id - VLAN ID, specified as a single number, a range of consecutive
numbers separated by a hyphen, or multiple numbers separated bycommas. (Range: 1-4094; Maximum command length: 300 characters)– 895 –

Chapter 32 | DHCP Commands

DHCP Client

Default Setting
None
Command Mode
Privileged Exec
Command Usage This command starts the DHCPv6 client process if it is not yet running bysubmitting requests for configuration information through the specified
interface(s). When DHCPv6 is restarted, the switch may attempt to acquire an IP
address prefix through stateful address auto-configuration. If the router
advertisements have the “other stateful configuration” flag set, the switch may
also attempt to acquire other non-address configuration information (such as adefault gateway or DNS server) when DHCPv6 is restarted.
Prior to submitting a client request to a DHCPv6 server, the switch should be
configured with a link-local address using the ipv6 address autoconfig
command. The state of the Managed Address Configuration flag (M flag) and
Other Stateful Configuration flag (O flag) received in Router Advertisement
messages will determine the information this switch should attempt to acquirefrom the DHCPv6 server as described below.
Both M and O flags are set to 1:
DHCPv6 is used for both address and other configuration settings.
This combination is known as DHCPv6 stateful, in which a DHCPv6 server
assigns stateful addresses to IPv6 hosts.



The M flag is set to 0, and the O flag is set to 1:
DHCPv6 is used only for other configuration settings.
Neighboring routers are configured to advertise non-link-local address
prefixes from which IPv6 hosts derive stateless addresses.
This combination is known as DHCPv6 stateless, in which a DHCPv6 server
does not assign stateful addresses to IPv6 hosts, but does assign statelessconfiguration settings.

 DHCPv6 clients build a list of servers by sending a solicit message andcollecting advertised message replies. These servers are then ranked based on
their advertised preference value. If the client needs to acquire prefixes fromservers, only servers that have advertised prefixes are considered.

 If the rapid commit option has been enabled on the switch using the ipv6 dhcp

client rapid-commit vlan command, and on the DHCPv6 server, message
exchange can be reduced from the normal four step process to a two-stepexchange of only solicit and reply messages.

– 896 –

Chapter 32 | DHCP Commands

DHCP Client

ExampleThe following command submits a client request on VLAN 1.
Console#ipv6 dhcp restart client vlan 1
Console#Related Commands
ipv6 address autoconfig (936)

ipv6 dhcp This command enables dynamic provisioning via DHCPv6. Use the no form todynamic-provision disable this feature.
Syntax[no] ipv6 dhcp dynamic-provision
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage DHCPD is the daemon used by Linux to dynamically configure TCP/IP

information for client systems. To support DHCPv6 options 59 and 60, you haveto add corresponding statements to the configuration file of DHCPD.
Information on how to complete this process are described in “Downloading a
Configuration File and Other Parameters from a DHCP Server” on page 70.

 The DHCPv6 options (59/60) for dynamic provision are described in RFC5970.

ExampleIn the following example enables DHCPv6 dynamic provisioning.
Console(config)#ipv6 dhcp dynamic-provision
Console(config)#show ipv6 dhcp duid This command shows the DHCP Unique Identifier for this switch.
Command Mode
Privileged Exec

– 897 –

Chapter 32 | DHCP Commands

DHCP Client

Command Usage
DHCPv6 clients and servers are identified by a DHCP Unique Identifier (DUID)
included in the client identifier and server identifier options. Static or dynamic
address prefixes may be assigned by a DHCPv6 server based on the client’s DUID.
ExampleConsole#show ipv6 dhcp duid
DHCPv6 Unique Identifier (DUID): 0001-0001-4A8158B4-00E00C0000FD
Console#show ipv6 dhcp vlan This command shows DHCPv6 information for the specified interface(s).
Syntaxshow ipv6 dhcp vlan vlan-list
vlan-list - VLAN ID, specified as a single number, a range of consecutive
numbers separated by a hyphen, or multiple numbers separated bycommas. (Range: 1-4094; Maximum command length: 300 characters)
Command Mode
Privileged Exec
Command Usage
Each allocation in the DHCPv6 server is identified by a DUID and an IAID. IAID
means Interface Association Identifier, and is a binding between the interface andone or more IP addresses.
ExampleConsole#show ipv6 dhcp vlan 1
VLAN 1 is in DHCP client mode, Rapid-Commit
IAID:
C0000F0
List of known servers:
Server address : FE80::250:FCFF:FEF9:A494
DUID: 0001-0001-48CFB0D5-F48F2A006801
Server address : FE80::250:FCFF:FEF9:A405
DUID: 0001-0001-38CF5AB0-F48F2A003917
Console#Related Commands
ipv6 address (935)show ipv6 dhcp This command shows the status of dynamic provision via DHCPv6.
dynamic-provision
Command Mode
Privileged Exec

– 898 –

Chapter 32 | DHCP Commands

DHCP Relay

ExampleConsole#show ipv6 dhcp dynamic-provision
Dynamic Provision via DHCPv6 Status:
Disabled
Console#

DHCP Relay
This section describes commands used to configure the switch to relay DHCP
requests from local hosts to a remote DHCP server.
Table 185: DHCP Relay Commands
CommandFunctionMode

ip dhcp relay server

Specifies DHCP server or relay server addressesIC

ip dhcp restart relay

Enables DHCP relay agentPEshow ip dhcp relay

Show the switch’s global DHCP Relay setting - L2 or L3

PE

Global DHCP Relay Settings

L3 DHCP Relay Option Settings
ip dhcp relay information
optionEnables information 82 option to be inserted into the client GC
requests when utilizing L3 DHCP relay.

ip dhcp relay information
option encode no-subtype

Disables the sub-type and sub-length sub-options of theinformation 82 option.

GC

ip dhcp relay information
option remote-id

Sets the Remote ID sub-optionGC

ip dhcp relay information
policySets the information 82 forwarding policy for DHCP Relay. GC

DHCP Relay for IPv6
ipv6 dhcp relay destination Specifies a DHCPv6 server or VLAN to which client requests IC
are forwarded and enables DHCPv6 relay service
show ipv6 dhcp relay
destination

Displays a DHCPv6 server or VLAN to which client requests PE
are forwarded

Global DHCP Relay settings

ip dhcp relay server This command specifies the DHCP server or relay server addresses to use. Use theno form to clear all addresses.
Syntax
ip dhcp relay server address1 [address2 [address3 [address4 [address5]]]]
no ip dhcp relay server
address - IP address of DHCP server. (Range: 1-5 addresses)– 899 –

Chapter 32 | DHCP Commands

DHCP Relay

Default Setting
None
Command Mode
Interface Configuration (VLAN)
Usage Guidelines
 DHCP relay service applies to DHCP client requests received on any configured
VLAN, both the management VLAN and non-management VLANs.
 This command is used to configure DHCP relay for host devices attached to theswitch. If DHCP relay service is enabled (using the ip dhcp relay information
option command), and this switch sees a DHCP client request, it inserts its own
IP address into the request so that the DHCP server will know the subnet where
the client is located. Then, the switch forwards the packet to a DHCP server onanother network. When the server receives the DHCP request, it allocates a free
IP address for the DHCP client from its defined scope for the DHCP client’s
subnet, and sends a DHCP response back to the DHCP relay agent (i.e., thisswitch). This switch then passes the DHCP response received from the server tothe client.

 You must specify the IP address for at least one active DHCP server. Otherwise,

the switch’s DHCP relay agent will not be able to forward client requests to a
DHCP server. Up to five DHCP servers can be specified in order of preference.

If any of the specified DHCP server addresses are not located in the same
network segment with this switch, use the ip default-gateway or ipv6 defaultgateway command to specify the default router through which this switch canreach other IP subnetworks.
 To start the DHCP relay service, enter the ip dhcp restart relay command.

ExampleConsole(config-if)#ip dhcp relay server 192.168.10.19
Console(config-if)#

ip dhcp restart relay This command enables DHCP relay for the switch. Use the no form to disable it.
Syntax
ip dhcp restart relay
Default Setting
Disabled
Command Mode
Privileged Exec

– 900 –

Chapter 32 | DHCP Commands

DHCP Relay

Command Usage
This command is used to configure DHCP relay functions for host devices attachedto the switch. If DHCP relay service is enabled, and this switch sees a DHCP request
broadcast, it inserts its own IP address into the request so the DHCP server willknow the subnet where the client is located. Then, the switch forwards the packet
to the DHCP server on another network. When the server receives the DHCP
request, it allocates a free IP address for the DHCP client from its defined scope forthe DHCP client’s subnet, and sends a DHCP response back to the DHCP relay agent(i.e., this switch). This switch then broadcasts the DHCP response received from theserver to the client.
ExampleIn the following example, the device is reassigned the same address.
Console#ip dhcp restart relay
Console#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is CC-37-AB-BC-4F-FA
Index: 1001, MTU: 1500
Address Mode is User specified
IP Address: 192.168.2.98 Mask: 255.255.255.0
Proxy ARP is disabled
DHCP Client Vendor Class ID (text): ECS4150-28P
DHCP Inform is disabled
DHCP Relay Server: 192.168.2.1
Console#Related Commands
ip dhcp relay server (899)show ip dhcp relay This command displays the operational mode and parameters of the DHCP relay
server.

Syntaxshow ip dhcp relay
Command Mode
Privileged Exec
ExampleConsole#show ip dhcp relay
Status of DHCP relay information:
Insertion of relay information: disabled.
DHCP option policy: drop.
DHCP sub-option format: extra subtype included
DHCP remote id sub-option: mac address (hex encoded)
Console#– 901 –

Chapter 32 | DHCP Commands

DHCP Relay

L3 DHCP Relay Option Settings

ip dhcp relay Enables the option 82 information to be relayed when the switch is set as an L3
information option DHCP Relay agent. Use the no form of the command to disable relaying option 82
information (RFC3046).
Syntax
ip dhcp relay information option
no ip dhcp relay information option
Default Setting
Disabled
Command Mode
Global Configuration
Usage Guidelines
This command enables the insertion of relay Option 82 information in DHCP
request packets.
ExampleConsole(config)#ip dhcp relay information option
Console(config)#

ip dhcp relay Use this command to disable the Option 82 packets including sub-type and subinformation option length in both CID and RID. Use the no form of the command to enable including
encode no-subtype the sub-type and sub-length in both CID and RID.
Syntax
ip dhcp relay information option encode no-subtype
no ip dhcp relay information option encode no-subtype
Default Setting
Sub-type and sub-length information is included.
Command Mode
Global Configuration
Usage Guidelines
Use this command when the Type and Length fields do not need to be relayed aspart of the CID and RID in the option 82 packets.

– 902 –

Chapter 32 | DHCP Commands

DHCP Relay

ExampleConsole(config)#ip dhcp relay information option encode no-subtype
Console(config)#

ip dhcp relay This command sets the remote ID to the switch’s IP address, MAC address, arbitrary
information option or string. Use the no form to restore the default setting.
remote-id
Syntax

ip dhcp relay information option remote-id{ip-address [encode {ascii | hex}] |mac-address [encode {ascii | hex}] |string string }no ip dhcp relay information option remote-id[ip-address encode] | [mac-address encode]
ip-address - Inserts an IP address in the remote ID sub-option for the DHCP
relay (that is, the IP address of the management interface).
mac-address - Inserts a MAC address in the remote ID sub-option for the
DHCP relay (that is, the MAC address of the switch’s CPU).
encode - Indicates encoding in ASCII or hexadecimal.
string - An arbitrary string inserted into the remote identifier field.
(Range: 1-32 characters)
Default Setting
MAC address: hexadecimal
Command Mode
Global Configuration
ExampleThis example sets the remote ID to the switch’s IP address.
Console(config)#ip dhcp relay information option remote-id ip-address
Console(config)#

ip dhcp relay This command sets the Option 82 Information forwarding policy of the switch’s
information policy DHCP Relay service. Use the no form of the command to set the policy to thedefault setting.
Syntax
ip dhcp relay information policy {drop | keep | replace}no ip dhcp relay information policy– 903 –

Chapter 32 | DHCP Commands

DHCP Relay

drop - Do not relay the DHCP request packet.
keep - Retain the original CID and RID in the Option 82 information of the
DHCP request.
replace - Replace the CID and RID of the Option 82 information with therelay agent switch address information.
Default Setting
dropCommand Mode
Global Configuration
Usage Guidelines
 If set to drop, the original DHCP request packet flooded to the receiving VLAN
is received but not relayed to the DHCP server.
 When the replace policy is set, the DHCP request packet’s Option 82 content(RID and CID sub-option) is replaced with the relay agent switch’s address
information. The agent then unicasts the modified DHCP Request packet to the
DHCP server.

 When set to the keep option the DHCP request packet’s Option 82 content isunmodified. However the switch address information of the relay agent isadditionally added into the DHCP request packet. The agent finally unicasts themodified DHCP Request packet including the original RID and CID to the DHCP
server.

ExampleConsole(config)#ip dhcp relay information policy keep
Console(config)#

DHCP Relay for IPv6

ipv6 dhcp relay This command specifies a DHCPv6 server or the VLAN to which client requests are
destination forwarded, and also enables DHCPv6 relay service on this interface. Use the noform to disable this service.
Syntaxipv6 dhcp relay destination {ipv6-address | multicast {all | vlan vlan-id}}no ipv6 dhcp relay destination [ipv6-address | multicast {all |vlan vlan-id}]
ipv6-address - A full IPv6 address including the network prefix and hostaddress bits. This address may designate another relay server or a DHCPv6
server.
multicast - All DHCP server multicast address (FF:05::1:3).
– 904 –

Chapter 32 | DHCP Commands

DHCP Relay

all - Specifies all local VLAN interfaces.
vlan-id - ID of configured VLAN. (Range: 1-4094)
Default Setting
None
Command Mode
Interface Configuration (VLAN)
Usage Guidelines

 You must specify the IPv6 address for at least one DHCPv6 server or anotherrelay agent, or the VLAN to which to multicast a relay message. Otherwise, theswitch’s DHCPv6 relay agent will not forward client requests. This command
enables DHCPv6 relay service for the VLAN from which the command isentered.

 Up to five destination addresses may be defined using consecutive commands.
 This command is used to configure DHCPv6 relay functions for host devices

attached to the switch. If DHCPv6 relay service is enabled (by entering thiscommand), and this switch sees a DHCPv6 request broadcast, it inserts its own
IP address into the request so the DHCPv6 server will know the subnet where
the client is located. Then, the switch forwards the packet to the next relay
agent or DHCPv6 server on another network. When the server receives the
DHCPv6 request, it allocates a free IP address for the DHCPv6 client from its
defined scope for the DHCPv6 client’s subnet, and sends a DHCPv6 responseback to the DHCPv6 relay agent (i.e., this switch). This switch then broadcasts
the DHCPv6 response received from the server to the client.

 When the multicast option is used, the switch multicasts the modified client

request to all configured VLANs or to a specified VLAN, and enables DHCPv6
relay service for those VLANs.

 Up to five relay destinations may be configured by repeating this command.
 When issuing the no ipv6 dhcp relay destination command without any

arguments, the switch will delete all configured destination addresses anddisable DHCP for IPv6 relay for all VLANs.

ExampleConsole(config)#interface vlan 1
Console(config-if)#ipv6 dhcp relay destination 2001:0DB8:3000:3000::42
Console(config-if)#– 905 –

Chapter 32 | DHCP Commands

DHCP Servershow ipv6 dhcp relay This command shows the destination addresses or VLAN to which client messages
destination are forwarded for DHCP relay service.
Syntaxshow ipv6 dhcp relay destination interface [vlan vlan-id]
vlan-id - VLAN ID (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#show ipv6 dhcp relay destination interface vlan 1
DHCP relay destination :VLAN 1 :Unicast: 2001:DB8:3000:3000::42
Console#

DHCP ServerThis section describes commands used to configure client address pools for the
DHCP service.
Table 186: DHCP Server Commands
CommandFunction

ip dhcp excluded-address

Specifies IP addresses that a DHCP server should not assign GC
to DHCP clients

ip dhcp pool

Configures a DHCP address pool on a DHCP Server

GC

service dhcp

Enables the DHCP server feature on this switchGC

bootfile

Specifies a default boot image for a DHCP clientDCclient-identifier*Specifies a client identifier for a DHCP clientDCdefault-routerSpecifies the default router list for a DHCP clientDC

dns-server

Specifies the Domain Name Server (DNS) servers available DC
to a DHCP client

domain-nameSpecifies the domain name for a DHCP clientDC

hardware-address*

Specifies the hardware address of a DHCP client

DC

host*

Specifies the IP address and network mask to manuallybind to a DHCP client

DC

lease

Sets the duration an IP address is assigned to a DHCP client DC

netbios-name-server

Configures NetBIOS Windows Internet Naming Service(WINS) name servers available to Microsoft DHCP clientsDC

netbios-node-type

Configures NetBIOS node type for Microsoft DHCP clientsDC

network

Configures the subnet number and mask for a DHCP
address poolDC

– 906 –

Mode

Chapter 32 | DHCP Commands

DHCP Server

Table 186: DHCP Server Commands (Continued)
CommandFunctionModenext-server

Configures the next server in the boot process of a DHCP
clientDC

optionSets DHCP option details

DC

clear ip dhcp binding

Deletes an automatic address binding from the DHCP
server databasePEshow ip dhcp binding

Displays address bindings on the DHCP server

PE, NEshow ip dhcp

Displays DHCP address poolsPEshow ip dhcp pool

Displays detailed information of DHCP address pools

PE* These commands are used for manually binding an address to a client.

ip dhcp This command specifies IP addresses that the DHCP server should not assign to
excluded-address DHCP clients. Use the no form to remove the excluded IP addresses.
Syntax[no] ip dhcp excluded-address low-address [high-address]
low-address - An excluded IP address, or the first IP address in an excluded
address range.
high-address - The last IP address in an excluded address range.
Default Setting
All IP pool addresses may be assigned.
Command Mode
Global Configuration
ExampleConsole(config)#ip dhcp excluded-address 10.1.0.19
Console(config)#

ip dhcp pool This command configures a DHCP address pool and enter DHCP Pool Configuration
mode. Use the no form to remove the address pool.
Syntax[no] ip dhcp pool namename - A string or integer. (Range: 1-32 characters)
Default Setting
DHCP address pools are not configured.

– 907 –

Chapter 32 | DHCP Commands

DHCP Server

Command Mode
Global Configuration
Usage Guidelines
 After executing this command, the switch changes to DHCP Pool Configurationmode, identified by the (config-dhcp)# prompt.
 From this mode, first configure address pools for the network interfaces (using

the network command). You can also manually bind an address to a specificclient (with the host command) if required. You can configure up to 8 network
address pools, and up to 32 manually bound host address pools (i.e., listing one
host address per pool). However, note that any address specified in a hostcommand must fall within the range of a configured network address pool.

ExampleConsole(config)#ip dhcp pool R&D
Console(config-dhcp)#

Related Commands
network (916)host (912)

service dhcp This command enables the DHCP server on this switch. Use the no form to disable
the DHCP server.
Syntax[no] service dhcp
Default Setting
EnabledCommand Mode
Global Configuration
Command Usage
If the DHCP server is running, you must restart it to implement any configuration
changes.
ExampleConsole(config)#service dhcp
Console(config)#– 908 –

Chapter 32 | DHCP Commands

DHCP Server

bootfile This command specifies the name of the default boot image for a DHCP client. This
file should placed on the Trivial File Transfer Protocol (TFTP) server specified with
the next-server command. Use the no form to delete the boot image name.
Syntaxbootfile filename
no bootfile
filename - Name of the file that is used as a default boot image. (Range: 1 to
128 characters)
Default Setting
None
Command Mode
DHCP Pool Configuration
ExampleConsole(config-dhcp)#bootfile wme.bat
Console(config-dhcp)#

Related Commands
next-server (917)client-identifier This command specifies the client identifier of a DHCP client. Use the no form to
remove the client identifier.
Syntaxclient-identifier {text text | hex hex}
no client-identifier
text - A text string. (Range: 1-32 characters)hex - The hexadecimal value.
Default Setting
None
Command Mode
DHCP Pool Configuration
Command Usage This command identifies a DHCP client to bind to an address specified in thehost command. If both a client identifier and hardware address are configured
for a host address, the client identifier takes precedence over the hardware
address in the search procedure.
– 909 –

Chapter 32 | DHCP Commands

DHCP Server

 BOOTP clients cannot transmit a client identifier. To bind an address to a BOOTP

client, you must associate a hardware address with the host entry.

ExampleConsole(config-dhcp)#client-identifier text steve
Console(config-dhcp)#

Related Commands
host (912)

default-router This command specifies default routers for a DHCP pool. Use the no form to remove
the default routers.
Syntaxdefault-router { address1 [address2] | bootfile filename}no default-routeraddress1 - Specifies the IP address of the primary router.
address2 - Specifies the IP address of an alternate router.
bootfile filename - specifies the boot file name. (Range: 1-128 characters)
Default Setting
None
Command Mode
DHCP Pool Configuration
Usage Guidelines
The IP address of the router should be on the same subnet as the client. You canspecify up to two routers. Routers are listed in order of preference (starting withaddress1 as the most preferred router).
ExampleConsole(config-dhcp)#default-router 10.1.0.54 10.1.0.64
Console(config-dhcp)#– 910 –

Chapter 32 | DHCP Commands

DHCP Server

dns-server This command specifies the Domain Name System (DNS) IP servers available to a
DHCP client. Use the no form to remove the DNS server list.

Syntaxdns-server address1 [address2]
no dns-server
address1 - Specifies the IP address of the primary DNS server.
address2 - Specifies the IP address of the alternate DNS server.
Default Setting
None
Command Mode
DHCP Pool Configuration
Usage Guidelines
 If DNS IP servers are not configured for a DHCP client, the client cannot
correlate host names to IP addresses.
 Servers are listed in order of preference (starting with address1 as the most

preferred server).

ExampleConsole(config-dhcp)#dns-server 10.1.1.253 192.168.3.19
Console(config-dhcp)#

domain-name This command specifies the domain name for a DHCP client. Use the no form to
remove the domain name.
Syntaxdomain-name domain
no domain-namedomain - Specifies the domain name of the client.
(Range: 1-128 characters)
Default Setting
None
Command Mode
DHCP Pool Configuration– 911 –

Chapter 32 | DHCP Commands

DHCP Server

ExampleConsole(config-dhcp)#domain-name sample.com
Console(config-dhcp)#

hardware-address This command specifies the hardware address of a DHCP client. This command isvalid for manual bindings only. Use the no form to remove the hardware address.
Syntax
hardware-address hardware-address typeno hardware-address
hardware-address - Specifies the MAC address of the client device.
type - Indicates the following protocol used on the client device:••

ethernet
ieee802

Default Setting
If no type is specified, the default protocol is Ethernet.
Command Mode
DHCP Pool Configuration
Command Usage
This command identifies a DHCP or BOOTP client to bind to an address specified in
the host command. BOOTP clients cannot transmit a client identifier. To bind an
address to a BOOTP client, you must associate a hardware address with the hostentry.
ExampleConsole(config-dhcp)#hardware-address 00-e0-29-94-34-28 ethernet
Console(config-dhcp)#

Related Commands
host (912)host Use this command to specify the IP address and network mask to manually bind to
a DHCP client. Use the no form to remove the IP address for the client.
Syntaxhost address [mask]
no hostaddress - Specifies the IP address of a client.
– 912 –

Chapter 32 | DHCP Commands

DHCP Servermask - Specifies the network mask of the client.
Default Setting
None
Command Mode
DHCP Pool Configuration
Usage Guidelines Host addresses must fall within the range specified for an existing networkpool.
 When a client request is received, the switch first checks for a network addresspool matching the gateway where the request originated (i.e., if the request
was forwarded by a relay server). If there is no gateway in the client request (i.e.,
the request was not forwarded by a relay server), the switch searches for a
network pool matching the interface through which the client request wasreceived. It then searches for a manually configured host address that falls
within the matching network pool.

 When searching for a manual binding, the switch compares the client identifier

for DHCP clients, and then compares the hardware address for DHCP or BOOTP
clients.

 If no manual binding has been specified for a host entry with the client-

identifier or hardware-address commands, then the switch will assign anaddress from the matching network pool.

 If the mask is unspecified, DHCP examines its address pools. If no mask is foundin the pool database, the Class A, B, or C natural mask is used (see page 916).
This command is valid for manual bindings only.

 The no host command only clears the address from the DHCP server database.

It does not cancel the IP address currently in use by the host.

ExampleConsole(config-dhcp)#host 10.1.0.21 255.255.255.0
Console(config-dhcp)#

Related Commands
client-identifier (909)
hardware-address (912)– 913 –

Chapter 32 | DHCP Commands

DHCP Serverlease This command configures the duration that an IP address is assigned to a DHCP
client. Use the no form to restore the default value.
Syntaxlease {days [hours] [minutes] | infinite}
no leasedays - Specifies the duration of the lease in numbers of days. (Range: 0-365)
hours - Specifies the number of hours in the lease. A days value must be
supplied before you can configure hours. (Range: 0-23)
minutes - Specifies the number of minutes in the lease. A days and hours
value must be supplied before you can configure minutes. (Range: 0-59)
infinite - Specifies that the lease time is unlimited. This option is normallyused for addresses manually bound to a BOOTP client via the hostcommand.
Default Setting
One day
Command Modes
DHCP Pool Configuration
ExampleThe following example leases an address to clients using this pool for 7 days.
Console(config-dhcp)#lease 7
Console(config-dhcp)#

netbios-name-server This command configures NetBIOS Windows Internet Naming Service (WINS) nameservers that are available to Microsoft DHCP clients. Use the no form to remove the
NetBIOS name server list.
Syntaxnetbios-name-server address1 [address2]
no netbios-name-server
address1 - Specifies IP address of primary NetBIOS WINS name server.
address2 - Specifies IP address of alternate NetBIOS WINS name server.
Default Setting
None
Command Mode
DHCP Pool Configuration– 914 –

Chapter 32 | DHCP Commands

DHCP Server

Usage Guidelines
Servers are listed in order of preference (starting with address1 as the most
preferred server).
ExampleConsole(config-dhcp)#netbios-name-server 10.1.0.33 10.1.0.34
Console(config-dhcp)#

Related Commands
netbios-node-type (915)

netbios-node-type This command configures the NetBIOS node type for Microsoft DHCP clients. Use
the no form to remove the NetBIOS node type.
Syntaxnetbios-node-type typeno netbios-node-type
type - Specifies the NetBIOS node type:broadcasthybrid (recommended)
mixed
peer-to-peer
Default Setting
None
Command Mode
DHCP Pool Configuration
ExampleConsole(config-dhcp)#netbios-node-type hybrid
Console(config-dhcp)#

Related Commands
netbios-name-server (914)– 915 –

Chapter 32 | DHCP Commands

DHCP Server

network This command configures the subnet number and mask for a DHCP address pool.
Use the no form to remove the subnet number and mask.
Syntax
network network-number [mask]
no network
network-number - The IP address of the DHCP address pool.
mask - The bit combination that identifies the network (or subnet) and thehost portion of the DHCP address pool.
Command Mode
DHCP Pool Configuration
Usage Guidelines When a client request is received, the switch first checks for a network addresspool matching the gateway where the request originated (i.e., if the request
was forwarded by a relay server). If there is no gateway in the client request (i.e.,
the request was not forwarded by a relay server), the switch searches for a
network pool matching the interface through which the client request wasreceived. It then searches for a manually configured host address that falls
within the matching network pool. If no manually configured host address isfound, it assigns an address from the matching network address pool. However,
if no matching address pool is found the request is ignored.
 This command is valid for DHCP network address pools only. If the mask is not

specified, the class A, B, or C natural mask is used. Subnet addresses areinterpreted as class A, B or C, based on the first field in the specified address. In
other words, if a subnet address nnn.xxx.xxx.xxx is entered, the first field (nnn)
determines the class:0 - 127 is class A, only uses the first field in the network address.
128 - 191 is class B, uses the first two fields in the network address.
192 - 223 is class C, uses the first three fields in the network address.

 The DHCP server assumes that all host addresses are available. You can exclude

subsets of the address space by using the ip dhcp excluded-address command.

ExampleConsole(config-dhcp)#network 10.1.0.0 255.255.255.0
Console(config-dhcp)#– 916 –

Chapter 32 | DHCP Commands

DHCP Servernext-server This command configures the next server in the boot process of a DHCP client. Use
the no form to remove the boot server list.
Syntax[no] next-server address
address - Specifies the IP address of the next server in the boot process,which is typically a Trivial File Transfer Protocol (TFTP) server.
Default Setting
None
Command Mode
DHCP Pool Configuration
ExampleConsole(config-dhcp)#next-server 10.1.0.21
Console(config-dhcp)#

Related Commands
bootfile (909)

option Use this command to enable DHCP options. Use the no form of the command todisable DHCP options.
Syntax

option code {ascii word | hex hex-value | ip-address address1[address2[address3[ address 4]]]}code - A DHCP option code (Range: 0-254).
ascii word - ASCII character string representing a network device (Range: 148 ASCII characters).
hex hex-value - A concatenated hex number string of up to 4 IPv4
addresses in hex format each representing a network device.
ip-address address - up to 4 IPv4 addresses can be entered sequentiallywith blank spaces between. Each address represents a device in the
network.

Default:
Disabled
Command Mode:
DHCP Pool Configuration– 917 –

Chapter 32 | DHCP Commands

DHCP Server

Command Usage:
To convert IPv4 address to a hex number string, each octet of the address is
individually converted to hex and then all four hex values obtained concatenated.
Take for example the address 192.168.2.1, 192=c016, 168=a816, 2=0216, and 1=0116
resulting in c0a8020116 as the hex value for the IPv4 address.
ExampleIn this example network devices 192.168.2.1 and 192.168.3.1 are entered in hex
format using the option command.
Console(config-dhcp)#option 43 hex c0a802021c0a80301
Console(config-dhcp)#

clear ip dhcp binding This command deletes an automatic address binding from the DHCP server
database.
Syntaxclear ip dhcp binding [address]
address - The address of the binding to clear.
Default Setting
None
Command Mode
Privileged Exec
Usage Guidelines An address specifies the client’s IP address. If no ip address is specified, the
DHCP server clears all automatic bindings.
 Use the no host command to delete a manual binding.
 This command is normally used after modifying the address pool, or after

moving DHCP service to another device.

Example.
Console#clear ip dhcp binding
ConsoleRelated Commands
show ip dhcp binding (919)– 918 –

Chapter 32 | DHCP Commands

DHCP Servershow ip dhcp binding This command displays address bindings on the DHCP server.
Syntaxshow ip dhcp binding [address]
address - Specifies the IP address of the DHCP client for which bindings will
be displayed.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
ExampleConsole#show ip dhcp binding
IP

MAC

Lease TimeStart
(dd/hh/mm/ss)--------------- ----------------- ------------------ ----------192.1.3.21 00-00-e8-98-73-21
86400 Dec 25 08:01:57 2002
Total entries : 1
Console#show ip dhcp This command displays DHCP address pools configured on the switch.
Command Mode
Privileged Exec
ExampleConsole#show ip dhcp
Name
Type
IP Address
Mask
Active Pool-------- ---- --------------- --------------- ------------------------------tps
Net 192.168.1.0
255.255.255.0
192.168.1.1- 192.168.1.254
Total entry : 1
Console#show ip dhcp pool This command displays the detailed configuration information of DHCP address
pools on the switch.
Command Mode
Privileged Exec

– 919 –

Chapter 32 | DHCP Commands

DHCP Server

ExampleConsole#show ip dhcp pool
Pool name : officea
Pool type : Network
Network address
Subnet mask

: 192.168.3.1: 255.255.255.0

Boot file:
Client identifier mode : Hex
Client identifier:
Default router: 10.2.3.4
0.0.0.0
DNS server: 192.168.4.4
0.0.0.0
Domain name: officeA
Hardware type
: NoneHardware address: 00-00-00-00-00-00
Lease time
: 1 d/ 0 h/ 0 m
Netbios name server: 0.0.0.0
0.0.0.0
Netbios node type
: Hybrid
Next server: 192.168.5.1
Console#– 920 –

33

IP Interface Commands

An IP Version 4 and Version 6 address may be used for management access to theswitch over the network. Both IPv4 or IPv6 addresses can be used simultaneously toaccess the switch. You can manually configure a specific IPv4 or IPv6 address ordirect the switch to obtain an IPv4 address from a BOOTP or DHCP server when it ispowered on. An IPv6 address can either be manually configured or dynamicallygenerated.
The IPv4 address for VLAN 1 on this switch is set to 192.168.2.10 by default. You may
also need to a establish an IPv4 or IPv6 default gateway between this device andmanagement stations that exist on another network segment.
Table 187: IP Interface Commands
Command Group

Function

IPv4 Interface

Configures an IPv4 address for the switch

IPv6 Interface

Configures an IPv6 address for the switch

ND Snooping

Maintains IPv6 prefix table and user address binding table which can beused for stateless address auto-configuration or for address filtering by
IPv6 Source Guard

IPv4 Interface
An initial IPv4 address of 192.168.2.10 is assigned to VLAN 1 on this switch by
default. If this address is not suitable, you can manually configure a new address tomanage the switch over your network or to connect the switch to existing IP
subnets. You may also need to a establish a default gateway between this device
and management stations or other devices that exist on another network segment(if routing is not enabled).
This section includes commands for configuring IP interfaces, the Address
Resolution Protocol (ARP) and Proxy ARP.
Table 188: IPv4 Interface Commands
Command Group

Function

Basic IPv4 Configuration

Configures the IP address for interfaces and the gateway router

ARP Configuration

Configures static, dynamic and proxy ARP service– 921 –

Chapter 33 | IP Interface Commands

IPv4 Interface

Basic IPv4 Configuration This section describes commands used to configure IP addresses for VLAN
interfaces on the switch.
Table 189: Basic IP Configuration Commands
CommandFunctionMode

ip address

Sets the IP address for the current interfaceIC

ip default-gateway

Defines the default gateway through which this switch can GC
reach other subnetworks

show ip interface

Displays the IP settings for this devicePEshow ip route

Displays specified entries in the routing tablePEshow ip traffic

Displays statistics for IP, ICMP, UDP, TCP and ARP protocols

PE

tracerouteShows the route packets take to the specified host

PE

ping

Sends ICMP echo request packets to another node on the
network

NE, PEip address This command sets the IPv4 address for the currently selected VLAN interface. Use
the no form to remove an IP address.
Syntax
ip address {ip-address netmask [secondary][default-gateway ip-address] | bootp | dhcp}
no ip address [ip-address netmask [secondary] | dhcp]
ip-address - IP address
netmask - Network mask for the associated IP subnet. This mask identifies
the host address bits used for routing to specific subnets. The network
mask can use either the traditional format xxx.xxx.xxx.xxx or classlessformat with the range /5 to /32. For example the subnet 255.255.224.0
would be /19.
secondary - Specifies a secondary IP address.
default-gateway - The default gateway. (Refer to the ip default-gatewaycommand which provides the same function.)bootp - Obtains IP address from BOOTP.
dhcp - Obtains IP address from DHCP.
Default Setting
192.168.2.10/24
Command Mode
Interface Configuration (VLAN)– 922 –

Chapter 33 | IP Interface Commands

IPv4 Interface

Command Usage Before any network interfaces are configured on the router, first create a VLAN
for each unique user group, or for each network application and its associatedusers. Then assign the ports associated with each of these VLANs.
 An IP address must be assigned to this device to gain management access overthe network or to connect the router to existing IP subnets. A specific IP address
can be manually configured, or the router can be directed to obtain an addressfrom a BOOTP or DHCP server. Valid IP addresses consist of four numbers, 0 to
255, separated by periods. Anything other than this format will not be acceptedby the configuration program.

 An interface can have only one primary IP address, but can have many

secondary IP addresses. In other words, secondary addresses need to be
specified if more than one IP subnet can be accessed through this interface.
Note that a secondary address cannot be configured prior to setting the
primary IP address, and the primary address cannot be removed if a secondary
address is still present. Also, if any router/switch in a network segment uses a
secondary address, all other routers/switches in that segment must also use asecondary address from the same network or subnet address space.

 If bootp or dhcp options are selected, the system will immediately start

broadcasting service requests for all VLANs configured to obtain address
assignments through BOOTP or DHCP. IP is enabled but will not function until a
BOOTP or DHCP reply has been received. Requests are broadcast periodicallyby the router in an effort to learn its IP address. (BOOTP and DHCP values can
include the IP address, default gateway, and subnet mask). If the DHCP/BOOTP
server is slow to respond, you may need to use the ip dhcp restart clientcommand to re-start broadcasting service requests, or reboot the switch.

Note: Each VLAN group can be assigned its own IP interface address. You canmanage the switch via any of these IP addresses.

ExampleIn the following example, the device is assigned an address in VLAN 1.
Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.5 255.255.255.0
Console(config-if)#

This example assigns an IP address to VLAN 2 using a classless network mask.
Console(config)#interface vlan 2
Console(config-if)#ip address 10.2.2.1/24
Console(config-if)#– 923 –

Chapter 33 | IP Interface Commands

IPv4 Interface

Related Commands
ip dhcp restart client (894)
ip default-gateway (924)
ipv6 address (935)

ip default-gateway This command specifies the default gateway for destinations not found in local
routing tables. Use the no form to remove a default gateway.
Syntaxip default-gateway gateway
no ip default-gateway
gateway - IP address of the default gateway
Default Setting
No default gateway is established.
Command Mode
Global Configuration
Command Usage The default gateway can also be defined using the following Global
configuration command: ip route 0.0.0.0 0.0.0.0 gateway-address.
 Static routes can also be defined using the ip route command to ensure that

traffic to the designated address or subnet passes through a preferred gateway.

 A default gateway can only be successfully set when a network interface that

directly connects to the gateway has been configured on the router.

 The same link-local address may be used by different interfaces/nodes indifferent zones (RFC 4007). Therefore, when specifying a link-local address for a
default gateway, include zone-id information indicating the VLAN identifier
after the % delimiter. For example, FE80::7272%1 identifies VLAN 1 as theinterface.

ExampleThe following example defines a default gateway for this device:
Console(config)#ip default-gateway 192.168.2.1
Console(config)#end
Console#show ip route
Codes: C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default
S*

0.0.0.0/0 [1/0] via 192.168.2.1, VLAN1– 924 –

Chapter 33 | IP Interface Commands

IPv4 Interface

C
192.168.2.0/24 is directly connected, VLAN1
Console(config)#

Related Commands
ip address (922)
ip route (980)
ipv6 default-gateway (934)show ip interface This command displays the settings of an IPv4 interface.
Syntaxshow ip interface [vlan vlan-id]
vlan-id - VLAN ID (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is E4-9D-73-1B-5E-00
Index: 1001, MTU: 1500
Address Mode is User specified
IP Address: 192.168.1.1 Mask: 255.255.255.0
Proxy ARP is disabled
DHCP Client Vendor Class ID (text): ECS4150-28P
DHCP Inform is disabled
DHCP Relay Server:
Console#Related Commands
ip address (922)show ipv6 interface (944)show ip traffic This command displays statistics for IP, ICMP, UDP, TCP and ARP protocols.
Command Mode
Privileged Exec
ExampleConsole#show ip traffic
IP Statistics:
IP received
7845 total received
header errors
unknown protocols
address errors– 925 –

Chapter 33 | IP Interface Commands

IPv4 Interface

IP sent

discards
7845 delivers
reassembly request datagrams
reassembly succeeded
reassembly failed
forwards datagrams
9903 requests
discards
no routes
generated fragments
fragment succeededfragment failed

ICMP Statistics:
ICMP received

input
errorsdestination unreachable messages
time exceeded messages
parameter problem message
echo request messages
echo reply messages
redirect messages
timestamp request messages
timestamp reply messages
source quench messages
address mask request messages
address mask reply messages

ICMP sent

outputerrorsdestination unreachable messages
time exceeded messages
parameter problem message
echo request messages
echo reply messages
redirect messages
timestamp request messages
timestamp reply messages
source quench messages
address mask request messages
address mask reply messages

UDP Statistics:

TCP Statistics:

Console#input
no port errors
other errors
output7841 input
input errors
9897 output

traceroute This command shows the route packets take to the specified destination.
Syntax
traceroute host– 926 –

Chapter 33 | IP Interface Commands

IPv4 Interface

host - IP address or alias of the host.
Default Setting
None
Command Mode
Privileged Exec
Command Usage Use the traceroute command to determine the path taken to reach a specified
destination.
 A trace terminates when the destination responds, when the maximum

timeout (TTL) is exceeded, or the maximum number of hops is exceeded.

 The traceroute command first sends probe datagrams with the TTL value set atone. This causes the first router to discard the datagram and return an error
message. The trace function then sends several probe messages at eachsubsequent TTL level and displays the round-trip time for each message. Not all
devices respond correctly to probes by returning an “ICMP port unreachable”
message. If the timer goes off before a response is returned, the trace function
prints a series of asterisks and the “Request Timed Out” message. A longsequence of these messages, terminating only when the maximum timeout
has been reached, may indicate this problem with the target device.

 If the target device does not respond or other errors are detected, the switch

will indicate this by one of the following messages:






* - No Response
H - Host Unreachable
N - Network Unreachable
P - Protocol Unreachable
O -Other

ExampleConsole#traceroute 192.168.0.99
Press "ESC" to abort.
Traceroute to 192.168.0.99, 30 hops max, timeout is 3 seconds
Hop Packet 1 Packet 2 Packet 3 IP Address--- -------- -------- -------- --------------1
20 ms<10 ms<10 ms 192.168.0.99
Trace completed.
Console#ping This command sends (IPv4) ICMP echo request packets to another node on the
network.

– 927 –

Chapter 33 | IP Interface Commands

IPv4 Interface

Syntaxping host [count count] [size size]
host - IP address or alias of the host.
count - Number of packets to send. (Range: 1-16)
size - Number of bytes in a packet. (Range: 32-512)
The actual packet size will be eight bytes larger than the size specified
because the switch adds header information.
Default Setting
count: 5
size: 32 bytes
Command Mode
Normal Exec, Privileged Exec
Command Usage Use the ping command to see if another site on the network can be reached.
 The following are some results of the ping command:Normal response - The normal response occurs in one to ten seconds,
depending on network traffic.

Destination does not respond - If the host does not respond, a “timeout”
appears in ten seconds.

Destination unreachable - The gateway for this destination indicates thatthe destination is unreachable.



Network or host unreachable - The gateway found no corresponding entry
in the route table.

 When pinging a host name, be sure the DNS server has been defined(page 883) and host name-to-address translation enabled (page 881). If
necessary, local devices can also be specified in the DNS static host table(page 882).

ExampleConsole#ping 10.1.0.9
Press ESC to abort.
PING to 10.1.0.9, by 5 32-byte payload ICMP packets, timeout is 5 seconds
response time: 10 ms
response time: 10 ms
response time: 10 ms
response time: 10 ms
response time: 0 ms
Ping statistics for 10.1.0.9:
5 packets transmitted, 5 packets received (100%), 0 packets lost (0%)
Approximate round trip times:– 928 –

Chapter 33 | IP Interface Commands

IPv4 Interface

Minimum = 0 ms, Maximum = 10 ms, Average = 8 ms
Console#Related Commands
interface (415)

ARP Configuration This section describes commands used to configure the Address Resolution
Protocol (ARP) on the switch.

Table 190: Address Resolution Protocol Commands
CommandFunction

Mode

arp

Adds a static entry in the ARP cacheGC

arp timeout

Sets the time a dynamic entry remains in the ARP cacheGC

ip proxy-arp

Enables proxy ARP service

ICclear arp-cache

Deletes all dynamic entries from the ARP cachePEshow arp

Displays entries in the ARP cachePE

arp This command adds a static entry in the Address Resolution Protocol (ARP) cache.
Use the no form to remove an entry from the cache.
Syntax
arp ip-address hardware-address
no arp ip-address
ip-address - IP address to map to a specified hardware address.
hardware-address - Hardware address to map to a specified IP address. (Theformat for this address is xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx.)
Default Setting
No default entries
Command Mode
Global Configuration
Command Usage The ARP cache is used to map 32-bit IP addresses into 48-bit hardware (i.e.,
Media Access Control) addresses. This cache includes entries for hosts andother routers on local network interfaces defined on this router.
 The maximum number of static entries allowed in the ARP cache is 128.
 You may need to put a static entry in the cache if there is no response to an ARP

broadcast message. For example, some applications may not respond to ARP– 929 –

Chapter 33 | IP Interface Commands

IPv4 Interface

requests or the response arrives too late, causing network operations to timeout.
 Static entries will not be aged out nor deleted when power is reset. A static

entry can only be removed through the configuration interface.

ExampleConsole(config)#arp 10.1.0.19 01-02-03-04-05-06
Console(config)#

Related Commands
clear arp-cache (931)show arp (932)

arp timeout This command sets the aging time for dynamic entries in the Address Resolution
Protocol (ARP) cache. Use the no form to restore the default timeout.
Syntaxarp timeout seconds
no arp timeout
seconds - The time a dynamic entry remains in the ARP cache.
(Range: 300-86400; 86400 seconds is one day)Default Setting
1200 seconds (20 minutes)
Command Mode
Global Configuration
Command Usage When a ARP entry expires, it is deleted from the cache and an ARP request
packet is sent to re-establish the MAC address.
 The aging time determines how long dynamic entries remain in the cache. If

the timeout is too short, the router may tie up resources by repeating ARP
requests for addresses recently flushed from the table.

ExampleThis example sets the ARP cache timeout for 15 minutes (i.e., 900 seconds).
Console(config)#arp timeout 900
Console(config)#– 930 –

Chapter 33 | IP Interface Commands

IPv4 Interface

ip proxy-arp This command enables proxy Address Resolution Protocol (ARP). Use the no form
to disable proxy ARP.
Syntax[no] ip proxy-arp
Default Setting
Disabled
Command Mode
Interface Configuration (VLAN)
Command Usage
 Proxy ARP allows a non-routing device to determine the MAC address of a hoston another subnet or network.
 End stations that require Proxy ARP must view the entire network as a single

network. These nodes must therefore use a smaller subnet mask than that usedby the router or other relevant network devices.

 Extensive use of Proxy ARP can degrade router performance because it may

lead to increased ARP traffic and increased search time for larger ARP addresstables.

ExampleConsole(config)#interface vlan 3
Console(config-if)#ip proxy-arp
Console(config-if)#clear arp-cache This command deletes all dynamic entries from the Address Resolution Protocol(ARP) cache.

Command Mode
Privileged Exec
ExampleThis example clears all dynamic entries in the ARP cache.
Console#clear arp-cacheThis operation will delete all the dynamic entries in ARP Cache.
Do you want to continue this operation (y/n)?
Console#– 931 –

Chapter 33 | IP Interface Commands

IPv6 Interface

show arp This command displays entries in the Address Resolution Protocol (ARP) cache.
Command Mode
Privileged Exec
Command Usage This command displays information about the ARP cache. The first line shows
the cache timeout. It also shows each cache entry, including the IP address,
MAC address, type (static, dynamic, other), and VLAN interface. Note that entry
type “other” indicates local addresses for this router.
 Static entries are only displayed for VLANs that are up. In other words, static

entries are only displayed when configured for the IP subnet of a existing VLAN,
and that VLAN is linked up.

ExampleThis example displays all entries in the ARP cache.
Console#show arp
ARP Cache Timeout: 1200 (seconds)
IP Address
MAC Address
TypeInterface--------------- ----------------- --------- ----------10.1.0.0
FF-FF-FF-FF-FF-FF other
VLAN1
10.1.0.254
00-00-AB-CD-00-00 other
VLAN1
10.1.0.255
FF-FF-FF-FF-FF-FF other
VLAN1
145.30.20.23
09-50-40-30-20-10 dynamic
VLAN3
Total entry : 4
Console#IPv6 Interface
This switch supports the following IPv6 interface commands.
Table 191: IPv6 Configuration Commands
CommandFunction

ModeInterface Address Configuration and Utilities
ipv6 default-gateway

Sets an IPv6 default gateway for traffic with no known next GC
hop

ipv6 address

Configures an IPv6 global unicast address, and enables
IPv6 on an interface

IC

ipv6 address autoconfig

Enables automatic configuration of IPv6 addresses on aninterface and enables IPv6 on the interface

IC

ipv6 address dhcp

Enables IPv6 DHCP client functionality on an interface

IC

ipv6 address eui-64

Configures an IPv6 global unicast address for an interface
using an EUI-64 interface ID in the low order 64 bits, andenables IPv6 on the interfaceIC– 932 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 191: IPv6 Configuration Commands (Continued)
CommandFunctionMode

ipv6 address link-local

Configures an IPv6 link-local address for an interface andenables IPv6 on the interface

IC

ipv6 enable

Enables IPv6 on an interface that has not been configured ICwith an explicit IPv6 address

ipv6 mtu

Sets the size of the maximum transmission unit (MTU) for
IPv6 packets sent on an interface

ICshow ipv6 interface

Displays the usability and configured settings for IPv6
interfaces

PEshow ipv6 mtu

Displays maximum transmission unit (MTU) information for PE
IPv6 interfaces

show ipv6 traffic

Displays statistics about IPv6 trafficPE

clear ipv6 traffic

Resets IPv6 traffic counters

PE

ping6

Sends IPv6 ICMP echo request packets to another node on NE, PE
the network

traceroute6

Shows the route packets take to the specified hostPE

ipv6 hop-limit

Configures the maximum number of hops used in router
advertisements that are originated by this routerGC

ipv6 neighbor

Configures a static entry in the IPv6 neighbor discovery
cache

GC

ipv6 nd dad attempts

Configures the number of consecutive neighborICsolicitation messages sent on an interface during duplicate
address detection

ipv6 ndmanaged-config-flag

Configures router advertisements to indicate that attached IC
hosts can use stateful autoconfiguration to obtain
addresses

ipv6 nd other-config-flag

Configures router advertisements to indicate that attached IC
hosts can obtain autoconfiguration information other thanaddresses

ipv6 nd ns-interval

Configures the interval between IPv6 neighbor solicitation IC
retransmissions on an interface

ipv6 nd raguard

Blocks incoming Router Advertisement and Router
Redirect packets

ipv6 nd reachable-time

Configures the amount of time that a remote IPv6 node is IC
considered reachable after some reachability confirmation
event has occurred

ipv6 nd prefix

Configures the IPv6 prefixes to include in router
advertisements

ipv6 nd ra interval
minimum-interval[maximum-interval]

Configures the interval between the transmission of router IC
advertisements on an interface

ipv6 nd ra lifetime

Configures the router lifetime value used in router
advertisements sent from an interface

IC

ipv6 nd rarouter-preference

Configures the default router preference for the router on
an interface

IC

Neighbor Discovery– 933 –ICIC

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 191: IPv6 Configuration Commands (Continued)
CommandFunctionMode

ipv6 nd ra suppress

Suppresses router advertisement transmissions on aninterfaceIC

show ipv6 nd raguard

Displays the configuration setting for RA Guard

PE

clear ipv6 neighbors

Deletes all dynamic entries in the IPv6 neighbor discovery PE
cacheshow ipv6 neighbors

Displays information in the IPv6 neighbor discovery cache PE

show ipv6 nd prefix

Displays IPv6 neighbor discovery prefixes for a VLANPEInterface Address Configuration and Utilities

ipv6 default-gateway This command sets an IPv6 default gateway to use for destinations with no known
next hop. Use the no form to remove a previously configured default gateway.
Syntaxipv6 default-gateway ipv6-address
no ipv6 default-gateway
ipv6-address - The IPv6 address of the default next hop router to use fordestinations with no known next hop.
Default Setting
No default gateway is defined
Command Mode
Global Configuration
Command Usage All IPv6 addresses must be according to RFC 2373 “IPv6 Addressing

Architecture,” using 8 colon-separated 16-bit hexadecimal values. One doublecolon may be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields.

 The same link-local address may be used by different interfaces/nodes indifferent zones (RFC 4007). Therefore, when specifying a link-local address,
include zone-id information indicating the VLAN identifier after the % delimiter.
For example, FE80::7272%1 identifies VLAN 1 as the interface from which theping is sent.

 An IPv6 default gateway should be defined if the destination has been assigned

an IPv6 address that is located in a different IP segment.

 An IPv6 default gateway can only be successfully set when a network interface

that directly connects to the gateway has been configured on the switch.

– 934 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ExampleThe following example defines a default gateway for this device:
Console(config)#ipv6 default-gateway FE80::269:3EF9:FE19:6780%1
Console(config)#

Related Commands
ip default-gateway (924)

ipv6 address This command configures an IPv6 global unicast address and enables IPv6 on aninterface. Use the no form without any arguments to remove all IPv6 addresses
from the interface, or use the no form with a specific IPv6 address to remove that
address from the interface.
Syntax[no] ipv6 address ipv6-address[/prefix-length]
ipv6-address - A full IPv6 address including the network prefix and hostaddress bits.
prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix (i.e., the network portion of theaddress).
Default Setting
No IPv6 addresses are defined
Command Mode
Interface Configuration (VLAN)
Command Usage All IPv6 addresses must be according to RFC 2373 “IPv6 Addressing

Architecture,” using 8 colon-separated 16-bit hexadecimal values. One doublecolon may be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields.

 To connect to a larger network with multiple subnets, you must configure a

global unicast address. This address can be manually configured with thiscommand, or it can be automatically configured using the ipv6 address
autoconfig command.

 If a link-local address has not yet been assigned to this interface, this command

will assign the specified static global unicast address and also dynamicallygenerate a link-local unicast address for the interface. (The link-local address ismade with an address prefix of FE80 and a host portion based the switch’s MAC
address in modified EUI-64 format.)– 935 –

Chapter 33 | IP Interface Commands

IPv6 Interface

 If a duplicate address is detected, a warning message is sent to the console.

ExampleThis example specifies a full IPv6 address and prefix length.
Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:DB8:2222:7272::72/96
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled
Link-local address:
fe80::7272:cfff:fe83:3466%1/64
Global unicast address(es):2001:db8:2222:7272::72/96, subnet is 2001:db8:2222:7272::/96
Joined group address(es):ff02::1:ff00:72
ff02::1:ff83:3466ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
ipv6 address eui-64 (939)
ipv6 address autoconfig (936)show ipv6 interface (944)
ip address (922)

ipv6 address This command enables stateless autoconfiguration of IPv6 addresses on an
autoconfig interface and enables IPv6 on the interface. The network portion of the address isbased on prefixes received in IPv6 router advertisement messages; the host portionis based on the modified EUI-64 form of the interface identifier (i.e., the switch’s
MAC address). Use the no form to remove the address generated by this command.
Syntax[no] ipv6 address autoconfig

Default Setting
No IPv6 addresses are defined
Command Mode
Interface Configuration (VLAN)– 936 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Command Usage If a link local address has not yet been assigned to this interface, this command
will dynamically generate a global unicast address (if a global prefix is included
in received router advertisements) and a link local address for the interface.
(The link-local address is made with an address prefix of FE80 and a hostportion based the switch’s MAC address in modified EUI-64 format.) If a duplicate address is detected, a warning message is sent to the console.
 When DHCPv6 is restarted, the switch may attempt to acquire an IP address

prefix through stateful address autoconfiguration. If the router advertisements
have the “other stateful configuration” flag set, the switch may also attempt toacquire other non-address configuration information (such as a default
gateway) from a DHCPv6 server when DHCPv6 is restarted.

ExampleThis example assigns a dynamic global unicast address of to the switch.
Console(config-if)#ipv6 address autoconfig
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is stale
Link-local address:
fe80::7272:cfff:fe83:3466%1/64
Global unicast address(es):(None)
Joined group address(es):ff02::1:ffbc:4ffa
ff02::1:2
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
ipv6 address (935)show ipv6 interface (944)– 937 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 address dhcp This command enables IPv6 DHCP client functionality on an interface so that it canacquire a stateful IPv6 address. Use the no form of the command to disabled theIPv6 DHCP client.
Syntaxipv6 address dhcp
no ipv6 address dhcp
Default Setting
Disabled
Command Mode
Interface Configuration (VLAN)
Command Usage Once enabled on any interface, the interface will have the ability to have astateful IPv6 address assigned to it dynamically using the DHCPv6 protocol.
 If IPv6 router advertisements are enabled and this command is configured, theIPv6 dhcp client will fail to be enabled on the interface.

ExampleConsole(config)#interface vlan 1
Console(config-if)#ipv6 address dhcp
Console(config-if)#

Related Commands
ipv6 address eui-64 (939)
ipv6 address link-local (941)show ipv6 interface (944)– 938 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 address eui-64 This command configures an IPv6 address for an interface using an EUI-64 interface

ID in the low order 64 bits and enables IPv6 on the interface. Use the no form
without any arguments to remove all manually configured IPv6 addresses from theinterface. Use the no form with a specific address to remove it from the interface.
Syntaxipv6 address ipv6-prefix/prefix-length eui-64
no ipv6 address [ipv6-prefix/prefix-length eui-64]
ipv6-prefix - The IPv6 network portion of the address assigned to theinterface.
prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix (i.e., the network portion of theaddress).
Default Setting
No IPv6 addresses are defined
Command Mode
Interface Configuration (VLAN)
Command Usage The prefix must be formatted according to RFC 2373 “IPv6 Addressing

Architecture,” using 8 colon-separated 16-bit hexadecimal values. One doublecolon may be used in the address to indicate the appropriate number of zeros
required to fill the undefined fields.

 If a link local address has not yet been assigned to this interface, this command

will dynamically generate a global unicast address and a link-local address forthis interface. (The link-local address is made with an address prefix of FE80 anda host portion based the switch’s MAC address in modified EUI-64 format.) Note that the value specified in the ipv6-prefix may include some of the high-order host bits if the specified prefix length is less than 64 bits. If the specified
prefix length exceeds 64 bits, then the network portion of the address will takeprecedence over the interface identifier.

 If a duplicate address is detected, a warning message is sent to the console.
 IPv6 addresses are 16 bytes long, of which the bottom 8 bytes typically form aunique host identifier based on the device’s MAC address. The EUI-64
specification is designed for devices that use an extended 8-byte MAC address.
For devices that still use a 6-byte MAC address (also known as EUI-48 format), it
must be converted into EUI-64 format by inverting the universal/local bit in theaddress and inserting the hexadecimal number FFFE between the upper andlower three bytes of the MAC address.

 For example, if a device had an EUI-48 address of 28-9F-18-1C-82-35, theglobal/local bit must first be inverted to meet EUI-64 requirements (i.e., 1 for– 939 –

Chapter 33 | IP Interface Commands

IPv6 Interface

globally defined addresses and 0 for locally defined addresses), changing 28 to
2A. Then the two bytes FFFE are inserted between the OUI (i.e., company id)
and the rest of the address, resulting in a modified EUI-64 interface identifier of
2A-9F-18-FF-FE-1C-82-35.
 This host addressing method allows the same interface identifier to be used on

multiple IP interfaces of a single device, as long as those interfaces are attachedto different subnets.

ExampleThis example uses the network prefix of 2001:0DB8:0:1::/64, and specifies that the
EUI-64 interface identifier be used in the lower 64 bits of the address.
Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:0DB8:0:1::/64 eui-64
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled
Link-local address:
fe80::7272:cfff:fe83:3466%1/64
Global unicast address(es):2001:db8:0:1:7272:cfff:fe83:3466/64, subnet is 2001:db8:0:1::/64[EUI]
2001:db8:2222:7272::72/96, subnet is 2001:db8:2222:7272::/96
Joined group address(es):ff02::1:ff00:72
ff02::1:ff83:3466ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
ipv6 address autoconfig (936)show ipv6 interface (944)– 940 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 address link-local This command configures an IPv6 link-local address for an interface and enables
IPv6 on the interface. Use the no form without any arguments to remove all
manually configured IPv6 addresses from the interface. Use the no form with a
specific address to remove it from the interface.
Syntaxipv6 address ipv6-address link-local
no ipv6 address [ipv6-address link-local]
ipv6-address - The IPv6 address assigned to the interface.
Default Setting
No IPv6 addresses are defined
Command Mode
Interface Configuration (VLAN)
Command Usage The specified address must be formatted according to RFC 2373 “IPv6

Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values.
One double colon may be used in the address to indicate the appropriate
number of zeros required to fill the undefined fields. And the address prefixmust be in the range of FE80~FEBF.

 The address specified with this command replaces a link-local address that was

automatically generated for the interface.

 You can configure multiple IPv6 global unicast addresses per interface, but only

one link-local address per interface.

 If a duplicate address is detected, a warning message is sent to the console.

ExampleThis example assigns a link-local address of FE80::269:3EF9:FE19:6779 to VLAN 1.
Note that a prefix in the range of FE80~FEBF is required for link-local addresses, andthe first 16-bit group in the host address is padded with a zero in the form 0269.
Console(config)#interface vlan 1
Console(config-if)#ipv6 address FE80::269:3EF9:FE19:6779 link-local
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled
Link-local address:
fe80::269:3ef9:fe19:6779%1/64
Global unicast address(es):2001:db8:0:1:7272:cfff:fe83:3466/64, subnet is 2001:db8:0:1::/64[EUI]
2001:db8:2222:7272::72/96, subnet is 2001:db8:2222:7272::/96
Joined group address(es):ff02::1:ff19:6779
ff02::1:ff00:72
ff02::1:ff83:3466– 941 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
ipv6 enable (942)show ipv6 interface (944)

ipv6 enable This command enables IPv6 on an interface that has not been configured with an
explicit IPv6 address. Use the no form to disable IPv6 on an interface that has notbeen configured with an explicit IPv6 address.
Syntax[no] ipv6 enable
Default Setting
IPv6 is disabled
Command Mode
Interface Configuration (VLAN)
Command Usage This command enables IPv6 on the current VLAN interface and automaticallygenerates a link-local unicast address. The address prefix uses FE80, and thehost portion of the address is generated by converting the switch’s MAC
address to modified EUI-64 format (see page 939). This address type makes theswitch accessible over IPv6 for all devices attached to the same local subnet.
 If a duplicate address is detected on the local segment, this interface will bedisabled and a warning message displayed on the console.

 The no ipv6 enable command does not disable IPv6 for an interface that has

been explicitly configured with an IPv6 address.

ExampleIn this example, IPv6 is enabled on VLAN 1, and the link-local address
FE80::2E0:CFF:FE00:FD/64 is automatically generated by the switch.
Console(config)#interface vlan 1
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up– 942 –

Chapter 33 | IP Interface Commands

IPv6 Interface

IPv6 is enabled
Link-local address:
fe80::269:3ef9:fe19:6779%1/64
Global unicast address(es):2001:db8:0:1:7272:cfff:fe83:3466/64, subnet is 2001:db8:0:1::/64[EUI]
2001:db8:2222:7272::72/96, subnet is 2001:db8:2222:7272::/96
Joined group address(es):ff02::1:ff19:6779
ff02::1:ff00:72
ff02::1:ff83:3466ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
ipv6 address link-local (941)show ipv6 interface (944)

ipv6 mtu This command sets the size of the maximum transmission unit (MTU) for IPv6
packets sent on an interface. Use the no form to restore the default setting.
Syntaxipv6 mtu size
no ipv6 mtu
size - Specifies the MTU size. (Range: 1280-65535 bytes)
Default Setting
1500 bytes
Command Mode
Interface Configuration (VLAN)
Command Usage If a non-default value is configured, an MTU option is included in the router
advertisements sent from this device.
 The maximum value set by this command cannot exceed the MTU of thephysical interface, which is currently fixed at 1500 bytes.

 IPv6 routers do not fragment IPv6 packets forwarded from other routers.

However, traffic originating from an end-station connected to an IPv6 router
may be fragmented.

– 943 –

Chapter 33 | IP Interface Commands

IPv6 Interface

 All devices on the same physical medium must use the same MTU in order tooperate correctly.

 IPv6 must be enabled on an interface before the MTU can be set.

ExampleThe following example sets the MTU for VLAN 1 to 1280 bytes:
Console(config)#interface vlan 1
Console(config-if)#ipv6 mtu 1280
Console(config-if)#

Related Commands
show ipv6 mtu (946)jumbo frame (125)show ipv6 interface This command displays the usability and configured settings for IPv6 interfaces.
Syntaxshow ipv6 interface [brief [vlan vlan-id [ipv6-prefix/prefix-length]]]brief - Displays a brief summary of IPv6 operational status and theaddresses configured for each interface.
vlan-id - VLAN ID (Range: 1-4094)
ipv6-prefix - The IPv6 network portion of the address assigned to theinterface. The prefix must be formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimalvalues. One double colon may be used in the address to indicate theappropriate number of zeros required to fill the undefined fields.
prefix-length - A decimal value indicating how many of the contiguous bits(from the left) of the address comprise the prefix (i.e., the network portionof the address).
Command Mode
Privileged Exec
ExampleThis example displays all the IPv6 addresses configured for the switch.
Console#show ipv6 interface
VLAN 2 is down.
IPv6 is stale.
Link-local address:
FE80::260:3EFF:FE11:6770/64[TEN]
Global unicast address(es):3FFE::1, subnet is 3FFE:0:0:0::/64[TEN]
3FFE::212:CFFF:FE32:2120, subnet is 3FFE:0:0:0::/64[TEN]
Joined group address(es):– 944 –

Chapter 33 | IP Interface Commands

IPv6 Interface

FF01::1/16
FF02::1/16
FF02::1:FF00:1/104
FF02::1:FF11:6770/104
FF02::1:FF32:2120/104
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 1.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND managed-config-flag: disabled
ND other-config-flag : disabled
ND ra suppress: disabled
Console#Table 192: show ipv6 interface - display description
Field

Description

VLAN

A VLAN is marked “up” if the switch can send and receive packets on this interface,“down” if a line signal is not present, or “administratively down” if the interface has
been disabled by the administrator.

IPv6

IPv6 is marked “enable” if the switch can send and receive IP traffic on thisinterface, “disable” if the switch cannot send and receive IP traffic on this interface,or “stalled” if a duplicate link-local address is detected on the interface.

Link-local
address

Shows the link-local address assigned to this interface

Global unicast
address(es)Shows the global unicast address(es) assigned to this interface

Joined groupaddress(es)In addition to the unicast addresses assigned to an interface, a node is required tojoin the all-nodes multicast addresses FF01::1 and FF02::1 for all IPv6 nodes within
scope 1 (interface-local) and scope 2 (link-local), respectively.
FF01::1/16 is the transient interface-local multicast address for all attached IPv6
nodes, and FF02::1/16 is the link-local multicast address for all attached IPv6
nodes. The interface-local multicast address is only used for loopback
transmission of multicast traffic. Link-local multicast addresses cover the sametypes as used by link-local unicast addresses, including all nodes (FF02::1), allrouters (FF02::2), and solicited nodes (FF02::1:FFXX:XXXX) as described below.
A node is also required to compute and join the associated solicited-node
multicast addresses for every unicast and anycast address it is assigned. IPv6
addresses that differ only in the high-order bits, e.g. due to multiple high-orderprefixes associated with different aggregations, will map to the same solicitednode address, thereby reducing the number of multicast addresses a node mustjoin. In this example, FF02::1:FF90:0/104 is the solicited-node multicast address
which is formed by taking the low-order 24 bits of the address and appending
those bits to the prefix.

IPv6 Link MTU

Maximum transmission unit for this interface (bytes).

ND DAD

Indicates whether (neighbor discovery) duplicate address detection is enabled.

ND retransmit
interval

The interval between IPv6 neighbor solicitation retransmissions sent on aninterface during duplicate address detection.

ND advertised
retransmit
interval

The retransmit interval is included in all router advertisements sent out of aninterface so that nodes on the same link use the same time value.

ND reachable
time

The amount of time a remote IPv6 node is considered reachable after areachability confirmation event has occurred– 945 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 192: show ipv6 interface - display description (Continued)
Field

Description

ND advertised
reachable time

The reachable time is included in all router advertisements sent out of aninterface so that nodes on the same link use the same time value.

ND advertisedrouter lifetime

The length of time during which the prefix is valid for on-link determination.

ND managedconfig-flagShows if router advertisements indicate that attached hosts can use statefulautoconfiguration to obtain addresses

ND other-config- Shows if router advertisements indicate that attached hosts can obtain
flag
autoconfiguration information other than addresses
ND ra suppress

Shows if periodic unsolicited router advertisements on an interface have been
suppressed.

This example displays a brief summary of IPv6 addresses configured on the switch.
Console#show ipv6 interface brief
Interface
Status
IPv6
IPv6 Address--------------- ---------- ---------- --------------------------------------VLAN 1
Up
Up
FE80::768E:F8FF:FE68:870
VLAN 1
UpUp
2001:1DB8:1111:2F3B:12AA:11FF:FE28:9C5A
VLAN 2Up
Down
Unassigned
Craft
Up
Up
FE80::768E:F8FF:FE68:870
Console#Related Commands
show ip interface (925)show ipv6 mtu This command displays the maximum transmission unit (MTU) cache fordestinations that have returned an ICMP packet-too-big message along with anacceptable MTU to this switch.
Command Mode
Normal Exec, Privileged Exec
ExampleThe following example shows the MTU cache for this device:
Console#show ipv6 mtu
MTU
Since
Destination Address
1400
00:04:21 5000:1::3
1280
00:04:50 FE80::203:A0FF:FED6:141D
Console#– 946 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 193: show ipv6 mtu - display description*
Field

Description

MTU

Adjusted MTU contained in the ICMP packet-too-big message returned from thisdestination, and now used for all traffic sent along this path.

Since

Time since an ICMP packet-too-big message was received from this destination.

Destination
Address

Address which sent an ICMP packet-too-big message.

*

No information is displayed if an IPv6 address has not been assigned to the switch.

show ipv6 traffic This command displays statistics about IPv6 traffic passing through this switch.
Command Mode
Privileged Exec
ExampleThe following example shows statistics for all IPv6 unicast and multicast traffic, as
well as ICMP, UDP and TCP statistics:
Console#show ipv6 traffic
IPv6 Statistics:
IPv6 received
3 total received
header errors
too big errors
no routes
address errors
unknown protocols
truncated packets
discards
delivers
reassembly request datagrams
reassembly succeeded
reassembly failed
IPv6 sent
forwards datagrams
6 requests
discards
no routes
generated fragments
fragment succeededfragment failed
ICMPv6 Statistics:
ICMPv6 received
input
errorsdestination unreachable messages
packet too big messages
time exceeded messages
parameter problem message
echo request messages
echo reply messages
router solicit messages
router advertisement messages
neighbor solicit messages– 947 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ICMPv6 sent

UDP Statistics:

Console#neighbor advertisement messages
redirect messages
group membership query messages
group membership response messages
group membership reduction messages
6 output
destination unreachable messages
packet too big messages
time exceeded messages
parameter problem message
echo request messages
echo reply messages
3 router solicit messages
router advertisement messages
3 neighbor solicit messages
neighbor advertisement messages
redirect messages
group membership query messages
group membership response messages
group membership reduction messages
input
no port errors
other errors
outputTable 194: show ipv6 traffic - display description
Field

Description

IPv6 Statistics
IPv6 received
total received

The total number of input datagrams received by the interface,
including those received in error.

header errors

The number of input datagrams discarded due to errors in their IPv6
headers, including version number mismatch, other format errors, hopcount exceeded, IPv6 options, etc.

too big errors

The number of input datagrams that could not be forwarded because
their size exceeded the link MTU of outgoing interface.

no routes

The number of input datagrams discarded because no route could befound to transmit them to their destination.

address errors

The number of input datagrams discarded because the IPv6 address intheir IPv6 header's destination field was not a valid address to bereceived at this entity. This count includes invalid addresses (e.g., ::0)and unsupported addresses (e.g., addresses with unallocated prefixes).
For entities which are not IPv6 routers and therefore do not forward
datagrams, this counter includes datagrams discarded because thedestination address was not a local address.

unknown protocols

The number of locally-addressed datagrams received successfully but
discarded because of an unknown or unsupported protocol. Thiscounter is incremented at the interface to which these datagrams wereaddressed which might not be necessarily the input interface for someof the datagrams.

truncated packets

The number of input datagrams discarded because datagram frame
didn't carry enough data.

– 948 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 194: show ipv6 traffic - display description (Continued)
Field

Description

discards

The number of input IPv6 datagrams for which no problems wereencountered to prevent their continued processing, but which werediscarded (e.g., for lack of buffer space). Note that this counter does notinclude any datagrams discarded while awaiting re-assembly.

delivers

The total number of datagrams successfully delivered to IPv6 userprotocols (including ICMP). This counter is incremented at the interface
to which these datagrams were addressed which might not benecessarily the input interface for some of the datagrams.

reassembly request
datagrams

The number of IPv6 fragments received which needed to bereassembled at this interface. Note that this counter is incremented at
the interface to which these fragments were addressed which might
not be necessarily the input interface for some of the fragments.

reassembly succeeded

The number of IPv6 datagrams successfully reassembled. Note that thiscounter is incremented at the interface to which these datagrams wereaddressed which might not be necessarily the input interface for someof the fragments.

reassembly failed

The number of failures detected by the IPv6 re-assembly algorithm (forwhatever reason: timed out, errors, etc.). Note that this is not necessarily
a count of discarded IPv6 fragments since some algorithms (notably
the algorithm in RFC 815) can lose track of the number of fragments bycombining them as they are received. This counter is incremented at
the interface to which these fragments were addressed which might
not be necessarily the input interface for some of the fragments.

IPv6 sent
forwards datagrams

The number of output datagrams which this entity received andforwarded to their final destinations. In entities which do not act as IPv6
routers, this counter will include only those packets which were SourceRouted via this entity, and the Source-Route processing was successful.
Note that for a successfully forwarded datagram the counter of theoutgoing interface is incremented.

requests

The total number of IPv6 datagrams which local IPv6 user-protocols(including ICMP) supplied to IPv6 in requests for transmission. Notethat this counter does not include any datagrams counted in
ipv6IfStatsOutForwDatagrams.

discards

The number of output IPv6 datagrams for which no problem wasencountered to prevent their transmission to their destination, butwhich were discarded (e.g., for lack of buffer space). Note that thiscounter would include datagrams counted in
ipv6IfStatsOutForwDatagrams if any such packets met this(discretionary) discard criterion.

no routes

The number of input datagrams discarded because no route could befound to transmit them to their destination.

generated fragments

The number of output datagram fragments that have been generated
as a result of fragmentation at this output interface.

fragment succeeded

The number of IPv6 datagrams that have been successfully fragmented
at this output interface.

fragment failed

The number of IPv6 datagrams that have been discarded because theyneeded to be fragmented at this output interface but could not be.

– 949 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 194: show ipv6 traffic - display description (Continued)
Field

Description

ICMPv6 Statistics
ICMPv6 received
input

The total number of ICMP messages received by the interface which
includes all those counted by ipv6IfIcmpInErrors. Note that thisinterface is the interface to which the ICMP messages were addressedwhich may not be necessarily the input interface for the messages.

errorsThe number of ICMP messages which the interface received but
determined as having ICMP-specific errors (bad ICMP checksums, badlength, etc.).

destination unreachable
messages

The number of ICMP Destination Unreachable messages received by
the interface.

packet too big messages

The number of ICMP Packet Too Big messages received by the interface.

time exceeded messages

The number of ICMP Time Exceeded messages received by theinterface.

parameter problem
message

The number of ICMP Parameter Problem messages received by theinterface.

echo request messages

The number of ICMP Echo (request) messages received by the interface.

echo reply messages

The number of ICMP Echo Reply messages received by the interface.

router solicit messages

The number of ICMP Router Solicit messages received by the interface.

router advertisement
messages

The number of ICMP Router Advertisement messages received by theinterface.

neighbor solicit messages

The number of ICMP Neighbor Solicit messages received by theinterface.

neighbor advertisement
messages

The number of ICMP Neighbor Advertisement messages received by
the interface.

redirect messages

The number of Redirect messages received by the interface.

group membership query
messages

The number of ICMPv6 Group Membership Query messages received
by the interface.

group membership
response messages

The number of ICMPv6 Group Membership Response messages
received by the interface.

group membership
reduction messages

The number of ICMPv6 Group Membership Reduction messages
received by the interface.

ICMPv6 sent
output

The total number of ICMP messages which this interface attempted tosend. Note that this counter includes all those counted by
icmpOutErrors.

destination unreachable
messages

The number of ICMP Destination Unreachable messages sent by theinterface.

packet too big messages

The number of ICMP Packet Too Big messages sent by the interface.

time exceeded messages

The number of ICMP Time Exceeded messages sent by the interface.

parameter problem
message

The number of ICMP Parameter Problem messages sent by theinterface.

echo request messages

The number of ICMP Echo (request) messages sent by the interface.

– 950 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 194: show ipv6 traffic - display description (Continued)
Field

Description

echo reply messages

The number of ICMP Echo Reply messages sent by the interface.

router solicit messages

The number of ICMP Router Solicitation messages sent by the interface.

router advertisement
messages

The number of ICMP Router Advertisement messages sent by theinterface.

neighbor solicit messages

The number of ICMP Neighbor Solicit messages sent by the interface.

neighbor advertisement
messages

The number of ICMP Router Advertisement messages sent by theinterface.

redirect messages

The number of Redirect messages sent. For a host, this object will
always be zero, since hosts do not send redirects.

group membership query
messages

The number of ICMPv6 Group Membership Query messages sent by
the interface.

group membership
response messages

The number of ICMPv6 Group Membership Response messages sent.

group membership
reduction messages

The number of ICMPv6 Group Membership Reduction messages sent.

UDP Statistics
input

The total number of UDP datagrams delivered to UDP users.

no port errors

The total number of received UDP datagrams for which there was no
application at the destination port.

other errors

The number of received UDP datagrams that could not be delivered forreasons other than the lack of an application at the destination port.

output

The total number of UDP datagrams sent from this entity.

clear ipv6 traffic This command resets IPv6 traffic counters.
Command Mode
Privileged Exec
Command Usage
This command resets all of the counters displayed by the show ipv6 trafficcommand.
ExampleConsole#clear ipv6 traffic
Console#– 951 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ping6 This command sends (IPv6) ICMP echo request packets to another node on the
network.
Syntax
ping6 {ipv6-address | host-name} [count count] [size size]
ipv6-address - The IPv6 address of a neighbor device. You can specify either
a link-local or global unicast address formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimalvalues. One double colon may be used in the address to indicate theappropriate number of zeros required to fill the undefined fields.
host-name - A host name string which can be resolved into an IPv6 address
through a domain name server.
count - Number of packets to send. (Range: 1-16)
size - Number of bytes in a packet. (Range: 0-1500 bytes)
The actual packet size will be eight bytes larger than the size specified
because the router adds header information.
Default Setting
count: 5
size: 32 bytes
Command Mode
Normal Exec, Privileged Exec
Command Usage Use the ping6 command to see if another site on the network can be reached,or to evaluate delays over the path.

 The same link-local address may be used by different interfaces/nodes indifferent zones (RFC 4007). Therefore, when specifying a link-local address,
include zone-id information indicating the VLAN identifier after the % delimiter.
For example, FE80::7272%1 identifies VLAN 1 as the interface from which theping is sent.

 When pinging a host name, be sure the DNS server has been enabled (seepage 881). If necessary, local devices can also be specified in the DNS static hosttable (see page 882).

 When using ping6 with a host name, the switch first attempts to resolve thealias into an IPv6 address before trying to resolve it into an IPv4 address.

ExampleConsole#ping6 FE80::2E0:CFF:FE00:FC%1
Press ESC to abort.
PING to FE80::2E0:CFF:FE00:FC%1/64, by 5 32-byte payload ICMP packets,
timeout is 3 seconds
response time: 20 ms[FE80::2E0:CFF:FE00:FC] seq_no: 1
response time: 0 ms
[FE80::2E0:CFF:FE00:FC] seq_no: 2– 952 –

Chapter 33 | IP Interface Commands

IPv6 Interface

response time: 0 ms
[FE80::2E0:CFF:FE00:FC] seq_no: 3
response time: 0 ms
[FE80::2E0:CFF:FE00:FC] seq_no: 4
response time: 0 ms
[FE80::2E0:CFF:FE00:FC] seq_no: 5
Ping statistics for FE80::2E0:CFF:FE00:FC%1/64:
5 packets transmitted, 5 packets received (100%), 0 packets lost (0%)
Approximate round trip times:
Minimum = 0 ms, Maximum = 20 ms, Average = 4 ms
Console#traceroute6 This command shows the route packets take to the specified destination.
Syntax
traceroute6 {ipv6-address | host-name} [max-failures failure-count]ipv6-address - The IPv6 address of a neighbor device. You can specify either
a link-local or global unicast address formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimalvalues. One double colon may be used in the address to indicate theappropriate number of zeros required to fill the undefined fields.
host-name - A host name string which can be resolved into an IPv6 address
through a domain name server.
failure-count - The maximum number of failures before which the traceroute is terminated. (Range: 1-255)
Default Setting
Maximum failures: 5
Command Mode
Privileged Exec
Command Usage Use the traceroute6 command to determine the path taken to reach a

specified destination.

 The same link-local address may be used by different interfaces/nodes indifferent zones (RFC 4007). Therefore, when specifying a link-local address,
include zone-id information indicating the VLAN identifier after the % delimiter.
For example, FE80::7272%1 identifies VLAN 1 as the interface from which theping is sent.

 A trace terminates when the destination responds, when the maximum

timeout (TTL) is exceeded, or the maximum number of hops is exceeded.

 The traceroute command first sends probe datagrams with the TTL value set atone. This causes the first router to discard the datagram and return an error
message. The trace function then sends several probe messages at eachsubsequent TTL level and displays the round-trip time for each message. Not all
devices respond correctly to probes by returning an “ICMP port unreachable”
message. If the timer goes off before a response is returned, the trace function– 953 –

Chapter 33 | IP Interface Commands

IPv6 Interface

prints a series of asterisks and the “Request Timed Out” message. A longsequence of these messages, terminating only when the maximum timeout
has been reached, may indicate this problem with the target device.
ExampleConsole#traceroute6 FE80::2E0:CFF:FE9C:CA10%1
Press "ESC" to abort.
Traceroute to FE80::2E0:CFF:FE9C:CA10%1/64, 30 hops max, timeout is 3
seconds, 5 max failure(s) before termination.
Hop Packet 1 Packet 2 Packet 3 IPv6 Address--- -------- -------- -------- -------------------------------------------1<10 ms<10 ms<10 ms FE80::2E0:CFF:FE9C:CA10%1/64
Trace completed.
Console#Neighbor Discovery

ipv6 hop-limit This command configures the maximum number of hops used in router

advertisements that are originated by this router. Use the no form to restore thedefault setting.
Syntaxipv6 hop-limit hops
no ipv6 hop-limit
hops - The maximum number of hops in router advertisements and all IPv6
packets. (Range: 1-255)

Default Setting
1
Command Mode
Global Configuration
ExampleThe following sets the hop limit for router advertisements to 64:
Console(config)#ipv6 hop-limit 64
Console(config)#– 954 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 neighbor This command configures a static entry in the IPv6 neighbor discovery cache. Use
the no form to remove a static entry from the cache.
Syntaxipv6 neighbor ipv6-address vlan vlan-id hardware-address
no ipv6 neighbor ipv6-address vlan vlan-id
ipv6-address - The IPv6 address of a neighbor device that can be reachedthrough one of the network interfaces configured on this switch. You canspecify either a link-local or global unicast address formatted according to
RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit
hexadecimal values. One double colon may be used in the address toindicate the appropriate number of zeros required to fill the undefined
fields.
vlan-id - VLAN ID (Range: 1-4094)
hardware-address - The 48-bit MAC layer address for the neighbor device.
This address must be formatted as six hexadecimal pairs separated byhyphens.
Default Setting
None
Command Mode
Global Configuration
Command Usage Address Resolution Protocol (ARP) has been replaced in IPv6 with the Neighbor
Discovery Protocol (NDP). The ipv6 neighbor command is similar to the macaddress-table static command that is implemented using ARP.
 Static entries can only be configured on an IPv6-enabled interface.
 The switch does not determine whether a static entry is reachable before

placing it in the IPv6 neighbor discovery cache.

 If the specified entry was dynamically learned through the IPv6 neighbordiscovery process, and already exists in the neighbor discovery cache, it isconverted to a static entry. Static entries in the IPv6 neighbor discovery cache
are not modified if subsequently detected by the neighbor discovery process.

 Disabling IPv6 on an interface with the no ipv6 enable command (seepage 942) deletes all dynamically learned entries in the IPv6 neighbordiscovery cache for that interface, but does not delete static entries.

– 955 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ExampleThe following maps a static entry for global unicast address to a MAC address:
Console(config)#ipv6 neighbor 2009:DB9:2229::81 vlan 1 30-65-14-01-11-86
Console(config)#end
Console#show ipv6 neighbors
State: I1 - Incomplete, I2 - Invalid, R - Reachable, S - Stale, D - Delay,
P1 - Probe, P2 - Permanent, U - Unknown
IPv6 Address
Age
Link-layer Addr
State
VLAN
2009:DB9:2229::80
956
12-34-11-11-43-21
R
1
2009:DB9:2229::81
Permanent
30-65-14-01-11-86
R
1
FE80::1034:11FF:FE11:4321 961
12-34-11-11-43-21
R1
Console#Related Commands
show ipv6 neighbors (967)

ipv6 nd dad attempts This command configures the number of consecutive neighbor solicitation

messages sent on an interface during duplicate address detection. Use the no form
to restore the default setting.
Syntaxipv6 nd dad attempts countno ipv6 nd dad attempts
count - The number of neighbor solicitation messages sent to determine
whether or not a duplicate address exists on this interface. (Range: 0-255)

Default Setting
1
Command Mode
Interface Configuration (VLAN)
Command Usage Configuring a value of 0 disables duplicate address detection.
 Duplicate address detection determines if a new unicast IPv6 address alreadyexists on the network before it is assigned to an interface.

 Duplicate address detection is stopped on any interface that has beensuspended (see the vlan command). While an interface is suspended, all unicast
IPv6 addresses assigned to that interface are placed in a “pending” state.
Duplicate address detection is automatically restarted when the interface isadministratively re-activated.

 An interface that is re-activated restarts duplicate address detection for all

unicast IPv6 addresses on the interface. While duplicate address detection is
performed on the interface’s link-local address, the other IPv6 addresses remain– 956 –

Chapter 33 | IP Interface Commands

IPv6 Interface

in a “tentative” state. If no duplicate link-local address is found, duplicate
address detection is started for the remaining IPv6 addresses.
 If a duplicate address is detected, it is set to “duplicate” state, and a warning

message is sent to the console. If a duplicate link-local address is detected, IPv6
processes are disabled on the interface. If a duplicate global unicast address is
detected, it is not used. All configuration commands associated with aduplicate address remain configured while the address is in “duplicate” state.

If the link-local address for an interface is changed, duplicate address detection is
performed on the new link-local address, but not for any of the IPv6 global unicast
addresses already associated with the interface.
ExampleThe following configures five neighbor solicitation attempts for addresses
configured on VLAN 1. The show ipv6 interface command indicates that the
duplicate address detection process is still on-going.
Console(config)#interface vlan 1
Console(config-if)#ipv6 nd dad attempts 5
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::269:3ef9:fe19:6779%1/64
Global unicast address(es):2001:db8:0:1:2e0:cff:fe02:fd/64, subnet is 2001:db8:0:1::/64[EUI]
2001:db8:2222:7272::72/96, subnet is 2001:db8:2222:7272::/96
Joined group address(es):ff02::2
ff02::1:ff19:6779
ff02::1:ff00:0
ff02::1:ff00:72
ff02::1:ff02:fd
ff02::1:2
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 5.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
ipv6 nd ns-interval (959)show ipv6 neighbors (967)– 957 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 nd This command configures IPv6 router advertisements to indicate to attached hosts
managed-config-flag that they can use stateful autoconfiguration to obtain addresses. Use the no form
to clear this flag from router advertisements.
Syntax[no] ipv6 nd managed-config-flag
Default Setting
Disabled
Command Mode
Interface Configuration (VLAN)
Command Usage The “managed-address configuration” flag tells hosts that they should use
stateful autoconfiguration to obtain addresses from a DHCPv6 server.
 The ipv6 nd other-config-flag command is used to tell hosts that they should

use stateless address autoconfiguration to get IPv6 address (based on the IPv6
prefixes found in router advertisements) and stateful autoconfiguration to getother non-address parameters (such as DNS server addresses) from DHCPv6
servers.

 The absence of the “managed-address configuration” flag tells hosts to use only

stateless address autoconfiguration (based on IPv6 prefixes found in router
advertisements).

 The “managed address configuration” flag is only a suggestion to attachedhosts. They may still use stateful and/or stateless address autoconfiguration. If
hosts must be forced to use DHCPv6 for security reasons, ensure that no routeprefixes are sent in router advertisements.

ExampleThe following tells hosts to use stateful autoconfiguration to obtain addresses:
Console(config)#interface vlan 1
Console(config)#ipv6 nd managed-config-flag
Console(config)#

ipv6 nd This command configures IPv6 router advertisements to indicate to attached hosts
other-config-flag that they can obtain stateful autoconfiguration information other than addresses.
Use the no form to clear this flag from router advertisements.
Syntax[no] ipv6 nd other-config-flag– 958 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Default Setting
Disabled
Command Mode
Interface Configuration (VLAN)
Command Usage The “other-stateful-configuration” flag tells hosts that they should use statefulautoconfiguration to obtain information other than addresses from a DHCPv6
server.
 Some hosts interpret the “other stateful configuration” flag to indicate that theyshould use stateless address autoconfiguration to get IPv6 address (based on
the IPv6 prefixes found in router advertisements) and statefulautoconfiguration to get other non-address parameters from DHCPv6 servers.
In this case, the absence of both the “managed address configuration” flag andthe “other stateful configuration” flag is interpreted to mean that they should
use only stateless autoconfiguration to obtain addresses.

ExampleThe following tells hosts to use stateful autoconfiguration to obtain other nonaddress information from a DHCPv6 server:
Console(config)#interface vlan 1
Console(config)#ipv6 nd other-config-flag
Console(config)#

ipv6 nd ns-interval This command configures the interval between transmitting IPv6 neighborsolicitation messages on an interface. Use the no form to restore the default value.

Syntaxipv6 nd ns-interval milliseconds
no ipv6 nd ns-interval
milliseconds - The interval between transmitting IPv6 neighbor solicitation
messages. (Range: 1000-3600000)
Default Setting
1000 milliseconds is used for neighbor discovery operations
0 milliseconds is advertised in router advertisements
Command Mode
Interface Configuration (VLAN)
Command Usage When a non-default value is configured, the specified interval is used both forrouter advertisements and by the router itself.
– 959 –

Chapter 33 | IP Interface Commands

IPv6 Interface

 This command specifies the interval between transmitting neighborsolicitation messages when resolving an address, or when probing thereachability of a neighbor. Therefore, avoid using very short intervals for normal
IPv6 operations.

 Setting the neighbor solicitation interval to 0 means that the configured time isunspecified by this router.Setting the neighbor solicitation interval to 0 meansthat the configured time is unspecified by this router.

ExampleThe following sets the interval between sending neighbor solicitation messages to
30000 milliseconds:
Console(config)#interface vlan 1
Console(config)#ipv6 nd ns-interval 30000
Console(config)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::269:3ef9:fe19:6779%1/64
Global unicast address(es):2001:db8:0:1:2e0:cff:fe02:fd/64, subnet is 2001:db8:0:1::/64[EUI][EIU]
2001:db8:2222:7272::72/96, subnet is 2001:db8:2222:7272::/96
Joined group address(es):ff02::2
ff02::1:ff19:6779
ff02::1:ff00:0
ff02::1:ff00:72
ff02::1:ff02:fd
ff02::1:2
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 5.
ND retransmit interval is 30000 milliseconds
ND advertised retransmit interval is 30000 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds
Console#Related Commands
show running-config (118)

ipv6 nd raguard This command blocks incoming Router Advertisement and Router Redirect
packets. Use the no form to disable this feature.
Syntax[no] ipv6 nd raguard
Default Setting
Disabled– 960 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Command Mode
Interface Configuration (Ethernet, Port Channel)
Command Usage IPv6 Router Advertisements (RA) convey information that enables nodes to
auto-configure on the network. This information may include the default routeraddress taken from the observed source address of the RA message, as well as
on-link prefix information. However, unintended mis-configurations, or
possibly malicious attacks on the network, may lead to bogus RAs being sent,
which in turn can cause operational problems for hosts on the network.
 This command can be used to block RAs and Router Redirect (RR) messages on

the specified interface. Determine which interfaces are connected to known
routers, and enable RA Guard on all other untrusted interfaces.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ipv6 nd raguard
Console(config-if)#show ipv6 nd raguard This command displays the configuration setting for RA Guard.
Syntaxshow ipv6 nd raguard [interface]interfaceethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28/54)
port-channel channel-id (Range: 1-28)
Command Mode
Privileged Exec
ExampleConsole#show ipv6 nd raguard interface ethernet 1/1
Interface RA Guard--------- -------Eth 1/ 1 Yes
Console#– 961 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 nd This command configures the amount of time that a remote IPv6 node isreachable-time considered reachable after some reachability confirmation event has occurred. Use
the no form to restore the default setting.
Syntaxipv6 nd reachable-time milliseconds
no ipv6 nd reachable-time
milliseconds - The time that a node can be considered reachable after
receiving confirmation of reachability. (Range: 0-3600000)
Default Setting
30000 milliseconds is used for neighbor discovery operations
0 milliseconds is advertised in router advertisements
Command Mode
Interface Configuration (VLAN)
Command Usage The time limit configured by this parameter allows the router to detect
unavailable neighbors. During the neighbor discover process, an IPv6 node will
multicast neighbor solicitation messages to search for neighbor nodes. For aneighbor node to be considered reachable, it must respond to the neighborsoliciting node with a neighbor advertisement message to become aconfirmed neighbor, after which the reachable timer will be considered in
effect for subsequent unicast IPv6 layer communications.
 This time limit is included in all router advertisements sent out through aninterface, ensuring that nodes on the same link use the same time value.

 Setting the time limit to 0 means that the configured time is unspecified by thisrouter.

ExampleThe following sets the reachable time for a remote node to 1000 milliseconds:
Console(config)#interface vlan 1
Console(config-if)ipv6 nd reachable-time 1000
Console(config-if)#

ipv6 nd prefix This command configures the IPv6 prefixes to include in router advertisements. Use
the no form to remove a prefix.
Syntaxipv6 nd prefix ipv6-address/prefix-length {default |[valid-lifetime preferred-lifetime [no-autoconfig | off-link]]}– 962 –

Chapter 33 | IP Interface Commands

IPv6 Interface

no ipv6 nd prefix ipv6-address/prefix-length
ipv6-address - An IPv6 address including the network prefix and hostaddress bits.
prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix (i.e., the network portion of theaddress).
default - Uses default values for remaining parameters.
valid-lifetime - The amount of time that the specified IPv6 prefix isadvertised as being valid. (Range: 0-4294967295 seconds)
preferred-lifetime - The amount of time that the specified IPv6 prefix isadvertised as being preferred. The preferred lifetime is counted down inreal time. (Range: 0-4294967295 seconds)
no-autoconfig - Indicates to hosts on the local link that the specified prefix
cannot be used for IPv6 autoconfiguration.
off-link - Indicates that the specified prefix is assigned to the link. Nodessending traffic to addresses that contain the prefix consider the destination
to be locally reachable on the link.
Default Setting
valid-lifetime
2592000 seconds
preferred-lifetime 2592000 seconds
no-autoconfig Disabled
off-link
Disabled
Command Mode
Interface Configuration (VLAN)
Command Usage Prefixes configured as addresses on an interface using the ipv6 addresscommand are advertised in router advertisements. If prefixes are configured foradvertisement using the ipv6 nd prefix command, then only these prefixes areadvertised.
 The preferred lifetime and valid lifetime are counted down in real time. Afterthe preferred lifetime expires, no new connections are made using this prefix.
When the valid lifetime expires, this prefix will no longer be advertised.

 All prefixes are inserted in the routing table as Connected (i.e., on-line), unlessspecified with the off-link option. If the off-link option is specified, and theprefix is already present in the routing table as a Connected prefix, it will be
removed.

 Do not include the link-local prefix in the list of advertised prefixes.

– 963 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ExampleThe following configures a network prefix with a valid lifetime of 1000 seconds, anda preferred lifetime of 900 seconds:
Console(config)#interface vlan 1
Console(config)#ipv6 nd prefix 2011:0DBF::/35 1000 900
Console(config)#

ipv6 nd ra interval This command configures the interval between the transmission of IPv6 router

advertisements on an interface. Use the no form to restore the default interval.
Syntaxipv6 nd ra interval minimum-interval [maximum-interval]
no ipv6 nd ra interval
minimum-interval - The maximum interval between IPv6 router
advertisements. (Range: 4-1800 seconds)
maximum-interval - The minimum interval between IPv6 router
advertisements. (Range: 3-1350 seconds)

Command Mode
Interface Configuration (VLAN)
Default Setting
maximum interval: 600 seconds
minimum interval: 198 seconds
Command Usage The interval between transmissions should be less than or equal to the IPv6
router advertisement lifetime if you configure a route as a default router byusing the ipv6 nd ra lifetime command.
 To prevent synchronization with other IPv6 nodes, the actual interval used is

randomly selected from a value between the minimum value set by the system(33% of the maximum RA interval) and the maximum value set by the ipv6 nd
ra interval command.

ExampleThe following sets the maximum RA interval to 1800 seconds:
Console(config)#interface vlan 1
Console(config)#ipv6 nd ra interval 1800
Console(config)#– 964 –

Chapter 33 | IP Interface Commands

IPv6 Interface

ipv6 nd ra lifetime This command configures the router lifetime value used in IPv6 router

advertisements sent from an interface. Use the no form to restore the default
setting.
Syntaxipv6 nd ra lifetime lifetime
no ipv6 nd ra lifetime
lifetime - Router lifetime. (Range: 0-9000 seconds)
Command Mode
Interface Configuration (VLAN)
Default Setting
1800 seconds
Command Usage This command can be used to indicate the usefulness of this router as a default

router on this interface.

 Set the router lifetime to 0 to indicate that this router should not be considereda default router. Set the lifetime to a non-zero value to indicate that it should beconsidered a default router. When a non-zero value is used, the lifetime should
not be less than the router advertisement interval.

ExampleThe following sets the router lifetime to 8000 seconds:
Console(config)#interface vlan 1
Console(config)#ipv6 nd ra lifetime 8000
Console(config)#

ipv6 nd ra This command configures the default router preference for the router on anrouter-preference interface. Use the no form to restore the default setting.
Syntaxipv6 nd ra router-preference {high | medium | low}
no ipv6 nd ra router-preferencehigh - Preference for the router is high.
medium - Preference for the router is medium.
low - Preference for the router is low.
Command Mode
Interface Configuration (VLAN)– 965 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Default Setting
mediumCommand Usage
Default router preference may be used to prioritize routers which provide
equivalent, but not equal-cost, routing, and policy dictates that hosts should prefer
one of the routers.
ExampleThe following sets the default router preference to high:Console(config)#interface vlan 1
Console(config)#ipv6 nd ra router-preference highConsole(config)#

ipv6 nd ra suppress This command suppresses router advertisement transmissions on an interface. Use
the no form to re-enable router advertisements.
Syntax[no] ipv6 nd ra suppress
Command Mode
Interface Configuration (VLAN, IPv6/v4 Tunnel)
Default Setting
Not suppressed
Command Usage
This command suppresses periodic unsolicited router advertisements. It does not
suppress advertisements sent in response to a router solicitation.
ExampleThe following suppresses router advertisements on the current interface:
Console(config)#interface vlan 1
Console(config)#ipv6 nd ra suppress
Console(config)#– 966 –

Chapter 33 | IP Interface Commands

IPv6 Interface

clear ipv6 neighbors This command deletes all dynamic entries in the IPv6 neighbor discovery cache.
Command Mode
Privileged Exec
ExampleThe following deletes all dynamic entries in the IPv6 neighbor cache:
Console#clear ipv6 neighbors
Console#show ipv6 neighbors This command displays information in the IPv6 neighbor discovery cache.
Syntaxshow ipv6 neighbors [vlan vlan-id | ipv6-address]
vlan-id - VLAN ID (Range: 1-4094)
ipv6-address - The IPv6 address of a neighbor device. You can specify either
a link-local or global unicast address formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimalvalues. One double colon may be used in the address to indicate theappropriate number of zeros required to fill the undefined fields.
Default Setting
All IPv6 neighbor discovery cache entries are displayed.
Command Mode
Privileged Exec
ExampleThe following shows all known IPv6 neighbors for this switch:
Console#show ipv6 neighbors
State: I1 - Incomplete, I2 - Invalid, R - Reachable, S - Stale, D - Delay,
P1 - Probe, P2 - Permanent, U - Unknown
IPv6 Address
Age Link-layer Addr
State Interface--------------------------------------- ---- ----------------- ----- --------FE80::2E0:CFF:FE9C:CA10
400-E0-0C-9C-CA-10 R
1
Console#Table 195: show ipv6 neighbors - display description
Field

Description

IPv6 Address

IPv6 address of neighbor

Age

The time since the address was verified as reachable (in seconds). A static entry is
indicated by the value “Permanent.”– 967 –

Chapter 33 | IP Interface Commands

IPv6 Interface

Table 195: show ipv6 neighbors - display description (Continued)
Field

Description

Link-layer Addr

Physical layer MAC address.

State

The following states are used for dynamic entries:
I1 (Incomplete) - Address resolution is being carried out on the entry. A neighborsolicitation message has been sent to the multicast address of the target, but it
has not yet returned a neighbor advertisement message.
I2 (Invalid) - An invalidated mapping. Setting the state to invalid dis-associates theinterface identified with this entry from the indicated mapping (RFC 4293).
R (Reachable) - Positive confirmation was received within the last ReachableTimeinterval that the forward path to the neighbor was functioning. While in REACH
state, the device takes no special action when sending packets.
S (Stale) - More than the ReachableTime interval has elapsed since the last
positive confirmation was received that the forward path was functioning. While
in STALE state, the device takes no action until a packet is sent.
D (Delay) - More than the ReachableTime interval has elapsed since the last
positive confirmation was received that the forward path was functioning. A
packet was sent within the last DELAY_FIRST_PROBE_TIME interval. If noreachability confirmation is received within this interval after entering the DELAY
state, the switch will send a neighbor solicitation message and change the state
to PROBE.
P1 (Probe) - A reachability confirmation is actively sought by resending neighborsolicitation messages every RetransTimer interval until confirmation ofreachability is received.
U (Unknown) - Unknown state.
The following states are used for static entries:
I1 (Incomplete)-The interface for this entry is down.
R (Reachable) - The interface for this entry is up. Reachability detection is notapplied to static entries in the IPv6 neighbor discovery cache.
P2 (Permanent) - Indicates a static entry.

VLAN

VLAN interface from which the address was reached.

Related Commands
show mac-address-table (519)show ipv6 nd prefix This command displays IPv6 prefixes in neighbor discovery router advertisements.
Syntaxshow ipv6 nd prefix vlan vlan-id
vlan-id - VLAN ID (Range: 1-4094)
Default Setting
All IPv6 prefixes for the specified VLAN are displayed.
Command Mode
Privileged Exec

– 968 –

Chapter 33 | IP Interface Commands

ND Snooping

ExampleThe following shows all neighbor discovery IPv6 prefixes for VLAN 1:
Console#show ipv6 nd prefix vlan 1
Ipv6 Neighbor Discovery Prefix Information.
VLAN Name
IPv6 Prefix
Valid Lifetime
Preferred Lifetime
On-link Flag
Autonomous Flag

: DefaultVlan: 2011:dbf::/35: 2592000: 604800: On: On

Console#ND Snooping
Neighbor Discover (ND) Snooping maintains an IPv6 prefix table and user addressbinding table. These tables can be used for stateless address auto-configuration or
for address filtering by IPv6 Source Guard.
ND snooping maintains a binding table in the process of neighbor discovery. Whenit receives an Neighbor Solicitation (NS) packet from a host, it creates a newbinding. If it subsequently receives a Neighbor Advertisement (NA) packet, thismeans that the address is already being used by another host, and the binding istherefore deleted. If it does not receive an NA packet after a timeout period, thebinding will be bound to the original host. ND snooping can also maintain a prefix
table used for stateless address auto-configuration by monitoring Router
Advertisement (RA) packets sent from neighboring routers.
ND snooping can also detect if an IPv6 address binding is no longer valid. When abinding has been timed out, it checks to see if the host still exists by sending an NS
packet to the target host. If it receives an NA packet in response, it knows that thetarget still exists and updates the lifetime of the binding; otherwise, it deletes thebinding.
This section describes commands used to configure ND Snooping.
Table 196: ND Snooping Commands
CommandFunctionMode

ipv6 nd snooping

Enables ND snooping globally or on a specified VLAN or GC
range of VLANs

ipv6 nd snooping auto-detect Enables automatic validation of binding table entries by GC
periodically sending NS messages and awaiting NA
replies
ipv6 nd snooping auto-detect Sets the number of times to send an NS message toretransmit countdetermine if a binding is still valid– 969 –

GC

Chapter 33 | IP Interface Commands

ND Snooping

Table 196: ND Snooping Commands (Continued)
CommandFunctionMode

ipv6 nd snooping auto-detect Sets the interval between sending NS messages toretransmit interval
determine if a binding is still validGC

ipv6 nd snooping prefix
timeout

Sets the time to wait for an RA message before deletingan entry in the prefix table

GC

ipv6 nd snooping
max-binding

Sets the maximum number of address entries which can IC
be bound to a port

ipv6 nd snooping trust

Configures a port as a trusted interface from which prefix IC
information in RA messages can be added to the prefix
table, or NS messages can be forwarded without
validation

clear ipv6 nd snooping
binding

Clears all entries in the address binding tablePE

clear ipv6 nd snooping prefix Clears all entries in the prefix tablePEshow ipv6 nd snooping

Shows configuration settings for ND snoopingPEshow ipv6 nd snooping
binding

Shows entries in the binding tablePEshow ipv6 nd snooping prefix Show entries in the prefix tablePE

ipv6 nd snooping This command enables ND snooping globally or on a specified VLAN or range of
VLANs. Use the no form to disable this feature.
Syntax[no] ipv6 nd snooping [vlan {vlan-id | vlan-range}]vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,or a random group of VLANs with each entry separated by a comma.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage Use this command without any keywords to enable ND snooping globally on
the switch. Use the VLAN keyword to enable ND snooping on a specific VLAN ora range of VLANs.
 Once ND snooping is enabled both globally and on the required VLANs, theswitch will start monitoring RA messages to build an address prefix table as
described below:

If an RA message is received on an untrusted interface, it is dropped. If
received on a trusted interface, the switch adds an entry in the prefix table– 970 –

Chapter 33 | IP Interface Commands

ND Snooping

according to the Prefix Information option in the RA message. The prefix
table records prefix, prefix length, valid lifetime, as well as the VLAN andport interface which received the message.


If an RA message is not received updating a table entry with the same
prefix for a specified timeout period, the entry is deleted.

 Once ND snooping is enabled both globally and on the required VLANs, theswitch will start monitoring NS messages to build a dynamic user binding tablefor use in Duplicate Address Detection (DAD) or for use by other security
filtering protocols (e.g., IPv6 Source Guard) as described below:

If an NS message is received on an trusted interface, it is forwarded without
further processing.



If an NS message is received on an untrusted interface, and the address
prefix does not match any entry in the prefix table, it drops the packet.



If the message does match an entry in the prefix table, it adds an entry to
the dynamic user binding table after a fixed delay, and forwards the packet.
Each entry in the dynamic binding table includes the link-layer address,
IPv6 address, lifetime, as well as the VLAN and port interface which received
the message.



If an RA message is received in response to the original NS message(indicating a duplicate address) before the dynamic binding timeout period
expires, the entry is deleted. Otherwise, when the timeout expires, theentry is dropped if the auto-detection process is not enabled.



If the auto-detection process is enabled, the switch periodically sends an
NS message to determine is the client still exists. If it does not receive an RA
message in response after the configured timeout, the entry is dropped. If
the switch receives an RA message before the timeout expires, it resets the
lifetime for the dynamic binding, and the auto-detection process resumes.

ExampleThis example enables ND snooping globally and on VLAN 1.
Console(config)#ipv6 nd snooping
Console(config)#ipv6 nd snooping vlan 1
Console(config)#

ipv6 nd snooping This command enables automatic validation of dynamic user binding table entries
auto-detect by periodically sending NS messages and awaiting NA replies. Use the no form todisable this feature.
Syntax[no] ipv6 nd snooping auto-detect
Default Setting
Disabled– 971 –

Chapter 33 | IP Interface Commands

ND Snooping

Command Mode
Global Configuration
Command Usage
If auto-detection is enabled, the switch periodically sends an NS message todetermine is a client listed in the dynamic binding table still exists. If it does notreceive an RA message in response after the configured timeout, the entry is
dropped. If the switch receives an RA message before the timeout expires, it resets
the lifetime for the dynamic binding, and the auto-detection process resumes.
ExampleConsole(config)#ipv6 nd snooping auto-detect
Console(config)#

ipv6 nd snooping This command sets the number of times the auto-detection process sends an NS
auto-detect message to determine if a dynamic user binding is still valid. Use the no form toretransmit count restore the default setting.
Syntaxipv6 nd snooping auto-detect retransmit count retransmit-times
no ipv6 nd snooping auto-detect retransmit countretransmit-times – The number of times to send an NS message todetermine if a client still exists. (Range: 1-5)
Default Setting
3
Command Mode
Global Configuration
Command Usage
The timeout after which the switch will delete a dynamic user binding if no RA
message is received is set to the retransmit count x the retransmit interval (see theipv6 nd snooping auto-detect retransmit interval command). Based on the default
settings, this is 3 seconds.
ExampleConsole(config)#ipv6 nd snooping auto-detect retransmit count 5
Console(config)#– 972 –

Chapter 33 | IP Interface Commands

ND Snooping

ipv6 nd snooping This command sets the interval between which the auto-detection process sends
auto-detect NS messages to determine if a dynamic user binding is still valid. Use the no form toretransmit interval restore the default setting.
Syntaxipv6 nd snooping auto-detect retransmit interval retransmit-interval
no ipv6 nd snooping auto-detect retransmit interval
retransmit-interval – The interval between which the switch sends an NS
message to determine if a client still exists. (Range: 1-10 seconds)
Default Setting
1 second
Command Mode
Global Configuration
Command Usage
The timeout after which the switch will delete a dynamic user binding if no RA
message is received is set to the retransmit count (see the ipv6 nd snooping autodetect retransmit count command) x the retransmit interval. Based on the default
settings, this is 3 seconds.
ExampleConsole(config)#ipv6 nd snooping auto-detect retransmit interval 5
Console(config)#

ipv6 nd snooping This command sets the time to wait for an RA message before deleting an entry in
prefix timeout the prefix table. Use the no form to restore the default setting.
Syntaxipv6 nd snooping prefix timeout timeout
no ipv6 nd snooping prefix timeout
timeout – The time to wait for an RA message to confirm that a prefix entry
is still valid. (Range: 3-1800 seconds)
Default Setting
None set
Command Mode
Global Configuration
Command Usage
If ND snooping is enabled and an RA message is received on a trusted interface, theswitch will add an entry in the prefix table based upon the Prefix Information– 973 –

Chapter 33 | IP Interface Commands

ND Snooping

contained in the message. If an RA message is not received for a table entry withthe same prefix for the specified timeout period, the entry is deleted.
ExampleConsole(config)#ipv6 nd snooping prefix timeout 200
Console(config)#

ipv6 nd snooping This command sets the maximum number of address entries in the dynamic user
max-binding binding table which can be bound to a port. Use the no form to restore the default
setting.
Syntaxipv6 nd snooping max-binding max-bindings
no ipv6 nd snooping max-binding
max-bindings – The maximum number of address entries in the dynamic
user binding table which can be bound to a port. (Range: 1-5)
Default Setting
5
Command Mode
Interface Configuration (Ethernet, Port Channel)
ExampleConsole(config)#interface ethernet 1/12
Console(config-if)#ipv6 nd snooping max-binding 5
Console(config-if)#

ipv6 nd snooping trust This command configures a port as a trusted interface from which prefix

information in RA messages can be added to the prefix table, or NS messages canbe forwarded without validation. Use the no form to restore the default setting.
Syntax[no] ipv6 nd snooping trust

Default Setting
Not trusted
Command Mode
Interface Configuration (Ethernet, Port Channel)– 974 –

Chapter 33 | IP Interface Commands

ND Snooping

Command Usage In general, interfaces facing toward to the network core, or toward routers
supporting the Network Discovery protocol, are configured as trusted
interfaces.
 RA messages received from a trusted interface are added to the prefix table andforwarded toward their destination.

 NS messages received from a trusted interface are forwarded toward theirdestination. Nothing is added to the dynamic user binding table.

ExampleConsole(config)#interface ethernet 1/1
Console(config-if)#ipv6 nd snooping trust
Console(config-if)#clear ipv6 nd This command clears all entries in the dynamic user address binding table.
snooping binding
Syntaxclear ipv6 nd snooping binding
Command Mode
Privileged Exec
ExampleConsole#clear ipv6 nd snooping binding
Console#show ipv6 nd snooping binding
MAC Address
IPv6 Address
Lifetime
VLAN Interface-------------- -------------------------------------- ---------- ---- --------Console#

clear ipv6 nd This command clears all entries in the address prefix table.
snooping prefix
Syntaxclear ipv6 nd snooping prefix [interface vlan vlan-id]
vlan-id - VLAN ID. (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#clear ipv6 nd snooping prefix
Console#show ipv6 nd snooping prefix
Prefix entry timeout: (seconds)
Prefix– 975 –

Len Valid-Time Expire

VLAN Interface

Chapter 33 | IP Interface Commands

ND Snooping-------------------------------------- --- ---------- ---------- ---- --------Console#

show ipv6 nd This command shows the configuration settings for ND snooping.
snooping
Syntaxshow ipv6 nd snooping
Command Mode
Privileged Exec
ExampleConsole#show ipv6 nd snooping
Global ND Snooping status: enabled
ND Snooping auto-detection: disabled
ND Snooping auto-detection retransmit count: 3
ND Snooping auto-detection retransmit interval: 1 (second)
ND Snooping is configured on the following VLANs:
VLAN
1,Interface
TrustedMax-binding--------------------------Eth 1/1
Yes1
Eth 1/2
No
5
Eth 1/3
No
5
Eth 1/4
No
5
Eth
1/5
No
5
.
.
.

show ipv6 nd This command shows all entries in the dynamic user binding table.
snooping binding
Syntaxshow ipv6 nd snooping binding
Command Mode
Privileged Exec
ExampleConsole#show ipv6 nd snooping binding
MAC Address
IPv6 Address
Lifetime
VLAN Interface-------------- -------------------------------------- ---------- ---- --------0013-49aa-3926 2001:b001::211:95ff:fe84:cb9e100
1 Eth 1/1
0012-cf01-0203 2001::1
3400
2 Eth 1/2
Console#– 976 –

Chapter 33 | IP Interface Commands

ND Snoopingshow ipv6 nd This command shows all entries in the address prefix table.
snooping prefix
Syntaxshow ipv6 nd snooping prefix [interface vlan vlan-id]
vlan-id - VLAN ID. (Range: 1-4094)
Command Mode
Privileged Exec
ExampleConsole#show ipv6 nd snooping prefix
Prefix entry timeout: 100 (second)
PrefixLen Valid-Time Expire
VLAN Interface-------------------------------------- --- ---------- ---------- ---- --------2001:b000::
642592000
100
1 Eth 1/1
2001::
64600
34
2 Eth 1/2
Console#– 977 –

Chapter 33 | IP Interface Commands

ND Snooping– 978 –

34

IP Routing Commands

After network interfaces are configured for the switch, the paths used to send
traffic between different interfaces must be set. To forward traffic to devices onother subnetworks, configure fixed paths with static routing commands. Thissection includes commands for static routing. These commands are used toconnect between different local subnetworks or to connect the router to theenterprise network.
Table 188: IP Routing Commands
Command Group

Function

Global Routing Configuration

Configures global parameters for static routing, displays therouting table

Global Routing Configuration.

Table 189: Global Routing Configuration Commands
CommandFunctionMode

ip route

Configures static routes

GCshow ip route

Displays entries in the routing tablePEshow ip host-route

Displays the interface associated with known routes

PEshow ip route database

Displays static or dynamically learned entries in the routing PE
tableshow ip route summary

Displays summary information for the routing tablePEshow ip traffic

Displays statistics for IP, ICMP, UDP, TCP and ARP protocols

PE

ipv6 route

Configures static routes

GCshow ipv6 route

Displays specified entries in the routing table

PE

IPv4 Commands

IPv6 Commands– 979 –

Chapter 34 | IP Routing Commands
Global Routing Configuration
IPv4 Commands

ip route This command configures static routes. Use the no form to remove static routes.
Syntax
ip route destination-ip netmask next-hop [distance]
no ip route {destination-ip netmask next-hop | *}destination-ip – IP address of the destination network, subnetwork, or host.
netmask - Network mask for the associated IP subnet. This mask identifies
the host address bits used for routing to specific subnets.
next-hop – IP address of the next hop router used for this route.
distance – An administrative distance indicating that this route can beoverridden by dynamic routing information if the distance of the dynamic
route is less than that configured for the static route. (Range: 1-255,
Default: 1)* – Removes all static routing table entries.
Default Setting
No static routes are configured.
Command Mode
Global Configuration
Command Usage Up to 56 static routes can be configured.
 If an administrative distance is defined for a static route, and the same

destination can be reached through a dynamic route at a lower administration
distance, then the dynamic route will be used.

ExampleThis example forwards all traffic for subnet 192.168.1.0 to the gateway router
192.168.5.254, using the default metric of 1.
Console(config)#ip route 192.168.1.0 255.255.255.0 192.168.5.254
Console(config)#– 980 –

Chapter 34 | IP Routing Commands

Global Routing Configuration

show ip route This command displays information in the Forwarding Information Base (FIB).
Syntaxshow ip route [connected | database | static | summary]connected – Displays all currently connected entries.
database – All known routes, including inactive routes. See show ip route
database.
static – Displays all static entries.
summary – Displays a brief list of summary information about entries in
the routing table, including the maximum number of entries supported,
the number of connected routes, the total number of routes currently
stored in the routing table, and the number of entries in the FIB. See show
ip route summary.
Command Mode
Privileged Exec
Command Usage The FIB contains information required to forward IP traffic. It contains theinterface identifier and next hop information for each reachable destination
network prefix based on the IP routing table. When routing or topology
changes occur in the network, the routing table is updated, and those changes
are immediately reflected in the FIB.
The FIB is distinct from the routing table (or, Routing Information Base), whichholds all routing information received from routing peers. The forwarding
information base contains unique paths only. It does not contain any secondary
paths. A FIB entry consists of the minimum amount of information necessary to
make a forwarding decision on a particular packet. The typical components
within a forwarding information base entry are a network prefix, a router port
identifier, and next hop information.
 This command only displays routes which are currently accessible forforwarding. The router must be able to directly reach the next hop, so the VLAN
interface associated with any static route entry must be up. Note that routes
currently not accessible for forwarding, may still be displayed by using theshow ip route database command.

ExampleConsole#show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
B - BGP, T - Table, v - VNC, V - VNC-Direct,> - selected route, * - FIB route, q - queued, r - rejected, b - backupt - trapped, o - offload failure
C>* 10.10.10.0/24 is directly connected, VLAN1, 02:22:54
C>* 192.168.10.0/24 is directly connected, VLAN10, 02:24:02
Console#– 981 –

Chapter 34 | IP Routing Commands
Global Routing Configuration
The RIB contains all available routes learned through directly attached networks,
and any additionally configured routes such as static routes. The RIB contains theset of all available routes from which optimal entries are selected for use by the
Forwarding Information Base (see Command Usage under the show ip routecommand).
Console#show ip route database
Codes: C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
> - selected route, * - FIB route, p - stale info
S*> 0.0.0.0/0 [1/0] via 192.168.2.1, VLAN1
C*> 192.168.2.0/24 is directly connected, VLAN1
Console#In the following example, the numeric identifier following the routing table name(0) indicates the Forwarding Information Base identifier.
Console#show ip route summary
IP routing table name is Default-IP-Routing-Table(0)IP routing table maximum-paths is 1
Connected
1
Static1
Total
2
Console#show ip host-route This command displays the interface associated with known routes.
Syntaxshow ip host-route
Command Mode
Privileged Exec
ExampleConsole#show ip host-route
IP Address
MAC Address
VLAN Port--------------- ----------------- ---- ------192.168.0.99
00-E0-29-94-34-64
1 1/1
192.168.1.250
00-00-30-01-01-01
3 1/ 110.2.48.2
00-00-30-01-01-02
1 1/ 110.2.5.6
00-00-30-01-01-03
1 1/ 210.3.9.1
00-00-30-01-01-04
2 1/ 3– 982 –

Chapter 34 | IP Routing Commands

Global Routing Configuration

Console#Table 190: show ip host-route - display description
Field

Description

IP Address

IP address of the destination network, subnetwork, or host.

MAC Address

The physical layer address associated with the IP address.

VLAN

The VLAN that connects to this IP address.

Port

The port that connects to this IP address.

show ip route This command displays entries in the Routing Information Base (RIB).
database
Command Mode
Privileged Exec
Command Usage
The RIB contains all available routes learned through dynamic routing protocols,
directly attached networks, and any additionally configured routes such as static
routes. The RIB contains the set of all available routes from which optimal entries
are selected for use by the Forwarding Information Base (see Command Usage
under the show ip route command).
ExampleConsole#show ip route database
Codes: C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
> - selected route, * - FIB route, p - stale info
CC*> 127.0.0.0/8 is directly connected, lo0*> 192.168.1.0/24 is directly connected, VLAN1

Console#show ip route This command displays summary information for the routing table.
summary
Command Mode
Privileged Exec
ExampleIn the following example, the numeric identifier following the routing table name(0) indicates the Forwarding Information Base (FIB) identifier.

– 983 –

Chapter 34 | IP Routing Commands
Global Routing Configuration

Console#show ip route summary
Route Source
Routesconnected2-----Totals
2

FIB
2

(vrf default)

2

Console#show ip traffic This command displays statistics for IP, ICMP, UDP, TCP and ARP protocols.
Command Mode
Privileged Exec
ExampleConsole#show ip traffic
IP Statistics:
IP received
4877 total received
header errors
unknown protocols
address errors
discards
4763 delivers
reassembly request datagrams
reassembled succeeded
reassembled failed
IP sent
forwards datagrams
5927 requests
discards
no routes
generated fragments
fragment succeededfragment failed
ICMP Statistics:
ICMP received
input
errorsdestination unreachable messages
time exceeded messages
parameter problem message
echo request messages
echo reply messages
redirect messages
timestamp request messages
timestamp reply messages
source quench messages
address mask request messages
address mask reply messages
ICMP sent
outputerrorsdestination unreachable messages
time exceeded messages
parameter problem message
echo request messages
echo reply messages
redirect messages
timestamp request messages– 984 –

Chapter 34 | IP Routing Commands

Global Routing Configuration

timestamp reply messages
source quench messages
address mask request messages
address mask reply messages

UDP Statistics:

TCP Statistics:

2 input
no port errors
other errors
output4698 input
input errors
5867 output

Console#IPv6 Commands

ipv6 route This command configures static IPv6 routes. Use the no form to remove static
routes.

Syntax[no] ipv6 route destination-ipv6-address/prefix-length{gateway-address [distance] |link-local-address%zone-id [distance]}
destination-ipv6-address – The IPv6 address of a destination network,
subnetwork, or host. This must be a full IPv6 address including the network
prefix and host address bits.
prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix (i.e., the network portion of theaddress).
gateway-address – IP address of the next hop router used for this route.
link-local-address%zone-id – a link-local address, including a zone-id
indicating the VLAN identifier after the % delimiter.
distance – An administrative distance indicating that this route can beoverridden by dynamic routing information if the distance of the dynamic
route is less than that configured for the static route. Note that the default
administrative distances used by the dynamic unicast routing protocols is
110 for OSPF, 120 for RIP, 20 for eBGP, and 200 for iBGP. (Range: 1-255,
Default: 1)
Default Setting
No static routes are configured.
Command Mode
Global Configuration– 985 –

Chapter 34 | IP Routing Commands
Global Routing Configuration
Command Usage Up to 1K static routes can be configured.
 If an administrative distance is defined for a static route, and the same

destination can be reached through a dynamic route at a lower administration
distance, then the dynamic route will be used.

 The default distance of 1 will take precedence over any other type of route,except for local routes.

 If both static and dynamic paths have the same lowest cost, the first route

stored in the routing table, either statically configured or dynamically learned
via a routing protocol, will be used.

ExampleThis example forwards all traffic for subnet 2001::/64 to the next hop router
2001:DB8:2222:7272::254, using the default metric of 1.
Console(config)#ipv6 route 2001::/64 2001:DB8:2222:7272::254
Console(config)#

Related Commands
show ip route summary (983)show ipv6 route This command displays information in the Forwarding Information Base (FIB).
Syntaxshow ipv6 route [ipv6-address[/prefix-length] | database | interface [vlan vlanid] | local | static]
ipv6-address - A full IPv6 address including the network prefix and hostaddress bits.
prefix-length - A decimal value indicating how many contiguous bits (fromthe left) of the address comprise the prefix (i.e., the network portion of theaddress).
database – All known routes, including inactive routes.
interface – Displays all routes that be accessed through this interface.
local – Displays all entries for destinations attached directly to this router.
static – Displays all static entries.
vlan-id - VLAN ID. (Range: 1-4093)
Command Mode
Privileged Exec

– 986 –

Chapter 34 | IP Routing Commands

Global Routing Configuration

Command Usage The FIB contains information required to forward IP traffic. It contains theinterface identifier and next hop information for each reachable destination
network prefix based on the IP routing table. When routing or topology
changes occur in the network, the routing table is updated, and those changes
are immediately reflected in the FIB.
The FIB is distinct from the routing table (or, Routing Information Base), whichholds all routing information received from routing peers. The forwarding
information base contains unique paths only. It does not contain any secondary
paths. A FIB entry consists of the minimum amount of information necessary to
make a forwarding decision on a particular packet. The typical components
within a forwarding information base entry are a network prefix, a router port
identifier, and next hop information.
 This command only displays routes which are currently accessible forforwarding. The router must be able to directly reach the next hop, so the VLAN
interface associated with any dynamic or static route entry must be up.

ExampleIn the following example, note that the last entry displays both the distance andmetric for this route.
Console#show ipv6 route
Codes: K - kernel route, C - connected, S - static, B - BGP,
T - Table, v - VNC, V - VNC-Direct,> - selected route, * - FIB route, q - queued, r - rejected, b - backupt - trapped, o - offload failure
C * fe80::/64 is directly connected, VLAN1, 02:17:31
C>* fe80::/64 is directly connected, VLAN10, 02:18:47
K>* ff00::/8 [0/256] is directly connected, VLAN1, 02:17:33
Console#– 987 –

Chapter 34 | IP Routing Commands
Global Routing Configuration– 988 –

Section III
AppendicesThis section provides additional information and includes these items:
 “Troubleshooting” on page 991
 “License Information” on page 993– 989 –

Section III | Appendices– 990 –

A

Troubleshooting

Problems Accessing the Management Interface
Table 191: Troubleshooting Chart
Symptom

ActionCannot connect using
Telnet, or SNMP software Be sure the switch is powered up.
 Check network cabling between the management station and theswitch. Make sure the ends are properly connected and there is nodamage to the cable. Test the cable if necessary.
 Check that you have a valid network connection to the switch andthat the port you are using has not been disabled.
 Be sure you have configured the VLAN interface through which the
management station is connected with a valid IP address, subnet
mask and default gateway.
 Be sure the management station has an IP address in the same
subnet as the switch’s IP interface to which it is connected.
 If you are trying to connect to the switch via the IP address for atagged VLAN group, your management station, and the ports
connecting intermediate switches in the network, must be
configured with the appropriate tag.
 If you cannot connect using Telnet, you may have exceeded the
maximum number of concurrent Telnet/SSH sessions permitted. Try
connecting again at a later time.
Cannot connect using
Secure Shell

 If you cannot connect using SSH, you may have exceeded the

Cannot access the onboard configuration
program via a serial port
connection

 Be sure you have set the terminal emulator program to VT100

maximum number of concurrent Telnet/SSH sessions permitted. Try
connecting again at a later time.
 Be sure the control parameters for the SSH server are properly
configured on the switch, and that the SSH client software isproperly configured on the management station.
 Be sure you have generated an RSA public key on the switch,
exported this key to the SSH client, and enabled the SSH service. Try
using another SSH client or check for updates to your SSH client
application.
 Be sure you have set up an account on the switch for each SSH user,
including user name, authentication level, and password.
 Be sure you have imported the client’s public key to the switch (ifpublic key authentication is used).
compatible, 8 data bits, 1 stop bit, no parity, and the baud rate set to115200 bps.
 Verify that you are using the RJ-45 to DB-9 null-modem serial cablesupplied with the switch. If you use any other cable, be sure that itconforms to the pin-out connections provided in the Installation
Guide.

Forgot or lost the password  Contact your local distributor.

– 991 –

Appendix A | Troubleshooting
Using System Logs

Using System Logs
If a fault does occur, refer to the Installation Guide to ensure that the problem you
encountered is actually caused by the switch. If the problem appears to be causedby the switch, follow these steps:

1. Enable logging.
2. Set the error messages reported to include all categories.
3. Enable SNMP.
4. Enable SNMP traps.
5. Designate the SNMP host that is to receive the error messages.
6. Repeat the sequence of commands or other actions that lead up to the error.
7. Make a list of the commands or circumstances that led to the fault. Also make alist of any error messages displayed.

8. Set up your terminal emulation software so that it can capture all console

output to a file. Then enter the “show tech-support” command to record all
system settings in this file.

9. Contact your distributor’s service engineer, and send a detailed description of
the problem, along with the file used to record your system settings.

For example:
Console(config)#logging on
Console(config)#logging history flash 7
Console(config)#snmp-server host 192.168.1.23.
.
.

– 992 –

B

License Information

This product includes copyrighted third-party software subject to the terms of the GNU General Public
License (GPL), GNU Lesser General Public License (LGPL), or other related free software licenses.
The GPL code used in this product is distributed WITHOUT ANY WARRANTY and is subject to the
copyrights of one or more authors. For details, refer to the section "The GNU General Public License"
below, or refer to the applicable license as included in the source-code archive.

The GNU General Public License
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it
is not allowed.
Preamble
The licenses for most software are designed to take away your freedom to share and change it. By
contrast, the GNU General Public License is intended to guarantee your freedom to share andchange free software--to make sure the software is free for all its users. This General Public License
applies to most of the Free Software Foundation's software and to any other program whose authors
commit to using it. (Some other Free Software Foundation software is covered by the GNU Library
General Public License instead.) You can apply it to your programs, too.
When we speak of free software, we are referring to freedom, not price. Our General Public Licenses
are designed to make sure that you have the freedom to distribute copies of free software (andcharge for this service if you wish), that you receive source code or can get it if you want it, that you
can change the software or use pieces of it in new free programs; and that you know you can dothese things.
To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to
ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether gratis or for a fee, you must give therecipients all the rights that you have. You must make sure that they, too, receive or can get thesource code. And you must show them these terms so they know their rights.
We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which
gives you legal permission to copy, distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain that everyone understands that
there is no warranty for this free software. If the software is modified by someone else and passed on,
we want its recipients to know that what they have is not the original, so that any problems introducedby others will not reflect on the original authors' reputations.
Finally, any free program is threatened constantly by software patents. We wish to avoid the danger
that redistributors of a free program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any patent must be licensed foreveryone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and modification follow.

– 993 –

Appendix B | License Information
The GNU General Public License
GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION
AND MODIFICATION
1.

This License applies to any program or other work which contains a notice placed by the
copyright holder saying it may be distributed under the terms of this General Public License. The"Program", below, refers to any such program or work, and a "work based on the Program"means either the Program or any derivative work under copyright law: that is to say, a work
containing the Program or a portion of it, either verbatim or with modifications and/or translated
into another language. (Hereinafter, translation is included without limitation in the term
"modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not covered by this License; they
are outside its scope. The act of running the Program is not restricted, and the output from theProgram is covered only if its contents constitute a work based on the Program (independent of
having been made by running the Program). Whether that is true depends on what the Program
does.

2.

You may copy and distribute verbatim copies of the Program's source code as you receive it, in
any medium, provided that you conspicuously and appropriately publish on each copy anappropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer tothis License and to the absence of any warranty; and give any other recipients of the Program acopy of this License along with the Program.
You may charge a fee for the physical act of transferring a copy, and you may at your option offer
warranty protection in exchange for a fee.

3.

You may modify your copy or copies of the Program or any portion of it, thus forming a work
based on the Program, and copy and distribute such modifications or work under the terms of
Section 1 above, provided that you also meet all of these conditions:a)

You must cause the modified files to carry prominent notices stating that you changed thefiles and the date of any change.

b)

You must cause any work that you distribute or publish, that in whole or in part contains or isderived from the Program or any part thereof, to be licensed as a whole at no charge to allthird parties under the terms of this License.

c)

If the modified program normally reads commands interactively when run, you must cause
it, when started running for such interactive use in the most ordinary way, to print or display
an announcement including an appropriate copyright notice and a notice that there is no
warranty (or else, saying that you provide a warranty) and that users may redistribute theprogram under these conditions, and telling the user how to view a copy of this License.
(Exception: if the Program itself is interactive but does not normally print such anannouncement, your work based on the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole. If identifiable sections of that work
are not derived from the Program, and can be reasonably considered independent and separate
works in themselves, then this License, and its terms, do not apply to those sections when you
distribute them as separate works. But when you distribute the same sections as part of a whole
which is a work based on the Program, the distribution of the whole must be on the terms of thisLicense, whose permissions for other licensees extend to the entire whole, and thus to each andevery part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest your rights to work written
entirely by you; rather, the intent is to exercise the right to control the distribution of derivative orcollective works based on the Program.
In addition, mere aggregation of another work not based on the Program with the Program (orwith a work based on the Program) on a volume of a storage or distribution medium does notbring the other work under the scope of this License.
4.

You may copy and distribute the Program (or a work based on it, under Section 2) in object codeor executable form under the terms of Sections 1 and 2 above provided that you also do one of
the following:a)Accompany it with the complete corresponding machine-readable source code, which must
be distributed under the terms of Sections 1 and 2 above on a medium customarily used forsoftware interchange; or,– 994 –

Appendix B | License Information

The GNU General Public Licenseb)

Accompany it with a written offer, valid for at least three years, to give any third party, for acharge no more than your cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be distributed under the termsof Sections 1 and 2 above on a medium customarily used for software interchange; or,c)

Accompany it with the information you received as to the offer to distribute corresponding
source code. (This alternative is allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such an offer, in accord with
Subsection b above.)

The source code for a work means the preferred form of the work for making modifications to it.
For an executable work, complete source code means all the source code for all modules it
contains, plus any associated interface definition files, plus the scripts used to control
compilation and installation of the executable. However, as a special exception, the source code
distributed need not include anything that is normally distributed (in either source or binary form)
with the major components (compiler, kernel, and so on) of the operating system on which theexecutable runs, unless that component itself accompanies the executable.
If distribution of executable or object code is made by offering access to copy from a designatedplace, then offering equivalent access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not compelled to copy the source
along with the object code.
5.

You may not copy, modify, sublicense, or distribute the Program except as expressly provided
under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Programis void, and will automatically terminate your rights under this License. However, parties who
have received copies, or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.

6.

You are not required to accept this License, since you have not signed it. However, nothing else
grants you permission to modify or distribute the Program or its derivative works. These actions
are prohibited by law if you do not accept this License. Therefore, by modifying or distributing theProgram (or any work based on the Program), you indicate your acceptance of this License to doso, and all its terms and conditions for copying, distributing or modifying the Program or works
based on it.

7.

Each time you redistribute the Program (or any work based on the Program), the recipient
automatically receives a license from the original licensor to copy, distribute or modify the
Program subject to these terms and conditions. You may not impose any further restrictions on
the recipients' exercise of the rights granted herein. You are not responsible for enforcing
compliance by third parties to this License.

8.

If, as a consequence of a court judgment or allegation of patent infringement or for any otherreason (not limited to patent issues), conditions are imposed on you (whether by court order,
agreement or otherwise) that contradict the conditions of this License, they do not excuse youfrom the conditions of this License. If you cannot distribute so as to satisfy simultaneously yourobligations under this License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent license would not permit royaltyfree redistribution of the Program by all those who receive copies directly or indirectly throughyou, then the only way you could satisfy both it and this License would be to refrain entirely from
distribution of the Program.
If any portion of this section is held invalid or unenforceable under any particular circumstance,
the balance of the section is intended to apply and the section as a whole is intended to apply inother circumstances.
It is not the purpose of this section to induce you to infringe any patents or other property rightclaims or to contest validity of any such claims; this section has the sole purpose of protecting
the integrity of the free software distribution system, which is implemented by public license
practices. Many people have made generous contributions to the wide range of software
distributed through that system in reliance on consistent application of that system; it is up to theauthor/donor to decide if he or she is willing to distribute software through any other system anda licensee cannot impose that choice.
This section is intended to make thoroughly clear what is believed to be a consequence of therest of this License.

– 995 –

Appendix B | License Information
The GNU General Public License
9.

If the distribution and/or use of the Program is restricted in certain countries either by patents orby copyrighted interfaces, the original copyright holder who places the Program under thisLicense may add an explicit geographical distribution limitation excluding those countries, sothat distribution is permitted only in or among countries not thus excluded. In such case, thisLicense incorporates the limitation as if written in the body of this License.

10. The Free Software Foundation may publish revised and/or new versions of the General Public
License from time to time. Such new versions will be similar in spirit to the present version, but
may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Program specifies a version
number of this License which applies to it and "any later version", you have the option offollowing the terms and conditions either of that version or of any later version published by theFree Software Foundation. If the Program does not specify a version number of this License,
you may choose any version ever published by the Free Software Foundation.
11. If you wish to incorporate parts of the Program into other free programs whose distribution
conditions are different, write to the author to ask for permission. For software which is
copyrighted by the Free Software Foundation, write to the Free Software Foundation; wesometimes make exceptions for this. Our decision will be guided by the two goals of preserving
the free status of all derivatives of our free software and of promoting the sharing and reuse ofsoftware generally.
NO WARRANTY
1.

BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTYFOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIESPROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH
YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL
NECESSARY SERVICING, REPAIR OR CORRECTION.

2.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITINGWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FORDAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL
DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDINGBUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO
OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY
HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

END OF TERMS AND CONDITIONS– 996 –

List of Commands

aaa accounting commands 248
aaa accounting dot1x 249
aaa accounting exec 250
aaa accounting update 251
aaa authorization commands 251
aaa authorization exec 252
aaa group server 253
absolute 181
access-list arp 406
access-list ip 388
access-list ipv6 394
access-list mac 400
accounting commands 255
accounting dot1x 254
accounting exec 255
alias 415
arp 929
arp timeout 930
authentication enable 236
authentication login 237
authorization commands 256
authorization exec 256
auto-traffic-control 491
auto-traffic-control action 491
auto-traffic-control alarm-clear-threshold 492
auto-traffic-control alarm-fire-threshold 493
auto-traffic-control apply-timer 489
auto-traffic-control auto-control-release 494
auto-traffic-control control-release 495
auto-traffic-control release-timer 490
backup-port 526
banner configure 105banner configure company 107
banner configure dc-power-info 107
banner configure department 108
banner configure equipment-info 109
banner configure equipment-location 109
banner configure ip-lan 110
banner configure lp-number 111
banner configure manager-info 111
banner configure mux 112
banner configure note 113
boot system 128
bootfile 909
bpdu-tcn-notify 630
bridge-ext gvrp 564

calendar set 179
capabilities 416
channel-group 450
class 670
class-map 666
clear access-list hardware counters 409
clear arp-cache 931
clear counters 423
clear dns cache 885
clear efm oam counters 872
clear efm oam event-log 872
clear erps statistics 643
clear ethernet cfm ais mpid 837
clear ethernet cfm errors 849
clear ethernet cfm linktrace-cache 858
clear ethernet cfm maintenance-points remote 848
clear ip dhcp binding 918
clear ip dhcp snooping binding 341
clear ip dhcp snooping database flash 341
clear ip igmp snooping groups dynamic 705
clear ip igmp snooping statistics 706
clear ip source-guard binding blocked 359
clear ipv6 dhcp snooping binding 350
clear ipv6 dhcp snooping statistics 351
clear ipv6 mld snooping groups dynamic 735
clear ipv6 mld snooping statistics 735
clear ipv6 nd snooping binding 975
clear ipv6 nd snooping prefix 975
clear ipv6 neighbors 967
clear ipv6 traffic 951
clear log 156
clear mac-address-table dynamic 518
clear mvr groups dynamic 763
clear mvr statistics 764
clear mvr6 groups dynamic 786
clear mvr6 statistics 786
clear network-access 320
clear pppoe intermediate-agent statistics 298
client-identifier 909
clock summer-time (date) 172
clock summer-time (predefined) 173
clock summer-time (recurring) 174
clock timezone 175
clock timezone-predefined 176
cluster 184
cluster commander 185– 997 –

List of Commands

cluster ip-pool 186
cluster member 186
configure 93
control-plane 683
control-vlan 624
copy 129
databits 142
default-router 910
delete 133
delete public-key 270
description 667
description 417
dir 133
disable 94
discard 417
disconnect 149
dns-server 911
domain-name 911
dos-protection echo-chargen 376
dos-protection smurf 376
dos-protection tcp-flooding 377
dos-protection tcp-null-scan 377
dos-protection tcp-syn-fin-scan 378
dos-protection tcp-udp-port-zero 378
dos-protection tcp-xmas-scan 379
dos-protection udp-flooding 379
dos-protection win-nuke 380
dot1q-tunnel system-tunnel-control 581
dot1q-tunnel tpid 582
dot1x default 275
dot1x eapol-pass-through 276
dot1x identity profile 284
dot1x intrusion-action 277
dot1x max-reauth-req 278
dot1x max-req 278
dot1x max-start 284
dot1x operation-mode 279
dot1x pae supplicant 285
dot1x port-control 280
dot1x re-authenticate 283
dot1x re-authentication 280
dot1x system-auth-control 276
dot1x timeout auth-period 286
dot1x timeout held-period 286
dot1x timeout quiet-period 281
dot1x timeout re-authperiod 281
dot1x timeout start-period 287
dot1x timeout supp-timeout 282
dot1x timeout tx-period 282
dying-gasp 189
efm oam 868
efm oam critical-link-event 868
efm oam link-monitor frame threshold 870
efm oam link-monitor frame window 870

efm oam link-monitor frame 869
efm oam mode 871
efm oam remote-loopback 873
efm oam remote-loopback test 874
enable 91
enable (instance) 623
enable (ring) 622
enable password 232
end 95erps 617
erps clear 643
erps forced-switch 639
erps instance 620
erps manual-switch 641
erps node-id 618
erps ring 619
erps vlan-group 619
ethernet cfm ais level 828
ethernet cfm ais ma 829
ethernet cfm ais period 830
ethernet cfm ais suppress alarm 830
ethernet cfm cc enable 846
ethernet cfm cc ma interval 845
ethernet cfm delay-measure two-way 864
ethernet cfm domain 831
ethernet cfm enable 833
ethernet cfm linktrace 857
ethernet cfm linktrace cache 854
ethernet cfm linktrace cache hold-time 855
ethernet cfm linktrace cache size 856
ethernet cfm loopback 859
ethernet cfm mep 836
ethernet cfm mep crosscheck 853
ethernet cfm mep crosscheck start-delay 851
ethernet cfm port-enable 837
excluded-vlan 612
exclusion-vlan 622
exec-timeout 142
exit 95
fan-speed force-full 125
fec 420
flowcontrol 418
garp timer 565
guard-timer 627
hardware-address 912
history 419
holdoff-timer 628
host 912
hostname 104
inclusion-vlan 638
interface 415
interface vlan 572
ip access-group 392
ip address 922– 998 –

List of Commands

ip arp inspection 367
ip arp inspection filter 368
ip arp inspection limit 372
ip arp inspection log-buffer logs 369
ip arp inspection trust 372
ip arp inspection validate 370
ip arp inspection vlan 371
ip default-gateway 924
ip dhcp client class-id 891
ip dhcp dynamic-provision 890
ip dhcp excluded-address 907
ip dhcp inform 893
ip dhcp pool 907
ip dhcp relay information option 902
ip dhcp relay information option encode no-subtype 902
ip dhcp relay information option remote-id 903
ip dhcp relay information policy 903
ip dhcp relay server 899
ip dhcp restart client 894
ip dhcp restart relay 900
ip dhcp snooping 330
ip dhcp snooping max-number 340
ip dhcp snooping database flash 342
ip dhcp snooping information option 332
ip dhcp snooping information option circuit-id 338
ip dhcp snooping information option encode no-subtype333
ip dhcp snooping information option remote-id 334
ip dhcp snooping information option tr101 board-id 335
ip dhcp snooping information policy 336
ip dhcp snooping trust 340
ip dhcp snooping verify mac-address 336
ip dhcp snooping vlan 337
ip domain-list 880
ip domain-lookup 881
ip domain-name 882
ip host 882
ip http authentication 259
ip http port 260
ip http secure-port 261
ip http secure-server 261
ip http server 260
ip igmp authentication 716
ip igmp filter (Global Configuration) 714
ip igmp filter (Interface Configuration) 718
ip igmp max-groups 719
ip igmp max-groups action 720
ip igmp profile 715
ip igmp query-drop 720
ip igmp snooping 689
ip igmp snooping mrouter-forward-mode dynamic 690
ip igmp snooping proxy-reporting 690
ip igmp snooping querier 692
ip igmp snooping report-suppression 691

ip igmp snooping router-alert-option-check 692
ip igmp snooping router-port-expire-time 693
ip igmp snooping tcn-flood 693
ip igmp snooping tcn-query-solicit 695
ip igmp snooping unregistered-data-flood 695
ip igmp snooping unsolicited-report-interval 696
ip igmp snooping version 697
ip igmp snooping version-exclusive 697
ip igmp snooping vlan general-query-suppression 698
ip igmp snooping vlan immediate-leave 699
ip igmp snooping vlan last-memb-query-count 700
ip igmp snooping vlan last-memb-query-intvl 700
ip igmp snooping vlan mrd 701
ip igmp snooping vlan mrouter 712
ip igmp snooping vlan proxy-address 702
ip igmp snooping vlan query-interval 703
ip igmp snooping vlan query-resp-intvl 704
ip igmp snooping vlan static 705
ip mdns 887
ip multicast-data-drop 721
ip name-server 883
ip proxy-arp 931
ip route 980
ip source-guard 355
ip source-guard binding 353
ip source-guard max-binding 357
ip source-guard mode 358
ip ssh authentication-retries 268
ip ssh crypto host-key generate 270
ip ssh crypto zeroize 271
ip ssh save host-key 272
ip ssh server 269
ip ssh timeout 269
ip telnet max-sessions 263
ip telnet port 264
ip telnet server 264
ip tftp retry 139
ip tftp timeout 139
ipv6 access-group 398
ipv6 address 935
ipv6 address autoconfig 936
ipv6 address dhcp 938
ipv6 address eui-64 939
ipv6 address link-local 941
ipv6 default-gateway 934
ipv6 dhcp client rapid-commit vlan 895
ipv6 dhcp dynamic-provision 897
ipv6 dhcp relay destination 904
ipv6 dhcp restart client vlan 895
ipv6 dhcp snooping 344
ipv6 dhcp snooping max-binding 349
ipv6 dhcp snooping option remote-id 346
ipv6 dhcp snooping option remote-id policy 347
ipv6 dhcp snooping trust 349– 999 –

List of Commands

ipv6 dhcp snooping vlan 348
ipv6 enable 942
ipv6 hop-limit 954
ipv6 host 884
ipv6 mld filter (Global Configuration) 743
ipv6 mld filter (Interface Configuration) 746
ipv6 mld max-groups 747
ipv6 mld max-groups action 747
ipv6 mld profile 744
ipv6 mld query-drop 748
ipv6 mld snooping 727
ipv6 mld snooping proxy-reporting 727
ipv6 mld snooping querier 728
ipv6 mld snooping query-interval 728
ipv6 mld snooping query-max-response-time 729
ipv6 mld snooping robustness 729
ipv6 mld snooping router-port-expire-time 730
ipv6 mld snooping unknown-multicast mode 731
ipv6 mld snooping unsolicited-report-interval 731
ipv6 mld snooping version 732
ipv6 mld snooping vlan immediate-leave 732
ipv6 mld snooping vlan mrouter 733
ipv6 mld snooping vlan static 734
ipv6 mtu 943
ipv6 multicast-data-drop 749
ipv6 nd dad attempts 956
ipv6 nd managed-config-flag 958
ipv6 nd ns-interval 959
ipv6 nd other-config-flag 958
ipv6 nd prefix 962
ipv6 nd ra interval 964
ipv6 nd ra lifetime 965
ipv6 nd ra router-preference 965
ipv6 nd ra suppress 966
ipv6 nd raguard 960
ipv6 nd reachable-time 962
ipv6 nd snooping 970
ipv6 nd snooping auto-detect 971
ipv6 nd snooping auto-detect retransmit count 972
ipv6 nd snooping auto-detect retransmit interval 973
ipv6 nd snooping max-binding 974
ipv6 nd snooping prefix timeout 973
ipv6 nd snooping trust 974
ipv6 neighbor 955
ipv6 route 985
ipv6 source-guard 363
ipv6 source-guard binding 361
ipv6 source-guard max-binding 364
jumbo frame 125
l2protocol-tunnel tunnel-dmac 590
lacp 451
lacp actor/partner mode (Ethernet Interface) 452
lacp admin-key (Ethernet Interface) 453
lacp admin-key (Port Channel) 455

lacp port-priority 454
lacp system-priority 455
lacp timeout 456
lease 914
line 141
lldp 801
lldp admin-status 805
lldp basic-tlv management-ip-address 805
lldp basic-tlv management-ipv6-address 806
lldp basic-tlv port-description 807
lldp basic-tlv system-capabilities 807
lldp basic-tlv system-description 808
lldp basic-tlv system-name 808
lldp dot1-tlv proto-ident 809
lldp dot1-tlv proto-vid 809
lldp dot1-tlv pvid 810
lldp dot1-tlv vlan-name 810
lldp dot3-tlv link-agg 811
lldp dot3-tlv mac-phy 811
lldp dot3-tlv max-frame 812
lldp dot3-tlv poe 812
lldp holdtime-multiplier 801
lldp med-fast-start-count 802
lldp med-location civic-addr 813
lldp med-notification 815
lldp med-tlv ext-poe 815
lldp med-tlv inventory 816
lldp med-tlv location 817
lldp med-tlv med-cap 817
lldp med-tlv network-policy 818
lldp notification 818
lldp notification-interval 802
lldp refresh-interval 803
lldp reinit-delay 803
lldp tx-delay 804
logging command 151
logging facility 152
logging history 152
logging host 153
logging level 154
logging on 155
logging sendmail 159
logging sendmail destination-email 160
logging sendmail host 160
logging sendmail level 161
logging sendmail source-email 162
logging trap 155
login 143
loopback detection trap 504
loopback-detection 502
loopback-detection action 502
loopback-detection recover-time 503
loopback-detection release 505
loopback-detection transmit-interval 504– 1000 –List of Commands

ma index name 834
ma index name-format 835
mac access-group 405
mac-address-table aging-time 515
mac-address-table hash-lookup-depth 516
mac-address-table static 516
mac-authentication intrusion-action 319
mac-authentication max-mac-count 319
mac-authentication reauth-time 311
mac-learning 302
mac-vlan 603
major-ring 629
management 290
match 668
max-hops 541
media-type 419
meg-level 623
memory 212
mep archive-hold-time 848
mep crosscheck mpid 852
mep fault-notify alarm-time 861
mep fault-notify lowest-priority 861
mep fault-notify reset-time 863
mgmt 98
mgmt loglevel 99
mgmt property 101
mgmt setoption 99
mgmt upgrade 101
mlag 462
mlag domain peer-link 462
mlag group member 463
mst priority 541
mst vlan 542
mvr 753
mvr associated-profile 753
mvr domain 754
mvr immediate-leave 760
mvr profile 755
mvr proxy-query-interval 755
mvr proxy-switching 756
mvr robustness-value 757
mvr source-port-mode 758
mvr type 761
mvr upstream-source-ip 759
mvr vlan 759
mvr vlan group 762
mvr6 associated-profile 776
mvr6 domain 776
mvr6 immediate-leave 783
mvr6 profile 777
mvr6 proxy-query-interval 778
mvr6 proxy-switching 779
mvr6 robustness-value 780
mvr6 source-port-mode dynamic 781

mvr6 type 784
mvr6 upstream-source-ip 781
mvr6 vlan 782
mvr6 vlan group 785
name 543
negotiation 421
netbios-name-server 914
netbios-node-type 915
network 916
network-access aging 309
network-access dynamic-qos 311
network-access dynamic-vlan 312
network-access guest-vlan 313
network-access link-detection 314
network-access link-detection link-down 314
network-access link-detection link-up 315
network-access link-detection link-up-down 316
network-access mac-filter 310
network-access max-mac-count 316
network-access mode mac-authentication 317
network-access port-mac-filter 318
next-server 917
nlm 209no rspan session 481
non-revertive 630
ntp authenticate 166
ntp authentication-key 167
ntp client 168
ntp server 169
option 917
parity 144
password 145
password-thresh 145
periodic 182
permit, deny 715
permit, deny 745
permit, deny (ARP ACL) 407
permit, deny (Extended IPv4 ACL) 389
permit, deny (Extended IPv6 ACL) 396
permit, deny (MAC ACL) 401
permit, deny (Standard IP ACL) 388
permit, deny (Standard IPv6 ACL) 395
physical-ring 639
ping 927
ping6 952
police flow 671
police srtcm-color 673
police trtcm-color 675
policy-map 670
port monitor 473
port security 303
port security mac-address sticky 305
port security mac-address-as-permanent 305
port-channel load-balance 449– 1001 –List of Commands

power inline 467
power inline maximum allocation 468
power inline priority 469
power-save 445
pppoe intermediate-agent 293
pppoe intermediate-agent format-type 293
pppoe intermediate-agent port-enable 294
pppoe intermediate-agent port-format-type 295
pppoe intermediate-agent port-format-type remote-iddelimiter 296
pppoe intermediate-agent trust 297
pppoe intermediate-agent vendor-tag strip 297
primary-port 525
privilege 234
process cpu 213
process cpu guard 214
prompt 89
propagate-tc 629
protocol-vlan protocol-group (Configuring Groups) 598
protocol-vlan protocol-group (Configuring Interfaces) 598
qos map cos-dscp 655
qos map dscp-mutation 657
qos map ip-prec-dscp 658
qos map phb-queue 654
qos map trust-mode 659
queue mode 650
queue weight 651
quit 92
radius-server acct-port 238
radius-server auth-port 239
radius-server encrypted-key 241
radius-server host 239
radius-server key 240
radius-server retransmit 241
radius-server timeout 242
range 716
range 745
raps-def-mac 634
raps-without-vc 635
rate-limit 484
rcommand 187
reload (Global Configuration) 90
reload (Privileged Exec) 94
rename 669
revision 543
ring-port 621
rmon alarm 218
rmon collection history 220
rmon collection rmon1 221
rmon event 219
rpl neighbor 626
rpl owner 625
rspan destination 479
rspan remote vlan 480

rspan source 478
server 253
service dhcp 908
service-policy 680
service-policy 684
set cos 677
set ip dscp 678
set phb 679
sflow owner 226
sflow polling instance 227
sflow sampling instance 228
show access-group 410
show access-list 410
show access-list arp 408
show access-list tcam-utilization 115
show accounting 257
show arp 932
show authorization 258
show auto-traffic-control 499
show auto-traffic-control interface 500
show banner 113
show bridge-ext 567
show cable-diagnostics 443
show calendar 179
show class-map 680
show cluster 188
show cluster candidates 188
show cluster members 188
show discard 423
show dns 885
show dns cache 885
show dos-protection 380
show dot1q-tunnel 588
show dot1q-tunnel service 587
show dot1q-tunnel vlan-double-tag 589
show dot1x 287
show dying-gasp packets 190
show dying-gasp status 190
show efm oam counters interface 875
show efm oam event-log interface 875
show efm oam remote-loopback interface 877
show efm oam status remote interface 878
show efm oam status interface 877
show erps 645
show erps statistics 644
show ethernet cfm configuration 838
show ethernet cfm errors 850
show ethernet cfm fault-notify-generator 863
show ethernet cfm linktrace-cache 858
show ethernet cfm ma 840
show ethernet cfm maintenance-points local 841
show ethernet cfm maintenance-points local detail mep
842– 1002 –List of Commands

show ethernet cfm maintenance-points remote crosscheck854
show ethernet cfm maintenance-points remote detail 843
show ethernet cfm md 840
show excluded-vlan 613
show garp timer 568
show gvrp configuration 569
show history 92
show hosts 886
show interfaces brief 424
show interfaces counters 425
show interfaces history 429
show interfaces protocol-vlan protocol-group 600
show interfaces status 431
show interfaces switchport 432
show interfaces transceiver 440
show interfaces transceiver-threshold 441
show ip access-group 393
show ip access-list 393
show ip arp inspection configuration 373
show ip arp inspection interface 373
show ip arp inspection log 374
show ip arp inspection statistics 374
show ip arp inspection vlan 375
show ip dhcp 919
show ip dhcp binding 919
show ip dhcp dynamic-provision 894
show ip dhcp pool 919
show ip dhcp relay 901
show ip dhcp snooping 342
show ip dhcp snooping binding 343
show ip host-route 982
show ip igmp authentication 721
show ip igmp filter 722
show ip igmp profile 723
show ip igmp query-drop 723
show ip igmp snooping 706
show ip igmp snooping group 707
show ip igmp snooping mrouter 708
show ip igmp snooping statistics 709
show ip igmp throttle interface 724
show ip interface 925
show ip mdns 887
show ip multicast-data-drop 725
show ip route 981
show ip route database 983
show ip route summary 983
show ip source-guard 359
show ip source-guard binding 360
show ip ssh 272
show ip telnet 265
show ip tftp 140
show ip traffic 925
show ip traffic 984

show ipv6 access-group 399
show ipv6 access-list 399
show ipv6 dhcp duid 897
show ipv6 dhcp dynamic-provision 898
show ipv6 dhcp relay destination 906
show ipv6 dhcp snooping 351
show ipv6 dhcp snooping binding 352
show ipv6 dhcp snooping statistics 352
show ipv6 dhcp vlan 898
show ipv6 interface 944
show ipv6 mld filter 749
show ipv6 mld profile 750
show ipv6 mld query-drop 750
show ipv6 mld snooping group 737
show ipv6 mld snooping group source-list 737
show ipv6 mld snooping mrouter 738
show ipv6 mld snooping statistics 739
show ipv6 mld throttle interface 751
show ipv6 mld snooping 736
show ipv6 mtu 946
show ipv6 nd prefix 968
show ipv6 nd raguard 961
show ipv6 nd snooping 976
show ipv6 nd snooping binding 976
show ipv6 nd snooping prefix 977
show ipv6 neighbors 967
show ipv6 route 986
show ipv6 source-guard 365
show ipv6 source-guard binding 366
show ipv6 traffic 947
show l2protocol-tunnel 593
show lacp 457
show line 150
show lldp config 819
show lldp info local-device 820
show lldp info remote-device 821
show lldp info statistics 823
show log 156
show logging 157
show logging sendmail 162
show loop internal 444
show loopback-detection 505
show mac access-group 405
show mac access-list 406
show mac-address-table 519
show mac-address-table aging-time 520
show mac-address-table count 520
show mac-address-table hash-lookup-depth 521
show mac-vlan 604
show management 291
show memory 116
show mgmt log 102
show mgmt option 103
show mgmt status 102– 1003 –List of Commands

show mgmt version 102
show mlag 465
show mlag domain 465
show mlag group 465
show mvr 764
show mvr associated-profile 765
show mvr interface 766
show mvr members 767
show mvr profile 769
show mvr statistics 769
show mvr6 787
show mvr6 associated-profile 788
show mvr6 domain 791
show mvr6 interface 789
show mvr6 members 789
show mvr6 profile 792
show mvr6 statistics 793
show network-access 320
show network-access mac-address-table 321
show network-access mac-filter 322
show nlm oper-status 212
show ntp 170
show ntp peer-status 171
show ntp statistics peer 170
show ntp status 170
show policy-map 681
show policy-map control-plane 684
show policy-map interface 682
show port monitor 475
show port security 306
show port-channel load-balance 460
show power inline status 470
show power inline time-range 471
show power mainpower 472
show power-save 446
show pppoe intermediate-agent info 298
show pppoe intermediate-agent statistics 299
show privilege 235
show process cpu 116
show process cpu guard 117
show process cpu task 118
show protocol-vlan protocol-group 599
show public-key 273
show qos map cos-dscp 660
show qos map dscp-mutation 661
show qos map ip-prec-dscp 661
show qos map phb-queue 662
show qos map trust-mode 663
show queue mode 653
show queue weight 653
show radius-server 242
show reload 95
show rmon alarms 222
show rmon events 222

show rmon history 223
show rmon statistics 223
show rspan 482
show running-config 118
show sflow 229
show smart-pair 527
show snmp 195
show snmp engine-id 206
show snmp group 207
show snmp notify-filter 212
show snmp user 208
show snmp view 209
show snmp-server enable port-traps 200
show sntp 166
show spanning-tree 558
show spanning-tree mst configuration 560
show spanning-tree tc-prop 561
show ssh 273
show startup-config 120
show subnet-vlan 602
show system 121
show tacacs-server 247
show tech-support 122
show time-range 183
show traffic-segmentation 385
show twamp reflector 530
show udld 512
show upgrade 138
show users 123
show version 123
show vlan 579
show vlan-translation 596
show voice vlan 611
show watchdog 124
show web-auth 327
show web-auth interface 328
show web-auth summary 328
shutdown 421
silent-time 146
smart-pair 523
smart-pair restore 524
snmp-server 193
snmp-server community 193
snmp-server contact 194
snmp-server enable port-traps atc broadcast-alarm-clear495
snmp-server enable port-traps atc broadcast-alarm-fire496
snmp-server enable port-traps atc broadcast-control-apply
496
snmp-server enable port-traps atc broadcast-controlrelease 497
snmp-server enable port-traps atc multicast-alarm-clear497– 1004 –List of Commands

snmp-server enable port-traps atc multicast-alarm-fire 498
snmp-server enable port-traps atc multicast-control-apply
498
snmp-server enable port-traps atc multicast-controlrelease 499
snmp-server enable traps ethernet cfm cc 847
snmp-server enable traps ethernet cfm crosscheck 851
snmp-server enable port-traps link-up-down 199
snmp-server enable port-traps mac-notification 200
snmp-server enable traps 196
snmp-server engine-id 201
snmp-server group 202
snmp-server host 197
snmp-server location 195
snmp-server notify-filter 210
snmp-server user 203
snmp-server view 205
sntp client 164
sntp poll 165
sntp server 165
spanning-tree 532
spanning-tree bpdu-filter 544
spanning-tree bpdu-guard 545
spanning-tree cisco-prestandard 533
spanning-tree cost 546
spanning-tree edge-port 547
spanning-tree forward-time 533
spanning-tree hello-time 534
spanning-tree link-type 548
spanning-tree loopback-detection 549
spanning-tree loopback-detection action 549
spanning-tree loopback-detection release 557
spanning-tree loopback-detection release-mode 550
spanning-tree loopback-detection trap 551
spanning-tree max-age 535
spanning-tree mode 535
spanning-tree mst configuration 537
spanning-tree mst cost 552
spanning-tree mst port-priority 553
spanning-tree pathcost method 537
spanning-tree port-bpdu-flooding 553
spanning-tree port-priority 554
spanning-tree priority 538
spanning-tree protocol-migration 557
spanning-tree restricted-tcn 551
spanning-tree root-guard 555
spanning-tree spanning-disabled 556
spanning-tree system-bpdu-flooding 539
spanning-tree tc-prop 539
spanning-tree tc-prop-stop 556
spanning-tree transmission-limit 540
speed 147
speed-duplex 422
stopbits 147

subnet-vlan 601
switchport acceptable-frame-types 573
switchport allowed vlan 574
switchport dot1q-tunnel mode 583
switchport dot1q-tunnel priority map 584
switchport dot1q-tunnel service match cvid 584
switchport dot1q-tunnel vlan-double-tag cvid 587
switchport forbidden vlan 566
switchport gvrp 567
switchport ingress-filtering 575
switchport l2protocol-tunnel 593
switchport mode 576
switchport native vlan 577
switchport packet-rate 485
switchport priority default 652
switchport vlan-translation 594
switchport voice vlan 608
switchport voice vlan priority 609
switchport voice vlan rule 609
switchport voice vlan security 610
tacacs-server encrypted-key 245
tacacs-server host 243
tacacs-server key 244
tacacs-server port 245
tacacs-server retransmit 246
tacacs-server timeout 246
telnet (client) 265
terminal 149
test cable-diagnostics 442
test loop internal 443
timeout login response 148
time-range 180
traceroute 926
traceroute6 953
traffic-segmentation 381
traffic-segmentation session 383
traffic-segmentation uplink/downlink 383
traffic-segmentation uplink-to-uplink 384
transceiver-monitor 434
transceiver-threshold current 435transceiver-threshold rx-power 436transceiver-threshold temperature 437transceiver-threshold tx-power 438
transceiver-threshold voltage 439transceiver-threshold-auto 434
twamp reflector 529
twamp reflector refwait 530
udld aggressive 510
udld detection-interval 507
udld message-interval 508
udld port 511
udld recovery 509
udld recovery-interval 509
umount usbdisk 134– 1005 –List of Commands

upgrade opcode auto 136
upgrade opcode path 137
upgrade opcode reload 138
username 233
version 637
vlan 571
vlan database 570
vlan-trunking 578
voice vlan 605
voice vlan aging 606
voice vlan mac-address 607
watchdog software 124
web-auth 326
web-auth login-attempts 324
web-auth quiet-period 324
web-auth re-authenticate (IP) 327
web-auth re-authenticate (Port) 326
web-auth session-timeout 325
web-auth system-auth-control 325
whichboot 135
wtr-delay 527
wtr-timer 627– 1006 –