Catalyst 2950 Desktop Switch Software Configuration Guide, 12.0(5.2)WC(1)
Managing Switches
Downloads: This chapterpdf (PDF - 1.01MB) The complete bookPDF (PDF - 3.54MB) | Feedback

Managing Switches

Table Of Contents

Managing Switches

Finding More Information About IOS Commands

Managing Configuration Conflicts

Features, Default Settings, and Descriptions

Configuring Standalone Switches

Enabling the Switch as a Command Switch

Changing the Password

Creating EtherChannel Port Groups

Understanding EtherChannel Port Grouping

Port Group Restrictions on Static-Address Forwarding

CLI: Creating EtherChannel Port Groups

Enabling Switch Port Analyzer

CLI: Enabling Switch Port Analyzer

CLI: Disabling Switch Port Analyzer

Configuring Flooding Controls

Enabling Storm Control

CLI: Enabling Storm Control

CLI: Disabling Storm Control

Managing the System Date and Time

Setting the System Date and Time

Configuring Daylight Saving Time

Configuring the Network Time Protocol

Configuring the Switch as an NTP Client

Enabling NTP Authentication

Configuring the Switch for NTP Broadcast-Client Mode

Configuring IP Information

Manually Assigning IP Information to the Switch

CLI: Assigning IP Information to the Switch

CLI: Removing an IP Address

DHCP-Based Autoconfiguration

DHCP Client Request Process

Configuring the DHCP Server

Configuring the TFTP Server

Configuring the DNS

Configuring the Relay Device

Obtaining Configuration Files

Example Configuration

Specifying a Domain Name and Configuring the DNS

Specifying the Domain Name

Specifying a Name Server

Enabling the DNS

Configuring SNMP

Disabling and Enabling SNMP

Entering Community Strings

Adding Trap Managers

CLI: Adding a Trap Manager

Managing the ARP Table

Managing the MAC Address Tables

MAC Addresses and VLANs

Changing the Address Aging Time

CLI: Configuring the Aging Time

CLI: Removing Dynamic Address Entries

Adding Secure Addresses

CLI: Adding Secure Addresses

CLI: Removing Secure Addresses

Adding and Removing Static Addresses

Configuring Static Addresses for EtherChannel Port Groups

CLI: Adding Static Addresses

CLI: Removing Static Addresses

Enabling Port Security

Defining the Maximum Secure Address Count

CLI: Enabling Port Security

CLI: Disabling Port Security

Configuring the Cisco Discovery Protocol

CLI: Configuring CDP for Extended Discovery

IGMP Snooping

Enabling or Disabling IGMP Snooping

CLI: Enabling or Disabling IGMP Snooping

CLI: Enabling IGMP Immediate-Leave Processing

Setting the Snooping Method

Joining a Multicast Group

Statically Configuring a Host to Join a Group

CLI: Statically Configuring a Interface to Join a Group

Leaving a Multicast Group

Configuring a Multicast Router Port

CLI: Configuring a Multicast Router Port

Configuring the Spanning Tree Protocol

Supported STP Instances

Using STP to Support Redundant Connectivity

Accelerating Aging to Retain Connectivity

Disabling STP Protocol

CLI: Disabling STP

Configuring Redundant Links By Using STP UplinkFast

CLI: Enabling STP UplinkFast

Changing STP Parameters for a VLAN

CLI: Changing the STP Implementation

CLI: Changing the Switch Priority

CLI: Changing the BPDU Message Interval

CLI: Changing the Hello BPDU Interval

CLI: Changing the Forwarding Delay Time

Changing STP Port Parameters

Enabling the Port Fast Feature

CLI: Enabling STP Port Fast

CLI: Changing the Path Cost

CLI: Changing the Port Priority

CLI: Configuring STP Root Guard

CLI: Configuring UniDirectional Link Detection

Configuring Protected Ports

CLI: Configuring Protected Ports

Configuring TACACS+

Understanding TACACS+

CLI Procedures for Configuring TACACS+

CLI: Configuring the TACACS+ Server Host

CLI: Configuring Login Authentication

CLI: Specifying TACACS+ Authorization for EXEC Access and Network Services

CLI: Starting TACACS+ Accounting

CLI: Configuring a Switch for Local AAA

Configuring the Switch for Remote Monitoring


Managing Switches


This chapter describes how to use the device-management features of the Cluster Management Suite (CMS). The features described in this chapter can all be implemented through Visual Switch Manager (VSM), the web-based interface for managing standalone switches, or through Cluster Manager. If you need information on how to group your switches into a cluster, see "Creating and Managing Clusters."

This chapter describes two ways to configure switches:

By using CMS windows to monitor and configure switches and ports.

How-to procedures for using the windows are in the online help.

By using the Cisco IOS command-line interface (CLI).

CLI procedures are included for many tasks in this chapter. There are some features that can only be implemented by using the CLI.

Finding More Information About IOS Commands

This guide describes only the IOS commands that have been created or changed for the Catalyst 2950 switches. These commands are further described in the Catalyst 2950 Desktop Switch Command Reference.

For information on other IOS Release 12.0 commands, refer to the Cisco IOS Release 12.0 documentation set available on Cisco.com.

Managing Configuration Conflicts

Certain combinations of port features create configuration conflicts (see Table 4-1). If you try to enable incompatible features, CMS issues a warning message, and you cannot make the change. Reload the page to refresh CMS.

In Table 4-1, No means that the two referenced features are incompatible and should not both be enabled; yes means that both can be enabled at the same time and will not cause an incompatibility conflict.

Table 4-1 Conflicting Features

 
Protected Port
Port Group
Port Security
SPAN Port
Connect to Cluster?

Protected Port

-

Yes

Yes

No

Yes

Port Group

Yes

-

No

No

Yes

Port Security

Yes

No

-

No

Yes

SPAN Port

No

No

No

-

Yes

Connect to Cluster

Yes

Yes

Yes

Yes

-


Features, Default Settings, and Descriptions

You can configure the software features of this release by using any of the available interfaces. Table 4-2 lists the most important features, their defaults, and where they are described in this guide.

Table 4-2 Default Settings and Where To Change Them 

Feature
Default Setting
Location of Feature and Feature Description
Equivalent IOS CLI Procedure
Network Management
     
 

Creating clusters

None

Cluster Builder

"Creating Clusters" section

"CLI: Creating a Cluster" section

Removing cluster members

None

Cluster Builder

"Adding and Removing Member Switches" section

"CLI: Removing a Member from a Cluster" section

 

Reloading or Upgrading cluster software

Enabled

Cluster Manager: System > Software Upgrade

"Upgrading or Reloading the Switch Software" section

"Upgrading or Reloading the Switch Software" section

Displaying graphs

Enabled

Cluster Manager and Cluster Builder

"Displaying Link Graphs" section

-

 

Configuring SNMP community strings and trap managers

None

Cluster Manager: System > SNMP Management

"Configuring SNMP" section

-

 

Configuring a port

None

Cluster Manager

"Monitoring and Configuring Ports" section

"Configuring Ports" section

Device Management
     
 

Switch IP address, subnet mask, and default gateway

0.0.0.0

Cluster Manager: System > IP Management

"Configuring IP Information" section

"CLI: Assigning IP Information to the Switch" section

Dynamic Host Configuration Protocol (DHCP)

DHCP client enabled

"DHCP-Based Autoconfiguration" section

-

Management VLAN

VLAN 1

Cluster Manager: Cluster > Management VLAN

"Changing the Management VLAN" section

"Changing the Management VLAN" section

Domain name

None

Cluster Manager: System > IP Management

"Specifying a Domain Name and Configuring the DNS" section

Documentation set for Cisco IOS Release 12.0 on Cisco.com

Cisco Discovery Protocol (CDP)

Enabled

-

Documentation set for Cisco IOS Release 12.0 on Cisco.com

 

CoS and WRR

Disabled

Cluster Manager: Device > CoS and WRR

"CoS and WRR" section

"CLI: Configuring CoS Priority Queues" section

"CLI: Configuring WRR" section

 

Address Resolution Protocol (ARP)

Enabled

Cluster Manager: System > ARP Table

"Managing the ARP Table" section

Documentation set for Cisco IOS Release 12.0 on Cisco.com

 

System Time Management

None

Cluster Manager: Cluster > System Time Management

"Setting the System Date and Time" section

Documentation set for Cisco IOS Release 12.0 on Cisco.com

 

Static address assignment

None assigned

Cluster Manager: Security > Address Management

"Adding and Removing Static Addresses" section

"CLI: Adding Static Addresses" section

 

Dynamic address management

Enabled

Cluster Manager: Security > Address Management

"Managing the MAC Address Tables" section and "Changing the Address Aging Time" section

"CLI: Configuring the Aging Time" section

"CLI: Removing Dynamic Address Entries" section

 

VLAN membership

Static-
access ports in VLAN 1

Cluster Manager: VLAN > VLAN Membership

"Displaying VLAN Membership" section

"Assigning Static-Access Ports to a VLAN" section

"CLI: Configuring a Trunk Port" section

"CLI: Assigning Static-Access Ports to a VLAN" section

"CLI: Configuring a Trunk Port" section

 

VTP Management

VTP server mode

Cluster Manager: VLAN > VTP Management

"Configuring VTP" section

"CLI: Configuring VTP Server Mode" section

Performance
     
 

Autonegotiation of duplex mode and port speeds

Enabled

Cluster Manager: Port > Port Configuration

"Monitoring and Configuring Ports" section

"CLI: Setting Speed and Duplex Parameters" section

Gigabit Ethernet flow control

Any

Cluster Manager > Port Configuration

Configuring Ports

CLI: Configuring Flow Control on Gigabit Ethernet Ports

Flooding Control
     
 

Storm control

Disabled

Cluster Manager: Port > Flooding Control

"Configuring Flooding Controls" section

"CLI: Enabling Storm Control" section

 

IGMP Snooping

Enabled

Cluster Manager: Device > IGMP Snooping

"IGMP Snooping" section

"CLI: Enabling or Disabling IGMP Snooping" section

"CLI: Enabling IGMP Immediate-Leave Processing" section

"CLI: Configuring a Multicast Router Port" section

Network Redundancy
     
 

Hot Standby Router Protocol

Disabled

"Building a Redundant Cluster" section

"CLI: Creating a Standby Group" section

"CLI: Adding Member Switches to a Standby Group" section

"CLI: Removing a Switch from a Standby Group" section

 

Spanning Tree Protocol

Enabled

Cluster Manager: Device > Spanning Tree Protocol

"Configuring the Spanning Tree Protocol" section

"CLI: Disabling STP" section

"CLI: Changing the Path Cost" section

"CLI: Changing the Port Priority" section

"CLI: Enabling STP Port Fast" section

"CLI: Configuring STP Root Guard" section

 

Unidirectional link detection

Disabled

-

"CLI: Configuring UniDirectional Link Detection" section

 

Port grouping

None assigned

Cluster Manager: Port > Port Grouping (EC)

"Creating EtherChannel Port Groups" section

"CLI: Creating EtherChannel Port Groups" section

Diagnostics
     
 

SPAN port monitoring

Disabled

Cluster Manager: Port > Switch Port Analyzer (SPAN)

"Enabling Switch Port Analyzer" section

"CLI: Enabling Switch Port Analyzer" section

 

Console, buffer, and file logging

Disabled

-

Documentation set for Cisco IOS Release 12.0 on Cisco.com

 

Remote monitoring (RMON)

Disabled

"Configuring the Switch for Remote Monitoring" section

Documentation set for Cisco IOS Release 12.0 on Cisco.com

Security
     
 

Password

None

"Changing the Password" section

"Recovering from a Lost or Forgotten Password" section

 

Addressing security

Disabled

Cluster Manager: Security > Address Management

"Adding Secure Addresses" section

"CLI: Adding Secure Addresses" section

 

Trap manager

0.0.0.0

Cluster Manager: System > SNMP Management

"CLI: Adding a Trap Manager" section

"CLI: Adding a Trap Manager" section

 

Community strings

public

Cluster Manager: System > SNMP Configuration

"Entering Community Strings" section

Documentation set for Cisco IOS Release 12.0 on Cisco.com

 

Port security

Disabled

Cluster Manager: Security > Port Security

"Enabling Port Security" section

"CLI: Enabling Port Security" section

 

TACACS+

Disabled

"Configuring TACACS+" section

"CLI Procedures for Configuring TACACS+" section

 

Protected Port

Disabled

"Configuring Protected Ports" section

"Configuring Protected Ports" section


Configuring Standalone Switches

Visual Switch Manager (VSM) is one of the CMS interfaces for managing individual switch features. If you are configuring a standalone switch, you can access VSM directly by entering the switch IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer). Click Cluster Management Suite or Visual Switch Manager on the Cisco Systems Access Page, and the switch senses that the IP address refers to a standalone switch and displays the VSM home page.


Note Menu options are arranged slightly differently in VSM than in Cluster Manager. For the complete list of the options available, see "VSM Menu Bar Options" section.


A browser plug-in is required to access the HTML interface. For information on installing the plug-in, refer to the Release Notes for the Catalyst 2950 Cisco IOS Release 12.0(5)WC(1).

Figure 4-1 VSM Home Page

Enabling the Switch as a Command Switch

Before you can create a cluster, one switch must be assigned an IP address and enabled as the command switch. See the "Command Switch Requirements" section to ensure that the switch meets all the requirements.

To enable a command switch, select Cluster > Cluster Command Configuration from the menu bar, and select Enable on the Cluster Configuration window. You can use up to 28 characters to name your cluster. After you have enabled the command switch, select Cluster > Cluster Builder to begin building your cluster. To build your cluster by using the CLI, see the "CLI: Creating a Cluster" section.

Figure 4-2 Enable Command Switch

Changing the Password

If you change the enable secret password, your connection with the switch breaks, and the browser prompts you for the new password. You can only change a password by using the CLI. If you have forgotten your password, see the "Recovering from a Lost or Forgotten Password" section.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Creating EtherChannel Port Groups

Use the Port Group (EtherChannel) window (Figure 4-4) to create Fast EtherChannel and Gigabit EtherChannel port groups. These port groups act as single logical ports for high-bandwidth connections between switches or between switches and servers.

To display this window, select Port > Port Grouping (EtherChannel) from the menu bar.

For the restrictions that apply to port groups, see the "Managing Configuration Conflicts" section.

Understanding EtherChannel Port Grouping

This software release supports two different types of port groups: source-based forwarding port groups and destination-based forwarding port groups.

Source-based forwarding port groups distribute packets forwarded to the group based on the source address of incoming packets. You can configure up to eight ports in a source-based forwarding port group. Source-based forwarding is enabled by default.

Destination-based port groups distribute packets forwarded to the group based on the destination address of incoming packets. You can configure up to eight ports in a group.

You can create up to 6 port groups of all source-based, all destination-based, or a combination of source- and destination-based ports. All ports in the group must be of the same type; for example, they must be all source based or all destination based. You can independently configure port groups that link switches, but you must consistently configure both ends of a port group.

In Figure 4-3, a port group of two workstations communicates with a router. Because the router is a single-MAC address device, source-based forwarding ensures that the switch uses all available bandwidth to the router. The router is configured for destination-based forwarding because the large number of stations ensures that the traffic is evenly distributed through the port-group ports on the router.

Figure 4-3 Source-Based Forwarding

The switch treats the port group as a single logical port; therefore, when you create a port group, the switch uses the configuration of the first port for all ports added to the group. If you add a port and change the forwarding method, it changes the forwarding for all ports in the group. After the group is created, changing STP or VLAN membership parameters for one port in the group automatically changes the parameters for all ports. Each port group has one port that carries all unknown multicast, broadcast, and STP packets.

Figure 4-4 Port Grouping (EtherChannel)

Figure 4-5 Port Group Configuration

Port Group Restrictions on Static-Address Forwarding

The following restrictions apply to entering static addresses that are forwarded to port groups:

If the port group forwards based on the source MAC address (the default), configure the static address to forward to all ports in the group. This method eliminates the chance of lost packets.

If the port group forwards based on the destination address, configure the static address to forward to only one port in the port group. This method avoids the possible transmission of duplicate packets. For more information, see "Adding and Removing Static Addresses" section.

CLI: Creating EtherChannel Port Groups

Beginning in privileged EXEC mode, follow these steps to create a two-port group:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port of the first port to be added to the group.

Step 3 

port group 1 distribution destination

Assign the port to group 1 with destination-based forwarding.

Step 4 

interface interface

Enter the second port to be added to the group.

Step 5 

port group 1 distribution destination

Assign the port to group 1 with destination-based forwarding.

Step 6 

end

Return to privileged EXEC mode.

Step 7 

show running-config

Verify your entries.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Enabling Switch Port Analyzer

You can monitor traffic on a given port by forwarding incoming and outgoing traffic on the port to another port in the same VLAN. Use the Switch Port Analyzer (SPAN) window (Figure 4-6) to enable port monitoring on a port, and use the Modify the Ports Being Monitored window (Figure 4-7) to select the port to be monitored. A SPAN port cannot monitor ports in a different VLAN, and a SPAN port must be a static-access port. You can have only one assigned monitor port at any given time. If you select another port as the monitor port, the previous monitor port is disabled, and the newly selected port becomes the monitor port.

To display this window, select Port > Switch Port Analyzer from the menu bar.

For the restrictions that apply to SPAN ports, see the "Managing Configuration Conflicts" section.

Figure 4-6 Switch Port Analyzer (SPAN)

Figure 4-7 Modify the Ports Being Monitored

CLI: Enabling Switch Port Analyzer

Beginning in privileged EXEC mode, follow these steps to enable switch port analyzer:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port that acts as the monitor port.

Step 3 

port monitor interface

Enable port monitoring on the port.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show running-config

Verify your entries.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Disabling Switch Port Analyzer

Beginning in privileged EXEC mode, follow these steps to disable switch port analyzer:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port number of the monitor port.

Step 3 

no port monitor interface

Disable port monitoring on the port.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show running-config

Verify your entries.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring Flooding Controls

Use the Flooding Controls window (Figure 4-8) to block the forwarding of unnecessary flooded traffic.

To display this window, select Port > Flooding Controls from the menu bar.

Enabling Storm Control

A packet storm occurs when a large number of broadcast, unicast, or multicast packets are received on a port. Forwarding these packets can cause the network to slow down or to time out. Storm control is configured for the switch as a whole but operates on a per-port basis. By default, storm control is disabled.

Storm control uses high and low thresholds to block and then restore the forwarding of broadcast, unicast, or multicast packets. You can also set the switch to shut down the port when the rising threshold is reached.

The rising threshold is the number of packets that a switch port can receive before forwarding is blocked. The falling threshold is the number of packets below which the switch resumes normal forwarding. In general, the higher the threshold, the less effective the protection against broadcast storms. The maximum half-duplex transmission on a 100BaseT link is 148,000 packets per second, but you can enter a threshold of up to 4294967295 broadcast packets per second.

To configure storm control, right-click a switch chassis in Cluster Manager, and select Port > Flooding Controls. Select one of the Storm tabs (Figure 4-8), select a port, and click Modify. Set the parameters on the Flooding Controls Configuration pop-up (Figure 4-9).

Figure 4-8 Flooding Controls

Figure 4-9 Flooding Controls Configuration Pop-up

CLI: Enabling Storm Control

With the exception of the broadcast keyword, the following procedure could also be used to enable storm control for unicast or multicast packets.

Beginning in privileged EXEC mode, follow these steps to enable broadcast-storm control.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to configure.

Step 3 

port storm-control broadcast [threshold {rising rising-number falling falling-number}]

Enter the rising and falling thresholds for broadcast packets.

Make sure the rising threshold is greater than the falling threshold.

Step 4 

port storm-control trap

Generate an SNMP trap when the traffic on the port crosses the rising or falling threshold.

Step 5 

end

Return to privileged EXEC mode.

Step 6 

show port storm-control [interface]

Verify your entries.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Disabling Storm Control

Beginning in privileged EXEC mode, follow these steps to disable broadcast-storm control.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to configure.

Step 3 

no port storm-control broadcast

Disable port storm control.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show port storm-control [interface]

Verify your entries.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Managing the System Date and Time

Use the System Time Management window (Figure 4-10) to set the system time for a switch or enable an external source such as Network Time Protocol (NTP) to supply time to the switch.

You can use this window to set the switch time by using one of the following techniques:

Manually setting the system time (including daylight saving time) and date

Configuring the switch to run in NTP client mode and to receive time information from an NTP server

Configuring the switch to run in NTP broadcast-client mode and to receive information from an NTP broadcast server

To display this window, select Cluster > System Time Management from the menu bar.

Setting the System Date and Time

Enter the date and a 24-hour clock time setting on the System Time Management window. If you are entering the time for an American time zone, enter the three-letter abbreviation for the time zone in the Name of Time Zone field, such as PST for Pacific standard time. If you are identifying the time zone by referring to Greenwich mean time, enter UTC (universal coordinated time) in the Name of Time Zone field. You then must enter a negative or positive number as an offset to indicate the number of time zones between the switch and Greenwich, England. Enter a negative number if the switch is west of Greenwich, England, and east of the international date line. For example, California is eight time zones west of Greenwich, so you would enter -8 in the Hours Offset From UTC field. Enter a positive number if the switch is east of Greenwich. You can also enter negative and positive numbers for minutes.

You can also set the date and time by using the CLI. "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Figure 4-10 System Time Management

Configuring Daylight Saving Time

To configure daylight saving time, click the Set Daylight Saving Time tab (Figure 4-11). You can configure the switch to change to daylight saving time on a particular day every year, on a day that you enter, or not at all.

Figure 4-11 Set Daylight Savings Time Tab

Configuring the Network Time Protocol

In complex networks, it is often prudent to distribute time information from a central server. The NTP can distribute time information by responding to requests from clients or by broadcasting time information. You can use the Network Time Protocol window (Figure 4-12) to enable these options and to enter authentication information to accompany NTP client requests.

To display this window, click Network Time Protocol on the System Time Management window.

You can also configure NTP by using the CLI. "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Figure 4-12 Network Time Protocol

Configuring the Switch as an NTP Client

You configure the switch as an NTP client by entering the IP addresses of up to ten NTP servers in the IP Address field. Click Preferred Server to specify which server should be used first. You can also enter an authentication key to be used as a password when requests for time information are sent to the server.

Enabling NTP Authentication

To ensure the validity of information received from NTP servers, you can authenticate NTP messages with public-key encryption. This procedure must be coordinated with the administrator of the NTP servers: the information you enter on this window will be matched by the servers to authenticate it.

Click Help for more information about entering information in the Key Number, Key Value, and Encryption Type fields.

Configuring the Switch for NTP Broadcast-Client Mode

You can configure the switch to receive NTP broadcast messages if there is an NTP broadcast server, such as a router, broadcasting time information on the network. You can also enter a delay in the Estimated Round-Trip Delay field to account for round-trip delay between the client and the NTP broadcast server.

Configuring IP Information

Use the IP Management window (Figure 4-13) to change or enter IP information for the switch. Some of this information, such as the IP address was previously entered.

You can use this window to perform the following tasks:

Assign IP information.

Remove an IP address.

Specify a domain name, and configure the Domain Name System (DNS) server.

To display this window, select System > IP Management from the menu bar.

Figure 4-13 IP Management—IP Configuration Tab

You can assign IP information to your switch in these ways:

Using the Setup program (refer to the Release Notes for the Catalyst 2950 Cisco IOS Release 12.0(5)WC(1)

Manually assigning an IP address

Using DHCP-based autoconfiguration

Manually Assigning IP Information to the Switch

You can manually assign an IP address, mask, and default gateway to the switch through the management console. This information is displayed in the IP Address, IP Mask, and Default Gateway fields of the IP Management window.

You can change the information in these fields. The mask identifies the bits that denote the network number in the IP address. When you use the mask to subnet a network, the mask is then referred to as a subnet mask. The broadcast address is reserved for sending messages to all hosts. The CPU sends traffic to an unknown IP address through the default gateway.


Caution Changing the command switch IP address on this window ends your VSM session and any SNMP or Telnet sessions in progress. Restart the Cluster Manager by entering the new IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer), as described in the "Using VSM" section.

CLI: Assigning IP Information to the Switch

Beginning in privileged EXEC mode, follow these steps to enter the IP information:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface vlan 1

Enter interface configuration mode, and enter the VLAN to which the IP information is assigned.
VLAN 1 is the management VLAN, but you can configure any VLAN from IDs 1 to 1001.

Step 3 

ip address ip_address subnet_mask

Enter the IP address and subnet mask.

Step 4 

exit

Return to global configuration mode.

Step 5 

ip default-gateway ip_address

Enter the IP address of the default router.

Step 6 

end

Return to privileged EXEC mode.

Step 7 

show running-config

Verify that the information was entered correctly by displaying the running configuration. If the information is incorrect, repeat the procedure.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Removing an IP Address

Use the following procedure to remove the IP information from a switch.


Note Using the no ip address command in configuration mode disables the IP protocol stack as well as removes the IP information. Cluster members without IP addresses rely on the IP protocol stack being enabled.


Beginning in privileged EXEC mode, follow these steps to remove an IP address:

 
Command
Purpose

Step 1 

clear ip address vlan 1 ip_address subnet_mask

Remove the IP address and subnet mask.

Step 2 

end

Return to privileged EXEC mode.

Step 3 

show running-config

Verify that the information was removed by displaying the running configuration.


Caution If you are removing the IP address through a Telnet session, your connection to the switch will be lost.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

DHCP-Based Autoconfiguration

The DHCP provides configuration information to Internet hosts and internetworking devices. This protocol consists of two components: one for delivering configuration parameters from a DHCP server to a device and a mechanism for allocating network addresses to devices. DHCP is built on a client-server model, where designated DHCP servers allocate network addresses and deliver configuration parameters to dynamically configured devices.

With DHCP-based autoconfiguration, your switch (DHCP client) can be automatically configured at startup with IP address information and a configuration file that it receives during DHCP-based autoconfiguration.

With DHCP-based autoconfiguration, no DHCP client-side configuration is required on your switch. However, you need to configure the DHCP server for various lease options. You might also need to configure a TFTP server, a Domain Name System (DNS) server, and possibly a relay device if the servers are on a different LAN than your switch. A relay device forwards broadcast traffic between two directly connected LANs. A router does not forward broadcast packets, but it forwards packets based on the destination IP address in the received packet. DHCP-based autoconfiguration replaces the BOOTP client functionality on your switch.

DHCP Client Request Process

When you boot your switch, the DHCP client can be invoked and automatically request configuration information from a DHCP server under the following conditions:

The configuration file is not present on the switch.

The configuration file is present, but the IP address is not specified in it.

The configuration file is present, the IP address is not specified in it, and the service config global configuration command is included. This command enables the autoloading of a configuration file from a network server.

Figure 4-14 shows the sequence of messages that are exchanged between the DHCP client and the DHCP server.

Figure 4-14 DHCP Request for IP Information from a DHCP Server

The client, Switch A, broadcasts a DHCPDISCOVER message to locate a DHCP server. The DHCP server offers configuration parameters (such as an IP address, subnet mask, gateway IP address, DNS IP address, a lease for the IP address, and so forth) to the client in a DHCPOFFER unicast message.

In a DHCPREQUEST broadcast message, the client returns a formal request for the offered configuration information to the DHCP server. The formal request is broadcast so that all other DHCP servers that received the DHCPDISCOVER broadcast message from the client can reclaim the IP addresses that they offered to the client.

The DHCP server confirms that the IP address has been allocated to the client by returning a DHCPACK unicast message to the client. With this message, the client and server are bound, and the client uses configuration information received from the server. The amount of information the switch receives depends on how you configure the DHCP server. For more information, see the "Configuring the DHCP Server" section.

If the configuration parameters sent to the client in the DHCPOFFER unicast message by the DHCP server are invalid (a configuration error exists), the client returns a DHCPDECLINE broadcast message to the DHCP server.

The DHCP server sends the client a DHCPNAK denial broadcast message, which means the offered configuration parameters have not been assigned, an error has occurred during the negotiation of the parameters, or the client has been slow in responding to the DHCPOFFER message (the DHCP server assigned the parameters to another client) of the DHCP server.

A DHCP client might receive offers from multiple DHCP or BOOTP servers and can accept any one of the offers; however, the client usually accepts the first offer it receives. The offer from the DHCP server is not a guarantee that the IP address will be allocated to the client; however, the server usually reserves the address until the client has had a chance to formally request the address. If the switch accepts replies from a BOOTP server and configures itself, the switch will broadcast, instead of unicast, TFTP requests to obtain the switch configuration file.

Configuring the DHCP Server

You should configure the DHCP servers with reserved leases that are bound to each switch by the switch hardware address. If the DHCP server does not support reserved leases, the switch can obtain different IP addresses and configuration files at different boot instances. You should configure the DHCP server with the following lease options:

IP address of the client (required)

Subnet mask of the client (required)

DNS server IP address (required)

Router IP address (default gateway address to be used by the switch) (required)

TFTP server name (required)

Boot filename (the name of the configuration file that the client needs) (recommended)

Host name (optional)

If you do not configure the DHCP server with the lease options described earlier, then it replies to client requests with only those parameters that have available values. If the IP address and subnet mask are not in the reply, the switch is not configured. If the DNS server IP address, router IP address, or TFTP server name are not found, the switch might broadcast TFTP requests. Unavailability of other lease options does not affect autoconfiguration.


Note If the configuration file on the switch does not contain the IP address, the switch obtains its address, mask, gateway IP address, and host name from DHCP. If the service config global configuration command is specified in the configuration file, the switch receives the configuration file through TFTP requests. If the service config global configuration command and the IP address are both present in the configuration file, DHCP is not used, and the switch obtains the default configuration file by broadcasting TFTP requests.


The DHCP server can be on the same or a different LAN as the switch. If it is on a different LAN, the switch must be able to access it through a relay device. The DHCP server can be running on a UNIX or Linux operating system; however, the Windows NT operating system is not supported in this release.

For more information, see the "Configuring the Relay Device" section. You must also set up the TFTP server with the switch configuration files; for more information, see the next section.

Configuring the TFTP Server

The TFTP server must contain one or more configuration files in its base directory. The files can include the following:

The configuration file named in the DHCP reply (the actual switch configuration file)

The network-confg or the cisconet.cfg file (known as the default configuration files)

The router-confg or the ciscortr.cfg file (These files contain commands common to all switches. Normally, if the DHCP and TFTP servers are properly configured, these files are not accessed.)

You must specify the TFTP server name in the DHCP server lease database. You must also specify the TFTP server name-to-IP-address mapping in the DNS server database.

The TFTP server can be on the same or a different LAN as the switch. If it is on a different LAN, the switch must be able to access it through a relay device or a router. For more information, see the "Configuring the Relay Device" section.

If the configuration filename is provided in the DHCP server reply, the configuration files for multiple switches can be spread over multiple TFTP servers. However, if the configuration filename is not provided, then the configuration files must reside on a single TFTP server.

Configuring the DNS

The switch uses the DNS server to resolve the TFTP server name to a TFTP server IP address. You must configure the TFTP server name-to-IP address map on the DNS server. The TFTP server contains the configuration files for the switch.

You must configure the IP addresses of the DNS servers in the lease database of the DHCP server from where the DHCP replies will retrieve them. You can enter up to two DNS server IP addresses in the lease database.

The DNS server can be on the same or a different LAN as the switch. If it is on a different LAN, the switch must be able to access it through a relay device or router. For more information, see the "Configuring the Relay Device" section.

Configuring the Relay Device

You need to use a relay device if the DHCP, DNS, or TFTP servers are on a different LAN than the switch. You must configure this relay device to forward received broadcast packets on an interface to the destination host. This configuration ensures that broadcasts from the DHCP client can reach the DHCP, DNS, and TFTP servers and that broadcasts from the servers can reach the DHCP client.

If the relay device is a Cisco router, you enable IP routing (ip routing global configuration command) and configure it with helper addresses by using the ip helper-address interface configuration command.

For example, in Figure 4-15, you configure the router interfaces as follows:

On interface 10.0.0.2:

router(config-if)# ip helper-address 20.0.0.2
router(config-if)# ip helper-address 20.0.0.3
router(config-if)# ip helper-address 20.0.0.4

On interface 20.0.0.1

router(config-if)# ip helper-address 10.0.0.1

Figure 4-15 Relay Device Used in Autoconfiguration

Obtaining Configuration Files

Depending on the availability of the IP address and the configuration filename in the DHCP reserved lease, the switch obtains its configuration information in the following ways:

The IP address and the configuration filename is reserved for the switch and provided in the DHCP reply (one-file read method).

The switch receives its IP address, subnet mask, and configuration filename from the DHCP server. It also receives a DNS server IP address and a TFTP server name. The switch sends a DNS request to the DNS server, specifying the TFTP server name, to obtain the TFTP server address. Then the switch sends a unicast message to the TFTP server to retrieve the named configuration file from the base directory of the server, and upon receipt, completes its boot-up process.

Only the configuration filename is reserved for the switch. The IP address is dynamically allocated to the switch by the DHCP server (one-file read method).

The switch follows the same configuration process described above.

Only the IP address is reserved for the switch and provided in the DHCP reply. The configuration filename is not provided (two-file read method).

The switch receives its IP address and subnet mask from the DHCP server. It also receives a DNS server IP address and a TFTP server name. The switch sends a DNS request to the DNS server, specifying the TFTP server name, to obtain the TFTP server address.

The switch sends a unicast message to the TFTP server to retrieve the network-confg or cisconet.cfg default configuration file. (If the network-confg file cannot be read, the switch reads the cisconet.cfg file.)

The default configuration file contains the host names-to-IP-address mapping for the switch. The switch fills its host table with the information in the file and obtains its host name. If the host name is not found in the file, the switch uses the host name in the DHCP reply. If the host name is not specified in the DHCP reply, the switch uses the default "Switch" as its host name.

After obtaining its host name from the default configuration file or the DHCP reply, the switch reads the configuration file that has the same name as its host name (hostname-confg or hostname.cfg, depending on whether network-confg or cisconet.cfg was read earlier) from the TFTP server. If the cisconet.cfg file is read, the filename of the host is truncated to eight characters.

If the switch cannot read the network-confg, cisconet.cfg, or the host-name file, it reads the router-confg file. If the switch cannot read the router-confg file, it reads the ciscortr.cfg file.


Note The switch broadcasts TFTP server requests if the TFTP server name is not obtained from the DHCP replies, if all attempts to read the configuration file through unicast transmissions fail, or if the TFTP server name cannot be resolved to an IP address.


Example Configuration

Figure 4-16 shows a sample network for retrieving IP information using DHCP-based autoconfiguration.

Figure 4-16 DHCP-Based Autoconfiguration Network Example

Table 4-3 shows the configuration of the reserved leases on the DHCP server.

Table 4-3 DHCP Server Configuration 

 
Switch-1
Switch-2
Switch-3
Switch-4

Binding key (hardware address)

00e0.9f1e.2001

00e0.9f1e.2002

00e0.9f1e.2003

00e0.9f1e.2004

IP address

10.0.0.21

10.0.0.22

10.0.0.23

10.0.0.24

Subnet mask

255.255.255.0

255.255.255.0

255.255.255.0

255.255.255.0

Router address

10.0.0.10

10.0.0.10

10.0.0.10

10.0.0.10

DNS server address

10.0.0.2

10.0.0.2

10.0.0.2

10.0.0.2

TFTP server name

maritsu or 10.0.0.3

maritsu or 10.0.0.3

maritsu or 10.0.0.3

maritsu or 10.0.0.3

Boot filename (configuration file) (optional)

switch1-confg

switch2-confg

switch3-confg

switch4-confg

Host name (optional)

switch1

switch2

switch3

switch4


DNS Server Configuration

The DNS server maps the TFTP server name maritsu to IP address 10.0.0.3.

TFTP Server Configuration (on UNIX)

The TFTP server base directory is set to /tftpserver/work/. This directory contains the network-confg file used in the two-file read method. This file contains the host name to be assigned to the switch based on its IP address. The base directory also contains a configuration file for each switch (switch1-confg, switch2-confg, and so forth) as shown in the following display:

prompt> cd /tftpserver/work/
prompt> ls
network-confg
switch1-confg
switch2-confg
switch3-confg
switch4-confg
prompt> cat network-confg
ip host switch1 10.0.0.21
ip host switch2 10.0.0.22
ip host switch3 10.0.0.23
ip host switch4 10.0.0.24

DHCP Client Configuration

No configuration file is present on Switch 1 through Switch 4.

Configuration Explanation

In Figure 4-16, Switch 1 reads its configuration file as follows:

It obtains its IP address 10.0.0.21 from the DHCP server.

If no configuration filename is given in the DHCP server reply, Switch 1 reads the network-confg file from the base directory of the TFTP server.

It adds the contents of the network-confg file to its host table.

It reads its host table by indexing its IP address 10.0.0.21 to its host name (switch1).

It reads the configuration file that corresponds to its host name; for example, it reads switch1-confg from the TFTP server.

Switches 2 through 4 retrieve their configuration files and IP addresses in the same way.

Specifying a Domain Name and Configuring the DNS

Each unique Internet Protocol (IP) address can have a host name associated with it. The IOS software maintains a cache of host name-to-address mappings for use by the EXEC mode connect, telnet, ping, and related Telnet support operations. This cache speeds the process of converting names to addresses.

IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain. Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco Systems is a commercial organization that IP identifies by a com domain name, so its domain name is cisco.com. A specific device in this domain, the File Transfer Protocol (FTP) system for example, is identified as ftp.cisco.com.

To keep track of domain names, IP has defined the concept of a domain name server (DNS), whose job is to hold a cache (or database) of names mapped to IP addresses. To map domain names to IP addresses, you must first identify the host names and then specify a name server and enable the DNS, the Internet's global naming scheme that uniquely identifies network devices.

Figure 4-17 DNS Configuration

Specifying the Domain Name

You can specify a default domain name that the software uses to complete domain name requests. You can specify either a single domain name or a list of domain names. When you specify a domain name, any IP host name without a domain name will have that domain name appended to it before being added to the host table.

To specify a domain name, enter the name into the Domain Name field of the IP Configuration tab of the IP Management window (Figure 4-17), and click OK. Do not include the initial period that separates an unqualified name (names without a dotted-decimal domain name) from the domain name.

You can also configure the DNS name by using the CLI. The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Specifying a Name Server

You can specify up to six hosts that can function as a name server to supply name information for the DNS. Enter the IP address into the New Server field, and click Add.

Enabling the DNS

If your network devices require connectivity with devices in networks for which you do not control name assignment, you can assign device names that uniquely identify your devices within the entire internetwork. The Internet's global naming scheme, the DNS, accomplishes this task. This service is enabled by default.

Configuring SNMP

Use the SNMP Management window (Figure 4-18) to configure your switch for SNMP management. If your switch is part of a cluster, the clustering software can change SNMP parameters (such as host names) when the cluster is created. If you are configuring a cluster for SNMP, see the "Configuring SNMP for a Cluster" section.

You can use this window to perform the following tasks:

Disabling and enabling SNMP.

Entering general information about the switch.

Entering community strings that serve as passwords for SNMP messages.

Entering trap managers and their community strings to receive traps (alerts) about switch activity.

Setting the classes of traps a trap manager receives.

To display this window, select System > SNMP Configuration from the menu bar.

Disabling and Enabling SNMP

SNMP is enabled by default and must be enabled for Cluster Management features to work properly. If you deselect Enable SNMP and click Apply, SNMP is disabled, and the SNMP parameters are disabled. For information on SNMP and Cluster Management, see "Managing Cluster Switches Through SNMP" section.

SNMP is always enabled for 1900 and 2820 switches.

Entering Community Strings

Community strings serve as passwords for SNMP messages to permit access to the agent on the switch. If you are entering community strings for a cluster member, see the "Configuring Community Strings for Cluster Switches" section. You can enter community strings with the following characteristics:

Read-only (RO)

Requests accompanied by the string can display MIB-object information.

Read-write (RW)

Requests accompanied by the string can display MIB-object information and set MIB objects.


Use the Community Strings tab (Figure 4-19) to add and remove community strings. You can also use the CLI to configure SNMP community strings. The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Figure 4-18 SNMP Management—System Options

Figure 4-19 SNMP Configuration—Community Strings

Adding Trap Managers

A trap manager is a management station that receives and processes traps. When you configure a trap manager, community strings for each member switch must be unique. If a member switch has an IP address assigned to it, the management station accesses the switch by using its assigned IP address. Use the Trap Managers tab (Figure 4-20) to configure trap managers and enter trap manager community strings.

By default, no trap manager is defined, and no traps are issued. Select a check box to enable one of the following classes of traps:

Config

Generate traps whenever the switch configuration changes.

SNMP

Generate the supported SNMP traps.

TTY

Generate traps when the switch starts a management console CLI session.

VLAN membership

Generate a trap for each VLAN Membership Policy Server (VMPS) change.

VTP

Generate a trap for each VLAN Trunk Protocol (VTP) change.

C2900/C3500

Generate the switch-specific traps. These traps are in the private enterprise-specific MIB.


Figure 4-20 SNMP Management—Trap Managers

CLI: Adding a Trap Manager

Beginning in privileged EXEC mode, follow these steps to add a trap manager and community string:

 
Command
Purpose

Step 1 

config terminal

Enter global configuration mode.

Step 2 

snmp-server host 172.2.128.263 traps1 snmp vlan-membership

Enter the trap manager IP address, community string, and the traps to generate.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show running-config

Verify that the information was entered correctly by displaying the running configuration.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Managing the ARP Table

To communicate with a device (on Ethernet, for example), the software first must determine the 48-bit MAC or local data link address of that device. The process of determining the local data link address from an IP address is called address resolution.

The Address Resolution Protocol (ARP) associates a host IP address with the corresponding media or MAC addresses and VLAN ID. Taking an IP address as input, ARP determines the associated MAC address. Once a MAC address is determined, the IP-MAC address association is stored in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP). By default, standard Ethernet-style ARP encapsulation (represented by the arpa keyword) is enabled on the IP interface.

Use the ARP Table window (Figure 4-21) to display the table and change the timeout value.

To display this window, select System > ARP Table from the menu bar. ARP entries added manually to the table do not age and must be manually removed.

You can manually add entries to the ARP Table by using the CLI; however, these entries do not age and must be manually removed. The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Figure 4-21 ARP Table

Managing the MAC Address Tables

Use the Address Management window (Figure 4-23) to manage the MAC address tables that the switch uses to forward traffic between ports. All MAC addresses in the address tables are associated with one or more ports. These MAC tables include the following types of addresses:

Dynamic address: a source MAC address that the switch learns and then drops when it is not in use.

Secure address: a manually entered unicast address that is usually associated with a secure port. Secure addresses do not age.

Static address: a manually entered unicast or multicast address that does not age and that is not lost when the switch resets.

To display this window, select Security > Address Management from the menu bar.

The address tables list the destination MAC address and the associated VLAN ID, module, and port number associated with the address. Figure 4-22 shows an example list of addresses as they would appear in the dynamic, secure, or static address table.

Figure 4-22 Contents of the Address Table

MAC Addresses and VLANs

All addresses are associated with a VLAN. An address can exist in more than one VLAN and have different destinations in each. Multicast addresses, for example, could be forwarded to port 1 in VLAN 1 and ports 9, 10, and 11 in VLAN 5.

Each VLAN maintains its own logical address table. A known address in one VLAN is unknown in another until it is learned or statically associated with a port in the other VLAN. An address can be secure in one VLAN and dynamic in another. Addresses that are statically entered in one VLAN must be static addresses in all other VLANs.

Figure 4-23 Address Management—Dynamic Address

Changing the Address Aging Time

Dynamic addresses are source MAC addresses that the switch learns and then drops when they are not in use. Use the Aging Time field to define how long the switch retains unseen addresses in the table. This parameter applies to all VLANs.

CLI: Configuring the Aging Time

Setting too short an aging time can cause addresses to be prematurely removed from the table. Then when the switch receives a packet for an unknown destination, it floods the packet to all ports in the same VLAN as the receiving port. This unnecessary flooding can impact performance. Setting too long an aging time can cause the address table to be filled with unused addresses; it can cause delays in establishing connectivity when a workstation is moved to a new port.

Beginning in privileged EXEC mode, follow these steps to configure the dynamic address table aging time.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

mac-address-table aging-time seconds

Enter the number of seconds that dynamic addresses are to be retained in the address table. You can enter a number from 10 to 1000000.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table aging-time

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Removing Dynamic Address Entries

Beginning in privileged EXEC mode, follow these steps to remove a dynamic address entry:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

no mac-address-table dynamic hw-addr

Enter the MAC address to be removed from dynamic MAC address table.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table

Verify your entry.

You can remove all dynamic entries by using the clear mac-address-table dynamic command in privileged EXEC mode.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Adding Secure Addresses

The secure address table contains secure MAC addresses and their associated ports and VLANs. A secure address is a manually entered unicast address that is forwarded to only one port per VLAN. If you enter an address that is already assigned to another port, the switch reassigns the secure address to the new port.

You can enter a secure port address even when the port does not yet belong to a VLAN. When the port is later assigned to a VLAN, packets destined for that address are forwarded to the port.

You can use the Secure Address tab (Figure 4-24) to remove individual secure addresses or a group of them. To display this window, click the Secure Address tab on the Address Management window. Click the New button to display the New Address window (Figure 4-25), and enter a new secure address.

Figure 4-24 Address Management—Secure Address Tab

After you have entered the secure address, select Security > Port Security from the menu bar to secure the port by using the Port Security window.

Figure 4-25 New Secure Address

CLI: Adding Secure Addresses

Beginning in privileged EXEC mode, follow these steps to add a secure address:

 

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

mac-address-table secure hw-addr interface
vlan vlan-id

Enter the MAC address, its associated port, and the VLAN ID.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table secure

Verify your entry.

 

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Removing Secure Addresses

Beginning in privileged EXEC mode, follow these steps to remove a secure address: 

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

no mac-address-table secure hw-addr vlan vlan-id

Enter the secure MAC address, its associated port, and the VLAN ID to be removed.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table secure

Verify your entry.

 

You can remove all secure addresses by using the clear mac-address-table secure command in privileged EXEC mode.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Adding and Removing Static Addresses

A static address has the following characteristics:

It is manually entered in the address table and must be manually removed.

It can be a unicast or multicast address.

It does not age and is retained when the switch restarts.

By clicking the Static Address tab on the Address Management window (Figure 4-23), you can add and remove static addresses. You can also define the forwarding behavior for the static address. Click Forwarding to display the Modify Static Forwarding window (Figure 4-26).

On the Modify Static Forwarding window, you determine how a port that receives a packet forwards it to another port for transmission. Because all ports are associated with at least one VLAN, the switch acquires the VLAN ID for the address from the ports that you select on the forwarding map.

The Available Port(s) column lists the ports where a static address is received. The Forward to Port(s) column lists the ports that the address with the static address can be forwarded to. Select a row, and click Modify to change the entries for an address.

A static address in one VLAN must be a static address in other VLANs. A packet with a static address that arrives on a VLAN where it has not been statically entered is flooded to all ports and not learned.

Figure 4-26 Static Address Forwarding

Configuring Static Addresses for EtherChannel Port Groups

Follow these rules if you are configuring a static address to forward to ports in an EtherChannel port group:

For default source-based port groups, configure the static address to forward to all ports in the port group to eliminate lost packets.

For destination-based port groups, configure the address to forward to only one port in the port group to avoid the transmission of duplicate packets.

CLI: Adding Static Addresses

Static addresses are entered in the address table with an out-port-list and a VLAN ID, if needed. Packets are forwarded to ports listed in the out-port-list.


Note If the in-port and out-port-list parameters are all access ports in a single VLAN, you can omit the VLAN ID. In this case, the switch recognizes the VLAN as that associated with the in-port VLAN. Otherwise, you must supply the VLAN ID.


Beginning in privileged EXEC mode, follow these steps to add a static address:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

mac-address-table static hw-addr interface out-port-list vlan vlan-id

Enter the MAC address, the ports to which it can be forwarded, and the VLAN ID of those ports. For unicast static addresses, only one output port can be specified. For multicast static addresses, more than one output port can be specified.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table static

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Removing Static Addresses

Beginning in privileged EXEC mode, follow these steps to remove a static address:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

no mac-address-table static hw-addr interface out-port-list vlan vlan-id

Enter the static MAC address, the ports to which it can be forwarded, and the VLAN ID to be removed.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table static

Verify your entry.

You can remove all secure addresses by using the clear mac-address-table static command in privileged EXEC mode.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Enabling Port Security

Secure ports restrict a port to a user-defined group of stations. When you assign secure addresses to a secure port, the switch does not forward any packets with source addresses outside the group of addresses you have defined. If you define the address table of a secure port to contain only one address, the workstation or server attached to that port is guaranteed the full bandwidth of the port.

Use the Port Security window (Figure 4-27) to enable port security on a port and to define the actions to take place when a security violation occurs. As part of securing the port, you can also define the size of the address table for the port.

To display this window, select Security > Port Security from the menu bar. To modify port-security parameters for several ports at once, select the rows by using the mouse, and click Modify to display the Port Security Configuration window (Figure 4-28).

Secure ports generate address-security violations under the following conditions:

The address table of a secure port is full and the address of an incoming packet is not found in the table.

An incoming packet has a source address assigned as a secure address on another port.

Limiting the number of devices that can connect to a secure port has the following advantages:

Dedicated bandwidth—If the size of the address table is set to 1, the attached device is guaranteed the full bandwidth of the port.

Added security—Unknown devices cannot connect to the port.

The following fields validate port security or indicate security violations:

Interface

Port to secure.

Security

Enable port security on the port.

Trap

Issue a trap when an address-security violation occurs.

Shutdown Port

Disable the port when an address-security violation occurs.

Secure Addresses

Number of addresses in the address table for this port. Secure ports have at least one in this field.

Max Addresses

Number of addresses that the address table for the port can contain.

Security Rejects

The number of unauthorized addresses seen on the port.


For the restrictions that apply to secure ports, see the "Managing Configuration Conflicts" section.

Figure 4-27 Port Security

Defining the Maximum Secure Address Count

A secure port can have from 1 to 132 associated secure addresses. Setting one address in the MAC address table for the port ensures that the attached device has the full bandwidth of the port.

Figure 4-28 Port Security Configuration Pop-up

CLI: Enabling Port Security

Beginning in privileged EXEC mode, follow these steps to enable port security.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode for the port you want to secure.

Step 3 

port security max-mac-count 1

Secure the port and set the address table to one address.

Step 4 

port security action shutdown

Set the port to shutdown when a security violation occurs.

Step 5 

end

Return to privileged EXEC mode.

Step 6 

show port security

Verify the entry.

"Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Disabling Port Security

Beginning in privileged EXEC mode, follow these steps to disable port security.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode for the port you want to unsecure.

Step 3 

no port security

Disable port security

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show port security

Verify the entry

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring the Cisco Discovery Protocol

Use the Cisco IOS command-line interface and Cisco Discovery Protocol (CDP) to enable CDP for the switch, set global CDP parameters, and display information about neighboring Cisco devices.

CDP enables the Cluster Management Suite to display a graphical view of the network. For example, the switch uses CDP to find cluster candidates and maintain information about cluster members and other devices up to three cluster-enabled devices away from the command switch.

If necessary, you can configure CDP to discover switches running the Cluster Management Suite up to seven devices away from the command switch. Devices that do not run clustering software display as edge devices, and no device connected to them can be discovered by CDP.


Note Creating and maintaining switch clusters is based on the regular exchange of CDP messages. Disabling CDP can interrupt cluster discovery. For more information on the role that CDP plays in clustering, see the "Automatically Discovering Cluster Candidates" section.


CLI: Configuring CDP for Extended Discovery

You can change the default configuration of CDP on the command switch to continue discovering devices up to seven hops away. Figure 4-29 shows a command switch that can discover candidates up to seven devices away from it. Figure 4-29 also shows the command switch connected to a Catalyst 5000 series switch. Because the Catalyst 5000 is a CDP device that does not support clustering, the command switch cannot learn about cluster candidate switches connected to it, even if they are running the Cluster Management Suite.

Figure 4-29 Discovering Cluster Candidates via CDP

Beginning in privileged EXEC mode, follow these steps to configure the number of hops that CDP discovers.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

cluster discovery hop-count number

Enter the number of hops that you want CDP to search for cluster candidates.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show running-config

Verify the change by displaying the running configuration file. The hop count is displayed in the file.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

IGMP Snooping

Internet Group Management Protocol (IGMP) snooping constrains the flooding of multicast traffic by dynamically configuring the interfaces so that multicast traffic is forwarded only to those interfaces associated with IP multicast devices. The LAN switch snoops on the IGMP traffic between the host and the router and keeps track of multicast groups and member ports. When the switch receives an IGMP join report from a host for a particular multicast group, the switch adds the host port number to the associated multicast forwarding table entry. When it receives an IGMP Leave Group message from a host, it removes the host port from the table entry. After it relays the IGMP queries from the multicast router, it deletes entries periodically if it does not receive any IGMP membership reports from the multicast clients.

When IGMP snooping is enabled, the multicast router sends out periodic IGMP general queries to all VLANs. The switch responds to the router queries with only one join request per MAC multicast group, and the switch creates one entry per VLAN in the Layer 2 forwarding table for each MAC group from which it receives an IGMP join request. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry.

Layer 2 multicast groups learned through IGMP snooping are dynamic. However, you can statically configure MAC multicast groups by using the ip igmp snooping vlan static command. If you specify group membership for a multicast group address statically, your setting supersedes any automatic manipulation by IGMP snooping. Multicast group membership lists can consist of both user-defined and IGMP snooping-learned settings.

Catalyst 2950 switches support a maximum of 255 IP multicast groups and support both IGMP version 1 and IGMP version 2.

If a port spanning-tree, a port group, or a VLAN ID change occurs, the IGMP snooping-learned multicast groups from this port on the VLAN are purged.

In the IP multicast-source-only environment, the switch learns the IP multicast group from the IP multicast data stream and only forwards traffic to the multicast router ports.

Use the IGMP Snooping window (Figure 4-30) to enable the IGMP snooping feature. To display this window, select Device > IGMP Snooping from the menu bar.

You can use this window to perform the following tasks:

Enable or disable IGMP snooping

Enable or disable Immediate-Leave processing

Join or leave a multicast group

Configure a multicast router

Figure 4-30 IGMP Snooping

Enabling or Disabling IGMP Snooping

By default, IGMP snooping is globally enabled on the switch. When globally enabled or disabled, it is also enabled or disabled in all existing VLAN interfaces. By default, IGMP snooping is enabled on all VLANs, but it can be enabled and disabled on a per-VLAN basis.

Global IGMP snooping overrides the per-VLAN IGMP snooping capability. If global snooping is disabled, you cannot enable VLAN snooping. If global snooping is enabled, you can enable or disable snooping on a VLAN basis.

To modify the IGMP snooping settings on a per-VLAN basis, select a row, and click Modify. You can modify the settings as shown in Figure 4-31.

Figure 4-31 Modify the IGMP Snooping Settings

CLI: Enabling or Disabling IGMP Snooping

Beginning in privileged EXEC mode, follow these steps to enable IGMP snooping globally on the switch:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

ip igmp snooping

Globally enable IGMP snooping in all existing VLAN interfaces.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show ip igmp snooping

Display snooping configuration.

Step 5 

copy running-config startup-config

(Optional) Save your configuration to the startup configuration.

To globally disable IGMP snooping on all existing VLAN interfaces, use the no ip igmp snooping global command.

Beginning in privileged EXEC mode, follow these steps to enable IGMP snooping on a VLAN interface:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

ip igmp snooping vlan vlan_id

Enable IGMP snooping on the VLAN interface.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show ip igmp snooping [vlan vlan_id]

Display snooping configuration.

(Optional) vlan_id is the number of the VLAN.

Step 5 

copy running-config startup-config

(Optional) Save your configuration to the startup configuration.

To disable IGMP snooping on a VLAN interface, use the global configuration command no ip igmp snooping vlan vlan_id for the specified VLAN number (for example, vlan1).

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Enabling IGMP Immediate-Leave Processing

When you enable IGMP Immediate-Leave processing, the switch immediately removes a port from the IP multicast group when it detects an IGMP version 2 leave message on that port. Immediate-Leave processing allows the switch to remove an interface that sends a leave message from the forwarding table without first sending out group specific queries to the interface. You should use the Immediate-Leave feature only when there is only a single receiver present on every port in the VLAN.

Beginning in privileged EXEC mode, follow these steps to enable IGMP Immediate-Leave processing:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

ip igmp snooping vlan vlan_id immediate-leave

Enable IGMP Immediate-Leave processing on the VLAN interface.

Step 3 

end

Return to privileged EXEC mode.

To disable Immediate-Leave processing, follow Steps 1 and 2 to enter interface configuration mode, and use the command no ip igmp snooping vlan vlan_id immediate-leave.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Setting the Snooping Method

Multicast-capable router ports are added to the forwarding table for every IP multicast entry. The switch learns of such ports through one of these methods:

Snooping on PIM and DVMRP packets

Listening to CGMP self-join packets from other routers

Statically connecting to a multicast router port with the ip igmp snooping mrouter command

You can configure the switch to either snoop on Protocol Independent Multicast/Distance Vector Multicast Routing Protocol (PIM/DVMRP) packets or to listen to CGMP self-join packets. By default, the switch snoops on PIM/DVMRP packets on all VLANs. To learn of multicast router ports through only CGMP self-join packets, use the ip igmp snooping vlan vlan_id mrouter learn cgmp global configuration command. When this command is used, the router listens only to CGMP self-join packets and no other CGMP packets. To learn of multicast router ports through only PIM-DVMRP packets, use the ip igmp snooping vlan vlan_id mrouter learn pim-dvmrp interface command.

Joining a Multicast Group

When a host connected to the switch wants to join an IP multicast group, it sends an IGMP join message, specifying the IP multicast group it wants to join. When the switch receives this message, it adds the port to the IP multicast group port address entry in the forwarding table.

Figure 4-32 Initial IGMP Join Message

Refer to Figure 4-32. Host 1 wants to join multicast group 224.1.2.3 and multicasts an unsolicited IGMP membership report (IGMP join message) to the group with the equivalent MAC destination address of 0100.5E01.0203. The switch recognizes IGMP packets and forwards them to the CPU. When the CPU receives the IGMP report multicast by Host 1, the CPU uses the information to set up a multicast forwarding table entry as shown in Table 4-4 that includes the port numbers of Host 1 and the router.

Table 4-4 IP Multicast Forwarding Table

Destination Address
Type of Packet
Ports

0100.5e01.0203

!IGMP

1, 2


Note that the architecture of the switch allows the CPU to distinguish IGMP information packets from other packets for the multicast group. The switch recognizes the IGMP packets through it's filter engine. This prevents the CPU from becoming overloaded with multicast frames.

The entry in the multicast forwarding table tells the switching engine to send frames addressed to the 0100.5E01.0203 multicast MAC address that are not IGMP packets (!IGMP) to the router and to the host that has joined the group.

If another host (for example, Host 4) sends an IGMP join message for the same group (Figure 4-33), the CPU receives that message and adds the port number of Host 4 to the CAM table as shown in Table 4-5.

Figure 4-33 Second Host Joining a Multicast Group

Table 4-5 Updated Multicast Forwarding Table

Destination Address
Type of Packet
Ports

0100.5e01.0203

!IGMP

1, 2, 5


Statically Configuring a Host to Join a Group

Ports normally join multicast groups through the IGMP report message, but you can also statically configure a host on an interface.

Select the Multicast Group tab on the IGMP snooping window (Figure 4-30) to view the current settings. Select the row you want to modify from the Multicast Groups window (Figure 4-34), and click Modify to change the settings. Use the Multicast Groups window (Figure 4-35) to add or remove ports from a multicast group.

Figure 4-34 Multicast Groups

Figure 4-35 Modify Multicast Groups

CLI: Statically Configuring a Interface to Join a Group

Beginning in privileged EXEC mode, follow these steps to add a port as a member of a multicast group:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode

Step 2 

ip igmp snooping vlan vlan_id static mac-address interface interface-num

Statically configure a port as a member of a multicast group:

vlan_id is the multicast group VLAN ID.

mac-address is the group MAC address.

interface is the member port.

FastEthernet interface number to specify a Fast Ethernet 802.3 interface.

Gigabit Ethernet interface-number to specify a Gigabit Ethernet 802.3z interface.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show mac-address-table multicast [vlan vlan-id] [user | igmp-snooping] [count]

Display MAC address table entries for a VLAN.

vlan_id (Optional) is the multicast group VLAN ID.

user displays only the user-configured multicast entries.

igmp-snooping displays entries learned via IGMP snooping.

count displays only the total number of entries for the selected criteria, not the actual entries.

Step 5 

copy running-config startup-config

(Optional) Save your configuration to the startup configuration.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Leaving a Multicast Group

The router sends periodic IP multicast general queries, and the switch responds to these queries with one join response per MAC multicast group. As long as at least one host in the VLAN needs multicast traffic, the switch responds to the router queries, and the router continues forwarding the multicast traffic to the VLAN. The switch only forwards IP multicast group traffic to those hosts listed in the forwarding table for that IP multicast group.

When hosts need to leave a multicast group, they can either ignore the periodic general-query requests sent by the router, or they can send a leave message. When the switch receives a leave message from a host, it sends out a group-specific query to determine if any devices behind that interface are interested in traffic for the specific multicast group. If, after a number of queries, the router processor receives no reports from a VLAN, it removes the group for the VLAN from its IGMP cache.

Configuring a Multicast Router Port

Select the Multicast Router Port tab on the IGMP snooping window (Figure 4-30) to view the current settings. Select the row that you want to modify from the Multicast Router Ports window (Figure 4-36), and click Modify to change the settings. Use the Multicast Router Ports window (Figure 4-37) to add or remove ports.

Figure 4-36 Multicast Router Ports

Figure 4-37 Modify Multicast Router Ports

CLI: Configuring a Multicast Router Port

Beginning in privileged EXEC mode, follow these steps to enable a static connection to a multicast router:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

ip igmp snooping vlan vlan_id mrouter {interface interface} {learn method}

Specify the multicast router VLAN ID (1 to 1001).

Specify the interface to the multicast router as one of the following:

FastEthernet interface number to specify a Fast Ethernet 802.3 interface (fa0/x, where x is the port number).

GigabitEthernet interface-number to specify a Gigabit Ethernet 802.3z interface (gi0/x, where x is the port number).

Specify the multicast router learning method:

cgmp to specify listening for CGMP packets.

pim-dvmrp to specify snooping PIM-DVMRP packets

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show ip igmp snooping [vlan vlan_id]

Verify that IGMP snooping is enabled on the VLAN interface.

Step 5 

show ip igmp snooping mrouter [vlan vlan_id]

Display information on dynamically learned and manually configured multicast router interfaces.

Step 6 

copy running-config startup-config

(Optional) Save your configuration to the startup configuration.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring the Spanning Tree Protocol

Spanning Tree Protocol (STP) provides path redundancy while preventing undesirable loops in the network. Only one active path can exist between any two stations. STP calculates the best loop-free path throughout the network.

Supported STP Instances

You create an STP instance when you assign an interface to a VLAN. The STP instance is removed when the last interface is moved to another VLAN. You can configure switch and port parameters before an STP instance is created. These parameters are applied when the STP instance is created. You can change all VLANs on a switch by using the show spanning-tree [vlan stp-list] privileged EXEC command when you enter STP commands through the CLI. For more information, refer to the Catalyst 2950 Desktop Switch Command Reference.

Catalyst 2950 switches support only 64 VLANs. For more information about VLANs, see "Creating and Maintaining VLANs."

Each VLAN is a separate STP instance. If you have already used up all available STP instances on a switch, adding another VLAN anywhere in the VLAN Trunk Protocol (VTP) domain creates a VLAN that is not running STP on that switch. For example, if 64 VLANs are defined in the VTP domain, you can enable STP on those 64 VLANs. The remaining VLANs must operate with STP disabled.

You can disable STP on one of the VLANs where it is running and then enable it on the VLAN where you want it to run. Use the no spanning-tree vlan vlan-id global configuration command to disable STP on a specific VLAN, and use the spanning-tree vlan vlan-id global configuration command to enable STP on the desired VLAN.


Caution Switches that are not running spanning tree still forward BPDUs that they receive so that the other switches on the VLAN that have a running STP instance can break loops. Therefore, spanning tree must be running on enough switches so that it can break all the loops in the network. For example, at least one switch on each loop in the VLAN must be running spanning tree. It is not absolutely necessary to run spanning tree on all switches in the VLAN; however, if you are running STP only on a minimal set of switches, an incautious change to the network that introduces another loop into the VLAN can result in a broadcast storm.


Note If you have the default allowed list on the trunk ports of that switch, the new VLAN is carried on all trunk ports. Depending on the topology of the network, this could create a loop in the new VLAN that will not be broken, particularly if there are several adjacent switches that all have run out of STP instances. You can prevent this by setting allowed lists on the trunk ports of switches that have used up their allocation of STP instances. Setting up allowed lists is not necessary in many cases andadding another VLAN to the network would become more labor-intensive.


Use the Spanning Tree Protocol (STP) window (Figure 4-38) to change parameters for STP, an industry standard for avoiding loops in switched networks. Each VLAN supports its own instance of STP.

Spanning Tree Protocol (STP) provides path redundancy while preventing undesirable loops in the network. Only one active path can exist between any two stations. STP calculates the best loop-free path throughout the network.

You can use this window to perform the following tasks:

Disable STP for a switch or group of switches.

Change STP parameters for per VLAN (STP implementation, switch priority, Bridge Protocol Data Unit (BPDU) message interval, hello BPDU interval, and the forwarding time).

Change STP port parameters per VLAN (Port Fast feature, root cost, path cost, port priority).

Display the STP parameters and port parameters for the switch currently acting as the STP root switch.


Note VLANs are identified with a number between 1 and 1001. Regardless of the switch model, only 64 possible instances of STP are supported.


To display this window, select Device > Spanning Tree Protocol from the menu bar to display STP information for the command switch, or right-click a switch, and select Device > Spanning Tree Protocol from the pop-up menu to display the STP information defined for that switch. You can also click the STP icon on the toolbar.

The STP rootguard option is described in the "CLI: Configuring STP Root Guard" section.

Figure 4-38 Spanning Tree Protocol —Status

Using STP to Support Redundant Connectivity

You can create a redundant backbone with STP by connecting two of the switch ports to another device or to two different devices. STP automatically disables one port but enables it if the other port is lost. If one link is high-speed and the other low-speed, the low-speed link is always disabled. If the speed of the two links is the same, the port priority and port ID are added together, and STP disables the link with the lowest value.

You can also create redundant links between switches by using EtherChannel port groups. For more information on creating port groups, see the "Creating EtherChannel Port Groups" section.

Accelerating Aging to Retain Connectivity

The default for aging dynamic addresses is 5 minutes. However, a reconfiguration of the spanning tree can cause many station locations to change. Because these stations could be unreachable for 5 minutes or more during a reconfiguration, the address-aging time is accelerated so that station addresses can be dropped from the address table and then relearned. The accelerated aging is the same as the forward-delay parameter value when STP reconfigures.

Because each VLAN is a separate instance of STP, the switch accelerates aging on a per-VLAN basis. A reconfiguration of STP on one VLAN can cause the dynamic addresses learned on that VLAN to be subject to accelerated aging. Dynamic addresses on other VLANs can be unaffected and remain subject to the aging interval entered for the switch.

Disabling STP Protocol

STP is enabled by default. Disable STP only if you are sure there are no loops in the network topology.


Caution When STP is disabled and loops are present in the topology, excessive traffic and indefinite packet duplication can drastically reduce network performance.

Figure 4-39 STP Pop-up

CLI: Disabling STP

Beginning in privileged EXEC mode, follow these steps to disable STP:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

no spanning-tree vlan stp-list

Disable STP on a VLAN.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring Redundant Links By Using STP UplinkFast

Switches in hierarchical networks can be grouped into backbone switches, distribution switches, and access switches. Figure 4-40 shows a complex network where distribution switches and access switches each have at least one redundant link that STP blocks to prevent loops.

If a switch looses connectivity, the switch begins using the alternate paths as soon as STP selects a new root port. When STP reconfigures the new root port, other ports flood the network with multicast packets, one for each address that was learned on the port. You can limit these bursts of multicast traffic by reducing the max-update-rate parameter (the default for this parameter is 150 packets per second). However, if you enter zero, station-learning frames are not generated, so the STP topology converges more slowly after a loss of connectivity.

STP UplinkFast is an enhancement that accelerates the choice of a new root port when a link or switch fails or when STP reconfigures itself. The root port transitions to the forwarding state immediately without going through the listening and learning states, as it would with normal STP procedures. UplinkFast is most useful in edge or access switches and might not be appropriate for backbone devices.

You can change STP parameters by using the UplinkFast tab of the Spanning Tree Protocol window or by using the CLI. The "Configuring the Spanning Tree Protocol" section describes the use of the Spanning Tree Protocol window.

To display this window, select Device > Spanning-Tree Protocol from the menu bar. Then click the UplinkFast tab.

Figure 4-40 Switches in a Hierarchical Network

CLI: Enabling STP UplinkFast

When you enable UplinkFast, it is enabled for the entire switch and cannot be enabled for individual VLANs.

Beginning in privileged EXEC mode, follow these steps to configure UplinkFast:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

spanning-tree uplinkfast max-update-rate pkts-per-second

Enable UplinkFast on the switch.

The range is from 0 to 1000 packets per second; The default is 150.

If you set the rate to 0, station-learning frames are not generated, so the STP topology converges more slowly after a loss of connectivity.

Step 3 

exit

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entries.

When UplinkFast is enabled, the bridge priority of all VLANs is set to 49152, and the path cost of all ports and VLAN trunks is increased by 3000. This change reduces the chance that the switch will become the root port. When UplinkFast is disabled, the bridge priorities of all VLANs and path costs of all ports are set to default values.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Changing STP Parameters for a VLAN

To change STP parameters for a VLAN, select Device > Spanning Tree Protocol from the menu bar, select the VLAN ID of the STP instance to change, and click Root Parameters.

Figure 4-41 Spanning Tree Protocol Current Root Tab

In Figure 4-41, the parameters under the heading Current Spanning-Tree Root are read-only. The MAC Address field shows the MAC address of the switch currently acting as the root for each VLAN; the remaining parameters show the other STP settings for the root switch for each VLAN. The root switch is the switch with the highest priority and transmits topology frames to other switches in the spanning tree.

In the Spanning Tree Protocol window (Figure 4-42), you can change the root parameters for the VLANs on a selected switch. The following fields (Figure 4-42) define how your switch responds when STP reconfigures itself.

Protocol

Implementation of STP to use.

Select one of the menu bar items: IBM, or IEEE. The default is IEEE.

Priority

Value used to identify the root switch. The switch with the lowest value has the highest priority and is selected as the root.

Enter a number from 0 to 65535.

Max age

Number of seconds a switch waits without receiving STP configuration messages before attempting a reconfiguration. This parameter takes effect when a switch is operating as the root switch. Switches not acting as the root use the root-switch Max age parameter.

Enter a number from 6 to 200.

Hello Time

Number of seconds between the transmission of hello messages, which indicate that the switch is active. Switches not acting as a root switch use the root-switch Hello-time value.

Enter a number from 1 to 10.

Forward Delay

Number of seconds a port waits before changing from its STP learning and listening states to the forwarding state. This wait is necessary so that other switches on the network ensure no loop is formed before they allow the port to forward packets.

Enter a number from 4 to 200.


Figure 4-42 Spanning Tree Protocol Root Parameters Tab

CLI: Changing the STP Implementation

Beginning in privileged EXEC mode, follow these steps to change the STP implementation. The stp-list is the list of VLANs to which the STP command applies.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

spanning-tree [vlan stp-list] protocol {ieee | ibm}

Specify the STP implementation to be used for a spanning-tree instance.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Changing the Switch Priority

Beginning in privileged EXEC mode, follow these steps to change the switch priority and affect which switch is the root switch. The stp-list is the list of VLANs to which the STP command applies.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

spanning-tree [vlan stp-list] priority bridge-priority

Configure the switch priority for the specified spanning-tree instance.

Enter a number from 0 to 65535; the lower the number, the more likely the switch will be chosen as the root switch.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Changing the BPDU Message Interval

Beginning in privileged EXEC mode, follow these steps to change the BPDU message interval (max age time). The stp-list is the list of VLANs to which the STP command applies.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

spanning-tree [vlan stp-list] max-age seconds

Specify the interval between messages the spanning tree receives from the root switch.

The maximum age is the number of seconds a switch waits without receiving STP configuration messages before attempting a reconfiguration. Enter a number from 6 to 200.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Changing the Hello BPDU Interval

Beginning in privileged EXEC mode, follow these steps to change the hello BPDU interval (hello time). The stp-list is the list of VLANs to which the STP command applies.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

spanning-tree [vlan stp-list] hello-time seconds

Specify the interval between hello BPDUs.

Hello messages indicate that the switch is active. Enter a number from 1 to 10.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Changing the Forwarding Delay Time

Beginning in privileged EXEC mode, follow these steps to change the forwarding delay time. The stp-list is the list of VLANs to which the STP command applies.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

spanning-tree [vlan stp-list] forward-time seconds

Specify the forwarding time for the specified spanning-tree instance.

The forward delay is the number of seconds a port waits before changing from its STP learning and listening states to the forwarding state. Enter a number from 4 to 200.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show spanning-tree

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Changing STP Port Parameters

The ports listed on this window (Figure 4-43) belong to the VLAN selected in the VLAN ID list above the table of parameters. To change STP port options, select Device > Spanning Tree Protocol from the menu bar, select the VLAN ID, and click Modify STP Parameters.

Use the following fields (Figure 4-43) to check the status of ports that are not forwarding due to STP:

Port

The interface and port number. FastEthernet0/1 refers to port 1x.

State

The current state of the port. A port can be in one of the following states:

Listening

Port is not participating in the frame-forwarding process, but is progressing towards a forwarding state. The port is not learning addresses.

Learning

Port is not forwarding frames but is learning addresses.

Forwarding

Port is forwarding frames and learning addresses.

Disabled

Port has been removed from STP operation.

Down

Port has no physical link.

Broken

One end of the link is configured as an access port and the other end is configured as an 802.1Q trunk port, or both ends of the link are configured as 802.1Q trunk ports but have different native VLAN IDs.


Figure 4-43 Spanning Tree Protocol Port Parameters Tab

Enabling the Port Fast Feature

The Port Fast feature brings a port directly from a blocking state into a forwarding state. This feature is useful when a connected server or workstation times out because its port is going through the normal cycle of STP status changes. The only time a port with Port Fast enabled goes through the normal cycle of STP status changes is when the switch is restarted.

To enable the Port Fast feature on the Port Configuration pop-up (Figure 4-44), select a row in the Port Parameters tab, and click Modify.


Caution Enabling this feature on a port connected to a switch or hub could prevent STP from detecting and disabling loops in your network, and this could cause broadcast storms and address-learning problems.

Figure 4-44 STP Port Configuration Pop-up

You can modify the following parameters and enable the Port Fast feature by selecting a row on the Port Parameters tab and clicking Modify.

Port Fast

Enable to bring the port more quickly to an STP forwarding state.

Path Cost

A lower path cost represents higher-speed transmission. This can affect which port remains enabled in the event of a loop.

Enter a number from 1 to 65535. The default is 100 for 10 Mbps, 19 for 100 Mbps, 4 for 1 Gbps, 2 for 10 Gbps, and 1 for interfaces with speeds greater than 10 Gbps.

Priority

Number used to set the priority for a port. A higher number has higher priority. Enter a number from 0 to 65535.


CLI: Enabling STP Port Fast

Enabling this feature on a port connected to a switch or hub could prevent STP from detecting and disabling loops in your network. Beginning in privileged EXEC mode, follow these steps to enable the Port Fast feature:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to be configured.

Step 3 

spanning-tree portfast

Enable the Port Fast feature for the port.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show running-config

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Changing the Path Cost

Beginning in privileged EXEC mode, follow these steps to change the path cost for STP calculations. The STP command applies to the stp-list.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to be configured.

Step 3 

spanning-tree [vlan stp-list] cost cost

Configure the path cost for the specified spanning-tree instance.

Enter a number from 1 to 65535.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show running-config

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Changing the Port Priority

Beginning in privileged EXEC mode, follow these steps to change the port priority, which is used when two switches tie for position as the root switch. The stp-list is the list of VLANs to which the STP command applies.

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to be configured.

Step 3 

spanning-tree [vlan stp-list] port-priority port-priority

Configure the port priority for a specified instance of STP.

Enter a number from 0 to 255. The lower the number, the higher the priority.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show running-config

Verify your entry.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Configuring STP Root Guard

The Layer 2 network of a service provider (SP) can include many connections to switches that are not owned by the SP. In such a topology, STP can reconfigure itself and select a customer switch as the STP root switch, as shown in Figure 4-45. You can avoid this possibility by configuring the root guard parameter on ports that connect to switches outside of your network. If a switch outside the network becomes the root switch, the port is blocked, and STP selects a new root switch.


Caution Misuse of this command can cause a loss of connectivity.

Figure 4-45 STP in a Service Provider Network

Root guard enabled on a port applies to all the VLANs that the port belongs to. Each VLAN has its own instance of STP.

Beginning in privileged EXEC mode, follow these steps to set root guard on a port:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to be configured.

Step 3 

spanning-tree rootguard

Enable root guard on the port.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show running-config

Verify that the port is configured for root guard.

Use the no version of the spanning-tree rootguard command to disable the root guard feature.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Configuring UniDirectional Link Detection

UniDirectional Link Detection (UDLD) is a Layer 2 protocol that detects and shuts down unidirectional links. You can configure UDLD on the entire switch or on an individual port.

Beginning in privileged EXEC mode, follow these steps to configure UDLD on a switch:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

udld enable

Enable UDLD.

Step 3 

end

Return to privileged EXEC mode.

Step 4 

show running-config

Verify the entry by displaying the running configuration.

Use the udld reset command to reset any port that has been shut down by UDLD.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring Protected Ports

Some applications require that no traffic be forwarded by the Layer 2 protocol between ports on the same switch. In such an environment, there is no exchange of unicast, broadcast, or multicast traffic between ports on the switch, and traffic between ports on the same switch is forwarded through a Layer 3 device such as a router.

To meet this requirement, you can configure Catalyst 2950, 2900 XL, and
3500 XL ports as protected ports. Protected ports do not forward any traffic to protected ports on the same switch. This means that all traffic passing between protected ports—unicast, broadcast, and multicast—must be forwarded through a Layer 3 device. Protected ports can forward any type of traffic to nonprotected ports, and they forward as usual to all ports on other switches.


Note There could be times when unknown unicast traffic from a nonprotected port is flooded to a protected port because a MAC address has timed out or has not been learned by the switch.


CLI: Configuring Protected Ports

Beginning in privileged EXEC mode, follow these steps to define a port as a
protected port:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

interface interface

Enter interface configuration mode, and enter the port to be configured.

Step 3 

port protected

Enable protected port on the port.

Step 4 

end

Return to privileged EXEC mode.

Step 5 

show port protected

Verify that the port has protected port enabled.

Use the no version of the port protected command to disable protected port.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring TACACS+

The Terminal Access Controller Access Control System Plus (TACACS+) provides the means to manage network security (authentication, authorization, and accounting [AAA]) from a server. This section describes how TACACS+ works and how you can configure it. For complete syntax and usage information for the commands described in this chapter, refer to the
Cisco IOS Release 12.0 Security Command Reference.

You can only configure this feature by using the CLI; you cannot configure it through the Cluster Management Suite.

Understanding TACACS+

In large enterprise networks, the task of administering passwords on each device can be simplified by centralizing user authentication on a server. TACACS+ is an access-control protocol that allows a switch to authenticate all login attempts through a central server. The network administrator configures the switch with the address of the TACACS+ server, and the switch and the server exchange messages to authenticate each user before allowing access to the management console.

TACACS+ consists of three services: authentication, authorization, and accounting. Authentication determines who the user is and whether or not the user is allowed access to the switch. Authorization is the action of determining what the user is allowed to do on the system. Accounting is the action of collecting data related to resource usage.

CLI Procedures for Configuring TACACS+

The TACACS+ feature is disabled by default. However, you can enable and configure it by using the CLI. You can access the CLI through the console port or through Telnet. To prevent a lapse in security, you cannot configure TACACS+ through a network-management application. When enabled, TACACS+ can authenticate users accessing the switch through the CLI.


Note Although the TACACS+ configuration is performed through the CLI, the TACACS+ server authenticates HTTP connections that have been configured with a privilege level of 15.


CLI: Configuring the TACACS+ Server Host

Use the tacacs-server host command to specify the names of the IP host or hosts maintaining an AAA/TACACS+ server. On TACACS+ servers, you can configure the following additional options:

Number of seconds that the switch attempts to contact the server before it times out.

Encryption key to encrypt and decrypt all traffic between the router and the daemon.

Number of attempts that a user can make when entering a command that is being authenticated by TACACS+.

Beginning in privileged EXEC mode, follow these steps to configure the TACACS+ server:

 
Command
Purpose

Step 1 

tacacs-server host name [timeout integer] [key string]

Define a TACACS+ host.

Entering the timeout and key parameters with this command overrides the global values that you can enter with the tacacs-server timeout (Step 3) and the tacacs-server key commands (Step 5).

Step 2 

tacacs-server retransmit retries

Enter the number of times the server searches the list of TACACS+ servers before stopping.

The default is two.

Step 3 

tacacs-server timeout seconds

Set the interval that the server waits for a TACACS+ server host to reply.

The default is 5 seconds.

Step 4 

tacacs-server attempts count

Set the number of login attempts that can be made on the line.

Step 5 

tacacs-server key key

Define a set of encryption keys for all of TACACS+ and communication between the access server and the TACACS daemon.

Repeat the command for each encryption key.

Step 6 

exit

Return to privileged EXEC mode.

Step 7 

show tacacs

Verify your entries.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Configuring Login Authentication

Beginning in privileged EXEC mode, follow these steps to configure login authentication by using AAA/TACACS+:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

aaa new-model

Enable AAA/TACACS+.

Step 3 

aaa authentication login {default | list-name} method1 [method2...]

Enable authentication at login, and create one or more lists of authentication methods.

Step 4 

line [aux | console | tty | vty] line-number [ending-line-number]

Enter line configuration mode, and configure the lines to which you want to apply the authentication list.

Step 5 

login authentication {default | list-name}

Apply the authentication list to a line or set of lines.

Step 6 

exit

Return to privileged EXEC mode.

Step 7 

show running-config

Verify your entries.

The variable list-name is any character string used to name the list you are creating. The method variable refers to the actual methods the authentication algorithm tries, in the sequence entered. You can choose one of the following methods:

line

Uses the line password for authentication. You must define a line password before you can use this authentication method. Use the password password line configuration mode command.

local

Uses the local username database for authentication. You must enter username information into the database. Use the username password global configuration command.

tacacs+

Uses TACACS+ authentication. You must configure the TACACS+ server before you can use this authentication method. For more information, see the "CLI: Configuring the TACACS+ Server Host" section.


To create a default list that is used if no list is specified in the login authentication command, use the default keyword followed by the methods you want used in default situations.

The additional methods of authentication are used only if the previous method returns an error, not if it fails. To specify that the authentication succeed even if all methods return an error, specify none as the final method in the command line.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Specifying TACACS+ Authorization for EXEC Access and Network Services

You can use the aaa authorization command with the tacacs+ keyword to set parameters that restrict a user's network access to Cisco IOS privilege mode (EXEC access) and to network services such as Serial Line Internet Protocol (SLIP), Point-to-Point Protocol (PPP) with Network Control Protocols (NCPs), and AppleTalk Remote Access (ARA).

The aaa authorization exec tacacs+ local command sets the following authorization parameters:

Use TACACS+ for EXEC access authorization if authentication was done using TACACS+.

Use the local database if authentication was not done using TACACS+.


Note Authorization is bypassed for authenticated users who login through the CLI even if authorization has been configured.


Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for EXEC access and network services:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

aaa authorization network tacacs+

Configure the switch for user TACACS+ authorization for all network-related service requests, including SLIP, PPP NCPs, and ARA protocols.

Step 3 

aaa authorization exec tacacs+

Configure the switch for user TACACS+ authorization to determine if the user is allowed EXEC access.

The exec keyword might return user profile information (such as autocommand information).

Step 4 

exit

Return to privileged EXEC mode.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

CLI: Starting TACACS+ Accounting

You use the aaa accounting command with the tacacs+ keyword to turn on TACACS+ accounting for each Cisco IOS privilege level and for network services.

Beginning in privileged EXEC mode, follow these steps to enable TACACS+ accounting:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

aaa accounting exec start-stop tacacs+

Enable TACACS+ accounting to send a start-record accounting notice at the beginning of an EXEC process and a stop-record at the end.

Step 3 

aaa accounting network start-stop tacacs+

Enable TACACS+ accounting for all network-related service requests, including SLIP, PPP, and PPP NCPs.

Step 4 

exit

Return to privileged EXEC mode.


Note These commands are documented in the "Accounting and Billing Commands" chapter of the Cisco IOS Release 12.0 Security Command Reference.


CLI: Configuring a Switch for Local AAA

You can configure AAA to operate without a server by setting the switch to implement AAA in local mode. Authentication and authorization are then handled by the switch. No accounting is available in this configuration.

Beginning in privileged EXEC mode, follow these steps to configure the switch for local AAA:

 
Command
Purpose

Step 1 

configure terminal

Enter global configuration mode.

Step 2 

aaa new-model

Enable AAA.

Step 3 

aaa authentication login default local

Set the login authorization to default to local.

Step 4 

aaa authorization exec local

Configure user AAA authorization for all network-related service requests, including SLIP, PPP NCPs, and ARA protocols.

Step 5 

aaa authorization network local

Configure user AAA authorization to determine if the user is allowed to run an EXEC shell.

Step 6 

username name password password privilege level

Enter the local database.

Repeat this command for each user.

The "Finding More Information About IOS Commands" section contains the path to the complete IOS documentation.

Configuring the Switch for Remote Monitoring

You can use the Remote Monitoring (RMON) feature with the SNMP agent in the switch to monitor all the traffic flowing among switches on all connected LAN segments.

You can configure your switch for RMON, which is disabled by default, by using the CLI or an SNMP-compatible network management station. You cannot configure it by using VSM. In addition, a generic RMON console application is recommended on the CMS to take advantage of RMON's network management capabilities. You must also configure SNMP on the switch to access RMON MIB objects.

RMON data is usually placed in the high-priority queue for the processor and can render the switch unusable; however, because the 2950 switches use hardware counters, the monitoring is more efficient and little processing power is required.

The switch supports the following four RMON groups:

Alarms—Monitor a specific MIB object for a specified interval, trigger an alarm at a specified value (rising threshold), and reset the alarm at another value (falling threshold). Alarms can be used with events; the alarm triggers an event, which can generate a log entry or an SNMP trap.

Events—Determine the action to take when an event is triggered by an alarm. The action can be to generate a log entry or an SNMP trap.

History—Collect a history group of statistics on an interface for a specified polling interval.

Statistics—Collect Ethernet statistics on an interface.

You configure RMON alarms and events in global configuration mode by using the rmon alarms and rmon events commands. You can collect group history or group Ethernet statistics in the interface configuration mode by using the rmon collection history or rmon collection stats commands.

This guide describes the use of IOS commands that have been created or changed for switches that support IOS Release 12.0(5)WC(1). For information on other IOS Release 12.0 commands, refer to the Cisco IOS Release 12.0 documentation set available on Cisco.com.