Configuring Cisco Gigabit EtherSwitch EHWICs
Available Languages
Table of Contents
Configuring the Cisco Gigabit EtherSwitch EHWIC
Prerequisites for Gigabit EtherSwitch EHWICs
Restrictions for Gigabit EtherSwitch EHWICs
Information About Gigabit EtherSwitch EHWICs
How to Configure Gigabit EtherSwitch EHWICs
Verifying the VLAN Configuration
Deleting a VLAN Instance from the Database
Configuring VLAN Trunking Protocol
Disabling VTP (VTP Transparent Mode)
Configuring Layer 2 Interfaces
Configuring a Range of Interfaces
Configuring Layer 2 Optional Interface Features
Configuring 802.1x Authentication
Understanding the Default 802.1x Configuration
Enabling 802.1x Authentication
Configuring the Switch-to-RADIUS-Server Communication
Enabling Periodic Reauthentication
Changing the Switch-to-Client Retransmission Time
Setting the Switch-to-Client Frame-Retransmission Number
Resetting the 802.1x Configuration to the Default Values
Displaying 802.1x Statistics and Status
Configuring Spanning Tree Port Priority
Configuring Spanning Tree Port Cost
Configuring the Bridge Priority of a VLAN
Configuring the Forward-Delay Time for a VLAN
Configuring the Maximum Aging Time for a VLAN
Configuring MAC Table Manipulation
Enabling Known MAC Address Traffic
Creating a Static Entry in the MAC Address Table
Configuring Cisco Discovery Protocol
Configuring the Switched Port Analyzer
Removing Sources or Destinations from a SPAN Session
Configuring Power Management on the Interface
Configuring Power to Cisco IP Phones
Configuring Maximum Inline Power Supply to a Port
Verifying Power Management on the Interface
Configuring IP Multicast Layer3 Switching
Enabling IP Multicast Routing Globally
Enabling IP Protocol-Independent Multicast (PIM) on Layer3 Interfaces
Verifying IP Multicast Layer3 Switching Summary
Verifying the IP Multicast Routing Table
Enabling or Disabling IGMP Snooping
Enabling IGMP Immediate-Leave Processing
Statically Configuring an Interface to Join a Group
Configuring a Multicast Router Port
Configuring Per-Port Storm-Control
Enabling Per-Port Storm-Control
Disabling Per-Port Storm-Control
Understanding the Default Fallback Bridging Configuration
Preventing the Forwarding of Dynamically Learned Stations
Configuring the Bridge Table Aging Time
Filtering Frames by a Specific MAC Address
Adjusting Spanning-Tree Parameters
Monitoring and Maintaining the Network
Configuring Separate Voice and Data Subnets
Configuring a Single Subnet for Voice and Data
Managing the EtherSwitch EHWIC
Managing the MAC Address Tables
Configuration Examples for Gigabit EtherSwitch EHWICs
Single Range Configuration: Example
Range Macro Definition: Example
Optional Interface Feature: Examples
Setting the Interface Duplex Mode: Example
Adding a Description for an Interface: Example
VLAN Trunking Using VTP: Example
Spanning-Tree Interface and Spanning-Tree Port Priority: Example
Spanning-Tree Port Cost: Example
Bridge Priority of a VLAN: Example
Forward-Delay Time for a VLAN: Example
Maximum Aging Time for a VLAN: Example
MAC Table Manipulation: Example
Switched Port Analyzer (SPAN) Source: Examples
SPAN Source Configuration: Example
SPAN Destination Configuration: Example
Removing Sources or Destinations from a SPAN Session: Example
Subnets for Voice and Data: Example
Single Subnet Configuration: Example
Ethernet Ports on IP Phones with Multiple Ports: Example
Configuring the Cisco Gigabit EtherSwitch EHWIC
First Published: July 30, 2010
This document provides configuration tasks for the Cisco Gigabit EtherSwitch enhanced high-speed WAN interface cards (EHWICs) supported on Cisco Integrated Services Routers Generation 2 (ISR G2).
Feature History for Cisco Gigabit EtherSwitch Enhanced High-Speed Interface Cards
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn . You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Prerequisites for Gigabit EtherSwitch EHWICs
The following are prerequisites to configuring Cisco Gigabit EtherSwitch EHWICs:
http://www.cisco.com/en/US/products/ps10592/products_installation_and_configuration_guides_
list.html. )Restrictions for Gigabit EtherSwitch EHWICs
The following restrictions apply to the Cisco Gigabit EtherSwitch EHWICs:
- The Cisco Gigabit EtherSwitch EHWIC cannot function with the following modules in the chassis at the same time:
- On the Cisco 1905, 1906, and 1921 ISR platforms, only a single gigabit EtherSwitch EHWIC is supported.
- Online insertion and removal (OIR) is not supported.
- When Ethernet switches have been installed and configured in a host router, do not perform OIR of the CompactFlash memory card in the router. OIR of the CompactFlash memory card compromises the configuration of the Ethernet switches.
- VLAN trunking protocol (VTP) pruning is not supported.
- No more than 200 secure MAC addresses per platform are supported by an EtherSwitch EHWIC.
Information About Gigabit EtherSwitch EHWICs
Cisco Gigabit EHWICs are 10/100/1000 BaseT Layer 2 gigabit Ethernet switches with Layer 3 routing capability. Layer 3 routing is done on the host router.
Note To link a port on a Cisco Gigabit EtherSwitch EHWIC to an enhanced EtherSwitch service module or EtherSwitch service module in the same VTP domain, the port and the Cisco Gigabit EtherSwitch EHWIC should be stacked.
The gigabit EHWICs are also available with a power over Ethernet (PoE) module to provide inline power for IP telephones.
To configure the Cisco Gigabit EHWICs, you should understand the following concepts:
How to Configure Gigabit EtherSwitch EHWICs
The following sections provide the configuration tasks for the EtherSwitch EHWICs:
- Configuring VLANs
- Configuring VLAN Trunking Protocol
- Configuring Layer 2 Interfaces
- Configuring 802.1x Authentication
- Configuring Spanning Tree
- Configuring MAC Table Manipulation
- Configuring Cisco Discovery Protocol
- Configuring the Switched Port Analyzer
- Configuring Power Management on the Interface
- Configuring IP Multicast Layer 3 Switching
- Configuring IGMP Snooping
- Configuring Per-Port Storm-Control
- Configuring Fallback Bridging
- Configuring Separate Voice and Data Subnets
- Managing the EtherSwitch EHWIC
- Configuring Port Security
Configuring VLANs
This section describes how to configure VLANs on the switch, and contains the following sections:
Table 1 shows the number of VLANs supported by a Cisco Gigabit EtherSwitch EHWIC.
Adding VLAN Instances
Beginning in global configuration mode, follow these steps to configure a Gigabit Ethernet (GE) interface as Layer 2 access.
Verifying the VLAN Configuration
You can verify the VLAN configuration in VLAN database mode or in privileged EXEC mode.
Verifying VLAN Configuration in VLAN Database Mode
Enter the show command in VLAN database mode to verify the VLAN configuration.
Verifying VLAN Configuration in EXEC Mode
Enter the show vlan-switch command in privileged EXEC mode to verify the VLAN configuration.
Deleting a VLAN Instance from the Database
You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.
Beginning in global configuration mode, follow these steps to delete a VLAN from the database:
Verifying VLAN Deletion
You can verify that a VLAN has been deleted from the switch in VLAN database mode.
Use the show command in VLAN database mode to verify that a VLAN has been deleted from the switch, as shown in the following output example:
Enter the show vlan-switch brief command in EXEC mode to verify that a VLAN has been deleted from the switch, as shown in the following output example:
Configuring VLAN Trunking Protocol
This section describes how to configure the VLAN Trunking Protocol (VTP) on an EtherSwitch EHWIC, and contains the following sections:
- Configuring a VTP Server
- Configuring a VTP Client
- Disabling VTP (VTP Transparent Mode)
- Verifying VTP
Note VTP pruning is not supported by EtherSwitch EHWICs.
Configuring a VTP Server
When a switch is in VTP server mode, you can change the VLAN configuration and have it propagate throughout the network.
Beginning in global configuration mode, follow these steps to configure the switch as a VTP server.
DETAILED STEPS
Configuring a VTP Client
When a switch is in VTP client mode, you cannot change the VLAN configuration on the switch. The client switch receives VTP updates from a VTP server in the management domain and modifies its configuration accordingly.
DETAILED STEPS
Disabling VTP (VTP Transparent Mode)
When you configure the switch as VTP transparent, you disable VTP on the switch. A VTP transparent switch does not send VTP updates and does not act on VTP updates received from other switches.
Beginning in global configuration mode, follow these steps to disable VTP on the switch.
Configuring Layer 2 Interfaces
This section provides the following configuration information:
- Configuring a Range of Interfaces (required)
- Defining a Range Macro (optional)
- Configuring Layer 2 Optional Interface Features (optional)
Configuring a Range of Interfaces
Use the interface range command in global configuration mode to configure a range of interfaces.
SUMMARY STEPS
2. interface range { gigabitethernet interfacenumber - interfacenumber | vlan number | macro word }
DETAILED STEPS
Defining a Range Macro
Use the define interface - range command in global configuration mode to define an interface range macro:
SUMMARY STEPS
2. define interface-range macro-name {gigabitethernet slot/first-interface - last-interface ] | vlan vlan-ID - vlan-ID }
DETAILED STEPS
Verifying Configuration of an Interface Range Macro
Use the show running - configuration command to show the defined interface-range macro configuration, as shown below:
Configuring Layer 2 Optional Interface Features
- Interface Speed and Duplex Configuration Guidelines
- Configuring the Interface Speed
- Configuring the Interface Duplex Mode
- Verifying Interface Speed and Duplex Mode Configuration
- Configuring a Description for an Interface
- Configuring a Gigabit Ethernet Interface as a Layer 2 Trunk
- Configuring a GE Interface as Layer 2 Access
Interface Speed and Duplex Configuration Guidelines
When configuring an interface speed and duplex mode, follow these guidelines:
- If both ends of the line support autonegotiation, we recommend the default auto negotiation settings.
- If one interface supports auto negotiation and the other end does not, configure duplex and speed on both interfaces; do not use the auto setting on the supported side.
- Both ends of the line need to be configured to the same setting, for example, both hard-set or both auto-negotiate. Mismatched settings are not supported.
Configuring the Interface Speed
Beginning in global configuration mode, follow these steps to set the interface speed.
DETAILED STEPS
Selects the interface to be configured.
The EHWIC slot number can be 0 to 3, and the EHWIC port number can be 0 to 7.
Note If you set the interface speed to auto on a 10/100/1000-Mbps Gigabitethernet interface, both speed and duplex are auto negotiated.
Configuring the Interface Duplex Mode
Beginning in interface configuration mode, follow these steps to set the duplex mode of a Gigabit Ethernet interface.
DETAILED STEPS
Note If you set the port speed to auto on a 10/100/1000-Mbps Gigabit Ethernet interface, both speed and duplex are auto negotiated, and the duplex mode cannot be modified.
The following example shows how to set the interface duplex mode to auto on gigabit Ethernet interface 3:
Verifying Interface Speed and Duplex Mode Configuration
Use the show interfaces command to verify the interface speed and duplex mode configuration for an interface, as shown in the following output example:
Configuring a Description for an Interface
You can add a description of an interface to help you remember its function. The description appears in the output of the following commands: show configuration , show running-config , and show interfaces .
Use the description command, in interface configuration mode, to add a description for an interface. Beginning in global configuration mode, follow these steps to add a description to the interface:
Configuring a Gigabit Ethernet Interface as a Layer 2 Trunk
Beginning in global configuration mode, follow these steps to configure a GigabitEthernet interface as a Layer 2 trunk.
SUMMARY STEPS
1. interface gigabitethernet 0/slot/port
4. switchport trunk native vlan vlan-num
5. switchport trunk allowed vlan { add | except | none | remove } vlan1[,vlan[,vlan[,...]]
DETAILED STEPS
Note Ports do not support Dynamic Trunk Protocol (DTP). Ensure that the neighboring switch is set to a mode that does not send DTP.
Verifying a GigabitEthernet Interface as a Layer 2 Trunk
Use the following show commands to verify the configuration of a GigabitEthernet interface as a Layer 2 trunk:
Configuring a GE Interface as Layer 2 Access
Beginning in global configuration mode, follow these steps to configure a GE interface as Layer 2 access.
DETAILED STEPS
(Optional) Shuts down the interface to prevent traffic flow until configuration is complete.
Activates the interface. (Required only if you shut down the interface.)
Verifying a GigabitEthernet Interface as Layer 2 Access
Use the show running - config interface command to verify the running configuration of the interface, as shown below:
Use the show interfaces command to verify the switchport configuration of the interface, as shown below:
Configuring 802.1x Authentication
This section describes how to configure 802.1x port-based authentication on an EtherSwitch EHWIC:
- Understanding the Default 802.1x Configuration
- Enabling 802.1x Authentication
- Configuring the Switch-to-RADIUS-Server Communication
- Enabling Periodic Reauthentication
- Changing the Quiet Period
- Changing the Switch-to-Client Retransmission Time
- Setting the Switch-to-Client Frame-Retransmission Number
- Enabling Multiple Hosts
- Resetting the 802.1x Configuration to the Default Values
- Displaying 802.1x Statistics and Status
Understanding the Default 802.1x Configuration
Table 2 shows the default 802.1x configuration.
802.1x Configuration Guidelines
Follow these guidelines to configure 802.1x authentication:
- When the 802.1x protocol is enabled, ports are authenticated before any other Layer 2 feature is enabled.
- The 802.1x protocol is supported on Layer 2 static-access ports, but it is not supported on these port types:
– Trunk port—If you try to enable 802.1x on a trunk port, an error message appears, and 802.1x is not enabled. If you try to change the mode of an 802.1x-enabled port to trunk, the port mode is not changed.
– Switch Port Analyzer (SPAN) destination port—You can enable 802.1x on a port that is a SPAN destination port; however, 802.1x is disabled until the port is removed as a SPAN destination.
Enabling 802.1x Authentication
To enable 802.1x port-based authentication, you must enable AAA and specify the authentication method list. A method list describes the sequence and authentication methods to be queried to authenticate a user.
The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other authentication methods are attempted.
Beginning in privileged EXEC mode, follow these steps to configure 802.1x port-based authentication. This procedure is required.
SUMMARY STEPS
3. aaa authentication dot1x {default | listname } method1 [ method2 ...]
DETAILED STEPS
aaa authentication dot1x {default | listname } method1 [ method2 ...]
Creates an 802.1x authentication method list.
To create a default list that is used when a named list is not specified in the authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces.
Enters interface configuration mode, and specifies the interface to be enabled for 802.1x authentication.
Enables 802.1x on the interface.
For feature interaction information with trunk, dynamic, dynamic-access, EtherChannel, secure, and SPAN ports, see the “802.1x Configuration Guidelines” section.
Check the Status column in the 802.1x Port Summary section of the display. An enabled status means the port-control value is set either to auto or to force-unauthorized .
To disable AAA, use the no aaa new-model command in global configuration mode. To disable 802.1x AAA authentication, use the no aaa authentication dot1x { default | list-name } method1 [ method2 ...] command in global configuration mode. To disable 802.1x, use either the dot1x port-control force-authorized command or the no dot1x port-control command in interface configuration mode.
Configuring the Switch-to-RADIUS-Server Communication
RADIUS security servers are identified by their host name or IP address, host name and specific UDP port numbers, or IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service—for example, authentication—the second host entry configured acts as the failover backup to the first one. The RADIUS host entries are tried in the order that they were configured.
Beginning in privileged EXEC mode, follow these steps to configure the RADIUS server parameters on the switch. This procedure is required.
DETAILED STEPS
To delete the specified RADIUS server, use the no radius-server host { hostname | ip-address } command in global configuration mode.
To configure the timeout, retransmission, and encryption key values for all RADIUS servers, use the radius-server host command in global configuration mode. To configure these options on a per-server basis, use the radius-server timeout , radius-server retransmit , and radius-server key commands in global configuration mode.
You also need to configure some settings on the RADIUS server. These settings include the IP address of the switch and the key string to be shared by both the server and the switch. For more information, refer to the RADIUS server documentation.
Enabling Periodic Reauthentication
You can enable periodic 802.1x client reauthentication and specify how often it occurs. If you do not specify a time period before enabling reauthentication, the time between reauthentication attempts is 3600 seconds.
Automatic 802.1x client reauthentication is a global setting and cannot be set for clients connected to individual ports.
Beginning in privileged EXEC mode, follow these steps to enable periodic reauthentication of the client and to configure the number of seconds between reauthentication attempts.
DETAILED STEPS
To disable periodic reauthentication, use the no dot1x re-authentication command in global configuration mode . To return to the default number of seconds between reauthentication attempts, use the no dot1x timeout re-authperiod global configuration command.
Changing the Quiet Period
When the switch cannot authenticate the client, the switch remains idle for a set period of time, and then tries again. The idle time is determined by the quiet-period value. A failed authentication of the client might occur because the client provided an invalid password. You can provide a faster response time to the user by entering smaller number than the default.
Beginning in privileged EXEC mode, follow these steps to change the quiet period:
DETAILED STEPS
Sets the number of seconds that the switch remains in the quiet state following a failed authentication exchange with the client.
To return to the default quiet time, use the no dot1x timeout quiet-period command in global configuration mode .
Changing the Switch-to-Client Retransmission Time
The client responds to the EAP-request/identity frame from the switch with an EAP-response/identity frame. If the switch does not receive this response, it waits a set period of time (known as the retransmission time), and then retransmits the frame.
Note You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers.
Beginning in privileged EXEC mode, follow these steps to change the amount of time that the switch waits for client notification:
DETAILED STEPS
Sets the number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before retransmitting the request.
To return to the default retransmission time, use the no dot1x timeout tx-period command in global configuration mode .
Setting the Switch-to-Client Frame-Retransmission Number
In addition to changing the switch-to-client retransmission time, you can change the number of times that the switch sends an EAP-request/identity frame (assuming no response is received) to the client before restarting the authentication process.
Note You should change the default value of this command only to adjust for unusual circumstances, such as unreliable links or specific behavioral problems with certain clients and authentication servers.
Beginning in privileged EXEC mode, follow these steps to set the switch-to-client frame-retransmission number.
DETAILED STEPS
Sets the number of times that the switch sends an EAP-request/identity frame to the client before restarting the authentication process. The range is 1 to 10; the default is 2.
To return to the default retransmission number, use the no dot1x max-req command in global configuration mode.
Enabling Multiple Hosts
You can attach multiple hosts to a single 802.1x-enabled port. In this mode, only one of the attached hosts must be successfully authorized for all hosts to be granted network access. If the port becomes unauthorized (reauthentication fails, and an EAPOL-logoff message is received), all attached clients are denied access to the network.
Beginning in privileged EXEC mode, follow these steps to allow multiple hosts (clients) on an 802.1x-authorized port that has the dot1x port-control interface configuration command set to auto .
To disable multiple hosts on the port, use the no dot1x multiple-hosts command in interface configuration mode.
DETAILED STEPS
Resetting the 802.1x Configuration to the Default Values
You can reset the 802.1x configuration to the default values with a single command.
Beginning in privileged EXEC mode, follow these steps to reset the 802.1x configuration to the default values.
Displaying 802.1x Statistics and Status
To display 802.1x statistics for all interfaces, use the show dot1x statistics command in privileged EXEC mode. To display 802.1x statistics for a specific interface, use the show dot1x statistics interface type 0/slot/port in privileged EXEC mode.
To display the 802.1x administrative and operational status for the switch, use the show dot1x in privileged EXEC mode. To display the 802.1x administrative and operational status for a specific interface, use the show dot1x interface type 0/slot/port command in privileged EXEC mode.
Enabling Spanning Tree
You can enable spanning tree on a per-VLAN basis. The switch maintains a separate instance of spanning tree for each VLAN (except on VLANs on which you disable spanning tree).
Note Spanning tree is enabled by default on all VLANs when they are created and the ports become members of that VLAN.
To enable spanning tree on a per-VLAN basis, use the spanning-tree vlan vlan_ID command in global configuration mode.
Configuring Spanning Tree Port Priority
Beginning in global configuration mode, follow these steps to configure the spanning tree port priority of an interface.
SUMMARY STEPS
1. interface gigabitethernet 0/slot/port
2. spanning-tree port-priority port_priority
DETAILED STEPS
Verifying Spanning Tree Port Priority
Use the show spanning - tree interface command to verify spanning-tree interface and the spanning-tree port priority configuration.
Configuring Spanning Tree Port Cost
Beginning in global configuration mode, follow these steps to configure the spanning tree port cost of an interface.
SUMMARY STEPS
1. interface gigabitethernet 0/slot/port
2. spanning-tree cost port_cost
DETAILED STEPS
Calculating Port Cost
Port cost value calculations are based on the bandwidth of the port. There are two classes of values. Short (16-bit) values are specified by the IEEE 802.1D specification, and range in value from 1 to 65535. Long (32-bit) values are specified by the IEEE 802.1t specification, and range in value from1 to 200,000,000.
Assigning Short Port Cost Values
You can manually assign short port costs in the range of 1 to 65535. Table 3 lists the default short port cost values.
Assigning Long Port Cost Values
You can manually assign long port costs in the range of 1 to 200,000,000. Table 4 lists the recommended cost values.
Verifying Spanning Tree Port Cost
Use the show spanning - tree vlan command to verify the spanning-tree port cost configuration.
Configuring the Bridge Priority of a VLAN
To configure the spanning tree bridge priority of a VLAN, use the spanning-tree vlan vlan_ID priority bridge_priority command in global configuration mode. The bridge_priority value can be from 1 to 65535.
Use the no form of this command to restore the defaults.
Router(config)# spanning-tree vlan 1 priority 25
Verifying the Bridge Priority of a VLAN
Use the show spanning - tree vlan bridge command to verify the bridge priority, as illustrated below:
Configuring the Hello Time
To configure the hello interval for the spanning tree, use the spanning-tree vlan vlan_ID hello-time hello_time command in global configuration mode. The hello _ time value can be from 1 to 10 seconds. Use the no form of this command to restore the defaults.
Configuring the Forward-Delay Time for a VLAN
To configure the forward delay for the spanning tree, use the spanning-tree vlan vlan_ID forward-time forward_time command in global configuration mode. The value of forward _ time can be from 4 to 30 seconds. Use the no form of this command to restore the defaults.
Configuring the Maximum Aging Time for a VLAN
To configure the maximum age interval for the spanning tree, use the spanning-tree vlan vlan_ID max-age max_age command in global configuration mode. The value of max _ age can be from 6 to 40 seconds. Use the no form of this command to restore the defaults.
Configuring the Root Bridge
The EtherSwitch EHWIC maintains a separate instance of spanning tree for each active VLAN configured on the switch. A bridge ID, consisting of the bridge priority and the bridge MAC address, is associated with each instance. For each VLAN, the switch with the lowest bridge ID becomes the root bridge for that VLAN.
To configure a VLAN instance to become the root bridge, the bridge priority can be modified from the default value (32768) to a significantly lower value so that the bridge becomes the root bridge for the specified VLAN. Use the spanning-tree vlan vlan-ID root command to alter the bridge priority.
The switch checks the bridge priority of the current root bridges for each VLAN. The bridge priority for the specified VLANs is set to 8192 if this value will cause the switch to become the root for the specified VLANs.
If any root switch for the specified VLANs has a bridge priority lower than 8192, the switch sets the bridge priority for the specified VLANs to 1 less than the lowest bridge priority.
For example, if all switches in the network have the bridge priority for VLAN 100 set to the default value of 32768, entering the spanning-tree vlan 100 root primary command on a switch will set the bridge priority for VLAN 100 to 8192, causing the switch to become the root bridge for VLAN 100.
Note The root switch for each instance of a spanning tree should be a backbone or distribution switch. Do not configure an access switch as the spanning tree primary root.
Use the diameter keyword to specify the Layer 2 network diameter (that is, the maximum number of bridge hops between any two end stations in the Layer 2 network). When you specify the network diameter, the switch automatically picks an optimal hello time, forward delay time, and maximum age time for a network of that diameter, which can significantly reduce the spanning tree convergence time. Use the hello keyword to override the automatically calculated hello time.
Note We recommend that you avoid configuring the hello time, forward delay time, and maximum age time manually after configuring the switch as the root bridge.
To configure the switch as the root, use the spanning-tree vlan vlan_ID root primary [diameter net-diameter [ hello-time seconds ]] command in global configuration mode. Use the no form of this command to restore the defaults.
Disabling Spanning Tree
To disable spanning tree on a per-VLAN basis, use the no spanning-tree vlan vlan_ID command in global configuration mode.
Verifying that Spanning Tree is Disabled
Use the show spanning-tree vlan command to verify that the spanning tree is disabled, as shown in the example below:
Configuring MAC Table Manipulation
Enabling Known MAC Address Traffic
Beginning in privileged EXEC mode, follow these steps to enable the MAC address secure option.
DETAILED STEPS
Verifying the MAC Address Table Secure Option
Use the show mac - address - table secure command to verify the configuration, as illustrated below:
Creating a Static Entry in the MAC Address Table
Beginning in privileged EXEC mode, follow these steps to create a static entry in the MAC address table.
DETAILED STEPS
Enters global configuration mode.
mac-address-table static mac-address gi 0/slot/port [ vlan vlan id ]
Use the show mac-address-table command in privileged EXEC mode to verify the configuration.
Configuring the Aging Timer
Beginning in privileged EXEC mode, follow these steps to configure the aging timer.
Verifying the Aging Time
Use the show mac - address - table aging - time command to verify the MAC address table aging timer, as shown below:
Configuring Cisco Discovery Protocol
Cisco Discovery Protocol (CDP) is primarily used to obtain protocol addresses of neighboring devices and discover the platform of those devices. CDP can also be used to display information about the interfaces your router uses. CDP is media- and protocol-independent, and runs on all Cisco-manufactured equipment including routers, bridges, access servers, and switches.
For information on how to configure CDP, see Using Cisco Discovery Protocol at
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_cdp_discover.html
Configuring the Switched Port Analyzer
This section describes how to configure a Switched Port Analyzer (SPAN) session for an EtherSwitch EHWIC.
Note An EtherSwitch EHWIC supports only one SPAN session.
Note Tx, Rx, or both Tx and Rx monitoring is supported.
Configuring the SPAN Sources
To configure the source for a SPAN session, use the monitor session session source { interface type 0/slot/port | vlan vlan_ID [ , | - | rx | tx | both ]} command in global configuration mode. This command specifies the SPAN session, the source interfaces or VLANs, and the traffic direction to be monitored.
Configuring SPAN Destinations
To configure the destination for a SPAN session, use the monitor session session destination { interface type 0/slot/port | vlan vlan_ID [ , | - | rx | tx | both ]} command in global configuration mode.
Verifying the SPAN Session
Use the show monitor session command to verify the sources and destinations configured for the SPAN session.
Removing Sources or Destinations from a SPAN Session
To remove sources or destinations from the SPAN session, use the no monitor session session command in global configuration mode as shown in the following example:
Configuring Power Management on the Interface
This section describes how to configure power management on the interface and contains the following topics:
Configuring Power to Cisco IP Phones
Beginning in privileged EXEC mode, follow these steps to manage power to Cisco IP phones.
DETAILED STEPS
Configuring Maximum Inline Power Supply to a Port
The default power limit per port is 20 watts. Use the power inline port max max-wattage command to configure the maximum inline power supply to a port the EHWIC.
Beginning in privileged EXEC mode, follow these steps to configure the maximum inline power for a port on the EHWIC:
DETAILED STEPS
Verifying Power Management on the Interface
Use the show power inline command to verify the power configuration on the ports.
Use the show power inline actual command to show the actual power used by the device at that time.
Configuring IP Multicast Layer 3 Switching
These sections describe how to configure IP multicast Layer 3 switching:
Enabling IP Multicast Routing Globally
You must enable IP multicast routing globally before you can enable IP multicast Layer 3 switching on Layer 3 interfaces.
For complete information and procedures, see these publications:
http://www.cisco.com/en/US/docs/ios/ipmulti/configuration/guide/15_1/imc_15_1_book.html
http://www.cisco.com/en/US/docs/ios/ipaddr/command/reference/iad_book.html
http://www.cisco.com/en/US/docs/ios/ipmulti/command/reference/imc_book.html
To enable IP multicast routing globally, use the ip multicast-routing command in global configuration mode.
Enabling IP Protocol-Independent Multicast (PIM) on Layer 3 Interfaces
You must enable PIM on the Layer 3 interfaces before enabling IP multicast Layer 3 switching functions on those interfaces.
Beginning in global configuration mode, follow these steps to enable IP PIM on a Layer 3 interface.
DETAILED STEPS
The following example shows how to enable PIM on an interface using the default mode ( sparse-dense-mode ):
The following example shows how to enable PIM sparse mode on an interface:
Verifying IP Multicast Layer 3 Switching Summary
Note The show interface statistics command does not verify hardware-switched packets. It only verifies packets switched by software.
The show ip pim interface count command verifies the IP multicast Layer 3 switching enable state on IP PIM interfaces and the number of packets received and sent on the interface.
Use the following show commands to verify IP multicast Layer 3 switching information for an IP PIM Layer 3 interface.
Step 1
Router#show ip pim interface countStep 2
Router#show ip mroute count
Note A negative counter means that the outgoing interface list of the corresponding entry is NULL, and this indicates that this flow is still active.
Verifying the IP Multicast Routing Table
Use the show ip mroute command to verify the IP multicast routing table:
Note The RPF-MFD flag indicates that the flow is completely hardware switched. The H flag indicates that the flow is hardware switched on the outgoing interface.
Configuring IGMP Snooping
This section describes how to configure IGMP snooping on your router and consists of the following configuration information and procedures:
Enabling or Disabling IGMP Snooping
By default, IGMP snooping is globally enabled on the EtherSwitch EHWIC. When globally enabled or disabled, it is also enabled or disabled in all existing VLAN interfaces. By default, IGMP snooping is enabled on all VLANs, but it can be enabled and disabled on a per-VLAN basis.
Global IGMP snooping overrides the per-VLAN IGMP snooping capability. If global snooping is disabled, you cannot enable VLAN snooping. If global snooping is enabled, you can enable or disable snooping on a VLAN basis.
Beginning in privileged EXEC mode, follow these steps to globally enable IGMP snooping on the EtherSwitch EHWIC.
DETAILED STEPS
To globally disable IGMP snooping on all VLAN interfaces, use the no ip igmp snooping global command.
Beginning in privileged EXEC mode, follow these steps to enable IGMP snooping on a VLAN interface.
DETAILED STEPS
To disable IGMP snooping on a VLAN interface, use the no ip igmp snooping vlan vlan-id command in global configuration mode for the specified VLAN number (for example, vlan1).
Enabling IGMP Immediate-Leave Processing
When you enable IGMP Immediate-Leave processing, the EtherSwitch EHWIC immediately removes a port from the IP multicast group when it detects an IGMP version 2 leave message on that port. Immediate-Leave processing allows the switch to remove an interface that sends a leave message from the forwarding table without first sending out group-specific queries to the interface. You should use the Immediate-Leave feature only when there is only a single receiver present on every port in the VLAN.
Beginning in privileged EXEC mode, follow these steps to enable IGMP Immediate-Leave processing.
DETAILED STEPS
To disable Immediate-Leave processing, follow Steps 1 and 2 to enter interface configuration mode, and use the no ip igmp snooping vlan vlan-id immediate-leave command in global configuration mode.
Statically Configuring an Interface to Join a Group
Ports normally join multicast groups through the IGMP report message, but you can also statically configure a host on an interface.
Beginning in privileged EXEC mode, follow these steps to add a port as a member of a multicast group.
DETAILED STEPS
ip igmp snooping vlan vlan-id static mac-address interface interface-id
Statically configures a port as a member of a multicast group:
Use the show mac-address-table multicast [ vlan vlan-id ] [ user | igmp-snooping ] [ count ] command in privileged EXEC mode to view the MAC address table entries for a VLAN.
Configuring a Multicast Router Port
Beginning in privileged EXEC mode, follow these steps to enable a static connection to a multicast router.
SUMMARY STEPS
2. ip igmp snooping vlan vlan-id mrouter { interface interface-id | learn pim-dvmrp }
DETAILED STEPS
Configuring Per-Port Storm-Control
You can use these techniques to block the forwarding of unnecessary flooded traffic. This section describes how to configure per-port storm-control and characteristics on your router and consists of the following configuration procedures:
By default, unicast, broadcast, and multicast suppression is disabled.
Enabling Per-Port Storm-Control
Beginning in privileged EXEC mode, follow these steps to enable per-port storm-control.
SUMMARY STEPS
3. storm-control { broadcast | multicast | unicast } level level-high [ level-low ]
4. storm-control action shutdown
6. show storm-control [ interface-type interface-number ] [ broadcast | multicast | unicast | history ]
DETAILED STEPS
Note If any type of traffic exceeds the upper threshold limit, all of the other types of traffic are stopped.
Disabling Per-Port Storm-Control
Beginning in privileged EXEC mode, follow these steps to disable per-port storm-control.
DETAILED STEPS
Use the show storm-control [ interface-type interface-number ] [ broadcast | multicast | unicast | history ] command in privileged EXEC mode to verify your entries.
Configuring Fallback Bridging
This section describes how to configure fallback bridging on your switch. It contains the following configuration information:
Understanding the Default Fallback Bridging Configuration
Table 5 shows the default fallback bridging configuration.
Creating a Bridge Group
To configure fallback bridging for a set of SVIs, these interfaces must be assigned to bridge groups. All interfaces in the same group belong to the same bridge domain. Each SVI can be assigned to only one bridge group.
Beginning in privileged EXEC mode, follow these steps to create a bridge group and assign an interface to it.
DETAILED STEPS
To remove a bridge group, use the no bridge bridge-group protocol vlan-bridge global configuration command. To remove an interface from a bridge group, use the no bridge-group bridge-group command in interface configuration mode.
Preventing the Forwarding of Dynamically Learned Stations
By default, the switch forwards any frames for stations that it has dynamically learned. By disabling this activity, the switch only forwards frames whose addresses have been statically configured into the forwarding cache.
Beginning in privileged EXEC mode, follow these steps to prevent the switch from forwarding frames for stations that it has dynamically learned.
DETAILED STEPS
To cause the switch to forward frames to stations that it has dynamically learned, use the bridge bridge-group acquire command in global configuration mode.
Configuring the Bridge Table Aging Time
A switch forwards, floods, or drops packets based on the bridge table. The bridge table maintains both static and dynamic entries. Static entries are entered by you. Dynamic entries are entered by the bridge learning process. A dynamic entry is automatically removed after a specified length of time, known as aging time, from the time the entry was created or last updated.
If you are likely to move hosts on a switched network, decrease the aging-time to enable the switch to quickly adapt to the change. If hosts on a switched network do not continuously send packets, increase the aging time to keep the dynamic entries for a longer time and thus reduce the possibility of flooding when the hosts send again.
Beginning in privileged EXEC mode, follow these steps to configure the aging time.
DETAILED STEPS
Specifies the length of time that a dynamic entry remains in the bridge table from the time the entry was created or last updated.
To return to the default aging-time interval, use the no bridge bridge-group aging-time command in global configuration mode.
Filtering Frames by a Specific MAC Address
A switch examines frames and sends them through the internetwork according to the destination address; a switch does not forward a frame back to its originating network segment. You can use the software to configure specific administrative filters that filter frames based on information other than the paths to their destinations.
You can filter frames with a particular MAC-layer station destination address. Any number of addresses can be configured in the system without a performance penalty.
Beginning in privileged EXEC mode, follow these steps to filter by the MAC-layer address.
DETAILED STEPS
To disable the frame forwarding ability, use the no bridge bridge-group address mac-address command in global configuration mode.
Adjusting Spanning-Tree Parameters
Parameters affecting the entire spanning tree are configured with variations of the bridge command in global configuration mode. Interface-specific parameters are configured with variations of the bridge-group command in interface configuration mode.
To adjust spanning-tree parameters, perform the tasks in these sections:
- Changing the Switch Priority
- Changing the Interface Priority
- Assigning a Path Cost
- Adjusting BPDU Intervals
- Disabling the Spanning Tree on an Interface
Note Only network administrators with a good understanding of how switches and STP function should make adjustments to spanning-tree parameters. Poorly planned adjustments can have a negative impact on performance. A good source on switching is the IEEE 802.1d specification.
Changing the Switch Priority
You can globally configure the priority of an individual switch when two switches tie for position as the root switch, or you can configure the likelihood that a switch will be selected as the root switch. This priority is determined by default; however, you can change it.
Beginning in privileged EXEC mode, follow these steps to change the switch priority.
DETAILED STEPS
No no form of this command exists. To return to the default setting, use the bridge bridge-group priority number command in global configuration mode, and set the priority to the default value. To change the priority on an interface, use the bridge-group priority command in interface configuration mode (described in the next section).
Changing the Interface Priority
You can change the priority for an interface. When two switches tie for position as the root switch, you configure an interface priority to break the tie. The switch with the lowest interface value is selected.
Beginning in privileged EXEC mode, follow these steps to change the interface priority.
DETAILED STEPS
To return to the default setting, use the bridge-group bridge-group priority number command in interface configuration mode.
Assigning a Path Cost
Each interface has a path cost associated with it. By convention, the path cost is 1000/data rate of the attached LAN, in Mbps.
Beginning in privileged EXEC mode, follow these steps to assign a path cost.
DETAILED STEPS
To return to the default path cost, use the no bridge-group bridge-group path-cost cost command in interface configuration mode.
Adjusting BPDU Intervals
You can adjust BPDU intervals as described in these sections:
- Adjusting the Interval between Hello BPDUs
- Changing the Forward-Delay Interval
- Changing the Maximum-Idle Interval
Note Each switch in a spanning tree adopts the interval between hello BPDUs, the forward delay interval, and the maximum idle interval parameters of the root switch, regardless of its individual configuration.
Adjusting the Interval between Hello BPDUs
Beginning in privileged EXEC mode, follow these step to adjust the interval between hello BPDUs.
DETAILED STEPS
To return to the default setting, use the no bridge bridge-group hello-time global configuration command.
Changing the Forward-Delay Interval
The forward-delay interval is the amount of time spent listening for topology change information after an interface has been activated for switching and before forwarding actually begins.
Beginning in privileged EXEC mode, follow these steps to change the forward-delay interval.
DETAILED STEPS
To return to the default setting, use the no bridge bridge-group forward-time seconds command in global configuration mode.
Changing the Maximum-Idle Interval
If a switch does not hear BPDUs from the root switch within a specified interval, it recomputes the spanning-tree topology.
Beginning in privileged EXEC mode, follow these steps to change the maximum-idle interval (maximum aging time).
DETAILED STEPS
To return to the default setting, use the no bridge bridge-group max-age command in global configuration mode.
Disabling the Spanning Tree on an Interface
When a loop-free path exists between any two switched subnetworks, you can prevent BPDUs generated in one switching subnetwork from impacting devices in the other switching subnetwork and still permit switching throughout the network as a whole. For example, when switched LAN subnetworks are separated by a WAN, BPDUs can be prevented from traveling across the WAN link.
Beginning in privileged EXEC mode, follow these steps to disable spanning tree on an interface.
DETAILED STEPS
Enters interface configuration mode, and specifies the interface ID.
Disables spanning tree on the interface.
For bridge-group , specify the bridge group number. The range is from 1 to 255.
To reenable spanning tree on the interface, use the no bridge-group bridge-group spanning-disabled command in interface configuration mode.
Monitoring and Maintaining the Network
To monitor and maintain the network, use one or more of the following commands in privileged EXEC mode.
Configuring Separate Voice and Data Subnets
For ease of network administration and increased scalability, network managers can configure the Cisco Gigabit EtherSwitch EHWIC to support Cisco IP phones such that the voice and data traffic reside on separate subnets. You should always use separate VLANs when you are able to segment the existing IP address space of your branch office.
User priority bits in the 802.1p portion of the 802.1Q standard header are used to provide prioritization in Ethernet switches. This is a vital component in designing Cisco AVVID networks.
The Cisco Gigabit EtherSwitch EHWIC provides the performance and intelligent services of Cisco IOS software for branch office applications. The Cisco Gigabit EtherSwitch EHWIC can identify user applications—such as voice or multicast video—and classify traffic with the appropriate priority levels.
Note See Cisco AVVID QoS Design Guide for more information on how to implement end-to-end QoS as you deploy Cisco AVVID solutions.
Beginning in EXEC mode, follow these steps to automatically configure Cisco IP phones to send voice traffic on the voice VLAN ID (VVID) on a per-port basis (see the “Voice Traffic and VVID” section).
DETAILED STEPS
Voice Traffic and VVID
The Cisco Gigabit EtherSwitch EHWIC can automatically configure voice VLAN. This capability overcomes the management complexity of overlaying a voice topology onto a data network while maintaining the quality of voice traffic. With the automatically configured voice VLAN feature, network administrators can segment phones into separate logical networks, even though the data and voice infrastructure is physically the same. The voice VLAN feature places the phones into their own VLANs without the need for end-user intervention. A user can plug the phone into the switch, and the switch provides the phone with the necessary VLAN information.
Configuring a Single Subnet for Voice and Data
For network designs with incremental IP telephony deployment, network managers can configure the Cisco Gigabit EtherSwitch EHWIC so that the voice and data traffic coexist on the same subnet. This might be necessary when it is impractical either to allocate an additional IP subnet for IP phones or to divide the existing IP address space into an additional subnet at the remote branch. It might be necessary to use a single IP address space for branch offices. (This is one of the simpler ways to deploy IP telephony.)
This configuration approach must address two key considerations:
- Network managers should ensure that existing subnets have enough available IP addresses for the new Cisco IP phones, each of which requires a unique IP address.
- Administering a network with a mix of IP phones and workstations on the same subnet might pose a challenge.
Beginning in privileged EXEC mode, follow these steps to automatically configure Cisco IP phones to send voice and data traffic on the same VLAN.
DETAILED STEPS
Verifying Switchport Configuration
Use the show run interface command to verify the switchport configuration.
Use the write memory command to save the current configuration in flash memory.
Managing the EtherSwitch EHWIC
This section describes how to perform basic management tasks on the Cisco Gigabit EtherSwitch EHWIC with the Cisco IOS CLI. You might find this information useful when you configure the switch for the previous scenarios.
Adding Trap Managers
A trap manager is a management station that receives and processes traps. When you configure a trap manager, community strings for each member switch must be unique. If a member switch has an IP address assigned to it, the management station accesses the switch by using its assigned IP address.
By default, no trap manager is defined, and no traps are issued.
Beginning in privileged EXEC mode, follow these steps to add a trap manager and community string.
DETAILED STEPS
Verifying Trap Managers
Use the show running - config command in privileged EXEC modeto verify that the information was entered.
Configuring IP Information
This section describes how to assign IP information on the Cisco Gigabit EtherSwitch EHWIC. The following topics are included:
Assigning IP Information to the Switch
You can use a BOOTP server to automatically assign IP information to the switch; however, the BOOTP server must be set up in advance with a database of physical MAC addresses and corresponding IP addresses, subnet masks, and default gateway addresses. In addition, the switch must be able to access the BOOTP server through one of its ports. At startup, a switch without an IP address requests the information from the BOOTP server; the requested information is saved in the switch running the configuration file. To ensure that the IP information is saved when the switch is restarted, save the configuration by entering the write memory command in privileged EXEC mode.
You can change the information in these fields. The mask identifies the bits that denote the network number in the IP address. When you use the mask to subnet a network, the mask is then referred to as a subnet mask. The broadcast address is reserved for sending messages to all hosts. The CPU sends traffic to an unknown IP address through the default gateway.
Beginning in privileged EXEC mode, follow these steps to enter the IP information.
DETAILED STEPS
Enters interface configuration mode, and enters the VLAN to which the IP information is assigned.
VLAN 1 is the management VLAN, but you can configure any VLAN from IDs 1 to 1001.
Use the following procedure to remove the IP information from a switch.
Note Using the no ip address command in configuration mode disables the IP protocol stack and removes the IP information. Cluster members without IP addresses rely on the IP protocol stack being enabled.
Beginning in global configuration mode, follow these steps to remove an IP address.
DETAILED STEPS
Enters interface configuration mode, and enters the VLAN to which the IP information is assigned.
VLAN 1 is the management VLAN, but you can configure any VLAN from IDs 1 to 1001.
Specifying a Domain Name and Configuring the DNS
Each unique IP address can have a host name associated with it. The Cisco IOS software maintains an EC mode, and related Telnet support operations. This cache speeds the process of converting names to addresses.
IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain. Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco Systems, Inc. is a commercial organization that IP identifies by a com domain name, so its domain name is cisco.com . A specific device in this domain, the FTP system, for example, is identified as ftp.cisco.com .
To track domain names, IP has defined the concept of a domain name server (DNS), the purpose of which is to hold a cache (or database) of names mapped to IP addresses. To map domain names to IP addresses, you must first identify the host names and then specify a name server and enable the DNS, the Internet global naming scheme that uniquely identifies network devices.
You can specify a default domain name that the software uses to complete domain name requests. You can specify either a single domain name or a list of domain names. When you specify a domain name, any IP host name without a domain name has that domain name appended to it before being added to the host table.
You can specify up to six hosts that can function as a name server to supply name information for the DNS.
If your network devices require connectivity with devices in networks for which you do not control name assignment, you can assign device names that uniquely identify your devices within the entire internetwork. The Internet global naming scheme, the DNS, accomplishes this task. This service is enabled by default.
Enabling Switch Port Analyzer
You can monitor traffic on a given port by forwarding incoming and outgoing traffic on the port to another port in the same VLAN. A Switch Port Analyzer (SPAN) port cannot monitor ports in a different VLAN, and a SPAN port must be a static-access port. Any number of ports can be defined as SPAN ports, and any combination of ports can be monitored. SPAN is supported for up to two sessions.
Beginning in privileged EXEC mode, follow these steps to enable SPAN.
SUMMARY STEPS
2. monitor session session-id { destination | source } { interface type 0/slot/port | vlan vlan-id } [ , | - | both | tx | rx ]
DETAILED STEPS
Use the no monitor session session-id command in global configuration mode to disable SPAN.
Managing the ARP Table
To communicate with a device (on Ethernet, for example), the software first must determine the 48-bit MAC or local data link address of that device. The process of determining the local data link address from an IP address is called address resolution .
The Address Resolution Protocol (ARP) associates a host IP address with the corresponding media or MAC addresses and VLAN ID. Taking an IP address as input, ARP determines the associated MAC address. After a MAC address is determined, the IP-MAC address association is stored in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP). By default, standard Ethernet-style ARP encapsulation (represented by the arpa keyword) is enabled on the IP interface.
When you manually add entries to the ARP Table by using the CLI, you must be aware that these entries do not age and must be manually removed.
Managing the MAC Address Tables
This section describes how to manage the MAC address tables on the Cisco Gigabit EtherSwitch EHWIC. The following topics are included:
- Understanding MAC Addresses and VLANs
- Changing the Address Aging Time
- Configuring the Aging Time
- Verifying Aging-Time Configuration
The switch uses the MAC address tables to forward traffic between ports. All MAC addresses in the address tables are associated with one or more ports. These MAC tables include the following types of addresses:
- Dynamic address—Source MAC address that the switch learns and then drops when it is not in use.
- Secure address—Manually entered unicast address that is usually associated with a secured port. Secure addresses do not age.
- Static address—Manually entered unicast or multicast address that does not age and that is not lost when the switch resets.
The address tables list the destination MAC address and the associated VLAN ID, module, and port number associated with the address. The following shows an example of a list of addresses as they would appear in the dynamic, secure, or static address table.
Understanding MAC Addresses and VLANs
All addresses are associated with a VLAN. An address can exist in more than one VLAN and have different destinations in each. Multicast addresses, for example, could be forwarded to port 1 in VLAN 1 and ports 9, 10, and 11 in VLAN 5.
Each VLAN maintains its own logical address table. A known address in one VLAN is unknown in another until it is learned or statically associated with a port in the other VLAN. An address can be secure in one VLAN and dynamic in another. Addresses that are statically entered in one VLAN must be static addresses in all other VLANs.
Changing the Address Aging Time
Dynamic addresses are source MAC addresses that the switch learns and then drops when they are not in use. Use the Aging Time field to define how long the switch retains unseen addresses in the table. This parameter applies to all VLANs.
Configuring the Aging Time
Setting too short an aging time can cause addresses to be prematurely removed from the table. When the switch receives a packet for an unknown destination, it floods the packet to all ports in the same VLAN as the receiving port. This unnecessary flooding can impact performance. Setting too long an aging time can cause the address table to be filled with unused addresses; it can cause delays in establishing connectivity when a workstation is moved to a new port.
The aging timer may be configured from 10 to 630 seconds, in 10-second intervals.
Beginning in global configuration mode, follow these steps to configure the dynamic address table aging time.
DETAILED STEPS
Verifying Aging-Time Configuration
Use the show mac-address-table aging-time command to verify the configuration:
Removing Dynamic Addresses
Beginning in privileged EXEC mode, follow these steps to remove a dynamic address entry.
DETAILED STEPS
Use the clear mac-address-table dynamic command in privileged EXEC mode to remove all dynamic entries.
Use the show mac - address - table dynamic command in privileged EXEC mode to verify configuration.
Adding Secure Addresses
The secure address table contains secure MAC addresses and their associated ports and VLANs. A secure address is a manually entered unicast address that is forwarded to only one port per VLAN. If you enter an address that is already assigned to another port, the switch reassigns the secure address to the new port.
You can enter a secure port address even when the port does not yet belong to a VLAN. When the port is later assigned to a VLAN, packets destined for that address are forwarded to the port.
Beginning in privileged EXEC mode, follow these steps to add a secure address.
DETAILED STEPS
mac-address-table secure hw-address interface gi 0/slot/port vlan vlan-id
Enters the MAC address, its associated port, and the VLAN ID.
Use the no mac-address-table secure hw-address interface gi 0/slot/port vlan vlan-id command in global configuration mode to remove a secure address.
To remove all secure addresses, use the clear mac-address-table secure command in privileged EXEC mode.
Use the show mac - address - table secure command in priviledged EXEC mode to verify configuration.
Configuring Static Addresses
A static address has the following characteristics:
- It is manually entered in the address table and must be manually removed.
- It can be a unicast or multicast address.
- It does not age and is retained when the switch restarts.
Because all ports are associated with at least one VLAN, the switch acquires the VLAN ID for the address from the ports that you select on the forwarding map. A static address in one VLAN must be a static address in other VLANs. A packet with a static address that arrives on a VLAN where it has not been statically entered is flooded to all ports and not learned.
Beginning in privileged EXEC mode, follow these steps to add a static address.
DETAILED STEPS
mac-address-table static mac-address vlan vlan-id interface type slot/port
Enters the static MAC address, the interface, and the VLAN ID of those ports.
To remove a static addresses, use the mac-address-table static mac-address vlan vlan-id interface type slot/port command in global configuration mode.
To remove all static addresses, use the clear mac-address-table static command in privileged EXEC mode.
Verifying Static Addresses
Use the show mac - address - table static command to verify configuration:
Clearing MAC Address Tables
To remove a MAC address table, use the clear mac-address-table [ dynamic | secure | static ] [ address mac-address ] [ interface type slot/port ] [ vlan vlan-id ] command in privileged EXEC mode as shown in the following example.
Router#clear mac-address-table static address0040.C80A.2F07interfacegigabitethernet 0/1/2Configuring Port Security
Port security can be either static or dynamic.
Static port security allows the user to specify which devices are allowed access through a given switch port. The specification is done manually by placing allowed device MAC addresses in the MAC address table. Static port security is also known as MAC address filtering.
Dynamic port security is similar. However, instead of specifying the MAC address of the devices, the user specifies the maximum number of devices that will be allowed on the port. If the maximum number specified is more than the number of MAC addresses specified manually, the switch will learn the MAC address automatically, up to the maximum specified. If the maximum number specified is less than the number of MAC addresses already specified statically, an error message will be produced.
Use the mac-address-table secure [ mac-address | maximum maximum addresses ] gigabitethernet 0/slot/port [ vlan vlan id ] command in global configuration mode to specify static or dynamic port security. mac-address enables static port security. maximum maximum addresses enables dynamic port security.
Configuration Examples for Gigabit EtherSwitch EHWICs
This section provides the following configuration examples:
- Range of Interface: Examples
- Optional Interface Feature: Examples
- VLAN Configuration: Example
- VLAN Trunking Using VTP: Example
- Spanning Tree: Examples
- MAC Table Manipulation: Example
- Switched Port Analyzer (SPAN) Source: Examples
- IGMP Snooping: Example
- Storm-Control: Example
- Ethernet Switching: Examples
Single Range Configuration: Example
The following example shows all Gigabit Ethernet interfaces on an HWIC-4ESW in slot 1 being reenabled:
Range Macro Definition: Example
The following example shows an interface-range macro named enet_list being defined to select interfaces 0/1/0 through 0/1/3:
The following example shows how to change to the interface-range configuration mode using the interface-range macro enet_list:
Interface Speed: Example
The following example shows the interface speed being set to 100 Mbps on GigabitEthernet interface 0/3/7:
Setting the Interface Duplex Mode: Example
The following example shows the interface duplex mode being set to full on GigabitEthernet interface 0/3/7:
Adding a Description for an Interface: Example
The following example shows how to add a description of GigabitEthernet interface 0/3/7:
VLAN Trunking Using VTP: Example
The following example shows how to configure the switch as a VTP server:
The following example shows how to configure the switch as a VTP client:
The following example shows how to configure the switch as VTP transparent:
Spanning-Tree Interface and Spanning-Tree Port Priority: Example
The following example shows the VLAN port priority of an interface being configured:
The following example shows how to verify the configuration of VLAN 1 on the interface when it is configured as a trunk port:
Spanning-Tree Port Cost: Example
The following example shows how to change the spanning-tree port cost of a Gigabit Ethernet interface:
The following example shows how to verify the configuration of the interface when it is configured as an access port:
Bridge Priority of a VLAN: Example
The following example shows the bridge priority of VLAN 20 being configured to 33792:
Hello Time: Example
The following example shows the hello time for VLAN 20 being configured to 7 seconds:
Spanning Tree: Examples
Spanning Tree Root: Example
The following example shows the switch being configured as the root bridge for VLAN 10, with a network diameter of 4:
MAC Table Manipulation: Example
SPAN Source Configuration: Example
The following example shows SPAN session 1 being configured to monitor bidirectional traffic from source interface Gigabit Ethernet 0/1/1:
SPAN Destination Configuration: Example
The following example shows interface Gigabit Ethernet 0/1/7 being configured as the destination for SPAN session 1:
Removing Sources or Destinations from a SPAN Session: Example
This following example shows interface Gigabit Ethernet 0/1/2 being removed as a SPAN source for SPAN session 1:
IGMP Snooping: Example
The following example shows the output from configuring IGMP snooping:
The following is an example of output from the sh run int privileged EXEC command for VLAN 1:
Storm-Control: Example
The following example shows bandwidth-based multicast suppression being enabled at 70 percent on Gigabit Ethernet interface 2:
Subnets for Voice and Data: Example
The following example shows separate subnets being configured for voice and data on the EtherSwitch EHWIC:
This configuration instructs the IP phone to generate a packet with an 802.1Q VLAN ID of 150 with an 802.1p value of 5 (default for voice bearer traffic).
Note In a centralized CallManager deployment model, the DHCP server might be located across the WAN link. If so, an ip helper-address command pointing to the DHCP server should be included on the voice VLAN interface for the IP phone. This is done to obtain its IP address as well as the address of the TFTP server required for its configuration.
Be aware that IOS supports a DHCP server function. If this function is used, the EtherSwitch EHWIC serves as a local DHCP server and a helper address would not be required.
Inter-VLAN Routing: Example
Configuring inter-vlan routing is identical to the configuration on an EtherSwitch EHWIC with an MSFC. Configuring an interface for WAN routing is consistent with other IOS platforms.
The following example provides a sample configuration:
Note Standard IGP routing protocols such as RIP, IGRP, EIGRP, and OSPF are supported on the EtherSwitch EHWIC. Multicast routing is also supported for PIM dense mode, sparse mode and sparse-dense mode.
Single Subnet Configuration: Example
The EtherSwitch EHWIC supports the use of an 802.1p-only option when configuring the voice VLAN. Using this option allows the IP phone to tag VoIP packets with a CoS of 5 on the native VLAN, while all PC data traffic is sent untagged.
The following example shows a single subnet configuration for the EtherSwitch EHWIC:
The EtherSwitch EHWIC instructs the IP phone to generate an 802.1Q frame with a null VLAN ID value but with an 802.1p value (default is COS of 5 for bearer traffic). The voice and data vlans are both 40 in this example.
Ethernet Ports on IP Phones with Multiple Ports: Example
The following example illustrates the configuration for the IP phone:
The following example illustrates the configuration for the PC:
Note Using a separate subnet, and possibly a separate IP address space, may not be an option for some small branch offices due to the IP routing configuration. If the IP routing can handle an additional subnet at the remote branch, use Cisco Network Registrar and secondary addressing.
Additional References
The following sections provide references related to EtherSwitch EHWICs.
MIBs
Technical Assistance
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2010 Cisco Systems, Inc. All rights reserved.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)