16- and 36-Port Ethernet Switch Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series
Available Languages
Table Of Contents
802.1x Port-Based Authentication
Maximum Number of VLAN and Multicast Groups
Ethernet Switching in Cisco AVVID Architecture
Related Features and Technologies
Supported Standards, MIBs, and RFCs
Configuring Layer 2 Interfaces
Configuring a Range of Interfaces
Verifying Configuration of a Range of Interfaces
Configuring Layer 2 Optional Interface Features
Interface Speed and Duplex Configuration Guidelines
Configuring the Interface Speed
Configuring the Interface Duplex Mode
Verifying Interface Speed and Duplex Mode Configuration
Configuring a Description for an Interface
Configuring an Ethernet Interface as a Layer 2 Trunk
Verifying an Ethernet Interface as a Layer 2 Trunk
Configuring an Ethernet Interface as a Layer 2 Access
Verifying an Ethernet Interface as a Layer 2 Access
Verifying the VLAN Configuration.
Deleting a VLAN from the Database
Configuring VLAN Trunking Protocol
Disabling VTP (VTP Transparent Mode)
Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)
Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)
Verifying Layer 2 EtherChannels
Configuring EtherChannel Load Balancing
Verifying EtherChannel Load Balancing
Removing an Interface from an EtherChannel
Configuring Removing an EtherChannel
Verify Removing an EtherChannel
Configuring 802.1x Authentication
Understanding the Default 802.1x Configuration
Enabling 802.1x Authentication
Configuring the Switch-to-RADIUS-Server Communication
Enabling Periodic Reauthentication
Changing the Switch-to-Client Retransmission Time
Setting the Switch-to-Client Frame-Retransmission Number
Resetting the 802.1x Configuration to the Default Values
Displaying 802.1x Statistics and Status
Configuring Spanning Tree Port Priority
Verify Spanning Tree Port Priority
Configuring Spanning Tree Port Cost
Verifying Spanning Tree Port Cost
Configuring the Bridge Priority of a VLAN
Verifying the Bridge Priority of a VLAN
Configuring the Forward-Delay Time for a VLAN
Configuring the Maximum Aging Time for a VLAN
Verifying that Spanning Tree is Disabled
Configuring MAC Table Manipulation — Port Security
Enabling Known MAC Address Traffic
Verifying the MAC Address Secure Configuration
Creating a Static or Dynamic Entry in the MAC Address Table
Verifying the MAC Address Table
Configuring Cisco Discovery Protocol
Enabling Cisco Discovery Protocol
Verifying the CDP Global Configuration
Verifying the CDP Interface Configuration
Monitoring and Maintaining CDP
Configuring Switched Port Analyzer
Specifying the Switched Port Analyzer Session
Removing Sources or Destinations from a SPAN Session
Configuring Network Security with ACLs
Creating Standard and Extended IP ACLs
Creating a Numbered Standard ACL
Creating a Numbered Extended ACL
Creating Named Standard and Extended ACLs
Including Comments About Entries in ACLs
Applying the ACL to an Interface
Configuring Quality of Service (QoS)
Understanding the Default QoS Configuration
Configuring Classification Using Port Trust States
Configuring the Trust State on Ports and SVIs within the QoS Domain
Configuring the CoS Value for an Interface
Classifying Traffic by Using ACLs
Classifying Traffic by Using Class Maps
Classifying, Policing, and Marking Traffic by Using Policy Maps
Configuring the CoS-to-DSCP Map
Configuring the DSCP-to-CoS Map
Configuring Power Management on the Interface
Verifying Power Management on the Interface
Configuring IP Multicast Layer 3 Switching
Enabling IP Multicast Routing Globally
Enabling IP PIM on Layer 3 Interfaces
Verifying IP Multicast Layer 3 Hardware Switching Summary
Verifying the IP Multicast Routing Table
Enabling or Disabling IGMP Snooping
Enabling IGMP Immediate-Leave Processing
Statically Configuring an Interface to Join a Group
Configuring a Multicast Router Port
Configuring Global Storm-Control
Verifying Global Storm-Control
Configuring Per-Port Storm-Control
Enabling Per-Port Storm-Control
Disabling Per-Port Storm-Control
Configuring Separate Voice and Data Subnets
Configuring a Single Subnet for Voice and Data
Verifying Switchport Configuration
Configuring Ethernet Ports to Support Cisco IP Phones with Multiple Ports
Managing the Ethernet Switch Network Module
Assigning IP Information to the Switch
Specifying a Domain Name and Configuring the DNS
Configuring a Port to Connect to a Cisco 7960 IP phone
Disabling Inline Power on a Ethernet switch network module
Verifying Inline Power Configuration
Managing the MAC Address Tables
Understanding MAC Addresses and VLANs
Changing the Address Aging Time
Verifying Aging-Time Configuration
Clearing all MAC Address Tables
Configuring Intrachassis Stacking
Verifying Intra-chassis Stacking
Configuring Flow Control on Gigabit Ethernet Ports
Configuring Layer 3 Interfaces
Understanding the Default Fallback Bridging Configuration
Preventing the Forwarding of Dynamically Learned Stations
Configuring the Bridge Table Aging Time
Filtering Frames by a Specific MAC Address
Adjusting Spanning-Tree Parameters
Monitoring and Maintaining the Network
Configuration Examples for the 16- and 36-Port Ethernet Switch Module
Single Range Configuration Example
Multiple Range Configuration Example
Range Macro Definition Example
Optional Interface Feature Examples
Setting the Interface Duplex Mode Example
Adding a Description for an Interface Example
Configuring an Ethernet Interface as a Layer 2 Trunk Example
Disabling VTP (VTP Transparent Mode) Example
EtherChannel Load Balancing Example
EtherChannel Load Balancing Example
Removing an EtherChannel Example
802.1x Authentication Examples
Enabling 802.1x Authentication Example
Configuring the Switch-to-RADIUS-Server Communication Example
Enabling Periodic Re-Authentication Example
Changing the Quiet Period Example
Changing the Switch-to-Client Retransmission Time Example
Setting the Switch-to-Client Frame-Retransmission Number Example
Enabling Multiple Hosts Example
Spanning-Tree Interface and Spanning-Tree Port Priority Example
Spanning-Tree Port Cost Example
Forward-Delay Time for a VLAN Example
Maximum Aging Time for a VLAN Example
Mac Table Manipulation Examples
Cisco Discovery Protocol (CDP) Example
Switched Port Analyzer (SPAN) Source Examples
SPAN Source Configuration Example
Removing Sources or Destinations from a SPAN Session Example
Network Security and ACL Configuration Examples
Creating Numbered Standard and Extended ACLs Example
Creating Named Standard and Extended ACLs Example
Including Comments About Entries in ACLs Example
Applying the ACL to an Interface Example
Displaying Standard and Extended ACLs Example
Displaying Access Groups Example
Classifying Traffic by Using ACL Example
Classifying Traffic by Using Class Maps Example
Classifying, Policing, and Marking Traffic by Using Policy Maps Example
Configuring the CoS-to-DSCP Map Example
Configuring the DSCP-to-CoS Map Example
Displaying QoS Information Example
Subnets for Voice and Data Example
Single Subnet Configuration Example
Ethernet Ports on IP Phones with Multiple Ports Example
Flow Control on Gigabit Ethernet Ports Example
Configuring Layer 3 Interfaces Example
Creating a Bridge Group Example
Preventing the Forwarding of Dynamically Learned Stations Example
Configuring the Bridge Table Aging Time Example
Filtering Frames by a Specific MAC Address Example
Adjusting Spanning-Tree Parameters Examples
deny (access-list configuration)
ip igmp snooping vlan immediate-leave
match (class-map configuration)
permit (access-list configuration)
16- and 36-Port Ethernet Switch Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series
Feature History
This feature module describes the 16- and 36-Port Ethernet Switch Module (NM-16ESW and NM-36ESW) for Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers in Cisco IOS Release 12.2(2)XT and Cisco IOS Release 12.2(8)T and above. Enhancements were added in Cisco IOS Release 12.2(15)ZJ.
This document includes the following sections:
•
Supported Standards, MIBs, and RFCs
•
Feature Overview
This document explains how to configure the 16- and 36-port Ethernet switch network modules. This network module is supported on Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. The Ethernet switch network module is a modular, high-density voice network module that provides Layer 2 switching across Ethernet ports. The 16-port Ethernet switch network module has 16 10/100BASE-TX ports and an optional 10/100/1000BASE-T Gigabit Ethernet port. The 36-port Ethernet switch network module has 36 10/100BASE-TX ports and two optional 10/100/1000BASE-T Gigabit Ethernet ports. The gigabit Ethernet can be used as an uplink port to a server or as a stacking link to another 16- or 36-port Ethernet switch network modules in the same system. The 36-port Ethernet switch network module requires a double-wide slot. An optional power module can also be added to provide inline power for IP telephones.
The 16- and 36-port Ethernet switch network modules support the following:
•
•
•
Layer 2 Ethernet Interfaces
Layer 2 Ethernet Switching
Ethernet switch network modules support simultaneous, parallel connections between Layer 2 Ethernet segments. Switched connections between Ethernet segments last only for the duration of the packet. New connections can be made between different segments for the next packet.
The Ethernet switch network module solves congestion problems caused by high-bandwidth devices and a large number of users by assigning each device (for example, a server) to its own 10-, 100-, or 1000-Mbps segment. Because each Ethernet interface on the switch represents a separate Ethernet segment, servers in a properly configured switched environment achieve full access to the bandwidth.
Because collisions are a major bottleneck in Ethernet networks, an effective solution is full-duplex communication. Normally, Ethernet operates in half-duplex mode, which means that stations can either receive or transmit. In full-duplex mode, two stations can transmit and receive at the same time. When packets can flow in both directions simultaneously, effective Ethernet bandwidth doubles to 20 Mbps for 10-Mbps interfaces and to 200 Mbps for Fast Ethernet interfaces.
Switching Frames Between Segments
Each Ethernet interface on an Ethernet switch network module can connect to a single workstation or server, or to a hub through which workstations or servers connect to the network.
On a typical Ethernet hub, all ports connect to a common backplane within the hub, and the bandwidth of the network is shared by all devices attached to the hub. If two stations establish a session that uses a significant level of bandwidth, the network performance of all other stations attached to the hub is degraded.
To reduce degradation, the switch treats each interface as an individual segment. When stations on different interfaces need to communicate, the switch forwards frames from one interface to the other at wire speed to ensure that each session receives full bandwidth.
To switch frames between interfaces efficiently, the switch maintains an address table. When a frame enters the switch, it associates the MAC address of the sending station with the interface on which it was received.
Building the Address Table
The Ethernet switch network module builds the address table by using the source address of the frames received. When the switch receives a frame for a destination address not listed in its address table, it floods the frame to all interfaces of the same virtual local area network (VLAN) except the interface that received the frame. When the destination station replies, the switch adds its relevant source address and interface ID to the address table. The switch then forwards subsequent frames to a single interface without flooding to all interfaces. The address table can store at least 8,191 address entries without flooding any entries. The switch uses an aging mechanism, defined by a configurable aging timer; so if an address remains inactive for a specified number of seconds, it is removed from the address table.
Note
VLAN Trunks
A trunk is a point-to-point link between one or more Ethernet switch interfaces and another networking device such as a router or a switch. Trunks carry the traffic of multiple VLANs over a single link and allow you to extend VLANs across an entire network and supports only one encapsulation on all Ethernet interfaces: 802.1Q-802.1Q is an industry-standard trunking encapsulation.
You can configure a trunk on a single Ethernet interface or on an EtherChannel bundle. For more information about EtherChannel, see the "Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)" section.
Layer 2 Interface Modes
Table 1 Default Layer 2 Ethernet Interface Configuration
When you connect a Cisco switch to a device other than a Cisco device through an 802.1Q trunk, the Cisco switch combines the spanning tree instance of the VLAN trunk with the spanning tree instance of the other 802.1Q switch. However, spanning tree information for each VLAN is maintained by Cisco switches separated by a cloud of 802.1Q switches that are not Cisco switches. The 802.1Q cloud separating the Cisco switches that is not Cisco devised, is treated as a single trunk link between the switches.
Make sure that the native VLAN for an 802.1Q trunk is the same on both ends of the trunk link. If the VLAN on one end of the trunk is different from the VLAN on the other end, spanning tree loops might result. Inconsistencies detected by a Cisco switch mark the line as broken and block traffic for the specific VLAN.
Disabling spanning tree on the VLAN of an 802.1Q trunk without disabling spanning tree on every VLAN in the network can potentially cause spanning tree loops. Cisco recommends that you leave spanning tree enabled on the VLAN of an 802.1Q trunk or that you disable spanning tree on every VLAN in the network. Make sure that your network is loop-free before disabling spanning tree.
Layer 2 Interface Configuration Guidelines and Restrictions
Switch Virtual Interfaces
A switch virtual interface (SVI) represents a VLAN of switch ports as one interface to the routing or bridging function in the system. Only one SVI can be associated with a VLAN, but it is necessary to configure an SVI for a VLAN only when you wish to route between VLANs, fallback-bridge nonroutable protocols between VLANs, or to provide IP host connectivity to the switch. By default, an SVI is created for the default VLAN (VLAN 1) to permit remote switch administration. Additional SVIs must be explicitly configured. You can configure routing across SVIs.
SVIs are created the first time that you enter the vlan interface configuration command for a VLAN interface. The VLAN corresponds to the VLAN tag associated with data frames on an ISL or 802.1Q encapsulated trunk or the VLAN ID configured for an access port. Configure a VLAN interface for each VLAN for which you want to route traffic, and assign it an IP address.
SVIs support routing protocol and bridging configurations. For more information about configuring IP routing, see the "Configuring IP Multicast Layer 3 Switching" section.
Routed Ports
A routed port is a physical port that acts like a port on a router; it does not have to be connected to a router. A routed port is not associated with a particular VLAN, as is an access port. A routed port behaves like a regular router interface, except that it does not support subinterfaces. Routed ports can be configured with a Layer 3 routing protocol.
Configure routed ports by putting the interface into Layer 3 mode with the no switchport interface configuration command. Then assign an IP address to the port, enable routing, and assign routing protocol characteristics by using the ip routing and router protocol global configuration commands.
Caution
The number of routed ports and SVIs that you can configure is not limited by software; however, the interrelationship between this number and the number of other features being configured might have an impact on CPU utilization because of hardware limitations.
Routed ports support only CEF switching (IP fast switching is not supported).
VLAN Trunk Protocol
VLAN Trunk Protocol (VTP) is a Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs within a VTP domain. A VTP domain (also called a VLAN management domain) is made up of one or more switches that share the same VTP domain name and that are interconnected with trunks. VTP minimizes misconfigurations and configuration inconsistencies that can result in a number of problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations. Before you create VLANs, you must decide whether to use VTP in your network. With VTP, you can make configuration changes centrally on one or more switches and have those changes automatically communicated to all the other switches in the network.
VTP Domain
A VTP domain (also called a VLAN management domain) is made up of one or more interconnected switches that share the same VTP domain name. A switch can be configured to be in one and only one VTP domain. You make global VLAN configuration changes for the domain using either the command-line interface (CLI) or Simple Network Management Protocol (SNMP).
By default, the switch is in VTP server mode and is in an un-named domain state until the switch receives an advertisement for a domain over a trunk link or until you configure a management domain. You cannot create or modify VLANs on a VTP server until the management domain name is specified or learned.
If the switch receives a VTP advertisement over a trunk link, it inherits the management domain name and the VTP configuration revision number. The switch ignores advertisements with a different management domain name or an earlier configuration revision number.
If you configure the switch as VTP transparent, you can create and modify VLANs but the changes affect only the individual switch.
When you make a change to the VLAN configuration on a VTP server, the change is propagated to all switches in the VTP domain. VTP advertisements are transmitted out all trunk connections using IEEE 802.1Q encapsulation.
VTP maps VLANs dynamically across multiple LAN types with unique names and internal index associations. Mapping eliminates excessive device administration required from network administrators.
VTP Modes
You can configure a switch to operate in any one of these VTP modes:
•
•
•
VTP Advertisements
Each switch in the VTP domain sends periodic advertisements out each trunk interface to a reserved multicast address. VTP advertisements are received by neighboring switches, which update their VTP and VLAN configurations as necessary.
The following global configuration information is distributed in VTP advertisements:
•
•
•
•
•
VTP Version 2
If you use VTP in your network, you must decide whether to use VTP version 1 or version 2. VTP version 2 supports the following features not supported in version 1:
Unrecognized Type-Length-Value (TLV) Support—A VTP server or client propagates configuration changes to its other trunks, even for TLVs it is not able to parse. The unrecognized TLV is saved in NVRAM.
Version-Dependent Transparent Mode—In VTP version 1, a VTP transparent switch inspects VTP messages for the domain name and version, and forwards a message only if the version and domain name match. Since only one domain is supported in the NM-16ESW software, VTP version 2 forwards VTP messages in transparent mode, without checking the version.
Consistency Checks—In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI or SNMP. Consistency checks are not performed when new information is obtained from a VTP message, or when information is read from NVRAM. If the digest on a received VTP message is correct, its information is accepted without consistency checks.
VTP Configuration Guidelines and Restrictions
Follow these guidelines and restrictions when implementing VTP in your network:
•
•
•
•
•
•
•
EtherChannel
EtherChannel bundles up to eight individual Ethernet links into a single logical link that provides bandwidth of up to 1600 Mbps (Fast EtherChannel full duplex) between the network module and another switch or host.
A Ethernet switch network module system supports a maximum of six EtherChannels. All interfaces in each EtherChannel must have the same speed duplex and mode.
Load Balancing
EtherChannel balances traffic load across the links in a channel by reducing part of the binary pattern formed from the addresses in the frame to a numerical value that selects one of the links in the channel.
EtherChannel load balancing can use MAC addresses, or IP addresses; either source or destination or both source and destination. The selected mode applies to all EtherChannels configured on the switch.
Use the option that provides the greatest variety in your configuration. For example, if the traffic on a channel is going only to a single MAC address, using the destination MAC address always chooses the same link in the channel; using source addresses or IP addresses may result in better load balancing.
EtherChannel Configuration Guidelines and Restrictions
If improperly configured, some EtherChannel interfaces are disabled automatically to avoid network loops and other problems. Follow these guidelines and restrictions to avoid configuration problems:
•
•
•
•
For Layer 2 EtherChannels:
•
An EtherChannel supports the same allowed range of VLANs on all interfaces in a trunking Layer 2 EtherChannel. If the allowed range of VLANs is not the same, the interfaces do not form an EtherChannel.
Interfaces with different Spanning Tree Protocol (STP) port path costs can form an EtherChannel as long they are otherwise compatibly configured. Setting different STP port path costs does not, by itself, make interfaces incompatible for the formation of an EtherChannel.
After you configure an EtherChannel, configuration that you apply to the port-channel interface affects the EtherChannel.
802.1x Port-Based Authentication
This section describes how to configure IEEE 802.1x port-based authentication to prevent unauthorized devices (clients) from gaining access to the network. As LANs extend to hotels, airports, and corporate lobbies, insecure environments could be created.
Understanding 802.1x Port-Based Authentication
The IEEE 802.1x standard defines a client/server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports. The authentication server authenticates each client connected to a switch port before making available any services offered by the switch or the LAN.
Until the client is authenticated, 802.1x access control allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port.
Device Roles
With 802.1x port-based authentication, the devices in the network have specific roles as shown in Figure 1.
Figure 1 802.1x Device Roles
•
Note
http://support.microsoft.com/support/kb/articles/Q303/5/97.ASP
•
•
When the switch receives EAPOL frames and relays them to the authentication server, the Ethernet header is stripped and the remaining EAP frame is reencapsulated in the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the authentication server must support EAP within the native frame format. When the switch receives frames from the authentication server, the server's frame header is removed, leaving the EAP frame, which is then encapsulated for Ethernet and sent to the client.
The devices that can act as intermediaries include the Catalyst 3550 multilayer switch, Catalyst 2950 switch, or a wireless access point. These devices must be running software that supports the RADIUS client and 802.1x.
Authentication Initiation and Message Exchange
The switch or the client can initiate authentication. If you enable authentication on a port by using the dot1x port-control auto interface configuration command, the switch must initiate authentication when it determines that the port link state changes from down to up. It then sends an EAP-request/identity frame to the client to request its identity (typically, the switch sends an initial identity/request frame followed by one or more requests for authentication information). Upon receipt of the frame, the client responds with an EAP-response/identity frame.
However, if during bootup, the client does not receive an EAP-request/identity frame from the switch, the client can initiate authentication by sending an EAPOL-start frame, which prompts the switch to request the client's identity.
Note
When the client supplies its identity, the switch begins its role as the intermediary, passing EAP frames between the client and the authentication server until authentication succeeds or fails. If the authentication succeeds, the switch port becomes authorized. For more information, see the "Ports in Authorized and Unauthorized States" section.
The specific exchange of EAP frames depends on the authentication method being used. Figure 2 shows a message exchange initiated by the client using the One-Time-Password (OTP) authentication method with a RADIUS server.
Figure 2 Message Exchange
Ports in Authorized and Unauthorized States
The switch port state determines whether or not the client is granted access to the network. The port starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except for 802.1x packets. When a client is successfully authenticated, the port changes to the authorized state, allowing all traffic for the client to flow normally.
If a client that does not support 802.1x is connected to an unauthorized 802.1x port, the switch requests the client's identity. In this situation, the client does not respond to the request, the port remains in the unauthorized state, and the client is not granted access to the network.
In contrast, when an 802.1x-enabled client connects to a port that is not running 802.1x, the client initiates the authentication process by sending the EAPOL-start frame. When no response is received, the client sends the request for a fixed number of times. Because no response is received, the client begins sending frames as if the port is in the authorized state.
You control the port authorization state by using the dot1x port-control interface configuration command and these keywords:
•
•
•
If the client is successfully authenticated (receives an Accept frame from the authentication server), the port state changes to authorized, and all frames from the authenticated client are allowed through the port. If the authentication fails, the port remains in the unauthorized state, but authentication can be retried. If the authentication server cannot be reached, the switch can retransmit the request. If no response is received from the server after the specified number of attempts, authentication fails, and network access is not granted.
When a client logs off, it sends an EAPOL-logoff message, causing the switch port to change to the unauthorized state.
If the link state of a port changes from up to down, or if an EAPOL-logoff frame is received, the port returns to the unauthorized state.
Supported Topologies
The 802.1x port-based authentication is supported in two topologies:
•
•
In a point-to-point configuration (see Figure 1), only one client can be connected to the 802.1x-enabled switch port. The switch detects the client when the port link state changes to the up state. If a client leaves or is replaced with another client, the switch changes the port link state to down, and the port returns to the unauthorized state.
Figure 3 shows 802.1x-port-based authentication in a wireless LAN. The 802.1x port is configured as a multiple-host port that becomes authorized as soon as one client is authenticated. When the port is authorized, all other hosts indirectly attached to the port are granted access to the network. If the port becomes unauthorized (reauthentication fails or an EAPOL-logoff message is received), the switch denies access to the network to all of the attached clients. In this topology, the wireless access point is responsible for authenticating the clients attached to it, and the wireless access point acts as a client to the switch.
Figure 3 Wireless LAN Example
Spanning Tree Protocol
This section describes how to configure the Spanning Tree Protocol (STP) on Ethernet switch network module systems.
Spanning tree is a Layer 2 link management protocol that provides path redundancy while preventing undesirable loops in the network. For a Layer 2 Ethernet network to function properly, only one active path can exist between any two stations. Spanning tree operation is transparent to end stations, which cannot detect whether they are connected to a single LAN segment or to a switched LAN of multiple segments.
The Ethernet switch network module uses STP (the IEEE 802.1D bridge protocol) on all VLANs. By default, a single instance of STP runs on each configured VLAN (provided that you do not manually disable STP). You can enable and disable STP on a per-VLAN basis.
When you create fault-tolerant internetworks, you must have a loop-free path between all nodes in a network. The spanning tree algorithm calculates the best loop-free path throughout a switched Layer 2 network. Switches send and receive spanning tree frames at regular intervals. The switches do not forward these frames, but use the frames to construct a loop-free path.
Spanning Tree Protocol defines a tree with a root switch and a loop-free path from the root to all switches in the Layer 2 network. Spanning tree forces redundant data paths into a standby (blocked) state. If a network segment in the spanning tree fails and a redundant path exists, the spanning tree algorithm recalculates the spanning tree topology and activates the standby path.
When two ports on a switch are part of a loop, the spanning tree port priority and port path cost setting determine which port is put in the forwarding state and which port is put in the blocking state. The spanning tree port priority value represents the location of an interface in the network topology and how well located it is to pass traffic. The spanning tree port path cost value represents media speed.
Bridge Protocol Data Units
The stable active spanning tree topology of a switched network is determined by the following:
•
•
•
The Bridge Protocol Data Units (BPDU) are transmitted in one direction from the root switch, and each switch sends configuration BPDUs to communicate and compute the spanning tree topology. Each configuration BPDU contains the following minimal information:
•
•
•
•
•
•
When a switch transmits a bridge packet data unit (BPDU) frame, all switches connected to the LAN on which the frame is transmitted receive the BPDU. When a switch receives a BPDU, it does not forward the frame but instead uses the information in the frame to calculate a BPDU, and, if the topology changes, initiate a BPDU transmission.
A BPDU exchange results in the following:
•
•
•
•
•
•
For each VLAN, the switch with the highest bridge priority (the lowest numerical priority value) is elected as the root switch. If all switches are configured with the default priority (32768), the switch with the lowest MAC address in the VLAN becomes the root switch.
The spanning tree root switch is the logical center of the spanning tree topology in a switched network. All paths that are not needed to reach the root switch from anywhere in the switched network are placed in spanning tree blocking mode.
BPDUs contain information about the transmitting bridge and its ports, including bridge and MAC addresses, bridge priority, port priority, and path cost. Spanning tree uses this information to elect the root bridge and root port for the switched network, as well as the root port and designated port for each switched segment.
STP Timers
Table 2 describes the STP timers that affect the entire spanning tree performance:
Table 2
STP Timers
Spanning Tree Port States
Propagation delays can occur when protocol information passes through a switched LAN. As a result, topology changes can take place at different times and at different places in a switched network. When a Layer 2 interface changes directly from nonparticipation in the spanning tree topology to the forwarding state, it can create temporary data loops. Ports must wait for new topology information to propagate through the switched LAN before starting to forward frames. They must allow the frame lifetime to expire for frames that have been forwarded using the old topology.
Each Layer 2 interface on a switch using spanning tree exists in one of the following five states:
•
•
•
•
•
A Layer 2 interface moves through these five states as follows:
•
•
•
•
•
Figure 4 illustrates how a port moves through the five stages.
Figure 4 STP Port States
When you enable spanning tree, every port in the switch, VLAN, or network goes through the blocking state and the transitory states of listening and learning at power up. If properly configured, each Layer 2 interface stabilizes to the forwarding or blocking state.
When the spanning tree algorithm places a Layer 2 interface in the forwarding state, the following process occurs:
1.
2.
3.
4.
Blocking State
A Layer 2 interface in the blocking state does not participate in frame forwarding, as shown in Figure 5. After initialization, a BPDU is sent out to each Layer 2 interface in the switch. A switch initially assumes it is the root until it exchanges BPDUs with other switches. This exchange establishes which switch in the network is the root or root bridge. If only one switch is in the network, no exchange occurs, the forward delay timer expires, and the ports move to the listening state. A port always enters the blocking state following switch initialization.
Figure 5 Interface 2 in Blocking State
A Layer 2 interface in the blocking state performs as follows:
•
•
•
•
•
•
Listening State
The listening state is the first transitional state a Layer 2 interface enters after the blocking state. The Layer 2 interface enters this state when STP determines that the Layer 2 interface should participate in frame forwarding. Figure 6 shows a Layer 2 interface in the listening state.
Figure 6 Interface 2 in Listening State
A Layer 2 interface in the listening state performs as follows:
•
•
•
•
•
•
Learning State
A Layer 2 interface in the learning state prepares to participate in frame forwarding. The Layer 2 interface enters the learning state from the listening state. Figure 7 shows a Layer 2 interface in the learning state.
Figure 7 Interface 2 in Learning State
A Layer 2 interface in the learning state performs as follows:
•
•
•
•
•
•
Forwarding State
A Layer 2 interface in the forwarding state forwards frames, as shown in Figure 8. The Layer 2 interface enters the forwarding state from the learning state.
Figure 8 Interface 2 in Forwarding State
A Layer 2 interface in the forwarding state performs as follows:
•
•
•
•
•
•
Disabled State
A Layer 2 interface in the disabled state does not participate in frame forwarding or spanning tree, as shown in Figure 9. A Layer 2 interface in the disabled state is virtually nonoperational.
Figure 9 Interface 2 in Disabled State
A disabled Layer 2 interface performs as follows:
•
•
•
•
•
MAC Address Allocation
The MAC address allocation manager has a pool of MAC addresses that are used as the bridge IDs for the VLAN spanning trees. In Table 3 you can view the number of VLANs allowed for each platform.
Table 3 Number of VLANs Allowed by Platform
Cisco 3640 or higher
64 VLANS
Cisco 3620
32 VLANs
Cisco 2600
32 VLANs
MAC addresses are allocated sequentially, with the first MAC address in the range assigned to VLAN 1, the second MAC address in the range assigned to VLAN 2, and so forth.
For example, if the MAC address range is 00-e0-1e-9b-2e-00 to 00-e0-1e-9b-31-ff, the VLAN 1 bridge ID is 00-e0-1e-9b-2e-00, the VLAN 2 bridge ID is 00-e0-1e-9b-2e-01, the VLAN 3 bridge ID is 00-e0-1e-9b-2e-02, and so forth.
Default Spanning Tree Configuration
In Table 4 you can view the default Spanning Tree configuration values.
Table 4 Spanning Tree Default Configuration
Spanning Tree Port Priority
In the event of a loop, spanning tree considers port priority when selecting an interface to put into the forwarding state. You can assign higher priority values to interfaces that you want spanning tree to select first, and lower priority values to interfaces that you want spanning tree to select last. If all interfaces have the same priority value, spanning tree puts the interface with the lowest interface number in the forwarding state and blocks other interfaces. The possible priority range is 0 to 255, configurable in increments of 4 (the default is 128).
Cisco IOS software uses the port priority value when the interface is configured as an access port and uses VLAN port priority values when the interface is configured as a trunk port.
Spanning Tree Port Cost
The spanning tree port path cost default value is derived from the media speed of an interface. In the event of a loop, spanning tree considers port cost when selecting an interface to put into the forwarding state. You can assign lower cost values to interfaces that you want spanning tree to select first and higher cost values to interfaces that you want spanning tree to select last. If all interfaces have the same cost value, spanning tree puts the interface with the lowest interface number in the forwarding state and blocks other interfaces.
The possible cost range is 0 to 65535 (the default is media-specific).
Spanning tree uses the port cost value when the interface is configured as an access port and uses VLAN port cost values when the interface is configured as a trunk port.
BackboneFast
BackboneFast is initiated when a root port or blocked port on a switch receives inferior BPDUs from its designated bridge. An inferior BPDU identifies one switch as both the root bridge and the designated bridge. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated bridge has lost its connection to the root switch). Under STP rules, the switch ignores inferior BPDUs for the configured maximum aging time specified by the spanning-tree max-age global configuration command.
The switch tries to determine if it has an alternate path to the root switch. If the inferior BPDU arrives on a blocked port, the root port and other blocked ports on the switch become alternate paths to the root switch. (Self-looped ports are not considered alternate paths to the root switch.) If the inferior BPDU arrives on the root port, all blocked ports become alternate paths to the root switch. If the inferior BPDU arrives on the root port and there are no blocked ports, the switch assumes that it has lost connectivity to the root switch, causes the maximum aging time on the root to expire, and becomes the root switch according to normal STP rules.
If the switch has alternate paths to the root switch, it uses these alternate paths to transmit a new kind of Protocol Data Unit (PDU) called the Root Link Query PDU. The switch sends the Root Link Query PDU on all alternate paths to the root switch. If the switch determines that it still has an alternate path to the root, it causes the maximum aging time on the ports on which it received the inferior BPDU to expire. If all the alternate paths to the root switch indicate that the switch has lost connectivity to the root switch, the switch causes the maximum aging times on the ports on which it received an inferior BPDU to expire. If one or more alternate paths can still connect to the root switch, the switch makes all ports on which it received an inferior BPDU its designated ports and moves them out of the blocking state (if they were in the blocking state), through the listening and learning states, and into the forwarding state.
Figure 10 shows an example topology with no link failures. Switch A, the root switch, connects directly to Switch B over link L1 and to Switch C over link L2. The interface on Switch C that connects directly to Switch B is in the blocking state.
Figure 10 BackboneFast Example Before Indirect Link Failure
If link L1 fails, Switch C cannot detect this failure because it is not connected directly to link L1. However, because Switch B is directly connected to the root switch over L1, it detects the failure, elects itself the root, and begins sending BPDUs to Switch C, identifying itself as the root. When Switch C receives the inferior BPDUs from Switch B, Switch C assumes that an indirect failure has occurred. At that point, BackboneFast allows the blocked port on Switch C to move immediately to the listening state without waiting for the maximum aging time for the port to expire. BackboneFast then changes the interface on Switch C to the forwarding state, providing a path from Switch B to Switch A. This switchover takes approximately 30 seconds, twice the Forward Delay time if the default Forward Delay time of 15 seconds is set. Figure 11 shows how BackboneFast reconfigures the topology to account for the failure of link L1.
Figure 11 BackboneFast Example After Indirect Link Failure
If a new switch is introduced into a shared-medium topology as shown in Figure 12, BackboneFast is not activated because the inferior BPDUs did not come from the recognized designated bridge (Switch B). The new switch begins sending inferior BPDUs that say it is the root switch. However, the other switches ignore these inferior BPDUs, and the new switch learns that Switch B is the designated bridge to Switch A, the root switch.
Figure 12 Adding a Switch in a Shared-Medium Topology
Cisco Discovery Protocol
Cisco Discovery Protocol (CDP) is a protocol that runs over Layer 2 (the data link layer) on all Cisco routers, bridges, access servers, and switches. CDP allows network management applications to discover Cisco devices that are neighbors of already known devices, in particular, neighbors running lower-layer, transparent protocols. With CDP, network management applications can learn the device type and the SNMP agent address of neighboring devices. This feature enables applications to send SNMP queries to neighboring devices.
CDP runs on all LAN and WAN media that support Subnetwork Access Protocol (SNAP). Each CDP-configured device sends periodic messages to a multicast address. Each device advertises at least one address at which it can receive SNMP messages. The advertisements also contain the time-to-live, or hold-time information, which indicates the length of time a receiving device should hold CDP information before discarding it.
Switched Port Analyzer
Switched Port Analyzer Session
A Switched Port Analyzer (SPAN) session is an association of a destination interface with a set of source interfaces. You configure SPAN sessions using parameters that specify the type of network traffic to monitor. SPAN sessions allow you to monitor traffic on one or more interfaces and to send either ingress traffic, egress traffic, or both to one destination interface. You can configure one SPAN session with separate or overlapping sets of SPAN source interfaces or VLANs. Only switched interfaces can be configured as SPAN sources or destinations on the same network module.
SPAN sessions do not interfere with the normal operation of the switch. You can enable or disable SPAN sessions with command-line interface (CLI) or SNMP commands. When enabled, a SPAN session might become active or inactive based on various events or actions, and this would be indicated by a syslog message. The show monitor session SPAN session number command displays the operational status of a SPAN session.
A SPAN session remains inactive after system power-up until the destination interface is operational.
Destination Interface
A destination interface (also called a monitor interface) is a switched interface to which SPAN sends packets for analysis. You can have one SPAN destination interface. Once an interface becomes an active destination interface, incoming traffic is disabled. You cannot configure a SPAN destination interface to receive ingress traffic. The interface does not forward any traffic except that required for the SPAN session.
An interface configured as a destination interface cannot be configured as a source interface. EtherChannel interfaces cannot be SPAN destination interfaces.
Specifying a trunk interface as a SPAN destination interface stops trunking on the interface.
Source Interface
A source interface is an interface monitored for network traffic analysis. One or more source interfaces can be monitored in a single SPAN session with user-specified traffic types (ingress, egress, or both) applicable for all the source interfaces.
You can configure source interfaces in any VLAN. You can configure EtherChannel as source interfaces, which means that all interfaces in the specified VLANs are source interfaces for the SPAN session.
Trunk interfaces can be configured as source interfaces and mixed with nontrunk source interfaces; however, the destination interface never encapsulates.
Traffic Types
Ingress SPAN (Rx) copies network traffic received by the source interfaces for analysis at the destination interface. Egress SPAN (Tx) copies network traffic transmitted from the source interfaces. Specifying the configuration option both copies network traffic received and transmitted by the source interfaces to the destination interface.
SPAN Traffic
Network traffic, including multicast, can be monitored using SPAN. Multicast packet monitoring is enabled by default. In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination interface. For example, a bidirectional (both ingress and egress) SPAN session is configured for sources a1 and a2 to a destination interface d1. If a packet enters the switch through a1 and gets switched to a2, both incoming and outgoing packets are sent to destination interface d1; both packets would be the same (unless a Layer-3 rewrite had occurred, in which case the packets would be different).
Note
SPAN Configuration Guidelines and Restrictions
Follow these guidelines and restrictions when configuring SPAN:
•
•
•
•
•
•
•
•
•
•
•
•
•
Network Security with ACLs
Network security on your Ethernet switch network module can be implemented using access control lists (ACLs), which are also referred to in commands and tables as access lists.
Understanding ACLs
Packet filtering can limit network traffic and restrict network use by certain users or devices. ACLs can filter traffic as it passes through a switch and permit or deny packets from crossing specified interfaces. An ACL is a sequential collection of permit and deny conditions that apply to packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied ACLs to verify that the packet has the required permissions to be forwarded, based on the criteria specified in the access lists. The switch tests the packet against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packet. Because the switch stops testing conditions after the first match, the order of conditions in the list is critical. If no conditions match, the switch rejects the packet. If there are no restrictions, the switch forwards the packet; otherwise, the switch drops the packet.
You configure access lists on a Layer 2 switch to provide basic security for your network. If you do not configure ACLs, all packets passing through the switch could be allowed onto all parts of the network. You can use ACLs to control which hosts can access different parts of a network or to decide which types of traffic are forwarded or blocked at switch interfaces. For example, you can allow e-mail traffic to be forwarded but not Telnet traffic. ACLs can be configured to block inbound traffic.
An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny depends on the context in which the ACL is used.
The Ethernet switch network module supports IP ACLs to filter IP traffic, including TCP or User Datagram Protocol (UDP) traffic (but not both traffic types in the same ACL).
ACLs
You can apply ACLs on physical Layer 2 interfaces. ACLs are applied on interfaces only on the inbound direction.
•
•
The switch examines access lists associated with features configured on a given interface and a direction. As packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface are examined.
ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL. For example, you can use ACLs to allow one host to access a part of a network, but to prevent another host from accessing the same part. In Figure 13, ACLs applied at the switch input allow Host A to access the Human Resources network, but prevent Host B from accessing the same network.
Figure 13 Using ACLs to Control Traffic to a Network
Handling Fragmented and Unfragmented Traffic
IP packets can be fragmented as they cross the network. When this happens, only the fragment containing the beginning of the packet contains the Layer 4 information, such as TCP or UDP port numbers, ICMP type and code, and so on. All other fragments are missing this information.
Some ACEs do not check Layer 4 information and therefore can be applied to all packet fragments. ACEs that do test Layer 4 information cannot be applied in the standard manner to most of the fragments in a fragmented IP packet. When the fragment contains no Layer 4 information and the ACE tests some Layer 4 information, the matching rules are modified:
•
•
Consider access list 102, configured with these commands, applied to three fragmented packets:
Switch (config)# access-list 102 permit tcp any host 10.1.1.1 eq smtpSwitch (config)# access-list 102 deny tcp any host 10.1.1.2 eq telnetSwitch (config)# access-list 102 deny tcp any any
Note
•
•
•
•
Understanding Access Control Parameters
Before configuring ACLs on the Ethernet switch network module, you must have a thorough understanding of the Access Control Parameters (ACPs). ACPs are referred to as masks in the switch CLI commands, and output.
Each ACE has a mask and a rule. The Classification Field or mask is the field of interest on which you want to perform an action. The specific values associated with a given mask are called rules.
Packets can be classified on these Layer 3 and Layer 4 fields.
•
–
–
You can use any combination or all of these fields simultaneously to define a flow.
•
–
–
Note
There are two types of masks:
•
•
Switch (config-ext-nacl)# permit tcp any anySwitch (config-ext-nacl)# deny tcp any anySwitch (config-ext-nacl)# permit udp any anySwitch (config-ext-nacl)# deny udp any anySwitch (config-ext-nacl)# permit ip any anySwitch (config-ext-nacl)# deny ip any anySwitch (config-ext-nacl)# deny any anySwitch (config-ext-nacl)# permit any any
Note
The Ethernet switch network module ACL configuration is consistent with Cisco Catalyst switches. However, there are significant restrictions as well as differences for ACL configurations on the Ethernet switch network module.
Guidelines for Configuring ACLs on the Ethernet Switch Network Module
These configuration guidelines apply to ACL filters:
•
•
The following example shows the same mask in an ACL:
Switch (config)#ip access-list extended acl2Switch (config-ext-nacl)# permit tcp 10.1.1.1 0.0.0.0 any eq 80Switch (config-ext-nacl)# permit tcp 20.1.1.1 0.0.0.0 any eq 23In this example, the first ACE permits all the TCP packets coming from the host 10.1.1.1 with a destination TCP port number of 80. The second ACE permits all TCP packets coming from the host 20.1.1.1 with a destination TCP port number of 23. Both the ACEs use the same mask; therefore, a Ethernet switch network module supports this ACL.
•
Table 5 lists a summary of the ACL restrictions on Ethernet switch network modules.
Quality of Service
Quality of service (QoS) can be implemented on your Ethernet switch network module. With this feature, you can provide preferential treatment to certain types of traffic. Without QoS, the switch offers best-effort service to each packet, regardless of the packet contents or size. It transmits the packets without any assurance of reliability, delay bounds, or throughput.
Understanding Quality of Service (QoS)
Typically, networks operate on a best-effort delivery basis, which means that all traffic has equal priority and an equal chance of being delivered in a timely manner. When congestion occurs, all traffic has an equal chance of being dropped.
With the QoS feature configured on your switch, you can select specific network traffic, prioritize it according to its relative importance, and use congestion-management and congestion-avoidance techniques to provide preferential treatment. Implementing QoS in your network makes network performance more predictable and bandwidth utilization more effective.
The QoS implementation for this release is based on the DiffServ architecture, an emerging standard from the Internet Engineering Task Force (IETF). This architecture specifies that each packet is classified upon entry into the network. The classification is carried in the IP packet header, using 6 bits from the deprecated IP type of service (ToS) field to carry the classification (class) information. Classification can also be carried in the Layer 2 frame. These special bits in the Layer 2 frame or a Layer 3 packet are described here and shown in Figure 14:
•
Layer 2 802.1Q frame headers have a 2-byte Tag Control Information field that carries the CoS value in the three most-significant bits, which are called the User Priority bits. On interfaces configured as Layer 2 802.1Q trunks, all traffic is in 802.1Q frames except for traffic in the native VLAN.
Other frame types cannot carry Layer 2 CoS values.
Layer 2 CoS values range from 0 for low priority to 7 for high priority.
•
Layer 3 IP packets can carry a Differentiated Services Code Point (DSCP) value. The supported DSCP values are 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56.
Figure 14 QoS Classification Layers in Frames and Packets
Note
Note
All switches and routers across the Internet rely on the class information to provide the same forwarding treatment to packets with the same class information and different treatment to packets with different class information. The class information in the packet can be assigned by end hosts or by switches or routers along the way, based on a configured policy, detailed examination of the packet, or both. Detailed examination of the packet is expected to happen closer to the edge of the network so that the core switches and routers are not overloaded.
Switches and routers along the path can use the class information to limit the amount of resources allocated per traffic class. The behavior of an individual device when handling traffic in the DiffServ architecture is called per-hop behavior. If all devices along a path provide a consistent per-hop behavior, you can construct an end-to-end QoS solution.
Implementing QoS in your network can be a simple or complex task and depends on the QoS features offered by your internetworking devices, the traffic types and patterns in your network, and the granularity of control you need over incoming and outgoing traffic.
The Ethernet switch network module can function as a Layer 2 switch connected to a Layer 3 router. When a packet enters the Layer 2 engine directly from a switch port, it is placed into one of four queues in the dynamic, 32-MB shared memory buffer. The queue assignment is based on the dot1p value in the packet. Any voice bearer packets that come in from the Cisco IP phones on the voice VLAN are automatically placed in the highest priority (Queue 3) based on the 802.1p value generated by the IP phone. The queues are then serviced on a weighted round robin (WRR) basis. The control traffic, which uses a CoS or ToS of 3, is placed in Queue 2.
Table 6 summarizes the queues, CoS values, and weights for Layer 2 QoS on the Ethernet switch network module.
Table 6 Queues, CoS values, and Weights for Layer 2 QoS
The weights specify the number of packets that are serviced in the queue before moving on to the next queue. Voice Realtime Transport Protocol (RTP) bearer traffic marked with a CoS or ToS of 5 and Voice Control plane traffic marked with a CoS/ToS of 3 are placed into the highest priority queues. If the queue has no packets to be serviced, it is skipped. Weighted Random Early Detection (WRED) is not supported on the Fast Ethernet ports.
You cannot configure port-based QoS on the Layer 2 switch ports.
Basic QoS Model
Figure 15 shows the basic QoS model. Actions at the ingress interface include classifying traffic, policing, and marking:
•
•
•
Actions at the egress interface include queueing and scheduling:
•
•
Figure 15 Basic QoS Model
Classification
Classification is the process of distinguishing one kind of traffic from another by examining the fields in the packet.
Classification occurs only on a physical interface basis. No support exists for classifying packets at the VLAN or the switched virtual interface level.
You specify which fields in the frame or packet that you want to use to classify incoming traffic.
Classification Based on QoS ACLs
You can use IP standard or IP extended ACLs to define a group of packets with the same characteristics (class). In the QoS context, the permit and deny actions in the access control entries (ACEs) have different meanings than with security ACLs:
•
•
•
•
•
–
–
–
Note
•
After a traffic class has been defined with the ACL, you can attach a policy to it. A policy might contain multiple classes with actions specified for each one of them. A policy might include commands to rate-limit the class. This policy is then attached to a particular port on which it becomes effective.
You implement IP ACLs to classify IP traffic by using the access-list global configuration command.
Classification Based on Class Maps and Policy Maps
A class map is a mechanism that you use to isolate and name a specific traffic flow (or class) from all other traffic. The class map defines the criteria used to match against a specific traffic flow to further classify it; the criteria can include matching the access group defined by the ACL. If you have more than one type of traffic that you want to classify, you can create another class map and use a different name. After a packet is matched against the class-map criteria, you further classify it through the use of a policy map.
A policy map specifies which traffic class to act on. Actions can include setting a specific DSCP value in the traffic class or specifying the traffic bandwidth limitations and the action to take when the traffic is out of profile. Before a policy map can be effective, you must attach it to an interface.
You create a class map by using the class-map global configuration command or the class policy-map configuration command. You should use the class-map global configuration command when the map is shared among many ports. When you enter the class-map global configuration command, the switch enters the class-map configuration mode. In this mode, you define the match criterion for the traffic by using the match class-map configuration command.
You create and name a policy map by using the policy-map global configuration command. When you enter this command, the switch enters the policy-map configuration mode. In this mode, you specify the actions to take on a specific traffic class by using the class policy-map configuration command and the police policy-map class configuration command. To make the policy map effective, you attach it to an interface by using the service-policy interface configuration command.
The policy map can also contain commands that define the policer, the bandwidth limitations of the traffic, and the action to take if the limits are exceeded. For more information, see the "Policing and Marking" section.
A policy map also has these characteristics:
•
•
•
For configuration information, see the "Configuring a QoS Policy" section.
Policing and Marking
Policing involves creating a policer that specifies the bandwidth limits for the traffic. Packets that exceed the limits are out of profile or nonconforming. Each policer specifies the action to take for packets that are in or out of profile. These actions, carried out by the marker, include dropping the packet, or marking down the packet with a new value that is user-defined.
You can create this type of policer:
Individual—QoS applies the bandwidth limits specified in the policer separately to each matched traffic class. You configure this type of policer within a policy map by using the policy-map configuration command.
For non-IP traffic, you have these marking options:
•
•
The trust DSCP configuration is meaningless for non-IP traffic. If you configure a port with this option and non-IP traffic is received, the switch assigns the default port CoS value and classifies traffic based on the CoS value.
For IP traffic, you have these classification options:
•
•
When configuring policing and policers, keep these items in mind:
•
•
•
•
•
–
–
–
•
•
Note
Mapping Tables
The Ethernet switch network modules support these types of marking to apply to the switch:
•
•
Note
Before the traffic reaches the scheduling stage, QoS uses the configurable DSCP-to-CoS map to derive a CoS value from the internal DSCP value.
The CoS-to-DSCP and DSCP-to-CoS map have default values that might or might not be appropriate for your network.
For configuration information, see the "Configuring CoS Maps" section.
Maximum Number of VLAN and Multicast Groups
The maximum number is less than or equal to 242. The number of VLANs is determined by multiplying the number of VLANs by the number of multicast groups. For example, the maximum number for 10 VLANs and 20 groups would be 200, under the 242 limit.
IP Multicast Support
The maximum number of multicast groups is related to the maximum number of VLANs. The product of the number of multicast groups and the number of VLANs cannot exceed 242. This feature also provides support for Protocol Independent Multicast (PIM) sparse mode/dense mode sparse-dense mode.
IGMP Snooping
Understanding IGMP Snooping
Internet Group Management Protocol (IGMP) snooping constrains the flooding of multicast traffic by dynamically configuring the interfaces so that multicast traffic is forwarded only to those interfaces associated with IP multicast devices. The LAN switch snoops on the IGMP traffic between the host and the router and keeps track of multicast groups and member ports. When the switch receives an IGMP join report from a host for a particular multicast group, the switch adds the host port number to the associated multicast forwarding table entry. When it receives an IGMP Leave Group message from a host, it removes the host port from the table entry. After it relays the IGMP queries from the multicast router, it deletes entries periodically if it does not receive any IGMP membership reports from the multicast clients.
When IGMP snooping is enabled, the multicast router sends out periodic IGMP general queries to all VLANs. The switch responds to the router queries with only one join request per MAC multicast group, and the switch creates one entry per VLAN in the Layer 2 forwarding table for each MAC group from which it receives an IGMP join request. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry.
Layer 2 multicast groups learned through IGMP snooping are dynamic. However, you can statically configure MAC multicast groups by using the ip igmp snooping vlan static command. If you specify group membership for a multicast group address statically, your setting supersedes any automatic manipulation by IGMP snooping. Multicast group membership lists can consist of both user-defined and IGMP snooping-learned settings.
Ethernet switch network modules support a maximum of 255 IP multicast groups and support both IGMP version 1 and IGMP version 2.
If a port spanning-tree, a port group, or a VLAN ID change occurs, the IGMP snooping-learned multicast groups from this port on the VLAN are deleted.
In the IP multicast-source-only environment, the switch learns the IP multicast group from the IP multicast data stream and only forwards traffic to the multicast router ports.
Immediate-Leave Processing
IGMP snooping Immediate-Leave processing allows the switch to remove an interface that sends a leave message from the forwarding table without first sending out MAC-based general queries to the interface. The VLAN interface is pruned from the multicast tree for the multicast group specified in the original leave message. Immediate-Leave processing ensures optimal bandwidth management for all hosts on a switched network, even when multiple multicast groups are in use simultaneously.
Note
Setting the Snooping Method
Multicast-capable router ports are added to the forwarding table for every IP multicast entry. The switch learns of such ports through one of these methods:
•
•
You can configure the switch to snoop on PIM/Distance Vector Multicast Routing Protocol (PIM/DVMRP) packets. By default, the switch snoops on PIM/DVMRP packets on all VLANs. To learn of multicast router ports through PIM-DVMRP packets, use the ip igmp snooping vlan vlan-id mrouter learn pim-dvmrp interface command.
Joining a Multicast Group
When a host connected to the switch wants to join an IP multicast group, it sends an IGMP join message, specifying the IP multicast group it wants to join. When the switch receives this message, it adds the port to the IP multicast group port address entry in the forwarding table.
Refer to Figure 16. Host 1 wants to join multicast group 224.1.2.3 and multicasts an unsolicited IGMP membership report (IGMP join message) to the group with the equivalent MAC destination address of 0100.5E01.0203. The switch recognizes IGMP packets and forwards them to the CPU. When the CPU receives the IGMP report multicast by Host 1, the CPU uses the information to set up a multicast forwarding table entry as shown in Table 7 that includes the port numbers of Host 1 and the router.
Figure 16 Initial IGMP Join Message
Table 7 IP Multicast Forwarding Table
0100.5e01.0203
!IGMP
1, 2
Note that the switch architecture allows the CPU to distinguish IGMP information packets from other packets for the multicast group. The switch recognizes the IGMP packets through its filter engine. This prevents the CPU from becoming overloaded with multicast frames.
The entry in the multicast forwarding table tells the switching engine to send frames addressed to the 0100.5E01.0203 multicast MAC address that are not IGMP packets (!IGMP) to the router and to the host that has joined the group.
If another host (for example, Host 4) sends an IGMP join message for the same group (Figure 17), the CPU receives that message and adds the port number of Host 4 to the multicast forwarding table as shown in Table 8.
Figure 17 Second Host Joining a Multicast Group
Table 8 Updated Multicast Forwarding Table
0100.5e01.0203
!IGMP
1, 2, 5
Leaving a Multicast Group
The router sends periodic IP multicast general queries, and the switch responds to these queries with one join response per MAC multicast group. As long as at least one host in the VLAN needs multicast traffic, the switch responds to the router queries, and the router continues forwarding the multicast traffic to the VLAN. The switch only forwards IP multicast group traffic to those hosts listed in the forwarding table for that IP multicast group.
When hosts need to leave a multicast group, they can either ignore the periodic general-query requests sent by the router, or they can send a leave message. When the switch receives a leave message from a host, it sends out a group-specific query to determine if any devices behind that interface are interested in traffic for the specific multicast group. If, after a number of queries, the router processor receives no reports from a VLAN, it removes the group for the VLAN from its multicast forwarding table.
Global Storm-Control
Global storm-control prevents switchports on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the interfaces. A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation or in the network configuration can cause a storm.
Global storm-control monitors incoming traffic statistics over a time period and compares the measurement with a predefined suppression level threshold. The threshold represents the percentage of the total available bandwidth of the port. If the threshold of a traffic type is reached, further traffic of that type is suppressed until the incoming traffic falls below the threshold level. Global storm-control is disabled by default.
The switch supports global storm-control for broadcast, multicast, and unicast traffic. This example of broadcast suppression can also be applied to multicast and unicast traffic.
The graph in Figure 18 shows broadcast traffic patterns on an interface over a given period of time. In this example, the broadcast traffic exceeded the configured threshold between time intervals T1 and T2 and between T4 and T5. When the amount of specified traffic exceeds the threshold, all traffic of that kind is dropped. Therefore, broadcast traffic is blocked during those intervals. At the next time interval, if broadcast traffic does not exceed the threshold, it is again forwarded.
Figure 18 Broadcast Suppression Example
When global storm-control is enabled, the switch monitors packets passing from an interface to the switching bus and determines if the packet is unicast, multicast, or broadcast. The switch monitors the number of broadcast, multicast, or unicast packets received within the 1-second time interval, and when a threshold for one type of traffic is reached, that type of traffic is dropped. This threshold is specified as a percentage of total available bandwidth that can be used by broadcast (multicast or unicast) traffic.
The combination of broadcast suppression threshold numbers and the 1-second time interval control the way the suppression algorithm works. A higher threshold allows more packets to pass through. A threshold value of 100 percent means that no limit is placed on the traffic.
Note
The switch continues to monitor traffic on the port, and when the utilization level is below the threshold level, the type of traffic that was dropped is forwarded again.
You use the storm-control broadcast, storm-control multicast, and storm-control unicast interface configuration commands to set up the global storm-control threshold value.
Global storm-control and per-port storm-control cannot be enabled at the same time.
Per-Port Storm-Control
A packet storm occurs when a large number of broadcast, unicast, or multicast packets are received on a port. Forwarding these packets can cause the network to slow down or to time out. By default, per-port storm-control is disabled.
Per-port storm-control uses rising and falling thresholds to block and then restore the forwarding of broadcast, unicast, or multicast packets. You can also set the switch to shut down the port when the rising threshold is reached.
Per-port storm-control uses a bandwidth-based method to measure traffic activity. The thresholds are expressed as a percentage of the total available bandwidth that can be used by the broadcast, multicast, or unicast traffic.
The rising threshold is the percentage of total available bandwidth associated with multicast, broadcast, or unicast traffic before forwarding is blocked. The falling threshold is the percentage of total available bandwidth below which the switch resumes normal forwarding. In general, the higher the level, the less effective the protection against broadcast storms.
Per-port storm control and global storm-control cannot be enabled at the same time.
Port Security
You can use port security to block input to an Ethernet, Fast Ethernet, or Gigabit Ethernet port when the MAC address of the station attempting to access the port is different from any of the MAC addresses specified for that port. Alternatively, you can use port security to filter traffic destined to or received from a specific host based on the host MAC address.
Ethernet Switching in Cisco AVVID Architecture
This section describes the Ethernet switching capabilities of the Ethernet switch network module, which is designed to work as part of the Cisco Architecture for Voice, Video, and Integrated Data (AVVID) solution.
The section outlines some of the concepts involved in configuring Ethernet ports on the Ethernet switch network module to support Cisco IP phones in a branch office on your network. Also included is a section describing the default settings on the Ethernet switch network module.
The following topics are included:
•
Configuring the Ethernet Switch Network Module for Cisco AVVID/IP Telephony
The Ethernet switch network module has sixteen 10/100 switched Ethernet ports with integrated inline power and QoS features that make it an ideal choice for extending Cisco AVVID (Architecture for Voice, Video and Integrated Data) based voice-over-IP (VoIP) networks to small branch offices.
As an access gateway switch, the Ethernet switch network module can be deployed as a component of a centralized call-processing network using a centrally deployed Cisco CallManager (CCM). Instead of deploying and managing key systems or PBXs in small branch offices, applications are centrally located at the corporate headquarters or data center and are accessed via the IP WAN.
Default Switch Configuration
By default, the Ethernet switch network module provides the following settings with respect to Cisco AVVID:
•
•
•
•
Stacking
Layer 2 switching may be extended in the router by connecting the Gigabit Ethernet (GE) ports of the Ethernet switch network module. This connection sustains a line-rate traffic similar to the switch fabric found in Cisco Catalyst switches and forms a single VLAN consisting of all ports in multiple Ethernet switch network modules.
•
•
Flow Control
Flow-control is a feature that Gigabit Ethernet ports use to inhibit the transmission of incoming packets. If a buffer on a Gigabit Ethernet port runs out of space, the port transmits a special packet that requests remote ports to delay sending packets for a period of time. This special packet is called a pause frame.
Using Flow-Control Keywords
Table 9 describes guidelines for using different configurations of the send and receive keywords with the set port flowcontrol command.
Fallback Bridging
With fallback bridging, the switch bridges together two or more VLANs or routed ports, essentially connecting multiple VLANs within one bridge domain. Fallback bridging forwards traffic that the multilayer switch does not route and forwards traffic belonging to a nonroutable protocol such as DECnet.
Fallback bridging does not allow the spanning trees from the VLANs being bridged to collapse; each VLAN has its own Spanning Tree Protocol (STP) instance and a separate spanning tree, called the VLAN-bridge spanning tree, which runs on top of the bridge group to prevent loops.
A VLAN bridge domain is represented using the switch virtual interface (SVI). A set of SVIs and routed ports (which do not have any VLANs associated with them) can be configured to form a bridge group.
Recall that an SVI represents a VLAN of switch ports as one interface to the routing or bridging function in the system. Only one SVI can be associated with a VLAN, and it is only necessary to configure an SVI for a VLAN when you want to route between VLANs, to fallback-bridge nonroutable protocols between VLANs, or to provide IP host connectivity to the switch. A routed port is a physical port that acts like a port on a router, but it is not connected to a router. A routed port is not associated with a particular VLAN, does not support subinterfaces, but behaves like a normal routed interface.
A bridge group is an internal organization of network interfaces on a switch. Bridge groups cannot be used to identify traffic switched within the bridge group outside the switch on which they are defined. Bridge groups on the same switch function as distinct bridges; that is, bridged traffic and bridge protocol data units (BPDUs) cannot be exchanged between different bridge groups on a switch. An interface can be a member of only one bridge group. Use a bridge group for each separately bridged (topologically distinct) network connected to the switch.
The purpose of placing network interfaces into a bridge group is twofold:
•
•
Figure 19 shows a fallback bridging network example. The multilayer switch has two interfaces configured as SVIs with different assigned IP addresses and attached to two different VLANs. Another interface is configured as a routed port with its own IP address. If all three of these ports are assigned to the same bridge group, non-IP protocol frames can be forwarded among the end stations connected to the switch.
Figure 19 Fallback Bridging Network Example
Benefits
•
•
•
•
•
•
The Interface Range Specification feature makes configuration easier for these reasons:
•
•
Restrictions
The following functions are not supported in this release:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Related Features and Technologies
•
•
•
Related Documents
For information about installing voice network modules and voice interface cards in Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers refer to these documents:
•
•
•
•
•
•
•
For information about configuring Voice over IP features, refer to these documents:
•
•
•
For more information on Flow control, refer to the following document:
•
Supported Platforms
•
•
•
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Supported Standards, MIBs, and RFCs
Standards
•
•
•
•
MIBs
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
RFCs
•
Prerequisites
•
•
In addition, complete the following tasks before configuring this feature:
•
For more information on IP routing, refer to the Cisco IOS IP Configuration Guide, Release 12.2.
•
For more information on setting up call agents, refer to the documentation that accompanies the call agents used in your network configuration.
Configuration Tasks
See the following sections for configuration tasks for the Ethernet switch network module.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Configuring Layer 2 Interfaces
•
•
•
•
•
Configuring a Range of Interfaces
To configure a range of interfaces, use the interface range command in global configuration mode:
Defining a Range Macro
Verifying Configuration of a Range of Interfaces
Step 1
Router#show running-configuration | include define define interface-range enet_list FastEthernet5/1 - 4
Configuring Layer 2 Optional Interface Features
•
•
•
•
•
•
Interface Speed and Duplex Configuration Guidelines
When configuring an interface speed and duplex mode, note these guidelines:
•
•
•
Caution
Configuring the Interface Speed
Note
Configuring the Interface Duplex Mode
To set the duplex mode of an Ethernet or Fast Ethernet interface, use the following commands beginning in global configuration mode:
Note
Router(config)# interface fastethernet 5/4Router(config-if)# duplex fullVerifying Interface Speed and Duplex Mode Configuration
Step 1
Router# show interfaces fastethernet 1/4FastEthernet1/4 is up, line protocol is downHardware is Fast Ethernet, address is 0000.0000.0c89 (bia 0000.0000.0c89)MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Auto-duplex, Auto-speedARP type: ARPA, ARP Timeout 04:00:00Last input never, output never, output hang neverLast clearing of "show interface" counters neverQueueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected3 packets output, 1074 bytes, 0 underruns(0/0/0)0 output errors, 0 collisions, 5 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outRouter#
Configuring a Description for an Interface
You can add a description about an interface to help you remember its function. The description appears in the output of the following commands: show configuration, show running-config, and show interfaces.
To add a description for an interface, use the description command in interface configuration mode:
Configuring an Ethernet Interface as a Layer 2 Trunk
To configure an Ethernet interface as a Layer 2 trunk, use the following commands beginning in global configuration mode:
Note
Verifying an Ethernet Interface as a Layer 2 Trunk
Step 1
Router# show running-config interface fastethernet 5/8Building configuration...Current configuration:!interface FastEthernet5/8no ip addressswitchportswitchport trunk encapsulation dot1qendStep 2
Router#show interfaces fastethernet 5/8 switchportName: Fa5/8Switchport: EnabledAdministrative Mode: static accessOperational Mode: static accessAdministrative Trunking Encapsulation: dot1qOperational Trunking Encapsulation: nativeNegotiation of Trunking: DisabledAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Protected: falseUnknown unicast blocked: falseUnknown multicast blocked: falseBroadcast Suppression Level: 100Multicast Suppression Level: 100Unicast Suppression Level: 100Voice VLAN: noneAppliance trust: noneStep 3
Router#show interfaces fastethernet 5/8 trunkPort Mode Encapsulation Status Native vlanFa1/15 off 802.1q not-trunking 1Port Vlans allowed on trunkFa1/15 1Port Vlans allowed and active in management domainFa1/15 1Port Vlans in spanning tree forwarding state and not prunedFa1/15 1
Configuring an Ethernet Interface as a Layer 2 Access
To configure an Ethernet Interface as a Layer 2 access use the following commands beginning in global configuration mode:
Verifying an Ethernet Interface as a Layer 2 Access
Step 1
Router#show running-config interface {ethernet | fastethernet} slot/port
Step 1
Router#show interfaces [ethernet | fastethernet] slot/port switchport
Configuring VLANs
This section describes how to configure the VLANs on the Ethernet switch network modules, and it contains the following sections:
•
•
Configuring VLANs
To configure an Ethernet Interface as a Layer 2 access, use the following commands beginning in EXEC mode:
Verifying the VLAN Configuration.
Step 1
Router# show vlan name VLAN0003VLAN Name Status Ports---- -------------------------------- --------- -------------------------------1 default active Fa1/0, Fa1/1, Fa1/2, Fa1/3Fa1/4, Fa1/5, Fa1/6, Fa1/7Fa1/8, Fa1/9, Fa1/10, Fa1/11Fa1/12, Fa1/13, Fa1/14, Fa1/151002 fddi-default active1003 token-ring-default active1004 fddinet-default active1005 trnet-default activeVLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------1 enet 100001 1500 - - - - - 1002 10031002 fddi 101002 1500 - - - - - 1 10031003 tr 101003 1500 1005 0 - - srb 1 10021004 fdnet 101004 1500 - - 1 ibm - 0 01005 trnet 101005 1500 - - 1 ibm - 0 0Router#
Deleting a VLAN from the Database
Step 1
Enters VLAN configuration mode.
Step 2
Step 3
Router(vlan)# exit
Verifying VLAN Deletion
Step 1
Router#show vlan-switch briefVLAN Name Status Ports---- -------------------------------- --------- -------------------------------1 default active Fa0/2, Fa0/9, Fa0/14, Gi0/02 VLAN0002 active3 VLAN0003 active Fa0/4, Fa0/5, Fa0/10, Fa0/114 VLAN0004 active Fa0/6, Fa0/7, Fa0/12, Fa0/135 VLAN0005 active40 VLAN0040 active Fa0/1550 VLAN0050 active1000 VLAN1000 active1002 fddi-default active1003 token-ring-default active1004 fddinet-default active1005 trnet-default activeRouter#
Configuring VLAN Trunking Protocol
This section describes how to configure the VLAN Trunking Protocol (VTP) on the Ethernet switch network module, and contains the following sections:
•
Configuring the VTP Server
When a switch is in VTP server mode, you can change the VLAN configuration and have it propagate throughout the network.
To configure the switch as a VTP server, use the following commands beginning in privileged EXEC mode:
Configuring a VTP Client
When a switch is in VTP client mode, you cannot change the VLAN configuration on the switch. The client switch receives VTP updates from a VTP server in the management domain and modifies its configuration accordingly.
Disabling VTP (VTP Transparent Mode)
When you configure the switch as VTP transparent, you disable VTP on the switch. A VTP transparent switch does not send VTP updates and does not act on VTP updates received from other switches. However, a VTP transparent switch running VTP version 2 does forward received VTP advertisements out all of its trunk links.
To disable VTP on the switch, use the following commands beginning in privileged EXEC mode:
Configuring VTP version 2
To enable VTP version 2, use the following commands beginning in privileged EXEC mode:
Step 1
Router# vlan databaseStep 2
Step 3
Router(vlan)# exit
Verifying VTP
Step 1
Router# show vtp statusVTP Version : 2Configuration Revision : 247Maximum VLANs supported locally : 1005Number of existing VLANs : 33VTP Operating Mode : ClientVTP Domain Name : Lab_NetworkVTP Pruning Mode : EnabledVTP V2 Mode : DisabledVTP Traps Generation : DisabledMD5 digest : 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80Configuration last modified by 0.0.0.0 at 8-12-99 15:04:49Router#
Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)
•
•
•
•
Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)
To configure Layer 2 EtherChannels, configure the Ethernet interfaces with the channel-group command, which creates the port-channel logical interface.
Note
Note
To configure Layer 2 Ethernet interfaces as a Layer 2 EtherChannel, use the following commands beginning in global configuration mode for each interface:
Verifying Layer 2 EtherChannels
Use the following show commands to verify Layer 2 EtherChannels:
Step 1
Router#show running-config interface fastethernet 5/6Building configuration...Current configuration:!interface FastEthernet5/6no ip addressswitchportswitchport access vlan 10switchport mode accesschannel-group 2 mode onendStep 2
Router#show interfaces fastethernet 5/6 etherchannelPort state = EC-Enbld Up In-Bndl Usr-ConfigChannel group = 2 Mode = Desirable Gcchange = 0Port-channel = Po2 GC = 0x00020001Port indx = 1 Load = 0x55Flags: S - Device is sending Slow hello. C - Device is in Consistent state.A - Device is in Auto mode. P - Device learns on physical port.Timers: H - Hello timer is running. Q - Quit timer is running.S - Switching timer is running. I - Interface timer is running.Local information:Hello Partner PAgP Learning GroupPort Flags State Timers Interval Count Priority Method IfindexFa5/6 SC U6/S7 30s 1 128 Any 56Partner's information:Partner Partner Partner Partner GroupPort Name Device ID Port Age Flags Cap.Fa5/6 JAB031301 0050.0f10.230c 2/47 18s SAC 2FAge of the port in the current state: 00h:10m:57sStep 3
Router#show running-config interface port-channel 2Building configuration...Current configuration:!interface Port-channel2no ip addressswitchportswitchport access vlan 10switchport mode accessendRouter#Step 4
Router#show etherchannel 2 port-channelPort-channels in the group:----------------------Port-channel: Po2------------Age of the Port-channel = 00h:23m:33sLogical slot/port = 10/2 Number of ports in agport = 2GC = 0x00020001 HotStandBy port = nullPort state = Port-channel Ag-InusePorts in the Port-channel:Index Load Port-------------------1 55 Fa5/60 AA Fa5/7Time since last port bundled: 00h:23m:33s Fa5/6
Configuring EtherChannel Load Balancing
To configure EtherChannel load balancing, use the following commands in global configuration mode:
Note
Verifying EtherChannel Load Balancing
Step 1
Router# show etherchannel load-balanceSource XOR Destination IP addressRouter#
Removing an Interface from an EtherChannel
To remove an Ethernet interface from an EtherChannel, use the following commands in global configuration mode:
Configuring Removing an EtherChannel
To remove an EtherChannel, use the following commands in global configuration mode:
Step 1
Removes the port-channel interface.
Step 2
Router(config)# endExits configuration mode.
Verify Removing an EtherChannel
Step 1
Router#show etherchannel summaryFlags: D - down P - in port-channelI - stand-alone s - suspendedR - Layer3 S - Layer2U - in useGroup Port-channel Ports-----+------------+-----------------------------------------------------------Router#
Configuring 802.1x Authentication
This section describes how to configure 802.1x port-based authentication on the Ethernet switch network module:
•
•
•
•
•
•
Understanding the Default 802.1x Configuration
Table 10 shows the default 802.1x configuration.
802.1x Configuration Guidelines
These are the 802.1x authentication configuration guidelines:
•
•
–
–
–
Enabling 802.1x Authentication
To enable 802.1x port-based authentication, you must enable AAA and specify the authentication method list. A method list describes the sequence and authentication methods to be queried to authenticate a user.
The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other authentication methods are attempted.
Beginning in privileged EXEC mode, follow these steps to configure 802.1x port-based authentication. This procedure is required.
Step 1
configure terminal
Enters global configuration mode.
Step 2
aaa new-model
Enables AAA.
Step 3
aaa authentication dot1x {default | listname} method1 [method2...]
Creates an 802.1x authentication method list.
To create a default list that is used when a named list is not specified in the authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces.
Enter at least one of these keywords:
•
•
Step 4
interface interface-id
Enters interface configuration mode, and specify the interface to be enabled for 802.1x authentication.
Step 5
dot1x port-control auto
Enables 802.1x on the interface.
For feature interaction information with trunk, dynamic, dynamic-access, EtherChannel, secure, and SPAN ports see the "802.1x Configuration Guidelines" section.
Step 6
end
Returns to privileged EXEC mode.
Step 7
show dot1x
Verifies your entries.
Check the Status column in the 802.1x Port Summary section of the display. An enabled status means the port-control value is set either to auto or to force-unauthorized.
Step 8
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
To disable AAA, use the no aaa new-model global configuration command. To disable 802.1x AAA authentication, use the no aaa authentication dot1x {default | list-name} method1 [method2...] global configuration command. To disable 802.1x, use the dot1x port-control force-authorized or the no dot1x port-control interface configuration command.
Configuring the Switch-to-RADIUS-Server Communication
RADIUS security servers are identified by their host name or IP address, host name and specific UDP port numbers, or IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service—for example, authentication—the second host entry configured acts as the fail-over backup to the first one. The RADIUS host entries are tried in the order that they were configured.
Beginning in privileged EXEC mode, follow these steps to configure the RADIUS server parameters on the switch. This procedure is required.
To delete the specified RADIUS server, use the no radius-server host {hostname | ip-address} global configuration command.
You can globally configure the timeout, retransmission, and encryption key values for all RADIUS servers by using the radius-server host global configuration command. If you want to configure these options on a per-server basis, use the radius-server timeout, radius-server retransmit, and the radius-server key global configuration commands.
You also need to configure some settings on the RADIUS server. These settings include the IP address of the switch and the key string to be shared by both the server and the switch. For more information, refer to the RADIUS server documentation.
Enabling Periodic Reauthentication
You can enable periodic 802.1x client reauthentication and specify how often it occurs. If you do not specify a time period before enabling reauthentication, the number of seconds between reauthentication attempts is 3600 seconds.
Automatic 802.1x client reauthentication is a global setting and cannot be set for clients connected to individual ports.
Beginning in privileged EXEC mode, follow these steps to enable periodic reauthentication of the client and to configure the number of seconds between reauthentication attempts:
To disable periodic reauthentication, use the no dot1x re-authentication global configuration command. To return to the default number of seconds between reauthentication attempts, use the no dot1x timeout re-authperiod global configuration command.
Changing the Quiet Period
When the switch cannot authenticate the client, the switch remains idle for a set period of time, and then tries again. The idle time is determined by the quiet-period value. A failed authentication of the client might occur because the client provided an invalid password. You can provide a faster response time to the user by entering smaller number than the default.
Beginning in privileged EXEC mode, follow these steps to change the quiet period:
To return to the default quiet time, use the no dot1x timeout quiet-period global configuration command.
Changing the Switch-to-Client Retransmission Time
The client responds to the EAP-request/identity frame from the switch with an EAP-response/identity frame. If the switch does not receive this response, it waits a set period of time (known as the retransmission time), and then retransmits the frame.
Note
Beginning in privileged EXEC mode, follow these steps to change the amount of time that the switch waits for client notification:
To return to the default retransmission time, use the no dot1x timeout tx-period global configuration command.
Setting the Switch-to-Client Frame-Retransmission Number
In addition to changing the switch-to-client retransmission time, you can change the number of times that the switch sends an EAP-request/identity frame (assuming no response is received) to the client before restarting the authentication process.
Note
Beginning in privileged EXEC mode, follow these steps to set the switch-to-client frame-retransmission number:
To return to the default retransmission number, use the no dot1x max-req global configuration command.
Enabling Multiple Hosts
You can attach multiple hosts to a single 802.1x-enabled port as shown in Figure 3. In this mode, only one of the attached hosts must be successfully authorized for all hosts to be granted network access. If the port becomes unauthorized (reauthentication fails, and an EAPOL-logoff message is received), all attached clients are denied access to the network.
Beginning in privileged EXEC mode, follow these steps to allow multiple hosts (clients) on an 802.1x-authorized port that has the dot1x port-control interface configuration command set to auto.
To disable multiple hosts on the port, use the no dot1x multiple-hosts interface configuration command.
Resetting the 802.1x Configuration to the Default Values
You can reset the 802.1x configuration to the default values with a single command.
Beginning in privileged EXEC mode, follow these steps to reset the 802.1x configuration to the default values:
Displaying 802.1x Statistics and Status
To display 802.1x statistics for all interfaces, use the show dot1x statistics privileged EXEC command. To display 802.1x statistics for a specific interface, use the show dot1x statistics interface interface-id privileged EXEC command.
To display the 802.1x administrative and operational status for the switch, use the show dot1x privileged EXEC command. To display the 802.1x administrative and operational status for a specific interface, use the show dot1x interface interface-id privileged EXEC command.
Configuring Spanning Tree
•
•
•
•
•
Enabling Spanning Tree
You can enable spanning tree on a per-VLAN basis. The switch maintains a separate instance of spanning tree for each VLAN (except on VLANs on which you disable spanning tree).
Step 1
Step 2
Router(config)# endExits configuration mode.
Verify Spanning Tree
Step 1
Router# show spanning-tree vlan 200VLAN200 is executing the ieee compatible Spanning Tree protocolBridge Identifier has priority 32768, address 0050.3e8d.6401Configured hello time 2, max age 20, forward delay 15Current root has priority 16384, address 0060.704c.7000Root port is 264 (FastEthernet5/8), cost of root path is 38Topology change flag not set, detected flag not setNumber of topology changes 0 last change occurred 01:53:48 agoTimes: hold 1, topology change 24, notification 2hello 2, max age 14, forward delay 10Timers: hello 0, topology change 0, notification 0Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 19, Port priority 128, Port Identifier 129.9.Designated root has priority 16384, address 0060.704c.7000Designated bridge has priority 32768, address 00e0.4fac.b000Designated port id is 128.2, designated path cost 19Timers: message age 3, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 3, received 3417
Configuring Spanning Tree Port Priority
To configure the spanning tree port priority of an interface, use the following commands beginning in global configuration mode:
Verify Spanning Tree Port Priority
Step 1
Router# show spanning-tree interface fastethernet 5/8Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 19, Port priority 100, Port Identifier 129.8.Designated root has priority 32768, address 0010.0d40.34c7Designated bridge has priority 32768, address 0010.0d40.34c7Designated port id is 128.1, designated path cost 0Timers: message age 2, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 0, received 13513Router#
Configuring Spanning Tree Port Cost
To configure the spanning tree port cost of an interface, use the following commands beginning in global configuration mode:
Verifying Spanning Tree Port Cost
Step 1
Router# show spanning-tree vlan 200Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 17, Port priority 64, Port Identifier 129.8.Designated root has priority 32768, address 0010.0d40.34c7Designated bridge has priority 32768, address 0010.0d40.34c7Designated port id is 128.1, designated path cost 0Timers: message age 2, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 0, received 13513Router#
Configuring the Bridge Priority of a VLAN
Caution
To configure the spanning tree bridge priority of a VLAN, use the following commands in global configuration mode:
Verifying the Bridge Priority of a VLAN
Step 1
Router# show spanning-tree vlan 200 bridge briefHello Max FwdVlan Bridge ID Time Age Delay Protocol---------------- -------------------- ---- ---- ----- --------VLAN200 33792 0050.3e8d.64c8 2 20 15 ieee
Configuring the Hello Time
To configure the hello interval for the spanning tree, use the following commands in global configuration mode:
Configuring the Forward-Delay Time for a VLAN
Step 1
Step 2
Router(config)# endExits configuration mode.
Configuring the Maximum Aging Time for a VLAN
To configure the maximum age interval for the spanning tree, use the following commands in global configuration mode:
Configuring the Root Bridge
The Ethernet switch network module maintains a separate instance of spanning tree for each active VLAN configured on the switch. A bridge ID, consisting of the bridge priority and the bridge MAC address, is associated with each instance. For each VLAN, the switch with the lowest bridge ID will become the root bridge for that VLAN.
To configure a VLAN instance to become the root bridge, the bridge priority can be modified from the default value (32768) to a significantly lower value so that the bridge becomes the root bridge for the specified VLAN. Use the spanning-tree vlan vlan-id root command to alter the bridge priority.
The switch checks the bridge priority of the current root bridges for each VLAN. The bridge priority for the specified VLANs is set to 8192 if this value will cause the switch to become the root for the specified VLANs.
If any root switch for the specified VLANs has a bridge priority lower than 8192, the switch sets the bridge priority for the specified VLANs to 1 less than the lowest bridge priority.
For example, if all switches in the network have the bridge priority for VLAN 100 set to the default value of 32768, entering the spanning-tree vlan 100 root primary command on a switch will set the bridge priority for VLAN 100 to 8192, causing the switch to become the root bridge for VLAN 100.
Note
Use the diameter keyword to specify the Layer 2 network diameter (that is, the maximum number of bridge hops between any two end stations in the Layer 2 network). When you specify the network diameter, the switch automatically picks an optimal hello time, forward delay time, and maximum age time for a network of that diameter, which can significantly reduce the spanning tree convergence time. You can use the hello keyword to override the automatically calculated hello time.
Note
To configure the switch as the root, use the following commands in global configuration mode:
Configuring BackboneFast
You can enable BackboneFast to detect indirect link failures and to start the spanning-tree reconfiguration sooner.
Note
Beginning in privileged EXEC mode, follow these steps to enable BackboneFast:
To disable the BackboneFast feature, use the no spanning-tree backbonefast global configuration command.
Disabling Spanning Tree
Step 1
Disables spanning tree on a per-VLAN basis.
Step 2
Router(config)# endExits configuration mode.
Verifying that Spanning Tree is Disabled
Step 1
Router# show spanning-tree vlan 200<...output truncated...>Spanning tree instance for VLAN 200 does not exist.Router#
Configuring MAC Table Manipulation — Port Security
•
•
•
Enabling Known MAC Address Traffic
To enable the MAC address secure option, use the following commands beginning in privileged EXEC mode:
Verifying the MAC Address Secure Configuration
Step 1
Router# show mac-address-table secureSecure Address Table:Destination Address Address Type VLAN Destination Port------------------- ------------ ---- --------------------0003.0003.0003 Secure 1 FastEthernet 2/8
Creating a Static or Dynamic Entry in the MAC Address Table
To create a static or dynamic entry in the mac address table, use the following commands beginning in privileged EXEC mode:
Note
Verifying the MAC Address Table
Step 1
Router# show macDestination Address Address Type VLAN Destination Port------------------- ------------ ---- --------------------0001.6443.6440 Static 1 Vlan10004.c16d.9be1 Dynamic 1 FastEthernet2/130004.ddf0.0282 Dynamic 1 FastEthernet2/130006.0006.0006 Dynamic 1 FastEthernet2/13001b.001b.ad45 Dynamic 1 FastEthernet2/13
Configuring Aging Timer-timer
To configure the aging timer, use the following commands beginning in privileged EXEC mode:
Caution
Verifying the Aging Timer
Step 1
Router # show mac-address-table aging-timeMac address aging time 23
Configuring Cisco Discovery Protocol
•
Enabling Cisco Discovery Protocol
To enable Cisco Discovery Protocol (CDP) globally, use the following command in global configuration mode:
Verifying the CDP Global Configuration
Step 1
Router# show cdpGlobal CDP information:Sending CDP packets every 120 secondsSending a holdtime value of 180 secondsSending CDPv2 advertisements is enabledRouter#
Enabling CDP on an Interface
To enable CDP on an interface, use the following command in interface configuration mode:
The following example shows how to enable CDP on Fast Ethernet interface 5/1:
Router(config)# interface fastethernet 5/1Router(config-if)# cdp enableVerifying the CDP Interface Configuration
Step 1
Router# show cdp interface fastethernet 5/1FastEthernet5/1 is up, line protocol is upEncapsulation ARPASending CDP packets every 120 secondsHoldtime is 180 secondsRouter#
Verifying CDP Neighbors
Step 1
Router# show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - RepeaterDevice ID Local Intrfce Holdtme Capability Platform Port IDJAB023807H1 Fas 5/3 127 T S WS-C2948 2/46JAB023807H1 Fas 5/2 127 T S WS-C2948 2/45JAB023807H1 Fas 5/1 127 T S WS-C2948 2/44JAB023807H1 Gig 1/2 122 T S WS-C2948 2/50JAB023807H1 Gig 1/1 122 T S WS-C2948 2/49JAB03130104 Fas 5/8 167 T S WS-C4003 2/47JAB03130104 Fas 5/9 152 T S WS-C4003 2/48
Monitoring and Maintaining CDP
Configuring Switched Port Analyzer
•
•
•
Specifying the Switched Port Analyzer Session
To configure the source for a Switched Port Analyzer (SPAN) session, use the following command in global configuration mode:
Note
The following example shows how to configure SPAN session 1 to monitor bidirectional traffic from source interface Fast Ethernet 5/1:
Router(config)# monitor session 1 source interface fastethernet 5/1Configuring SPAN Destinations
To configure the destination for a SPAN session, use the following command in global configuration mode:
Removing Sources or Destinations from a SPAN Session
To remove sources or destinations from a SPAN session, use the following command in global configuration mode:
Step 1
Router(config)# no monitor session session-number
Clears existing SPAN configuration for a session.
Configuring Network Security with ACLs
Configuring ACLs on Layer 2 interfaces is the same as configuring ACLs on Cisco routers. The process is briefly described here. For more detailed information on configuring router ACLs, refer to the "Configuring IP Services" chapter in the Cisco IP Configuration Guide for Cisco IOS Release 12.2. For detailed information about the commands, refer to Cisco IOS IP Command Reference for Cisco IOS Release 12.2. For a list of Cisco IOS features not supported on the Ethernet switch network module, see the following section.
Unsupported Features
The Ethernet switch network module does not support these Cisco IOS router ACL-related features:
•
•
•
•
•
•
•
•
•
•
Creating Standard and Extended IP ACLs
This section describes how to create switch IP ACLs. An ACL is a sequential collection of permit and deny conditions. The switch tests packets against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packet. Because the switch stops testing conditions after the first match, the order of the conditions is critical. If no conditions match, the switch denies the packet.
An ACL must first be created by specifying an access list number or name and access conditions. The ACL can then be applied to interfaces or terminal lines.
The software supports these styles of ACLs or IP access lists:
•
•
The next sections describe access lists and the steps for using them.
ACL Numbers
The number you use to denote your ACL shows the type of access list that you are creating. Table 11 lists the access list number and corresponding type and shows whether or not they are supported by the switch. The Ethernet switch network module supports IP standard and IP extended access lists, numbers 1 to 199 and 1300 to 2699.
Note
Note
Creating a Numbered Standard ACL
Beginning in privileged EXEC mode, follow these steps to create a numbered standard ACL:
Use the no access-list access-list-number global configuration command to delete the entire ACL. You cannot delete individual ACEs from numbered access lists.
Note
Creating a Numbered Extended ACL
Although standard ACLs use only source addresses for matching, you can use an extended ACL source and destination addresses for matching operations and optional protocol type information for finer granularity of control. Some protocols also have specific parameters and keywords that apply to that protocol.
These IP protocols are supported (protocol keywords are in parentheses in bold): Internet Protocol (ip), Transmission Control Protocol (tcp), or User Datagram Protocol (udp).
Supported parameters can be grouped into these categories:
•
•
Table 12 lists the possible filtering parameters for ACEs for each protocol type.
Table 12 Filtering Parameter ACEs Supported by Different IP Protocols
IP ToS byte1
No
No
Differentiated Services Code Point (DSCP)
No
No
IP source address
Yes
Yes
IP destination address
Yes
Yes
Fragments
No
No
TCP or UDP
Yes
Yes
Source port operator
Yes
Yes
Source port
Yes
Yes
Destination port operator
Yes
Yes
Destination port
Yes
Yes
TCP flag
No
No
1 No support for type of service (TOS) minimize monetary cost bit.
For more details on the specific keywords relative to each protocol, refer to the Cisco IP Command Reference for Cisco IOS Release 12.2.
Note
When creating ACEs in numbered extended access lists, remember that after you create the list, any additions are placed at the end of the list. You cannot reorder the list or selectively add or remove ACEs from a numbered list.
Beginning in privileged EXEC mode, follow these steps to create an extended ACL:
Use the no access-list access-list-number global configuration command to delete the entire access list. You cannot delete individual ACEs from numbered access lists.
After an ACL is created, any additions (possibly entered from the terminal) are placed at the end of the list. You can add ACEs to an ACL, but deleting any ACE deletes the entire ACL.
Note
After creating an ACL, you must apply it to an interface, as described in the "Applying the ACL to an Interface" section.
Creating Named Standard and Extended ACLs
You can identify IP ACLs with an alphanumeric string (a name) rather than a number. You can use named ACLs to configure more IP access lists on a switch than if you use numbered access lists. If you identify your access list with a name rather than a number, the mode and command syntax are slightly different. However, not all commands that use IP access lists accept a named ACL.
Note
Consider these guidelines and limitations before configuring named ACLs:
•
•
Beginning in privileged EXEC mode, follow these steps to create a standard access list using names:
Beginning in privileged EXEC mode, follow these steps to create an extended ACL using names:
Step 1
configure terminal
Enters global configuration mode.
Step 2
ip access-list extended {name | access-list-number}
Defines an extended IP access list by using a name, and enter access-list configuration mode.
Note
Step 3
{deny | permit} protocol
{source source-wildcard | host source | any} [operator port] {destination destination-wildcard | host destination | any} [operator port]In access-list configuration mode, specifies the conditions allowed or denied.
See the "Creating a Numbered Extended ACL" section for definitions of protocols and other keywords.
•
•
Step 4
end
Returns to privileged EXEC mode.
Step 5
show access-lists [number | name]
Displays the access list configuration.
Step 6
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
When making the standard and extended ACL, remember that, by default, the end of the ACL contains an implicit deny statement for everything if it did not find a match before reaching the end. For standard ACLs, if you omit the mask from an associated IP host address access list specification, 0.0.0.0 is assumed to be the mask.
After you create an ACL, any additions are placed at the end of the list. You cannot selectively add ACEs to a specific ACL. However, you can use no permit and no deny commands to remove ACEs from a named ACL. Being able to selectively remove lines from a named ACL is one reason you might use named ACLs instead of numbered ACLs.
After creating an ACL, you must apply it to a line or interface, as described in the "Applying the ACL to an Interface" section.
Including Comments About Entries in ACLs
You can use the remark command to include comments (remarks) about entries in any IP standard or extended ACL. The remarks make the ACL easier for you to understand and scan. Each remark line is limited to 100 characters.
The remark can go before or after a permit or deny statement. You should be consistent about where you put the remark so that it is clear which remark describes which permit or deny statement. For example, it would be confusing to have some remarks before the associated permit or deny statements and some remarks after the associated statements.
For IP numbered standard or extended ACLs, use the access-list access-list number remark remark global configuration command to include a comment about an access list. To remove the remark, use the no form of this command.
For an entry in a named IP ACL, use the remark access-list global configuration command. To remove the remark, use the no form of this command.
Applying the ACL to an Interface
After you create an ACL, you can apply it to one or more interfaces. ACLs can be applied on inbound interfaces. This section describes how to accomplish this task for network interfaces. Note these guidelines:
•
•
Beginning in privileged EXEC mode, follow these steps to control access to a Layer 2 or Layer 3 interface:
Note
For inbound ACLs, after receiving a packet, the switch checks the packet against the ACL. If the ACL permits the packet, the switch continues to process the packet. If the ACL rejects the packet, the switch discards the packet.
When you apply an undefined ACL to an interface, the switch acts as if the ACL has not been applied to the interface and permits all packets. Remember this behavior if you use undefined ACLs for network security.
Displaying ACLs
You can display existing ACLs by using show commands.
Beginning in privileged EXEC mode, follow these steps to display access lists:
Configuring Quality of Service (QoS)
Before configuring QoS, you must have a thorough understanding of these items:
•
•
•
•
This section describes how to configure QoS on your Ethernet switch network module:
•
•
Understanding the Default QoS Configuration
•
•
•
•
•
•
Configuration Guidelines
Before beginning the QoS configuration, you should be aware of this information:
•
•
•
•
•
•
For more information on guidelines for configuring ACLs, see the "Classification Based on QoS ACLs" section.
Configuring Classification Using Port Trust States
This section describes how to classify incoming traffic by using port trust states:
•
•
Configuring the Trust State on Ports and SVIs within the QoS Domain
Packets entering a QoS domain are classified at the edge of the QoS domain. When the packets are classified at the edge, the switch port within the QoS domain can be configured to one of the trusted states because there is no need to classify the packets at every switch within the QoS domain. Figure 20 shows a sample network topology.
Figure 20 Port Trusted States within the QoS Domain
Beginning in privileged EXEC mode, follow these steps to configure the port to trust the classification of the traffic that it receives:
To return a port to its untrusted state, use the no mls qos trust interface configuration command.
For information on how to change the default CoS value, see the "Configuring the CoS Value for an Interface" section. For information on how to configure the CoS-to-DSCP map, see the "Configuring the CoS-to-DSCP Map" section.
Configuring the CoS Value for an Interface
QoS assigns the CoS value specified with the mls qos cos interface configuration command to untagged frames received on trusted and untrusted ports.
Beginning in privileged EXEC mode, follow these steps to define the default CoS value of a port or to assign the default CoS to all incoming packets on the port:
To return to the default setting, use the no mls qos cos {default-cos | override} interface configuration command.
Note
Configuring a QoS Policy
Configuring a QoS policy typically requires classifying traffic into classes, configuring policies applied to those traffic classes, and attaching policies to interfaces.
For background information, see the "Classification" section and the "Policing and Marking" section.
This section contains this configuration information:
•
•
•
Classifying Traffic by Using ACLs
You can classify IP traffic by using IP standard or IP extended ACLs.
Beginning in privileged EXEC mode, follow these steps to create an IP standard ACL for IP traffic:
Step 1
configure terminal
Enters global configuration mode.
Step 2
access-list access-list-number {deny | permit | remark} {source source-wildcard | host source | any}
Creates an IP standard ACL, repeating the command as many times as necessary.
For access-list-number, enter the ACL number. The range is 1 to 99 and 1300 to 1999.
Enter deny or permit to specify whether to deny or permit access if The source is the source address of the network or host from which the packet is being sent, specified in one of three ways:
•
•
•
(Optional) The source-wildcard applies wildcard bits to the source (see first bullet item).
Note
Step 3
end
Returns to privileged EXEC mode.
Step 4
show access-lists
Verifies your entries.
Step 5
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
To delete an ACL, use the no access-list access-list-number global configuration command.
Beginning in privileged EXEC mode, follow these steps to create an IP extended ACL for IP traffic:
Step 1
configure terminal
Enters global configuration mode.
Step 2
access-list access-list-number
{deny | permit | remark} protocol
{source source-wildcard | host source | any}[operator port] {destination destination-wildcard | host destination | any} [operator port]Creates an IP extended ACL, repeating the command as many times as necessary.
For access-list-number, enter the ACL number. The range is 100 to 199 and 2000 to 2699.
Enter deny or permit to specify whether to deny or permit access if conditions are matched.
For protocol, enter the name or number of an IP protocol. Use the question mark (?) to see a list of available protocol keywords.
For source, enter the network or host from which the packet is being sent. You specify this by using dotted decimal notation by using the any keyword as an abbreviation for source 0.0.0.0 source-wildcard 255.255.255.255, or by using the host keyword for source 0.0.0.0.
For source-wildcard, enter the wildcard bits by placing ones in the bit positions that you want to ignore. You specify the wildcard by using dotted decimal notation, by using the any keyword as an abbreviation for source 0.0.0.0 source-wildcard 255.255.255.255, or by using the host keyword for source 0.0.0.0.
For destination, enter the network or host to which the packet is being sent. You have the same options for specifying the destination and destination-wildcard as those described by source and source-wildcard.
Defines a destination or source port.
•
•
•
•
•
•
Note
Step 3
end
Returns to privileged EXEC mode.
Step 4
show access-lists
Verifies your entries.
Step 5
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
To delete an ACL, use the no access-list access-list-number global configuration command.
Classifying Traffic by Using Class Maps
You use the class-map global configuration command to isolate a specific traffic flow (or class) from all other traffic and to name it. The class map defines the criteria to use to match against a specific traffic flow to further classify it. Match statements can include criteria such as an ACL. The match criterion is defined with one match statement entered within the class-map configuration mode.
Note
Beginning in privileged EXEC mode, follow these steps to create a class map and to define the match criterion to classify traffic:
Step 1
configure terminal
Enters global configuration mode.
Step 2
access-list access-list-number {deny | permit} {source source-wildcard | host source | any}
or
access-list access-list-number
{deny | permit | remark} protocol
{source source-wildcard | host source | any} [operator port] {destination destination-wildcard | host destination | any} [operator port]Creates an IP standard or extended ACL for IP traffic, repeating the command as many times as necessary.
For more information, see the "Classifying Traffic by Using ACLs" section.
Note
Step 3
class-map class-map-name
Creates a class map, and enter class-map configuration mode.
By default, no class maps are defined.
For class-map-name, specify the name of the class map.
Step 4
match access-group acl-index-or-name
Defines the match criterion to classify traffic.
By default, no match criterion is supported.
Only one match criterion per class map is supported, and only one ACL per class map is supported.
For access-group acl-index-or-name, specify the number or name of the ACL created in Step 3.
Step 5
end
Returns to privileged EXEC mode.
Step 6
show class-map [class-map-name]
Verifies your entries.
Step 7
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
To delete an existing class map, use the no class-map class-map-name global configuration command. To remove a match criterion, use the no match access-group acl-index-or-name class-map configuration command.
Classifying, Policing, and Marking Traffic by Using Policy Maps
A policy map specifies which traffic class to act on. Actions can include trusting the CoS or DSCP values in the traffic class; setting a specific DSCP value in the traffic class; and specifying the traffic bandwidth limitations for each matched traffic class (policer) and the action to take when the traffic is out of profile (marking).
A separate policy-map class can exist for each type of traffic received through an interface. You can attach only one policy map per interface in the input direction.
Beginning in privileged EXEC mode, follow these steps to create a policy map:
Step 1
configure terminal
Enters global configuration mode.
Step 2
access-list access-list-number {deny | permit} {source source-wildcard | host source | any}
or
access-list access-list-number
{deny | permit | remark} protocol
{source source-wildcard | host source | any}[operator port] {destination destination-wildcard | host destination | any} [operator port]Creates an IP standard or extended ACL for IP traffic, repeating the command as many times as necessary.
For more information, see the "Classifying Traffic by Using ACLs" section.
Note
Step 3
policy-map policy-map-name
Creates a policy map by entering the policy map name, and enter policy-map configuration mode.
By default, no policy maps are defined.
The default behavior of a policy map is to set the DSCP to 0 if the packet is an IP packet and to set the CoS to 0 if the packet is tagged. No policing is performed.
Step 4
class class-map-name [access-group acl-index-or-name]
Defines a traffic classification, and enter policy-map class configuration mode.
By default, no policy map class maps are defined.
If a traffic class has already been defined by using the class-map global configuration command, specify its name for class-map-name in this command.
For access-group acl-index-or-name, specify the number or name of the ACL created in Step 2.
Note
Step 5
police {bps | cir bps} [burst-byte | bc burst-byte] conform-action transmit [exceed-action {drop | dscp dscp-value}]
Defines a policer for the classified traffic.
You can configure up to 60 policers on ingress Gigabit-capable Ethernet ports and up to 6 policers on ingress 10/100 Ethernet ports.
For bps, specify average traffic rate or committed information rate in bits per second (bps). The range is 1 Mbps to 100 Mbps for 10/100 Ethernet ports and 8 Mbps to 1000 Mbps for the Gigabit-capable Ethernet ports.
For burst-byte, specify the normal burst size or burst count in bytes.
(Optional) Specify the action to take when the rates are exceeded. Use the exceed-action drop keywords to drop the packet. Use the exceed-action dscp dscp-value keywords to mark down the DSCP value and transmit the packet.
Step 6
exit
Returns to policy-map configuration mode.
Step 7
exit
Returns to global configuration mode.
Step 8
interface interface-id
Enters interface configuration mode, and specify the interface to attach to the policy map.
Valid interfaces include physical interfaces.
Step 9
service-policy input policy-map-name
Applies a policy map to the input of a particular interface.
Only one policy map per interface per direction is supported.
Use input policy-map-name to apply the specified policy map to the input of an interface.
Step 10
end
Returns to privileged EXEC mode.
Step 11
show policy-map [policy-map-name class class-name]
Verifies your entries.
Step 12
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
To delete an existing policy map, use the no policy-map policy-map-name global configuration command. To delete an existing class map, use the no class class-map-name policy-map configuration command. To remove an existing policer, use the no police rate-bps burst-byte [exceed-action {drop | dscp dscp-value}] policy-map configuration command. To remove the policy map and interface association, use the no service-policy input policy-map-name interface configuration command.
Configuring CoS Maps
This section describes how to configure the DSCP maps:
•
•
All the maps are globally defined.
Configuring the CoS-to-DSCP Map
You use the CoS-to-DSCP map to map CoS values in incoming packets to a DSCP value that QoS uses internally to represent the priority of the traffic.
Table 13 shows the default CoS-to-DSCP map.
If these values are not appropriate for your network, you need to modify them. These CoS-to-DSCP mapping numbers follow the numbers used in deploying Cisco AVVID and may be different from the mapping numbers used by the Catalyst 2950, Catalyst 3550, and other switches.
Beginning in privileged EXEC mode, follow these steps to modify the CoS-to-DSCP map:
To return to the default map, use the no mls qos map cos-dscp global configuration command.
Configuring the DSCP-to-CoS Map
You use the DSCP-to-CoS map to map DSCP values in incoming packets to a CoS value, which is used to select one of the four egress queues.
The Ethernet switch network modules support these DSCP values: 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56.
Table 14 shows the default DSCP-to-CoS map.
Table 14 Default DSCP-to-CoS Map
DSCP values
0
8, 10
16, 18
24, 26
32, 34
40, 46
48
56
CoS values
0
1
2
3
4
5
6
7
If these values are not appropriate for your network, you need to modify them.
Beginning in privileged EXEC mode, follow these steps to modify the DSCP-to-CoS map:
To return to the default map, use the no mls qos map dscp-cos global configuration command.
Displaying QoS Information
To display the current QoS information, use one or more of the privileged EXEC commands in Table 15:
Table 15 Commands for Displaying QoS Information
show class-map [class-map-name]
Displays QoS class maps, which define the match criteria to classify traffic.
show policy-map [policy-map-name [class class-name]]
Displays QoS policy maps, which define classification criteria for incoming traffic.
show mls qos maps [cos-dscp | dscp-cos]
Displays QoS mapping information. Maps are used to generate an internal DSCP value, which represents the priority of the traffic.
show mls qos interface [interface-id] [policers]
Displays QoS information at the interface level.
show mls masks [qos | security]
Displays details regarding the masks1 used for QoS and security ACLs.
1 Access Control Parameters are called masks in the switch CLI commands and output.
Configuring Power Management on the Interface
To manage the powering of the Cisco IP phones, use the following commands beginning in privileged EXEC mode:
Verifying Power Management on the Interface
Step 1
Router#show power inlinePowerSupply SlotNum. Maximum Allocated Status----------- -------- ------- --------- ------EXT-PS 1 165.000 20.000 PS1 GOOD PS2 ABSENTInterface Config Phone Powered PowerAllocated--------- ------ ----- ------- --------------FastEthernet1/0 auto no off 0.000 WattsFastEthernet1/1 auto no off 0.000 WattsFastEthernet1/2 auto no off 0.000 WattsFastEthernet1/3 auto no off 0.000 WattsFastEthernet1/4 auto unknown off 0.000 WattsFastEthernet1/5 auto unknown off 0.000 WattsFastEthernet1/6 auto unknown off 0.000 WattsFastEthernet1/7 auto unknown off 0.000 WattsFastEthernet1/8 auto unknown off 0.000 WattsFastEthernet1/9 auto unknown off 0.000 WattsFastEthernet1/10 auto unknown off 0.000 WattsFastEthernet1/11 auto yes on 6.400 WattsFastEthernet1/12 auto yes on 6.400 WattsFastEthernet1/13 auto no off 0.000 WattsFastEthernet1/14 auto unknown off 0.000 WattsFastEthernet1/15 auto unknown off 0.000 Watts
Configuring IP Multicast Layer 3 Switching
These sections describe how to configure IP multicast Layer 3 switching:
•
•
•
•
Enabling IP Multicast Routing Globally
You must enable IP multicast routing globally before you can enable IP multicast Layer 3 switching on Layer 3 interfaces.
For complete information and procedures, refer to these publications:
•
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipr_c/
•
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipras_r/index.htm
•
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fiprrp_r/index.htm
•
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fiprmc_r/index.htm
To enable IP multicast routing globally, Use the following command in global configuration mode:
Enabling IP PIM on Layer 3 Interfaces
You must enable PIM on the Layer 3 interfaces before IP multicast Layer 3 switching functions on those interfaces.
To enable IP PIM on a Layer 3 interface, use the following commands beginning in global configuration mode:
The following example shows how to enable PIM on an interface using the default mode (sparse-dense-mode):
Router(config-if)# ip pimRouter(config-if)#The following example shows how to enable PIM sparse mode on an interface:
Router(config-if)# ip pim sparse-modeRouter(config-if)#Verifying IP Multicast Layer 3 Hardware Switching Summary
Note
The show ip pim interface count command verifies the IP multicast Layer 3 switching enable state on IP PIM interfaces and the number of packets received and sent on the interface.
Use the following show commands to verify IP multicast Layer 3 switching information for an IP PIM Layer 3 interface:
Step 1
Router#show ip pim interface countState:* - Fast Switched, D - Distributed Fast SwitchedH - Hardware Switching EnabledAddress Interface FS Mpackets In/Out10.15.1.20 GigabitEthernet4/8 * H 952/423713077010.20.1.7 GigabitEthernet4/9 * H 1385673757/3410.25.1.7 GigabitEthernet4/10* H 0/3410.11.1.30 FastEthernet6/26 * H 0/010.37.1.1 FastEthernet6/37 * H 0/01.22.33.44 FastEthernet6/47 * H 514/68Step 2
Router#show ip mroute countIP Multicast Statistics56 routes using 28552 bytes of memory13 groups, 3.30 average sources per groupForwarding Counts:Pkt Count/Pkts per second/Avg Pkt Size/Kilobits per secondOther counts:Total/RPF failed/Other drops(OIF-null, rate-limit etc)Group:224.2.136.89, Source count:1, Group pkt count:29051Source:132.206.72.28/32, Forwarding:29051/-278/1186/0, Other:85724/8/56665Router#
Note
Step 3
Router#show ip interface vlan 10Vlan10 is up, line protocol is upInternet address is 10.0.0.6/8Broadcast address is 255.255.255.255Address determined by non-volatile memoryMTU is 1500 bytesHelper address is not setDirected broadcast forwarding is disabledMulticast reserved groups joined: 224.0.0.1 224.0.0.2 224.0.0.13 224.0.0.10Outgoing access list is not setInbound access list is not setProxy ARP is enabledSecurity level is defaultSplit horizon is enabledICMP redirects are always sentICMP unreachables are never sentICMP mask replies are never sentIP fast switching is enabledIP fast switching on the same interface is disabledIP Flow switching is disabledIP CEF switching is enabledIP Fast switching turbo vectorIP Normal CEF switching turbo vectorIP multicast fast switching is enabledIP multicast distributed fast switching is disabledIP route-cache flags are Fast, CEFRouter Discovery is disabledIP output packet accounting is disabledIP access violation accounting is disabledTCP/IP header compression is disabledRTP/IP header compression is disabledProbe proxy name replies are disabledPolicy routing is disabledNetwork address translation is disabledWCCP Redirect outbound is disabledWCCP Redirect exclude is disabledBGP Policy Mapping is disabledIP multicast multilayer switching is enabledIP mls switching is enabledRouter#Verifying the IP Multicast Routing Table
Step 1
Router# show ip mroute 230.13.13.1IP Multicast Routing TableFlags:D - Dense, S - Sparse, s - SSM Group, C - Connected, L - Local,P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set,J - Join SPT, M - MSDP created entry, X - Proxy Join Timer RunningA - Advertised via MSDP, U - URD, I - Received Source Specific HostReportOutgoing interface flags:H - Hardware switchedTimers:Uptime/ExpiresInterface state:Interface, Next-Hop or VCD, State/Mode(*, 230.13.13.1), 00:16:41/00:00:00, RP 10.15.1.20, flags:SJCIncoming interface:GigabitEthernet4/8, RPF nbr 10.15.1.20Outgoing interface list:GigabitEthernet4/9, Forward/Sparse-Dense, 00:16:41/00:00:00, H(*, 230.13.13.2), 00:16:41/00:00:00, RP 10.15.1.20, flags:SJCIncoming interface:GigabitEthernet4/8, RPF nbr 10.15.1.20, RPF-MFDOutgoing interface list:GigabitEthernet4/9, Forward/Sparse-Dense, 00:16:41/00:00:00, H(10.20.1.15, 230.13.13.1), 00:14:31/00:01:40, flags:CJTIncoming interface:GigabitEthernet4/8, RPF nbr 10.15.1.20, RPF-MFDOutgoing interface list:GigabitEthernet4/9, Forward/Sparse-Dense, 00:14:31/00:00:00, H(132.206.72.28, 224.2.136.89), 00:14:31/00:01:40, flags:CJTIncoming interface:GigabitEthernet4/8, RPF nbr 10.15.1.20, RPF-MFDOutgoing interface list:NullRouter#
Note
Configuring IGMP Snooping
This section describes how to configure IGMP snooping on your router and consists of the following configuration information and procedures:
•
•
•
•
Enabling or Disabling IGMP Snooping
By default, IGMP snooping is globally enabled on the Ethernet switch network module. When globally enabled or disabled, it is also enabled or disabled in all existing VLAN interfaces. By default, IGMP snooping is enabled on all VLANs, but it can be enabled and disabled on a per-VLAN basis.
Global IGMP snooping overrides the per-VLAN IGMP snooping capability. If global snooping is disabled, you cannot enable VLAN snooping. If global snooping is enabled, you can enable or disable snooping on a VLAN basis.
Beginning in privileged EXEC mode, follow these steps to globally enable IGMP snooping on the Ethernet switch network module:
To globally disable IGMP snooping on all VLAN interfaces, use the no ip igmp snooping global command.
Beginning in privileged EXEC mode, follow these steps to enable IGMP snooping on a VLAN interface:
To disable IGMP snooping on a VLAN interface, use the no ip igmp snooping vlan vlan-id global configuration command for the specified VLAN number (for example, vlan1).
Enabling IGMP Immediate-Leave Processing
When you enable IGMP Immediate-Leave processing, the Ethernet switch network module immediately removes a port from the IP multicast group when it detects an IGMP version 2 leave message on that port. Immediate-Leave processing allows the switch to remove an interface that sends a leave message from the forwarding table without first sending out group-specific queries to the interface. You should use the Immediate-Leave feature only when there is only a single receiver present on every port in the VLAN.
Beginning in privileged EXEC mode, follow these steps to enable IGMP Immediate-Leave processing:
To disable Immediate-Leave processing, follow Steps 1 and 2 to enter interface configuration mode, and use the no ip igmp snooping vlan vlan-id immediate-leave global configuration command.
Statically Configuring an Interface to Join a Group
Ports normally join multicast groups through the IGMP report message, but you can also statically configure a host on an interface.
Beginning in privileged EXEC mode, follow these steps to add a port as a member of a multicast group:
Configuring a Multicast Router Port
Beginning in privileged EXEC mode, follow these steps to enable a static connection to a multicast router:
Configuring Global Storm-Control
This section describes how to configure global storm-control and characteristics on your router and consists of the following configuration procedures:
•
•
By default, unicast, broadcast, and multicast suppression is disabled on the switch.
Enabling Global Storm-Control
Enable global storm-control globally and enter the percentage of total available bandwidth that you want to be used by all traffic (multicast, unicast,); entering 100 percent would allow all traffic.
To enable a particular type of global storm-control, use the following commands beginning in privileged EXEC mode:
Verifying Global Storm-Control
Step 1
Router# show storm-controlStep 2
To verify global storm-control statistics on an interface, use the following commands beginning in privileged EXEC mode:
The following is sample output from the show interface counters broadcast privileged EXEC command:
Router#show interface counters broadcastPort BcastSuppDiscardsFa0/1 0Fa0/2 0
Configuring Per-Port Storm-Control
You can use these techniques to block the forwarding of unnecessary flooded traffic. This section describes how to configure per-port storm-control and characteristics on your router and consists of the following configuration procedures:
•
•
By default, unicast, broadcast, and multicast suppression is disabled.
Enabling Per-Port Storm-Control
Beginning in privileged EXEC mode, follow these steps to enable per-port storm-control:
Disabling Per-Port Storm-Control
Beginning in privileged EXEC mode, follow these steps to disable per-port storm-control:
Configuring Separate Voice and Data Subnets
For ease of network administration and increased scalability, network managers can configure the Ethernet switch network module to support Cisco IP phones such that the voice and data traffic reside on separate subnets. You should always use separate VLANs when you are able to segment the existing IP address space of your branch office.
User priority bits in the 802.1p portion of the 802.1Q standard header are used to provide prioritization in Ethernet switches. This is a vital component in designing Cisco AVVID networks.
The Ethernet switch network module provides the performance and intelligent services of Cisco IOS software for branch office applications. The Ethernet switch network module can identify user applications—such as voice or multicast video—and classify traffic with the appropriate priority levels. QoS policies are enforced using Layer 2 and 3 information such as 802.1p, IP precedence, and DSCP.
Note
To automatically configure Cisco IP phones to send voice traffic on the voice VLAN ID (VVID) on a per-port basis (see the "Voice Traffic and VVID" section), use the following commands beginning in global configuration mode:
Voice Traffic and VVID
The Ethernet switch network module can automatically configure voice VLAN. This capability overcomes the management complexity of overlaying a voice topology onto a data network while maintaining the quality of voice traffic. With the automatically configured voice VLAN feature, network administrators can segment phones into separate logical networks, even though the data and voice infrastructure is physically the same. The voice VLAN feature places the phones into their own VLANs without the need for end-user intervention. A user can plug the phone into the switch, and the switch provides the phone with the necessary VLAN information.
Configuring a Single Subnet for Voice and Data
For network designs with incremental IP telephony deployment, network managers can configure the Ethernet switch network module so that the voice and data traffic coexist on the same subnet. This might be necessary when it is impractical either to allocate an additional IP subnet for IP phones or to divide the existing IP address space into an additional subnet at the remote branch, it might be necessary to use a single IP address space for branch offices. (This is one of the simpler ways to deploy IP telephony.) When this is the case, you must still prioritize voice above data at both Layer 2 and Layer 3.
Layer 3 classification is already handled because the phone sets the Type of Service (ToS) bits in all media streams to an IP Precedence value of 5. (With Cisco CallManager Release 3.0(5), this marking changed to a Differentiated Services Code Point ([DSCP]) value of EF.) However, to ensure that there is
Layer 2 classification for admission to the multiple queues in the branch office switches, the phone must also use the User Priority bits in the Layer 2 802.1p header to provide Class of Service (CoS) marking. Setting the bits to provide marking can be done by having the switch look for 802.1p headers on the native VLAN.This configuration approach must address two key considerations:
•
•
To automatically configure Cisco IP phones to send voice and data traffic on the same VLAN, use the following commands beginning in privileged EXEC mode:
Verifying Switchport Configuration
Step 1
Router# show run interface interface
Step 2
Router#write memory
Configuring Ethernet Ports to Support Cisco IP Phones with Multiple Ports
You might want to use multiple ports to connect the Cisco IP phones if any of the following conditions apply to your Cisco IP telephony network:
•
•
•
•
IP Addressing
The recommended configuration for using multiple cables to connect IP phones to the Cisco AVVID network is to use a separate IP subnet and separate VLANs for IP telephony.
Managing the Ethernet Switch Network Module
This section describes how to perform basic management tasks on the Ethernet switch network module with the Cisco IOS CLI. You might find this information useful when you configure the switch for the previous scenarios.
The following topics are included:
•
•
Adding Trap Managers
A trap manager is a management station that receives and processes traps. When you configure a trap manager, community strings for each member switch must be unique. If a member switch has an IP address assigned to it, the management station accesses the switch by using its assigned IP address.
By default, no trap manager is defined, and no traps are issued.
To add a trap manager and community string, use the following commands beginning in privileged EXEC mode:
Verifying Trap Managers
Step 1
Router# show running-config
Configuring IP Information
This section describes how to assign IP information on the Ethernet switch network module. The following topics are included:
•
•
Assigning IP Information to the Switch
You can use a BOOTP server to automatically assign IP information to the switch; however, the BOOTP server must be set up in advance with a database of physical MAC addresses and corresponding IP addresses, subnet masks, and default gateway addresses. In addition, the switch must be able to access the BOOTP server through one of its ports. At startup, a switch without an IP address requests the information from the BOOTP server; the requested information is saved in the switch running the configuration file. To ensure that the IP information is saved when the switch is restarted, save the configuration by entering the write memory command in privileged EXEC mode.
You can change the information in these fields. The mask identifies the bits that denote the network number in the IP address. When you use the mask to subnet a network, the mask is then referred to as a subnet mask. The broadcast address is reserved for sending messages to all hosts. The CPU sends traffic to an unknown IP address through the default gateway.
To enter the IP information, use the following commands beginning in privileged EXEC mode:
Use the following procedure to remove the IP information from a switch.
Note
To remove an IP address, use the following commands beginning in global configuration mode:
Caution
Specifying a Domain Name and Configuring the DNS
Each unique IP address can have a host name associated with it. The Cisco IOS software maintains a EC mode, and related Telnet support operations. This cache speeds the process of converting names to addresses.
IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain. Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco Systems is a commercial organization that IP identifies by a com domain name, so its domain name is cisco.com. A specific device in this domain, the FTP system, for example, is identified as ftp.cisco.com.
To track domain names, IP has defined the concept of a domain name server (DNS), the purpose of which is to hold a cache (or database) of names mapped to IP addresses. To map domain names to IP addresses, you must first identify the host names and then specify a name server and enable the DNS, the Internet's global naming scheme that uniquely identifies network devices.
Specifying the Domain Name
You can specify a default domain name that the software uses to complete domain name requests. You can specify either a single domain name or a list of domain names. When you specify a domain name, any IP host name without a domain name has that domain name appended to it before being added to the host table.
Specifying a Name Server
You can specify up to six hosts that can function as a name server to supply name information for the DNS.
Enabling the DNS
If your network devices require connectivity with devices in networks for which you do not control name assignment, you can assign device names that uniquely identify your devices within the entire internetwork. The Internet's global naming scheme, the DNS, accomplishes this task. This service is enabled by default.
Configuring Voice Ports
This section describes how to configure voice ports on the Ethernet switch network module. The following topics are included:
•
•
The Ethernet switch network module can connect to a Cisco 7960 IP phone and carry IP voice traffic. If necessary, the Ethernet switch network module can supply electrical power to the circuit connecting it to the Cisco 7960 IP phone.
Because the sound quality of an IP telephone call can deteriorate if the data is unevenly transmitted, the current release of the Cisco IOS software supports QoS based on IEEE 802.1p CoS. QoS uses classification and scheduling to transmit network traffic from the switch in a predictable manner.
The Cisco 7960 IP phone contains an integrated three-port 10/100 switch. The ports are dedicated to connect to the following devices:
•
•
•
Configuring a Port to Connect to a Cisco 7960 IP phone
Because a Cisco 7960 IP phone also supports connection to a PC or other device, a port connecting a Ethernet switch network module to a Cisco 7960 IP phone can carry a mix of traffic. There are three ways to configure a port connected to a Cisco 7960 IP phone:
•
•
•
To instruct the phone to give voice traffic a higher priority and to forward all traffic through the 802.1Q native VLAN, use the following commands beginning in privileged EXEC mode:
Disabling Inline Power on a Ethernet switch network module
The Ethernet switch network module can supply inline power to a Cisco 7960 IP phone, if necessary. The Cisco 7960 IP phone can also be connected to an AC power source and supply its own power to the voice circuit. When the Cisco 7960 IP phone is supplying its own power, a Ethernet switch network module can forward IP voice traffic to and from the phone.
A detection mechanism on the Ethernet switch network module determines whether it is connected to a Cisco 7960 IP phone. If the switch senses that there is no power on the circuit, the switch supplies the power. If there is power on the circuit, the switch does not supply it.
You can configure the switch to never supply power to the Cisco 7960 IP phone and to disable the detection mechanism.
To configure a port to never supply power to Cisco 7960 IP phones, use the following commands beginning in privileged EXEC mode:
Verifying Inline Power Configuration
Step 1
Router# show power inline interface configured
Enabling Switch Port Analyzer
You can monitor traffic on a given port by forwarding incoming and outgoing traffic on the port to another port in the same VLAN. A Switch Port Analyzer (SPAN) port cannot monitor ports in a different VLAN, and a SPAN port must be a static-access port. Any number of ports can be defined as SPAN ports, and any combination of ports can be monitored. SPAN is supported for up to 2 sessions.
To enable SPAN, use the following commands beginning in privileged EXEC mode:
To disable SPAN, use the following commands beginning in privileged EXEC mode:
Managing the ARP Table
To communicate with a device (on Ethernet, for example), the software first must determine the 48-bit MAC or local data link address of that device. The process of determining the local data link address from an IP address is called address resolution.
The Address Resolution Protocol (ARP) associates a host IP address with the corresponding media or MAC addresses and VLAN ID. Taking an IP address as input, ARP determines the associated MAC address. Once a MAC address is determined, the IP-MAC address association is stored in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP). By default, standard Ethernet-style ARP encapsulation (represented by the arpa keyword) is enabled on the IP interface.
When you manually add entries to the ARP Table by using the CLI, you must be aware that these entries do not age and must be manually removed.
Managing the MAC Address Tables
This section describes how to manage the MAC address tables on the Ethernet switch network module. The following topics are included:
•
•
The switch uses the MAC address tables to forward traffic between ports. All MAC addresses in the address tables are associated with one or more ports. These MAC tables include the following types of addresses:
•
•
•
The address tables list the destination MAC address and the associated VLAN ID, module, and port number associated with the address. The following shows an example of a list of addresses as they would appear in the dynamic, secure, or static address table.
Router# show mac4d01h:%SYS-5-CONFIG_I:Configured from console by consolecSlot # :0--------------Destination Address Address Type VLAN Destination Port------------------- ------------ ---- --------------------0004.272f.49de Dynamic 1 FastEthernet0/80004.2762.3235 Dynamic 1 FastEthernet0/30004.4d07.6960 Dynamic 1 FastEthernet0/00004.ddbb.6700 Self 1 Vlan10020.18d7.4304 Dynamic 1 FastEthernet0/2beef.beef.beef Static 1 FastEthernet0/110004.2762.3235 Dynamic 2 FastEthernet0/30004.ddbb.6700 Self 2 Vlan20002.7e48.cc38 Dynamic 3 FastEthernet0/40002.7e48.cc39 Dynamic 3 FastEthernet0/5Understanding MAC Addresses and VLANs
All addresses are associated with a VLAN. An address can exist in more than one VLAN and have different destinations in each. Multicast addresses, for example, could be forwarded to port 1 in VLAN 1 and ports 9, 10, and 11 in VLAN 5.
Each VLAN maintains its own logical address table. A known address in one VLAN is unknown in another until it is learned or statically associated with a port in the other VLAN. An address can be secure in one VLAN and dynamic in another. Addresses that are statically entered in one VLAN must be static addresses in all other VLANs.
Changing the Address Aging Time
Dynamic addresses are source MAC addresses that the switch learns and then drops when they are not in use. Use the Aging Time field to define how long the switch retains unseen addresses in the table. This parameter applies to all VLANs.
Configuring the Aging Time
Setting too short an aging time can cause addresses to be prematurely removed from the table. Then when the switch receives a packet for an unknown destination, it floods the packet to all ports in the same VLAN as the receiving port. This unnecessary flooding can impact performance. Setting too long an aging time can cause the address table to be filled with unused addresses; it can cause delays in establishing connectivity when a workstation is moved to a new port.
To configure the dynamic address table aging time, use the following commands beginning in global configuration mode:
Verifying Aging-Time Configuration
Step 1
Router# show mac-address-table aging-time
Removing Dynamic Addresses
To remove a dynamic address entry, follow these steps beginning in privileged EXEC mode:
You can remove all dynamic entries by using the clear mac-address-table dynamic command in privileged EXEC mode.
Verifying Dynamic Addresses
Step 1
Router#show mac-address-table dynamic
Adding Secure Addresses
The secure address table contains secure MAC addresses and their associated ports and VLANs. A secure address is a manually entered unicast address that is forwarded to only one port per VLAN. If you enter an address that is already assigned to another port, the switch reassigns the secure address to the new port.
You can enter a secure port address even when the port does not yet belong to a VLAN. When the port is later assigned to a VLAN, packets destined for that address are forwarded to the port.
To add a secure address, use the following commands beginning in privileged EXEC mode:
To remove a secure address, use the following commands beginning in privileged EXEC mode:
You can remove all secure addresses by using the clear mac-address-table secure command in privileged EXEC mode.
Verifying Secure Addresses
Step 1
Router#show mac-address-table secure
Configuring Static Addresses
A static address has the following characteristics:
•
•
•
Because all ports are associated with at least one VLAN, the switch acquires the VLAN ID for the address from the ports that you select on the forwarding map. A static address in one VLAN must be a static address in other VLANs. A packet with a static address that arrives on a VLAN where it has not been statically entered is flooded to all ports and not learned.
To add a static address, use the following commands beginning in privileged EXEC mode:
To remove a static address, use the following commands beginning in privileged EXEC mode
:
You can remove all secure addresses by using the clear mac-address-table static command in privileged EXEC mode.
Verifying Static Addresses
Step 1
Router #show mac-address-table static4d01h:%SYS-5-CONFIG_I:Configured from console by consolecSlot # :0--------------Destination Address Address Type VLAN Destination Port------------------- ------------ ---- --------------------0004.272f.49de Dynamic 1 FastEthernet0/80004.2762.3235 Dynamic 1 FastEthernet0/30004.4d07.6960 Dynamic 1 FastEthernet0/00004.ddbb.6700 Self 1 Vlan10020.18d7.4304 Dynamic 1 FastEthernet0/2beef.beef.beef Static 1 FastEthernet0/110004.2762.3235 Dynamic 2 FastEthernet0/30004.ddbb.6700 Self 2 Vlan20002.7e48.cc38 Dynamic 3 FastEthernet0/40002.7e48.cc39 Dynamic 3 FastEthernet0/5
Clearing all MAC Address Tables
To remove all addresses, use the clear mac-address command in privileged EXEC mode:
Step 1
Router# clear mac-address-table
Enters to clear all MAC address tables.
Step 2
Router# end
Returns to privileged EXEC mode.
Configuring Intrachassis Stacking
Verifying Intra-chassis Stacking
Step 1
Configuring Flow Control on Gigabit Ethernet Ports
To configure flow control on a Gigabit Ethernet port, use the following commands in privileged mode:
Configuring Layer 3 Interfaces
The Ethernet switch network module supports two types of Layer 3 interfaces for routing and bridging:
•
•
Note
All Layer 3 interfaces require an IP address to route traffic (a routed port cannot obtain an IP address from a DHCP server, but the router can act as a DHCP server and serve IP addresses through a routed port). The following procedure shows how to configure an interface as a Layer 3 interface and how to assign an IP addresses to an interface.
Routed ports support only CEF switching (IP fast switching is not supported).
Note
Beginning in privileged EXEC mode, follow these steps to configure a Layer 3 interface:
To remove an IP address from an interface, use the no ip address interface configuration command.
Configuring Fallback Bridging
This section describes how to configure fallback bridging on your switch. It contains this configuration information:
•
•
•
•
•
•
Understanding the Default Fallback Bridging Configuration
Table 16 shows the default fallback bridging configuration.
Creating a Bridge Group
To configure fallback bridging for a set of SVIs or routed ports, these interfaces must be assigned to bridge groups. All interfaces in the same group belong to the same bridge domain. Each SVI or routed port can be assigned to only one bridge group. A maximum of 31 bridge groups can be configured on the switch.
Note
Beginning in privileged EXEC mode, follow these steps to create a bridge group and assign an interface to it:
To remove a bridge group, use the no bridge bridge-group protocol vlan-bridge global configuration command. To remove an interface from a bridge group, use the no bridge-group bridge-group interface configuration command.
Preventing the Forwarding of Dynamically Learned Stations
By default, the switch forwards any frames for stations that it has dynamically learned. By disabling this activity, the switch only forwards frames whose addresses have been statically configured into the forwarding cache.
Beginning in privileged EXEC mode, follow these steps to prevent the switch from forwarding frames for stations that it has dynamically learned:
To cause the switch to forward frames to stations that it has dynamically learned, use the bridge bridge-group acquire global configuration command.
Configuring the Bridge Table Aging Time
A switch forwards, floods, or drops packets based on the bridge table. The bridge table maintains both static and dynamic entries. Static entries are entered by you or learned by the switch. Dynamic entries are entered by the bridge learning process. A dynamic entry is automatically removed after a specified length of time, known as aging time, from the time the entry was created or last updated.
If you are likely to move hosts on a switched network, decrease the aging-time to enable the switch to quickly adapt to the change. If hosts on a switched network do not continuously send packets, increase the aging time to keep the dynamic entries for a longer time and thus reduce the possibility of flooding when the hosts send again.
Beginning in privileged EXEC mode, follow these steps to configure the aging time:
To return to the default aging-time interval, use the no bridge bridge-group aging-time global configuration command.
Filtering Frames by a Specific MAC Address
A switch examines frames and sends them through the internetwork according to the destination address; a switch does not forward a frame back to its originating network segment. You can use the software to configure specific administrative filters that filter frames based on information other than the paths to their destinations.
You can filter frames with a particular MAC-layer station destination address. Any number of addresses can be configured in the system without a performance penalty.
Beginning in privileged EXEC mode, follow these steps to filter by the MAC-layer address:
To disable the frame forwarding ability, use the no bridge bridge-group address mac-address global configuration command.
Adjusting Spanning-Tree Parameters
You might need to adjust certain spanning-tree parameters if the default values are not suitable for your switch configuration. Parameters affecting the entire spanning tree are configured with variations of the bridge global configuration command. Interface-specific parameters are configured with variations of the bridge-group interface configuration command.
You can adjust spanning-tree parameters by performing any of the tasks in these sections:
•
•
Note
Changing the Switch Priority
You can globally configure the priority of an individual switch when two switches tie for position as the root switch, or you can configure the likelihood that a switch will be selected as the root switch. This priority is determined by default; however, you can change it.
Beginning in privileged EXEC mode, follow these steps to change the switch priority:
No no form of this command exists. To return to the default setting, use the bridge bridge-group priority number global configuration command, and set the priority to the default value. To change the priority on an interface, use the bridge-group priority interface configuration command (described in the next section).
Changing the Interface Priority
You can change the priority for an interface. When two switches tie for position as the root switch, you configure an interface priority to break the tie. The switch with the lowest interface value is elected.
Beginning in privileged EXEC mode, follow these steps to change the interface priority:
To return to the default setting, use the bridge-group bridge-group priority number interface configuration command.
Assigning a Path Cost
Each interface has a path cost associated with it. By convention, the path cost is 1000/data rate of the attached LAN, in Mbps.
Beginning in privileged EXEC mode, follow these steps to assign a path cost:
To return to the default path cost, use the no bridge-group bridge-group path-cost cost interface configuration command.
Adjusting BPDU Intervals
You can adjust BPDU intervals as described in these sections:
•
•
•
Note
Adjusting the Interval between Hello BPDUs
Beginning in privileged EXEC mode, follow these step to adjust the interval between hello BPDUs:
To return to the default setting, use the no bridge bridge-group hello-time global configuration command.
Changing the Forward-Delay Interval
The forward-delay interval is the amount of time spent listening for topology change information after an interface has been activated for switching and before forwarding actually begins.
Beginning in privileged EXEC mode, follow these steps to change the forward-delay interval:
To return to the default setting, use the no bridge bridge-group forward-time seconds global configuration command.
Changing the Maximum-Idle Interval
If a switch does not hear BPDUs from the root switch within a specified interval, it recomputes the spanning-tree topology.
Beginning in privileged EXEC mode, follow these steps to change the maximum-idle interval (maximum aging time):
To return to the default setting, use the no bridge bridge-group max-age global configuration command.
Disabling the Spanning Tree on an Interface
When a loop-free path exists between any two switched subnetworks, you can prevent BPDUs generated in one switching subnetwork from impacting devices in the other switching subnetwork, yet still permit switching throughout the network as a whole. For example, when switched LAN subnetworks are separated by a WAN, BPDUs can be prevented from traveling across the WAN link.
Beginning in privileged EXEC mode, follow these steps to disable spanning tree on an interface:
To reenable spanning tree on the interface, use the no bridge-group bridge-group spanning-disabled interface configuration command.
Monitoring and Maintaining the Network
To monitor and maintain the network, use one or more of the privileged EXEC commands in Table 17:
Configuration Examples for the 16- and 36-Port Ethernet Switch Module
This section provides the following configuration examples:
•
•
•
•
•
•
•
•
•
•
Range of Interface Examples
•
•
•
Single Range Configuration Example
The following example shows all Fast Ethernet interfaces 5/1 to 5/5 being reenabled:
Router(config)# interface range fastethernet 5/1 - 5Router(config-if)# no shutdownRouter(config-if)#*Oct 6 08:24:35: %LINK-3-UPDOWN: Interface FastEthernet5/1, changed state to up*Oct 6 08:24:35: %LINK-3-UPDOWN: Interface FastEthernet5/2, changed state to up*Oct 6 08:24:35: %LINK-3-UPDOWN: Interface FastEthernet5/3, changed state to up*Oct 6 08:24:35: %LINK-3-UPDOWN: Interface FastEthernet5/4, changed state to up*Oct 6 08:24:35: %LINK-3-UPDOWN: Interface FastEthernet5/5, changed state to up*Oct 6 08:24:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet5/5, changed state to up*Oct 6 08:24:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet5/3, changed state to up*Oct 6 08:24:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet5/4, changed state to upRouter(config-if)#Multiple Range Configuration Example
The following example shows how to use a comma to add different interface type strings to the range to reenable all Fast Ethernet interfaces in the range 5/1 to 5/5 and both Gigabit Ethernet interfaces 1/1 and 1/2:
Router(config-if)# interface range fastethernet 5/1 - 5, gigabitethernet 1/1 - 2Router(config-if)# no shutdownRouter(config-if)#*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface FastEthernet5/1, changed state to up*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface FastEthernet5/2, changed state to up*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface FastEthernet5/3, changed state to up*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface FastEthernet5/4, changed state to up*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface FastEthernet5/5, changed state to up*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface GigabitEthernet1/1, changed state to up*Oct 6 08:29:28: %LINK-3-UPDOWN: Interface GigabitEthernet1/2, changed state to up*Oct 6 08:29:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet5/5, changed state to up*Oct 6 08:29:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet5/3, changed state to up*Oct 6 08:29:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet5/4, changed state to upRouter(config-if)#Range Macro Definition Example
The following example shows an interface-range macro named enet_list being defined to select Fast Ethernet interfaces 5/1 through 5/4:
Router(config)# define interface-range enet_list fastethernet 5/1 - 4Router(config)#Router(config)# interface range macro enet_listRouter(config-if)#Optional Interface Feature Examples
•
•
•
Interface Speed Example
The following example shows the interface speed being set to 100 Mbps on the Fast Ethernet interface 5/4:
Router(config)# interface fastethernet 5/4Router(config-if)# speed 100Setting the Interface Duplex Mode Example
The following example shows the interface duplex mode being set to full on Fast Ethernet interface 5/4:
Router(config)# interface fastethernet 5/4Router(config-if)# duplex fullAdding a Description for an Interface Example
The following example shows how to add a description on Fast Ethernet interface 5/5:
Router(config)# interface fastethernet 5/5Router(config-if)# description Channel-group to "Marketing"Configuring an Ethernet Interface as a Layer 2 Trunk Example
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# interface fastethernet 5/8Router(config-if)# shutdownRouter(config-if)# switchport trunk encapsulation dot1qRouter(config-if)# switchport mode trunkRouter(config-if)# no shutdownRouter(config-if)# endRouter# exitVLAN Configuration Example
The following example shows how to configure the VLAN:
Router# vlan databaseRouter(vlan)# vlan 3VLAN 3 added:Name: VLAN0003Router(vlan)# exitAPPLY completed.Exiting....VTP Examples
•
VTP Server Example
The following example shows how to configure the switch as a VTP server:
Router# vlan databaseRouter(vlan)# vtp serverSetting device to VTP SERVER mode.Router(vlan)# vtp domain Lab_NetworkSetting VTP domain name to Lab_NetworkRouter(vlan)# vtp password WATERSetting device VLAN database password to WATER.Router(vlan)# exitAPPLY completed.Exiting....Router#VTP Client Example
The following example shows how to configure the switch as a VTP client:
Router# vlan databaseRouter(vlan)# vtp clientSetting device to VTP CLIENT mode.Router(vlan)# exitIn CLIENT state, no apply attempted.Exiting....Router#Disabling VTP (VTP Transparent Mode) Example
The following example shows how to configure the switch as VTP transparent:
Router# vlan databaseRouter(vlan)# vtp transparentSetting device to VTP TRANSPARENT mode.Router(vlan)# exitAPPLY completed.Exiting....Router#VTP version 2 Example
The following example shows VTP version 2 being enabled:
Router# vlan databaseRouter(vlan)# vtp v2-modeV2 mode enabled.Router(vlan)# exitAPPLY completed.Exiting....Router#EtherChannel Load Balancing Example
•
•
•
Layer 2 EtherChannels Example
Router# configure terminalRouter(config)# interface range fastethernet 5/6 -7Router(config-if)# channel-group 2 mode desirableRouter(config-if)# endEtherChannel Load Balancing Example
Router# configure terminalRouter(config)# port-channel load-balance src-dst-ipRouter(config)# endRouter(config)#Removing an EtherChannel Example
The following example shows port-channel 1 being removed:
Router# configure terminalRouter(config)# no interface port-channel 1Router(config)# end
Note
802.1x Authentication Examples
•
•
•
•
•
•
•
Enabling 802.1x Authentication Example
The following example shows how to enable AAA and 802.1x on Fast Ethernet port 0/1:
Switch# configure terminalSwitch(config)# aaa new-modelSwitch(config)# aaa authentication dot1x default group radiusSwitch(config)# interface fastethernet0/1Switch(config-if)# dot1x port-control autoSwitch(config-if)# endConfiguring the Switch-to-RADIUS-Server Communication Example
The following example shows how to specify the server with IP address 172.20.39.46 as the RADIUS server, to use port 1612 as the authorization port, and to set the encryption key to rad123, matching the key on the RADIUS server:
Switch(config)# radius-server host 172.l20.39.46 auth-port 1612 key rad123Enabling Periodic Re-Authentication Example
The following example shows how to enable periodic reauthentication and set the number of seconds between reauthentication attempts to 4000:
Switch(config)# dot1x re-authenticationSwitch(config)# dot1x timeout re-authperiod 4000Changing the Quiet Period Example
The following example shows how to set the quiet time on the switch to 30 seconds:
Switch(config)# dot1x timeout quiet-period 30Changing the Switch-to-Client Retransmission Time Example
The following example shows how to set 60 seconds as the number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before retransmitting the request:
Switch(config)# dot1x timeout tx-period 60Setting the Switch-to-Client Frame-Retransmission Number Example
The following example shows how to set 5 as the number of times that the switch sends an EAP-request/identity request before restarting the authentication process:
Switch(config)# dot1x max-req 5Enabling Multiple Hosts Example
The following example shows how to enable 802.1x on Fast Ethernet interface 0/1 and to allow multiple hosts:
Switch(config)# interface fastethernet0/1Switch(config-if)# dot1x port-control autoSwitch(config-if)# dot1x multiple-hostsSpanning Tree Examples
•
•
•
•
Spanning-Tree Interface and Spanning-Tree Port Priority Example
The following example shows the VLAN port priority of an interface being configured:
Router# configure terminalRouter(config)# interface fastethernet 5/8Router(config-if)# spanning-tree vlan 200 port-priority 64Router(config-if)# endRouter#The following example shows how to verify the configuration of VLAN 200 on the interface when it is configured as a trunk port:
Router# show spanning-tree vlan 200!!!Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 19, Port priority 64, Port Identifier 129.8.Designated root has priority 32768, address 0010.0d40.34c7Designated bridge has priority 32768, address 0010.0d40.34c7Designated port id is 128.1, designated path cost 0Timers: message age 2, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 0, received 13513Router#!!!Spanning-Tree Port Cost Example
The following example shows how to change the spanning-tree port cost of a Fast Ethernet interface:
Router# configure terminalRouter(config)# interface fastethernet 5/8Router(config-if)# spanning-tree cost 18Router(config-if)# endRouter#The following example shows how to verify the configuration of the interface when it is configured as an access port:
Router# show spanning-tree interface fastethernet 5/8Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 18, Port priority 100, Port Identifier 129.8.Designated root has priority 32768, address 0010.0d40.34c7Designated bridge has priority 32768, address 0010.0d40.34c7Designated port id is 128.1, designated path cost 0Timers: message age 2, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 0, received 13513Router#The following example shows how to configure the spanning-tree VLAN port cost of a Fast Ethernet interface:
Router# configure terminalRouter(config)# interface fastethernet 5/8Router(config-if)# spanning-tree vlan 200 cost 17Router(config-if)# exitRouter(config)# exitRouter#Bridge Priority of a VLAN
The following example shows the bridge priority of VLAN 200 being configured to 33792:
Router# configure terminalRouter(config)# spanning-tree vlan 200 priority 33792Router(config)# endRouter#Hello Time Example
The following example shows the hello time for VLAN 200 being configured to 7 seconds:
Router# configure terminalRouter(config)# spanning-tree vlan 200 hello-time 7Router(config)# endRouter#Forward-Delay Time for a VLAN Example
Router# configure terminalRouter(config)# spanning-tree vlan 200 forward-time 21Router(config)# endRouter#Maximum Aging Time for a VLAN Example
Router# configure terminalRouter(config)# spanning-tree vlan 200 max-age 36Router(config)# endRouter#BackboneFast Example
Router# configure terminalRouter(config)# spanning-tree backbonefastRouter(config)# endRouter#Spanning Tree Examples
Router# configure terminalRouter(config)# spanning-tree vlan 200Router(config)# endRouter#
Note
Router# configure terminalRouter(config)# no spanning-tree vlan 200Router(config)# endRouter#Spanning Tree Root Example
The following example shows the switch being configured as the root bridge for VLAN 10, with a network diameter of 4:
Router#configure terminalRouter(config)#spanning-tree vlan 10 root primary diameter 4Router(config)#exitRouter#Mac Table Manipulation Examples
Router# configure terminalRouter(config)# mac-address-table dynamic 6.6.6 fastEthernet 2/13 vlan 1Router(config)# end
Router(config)#mac-address-table static beef.beef.beef int fa0/11 vlan 1
Router(config)#endCisco Discovery Protocol (CDP) Example
Switched Port Analyzer (SPAN) Source Examples
•
•
SPAN Source Configuration Example
The following example shows SPAN session 1 being configured to monitor bidirectional traffic from source interface Fast Ethernet 5/1:
Router(config)# monitor session 1 source interface fastethernet 5/1SPAN Destinations Example
The following example shows interface Fast Ethernet 5/48 being configured as the destination for SPAN session 1:
Router(config)# monitor session 1 destination interface fastethernet 5/48Removing Sources or Destinations from a SPAN Session Example
The following example shows interface Fast Ethernet 5/2 being removed as a SPAN source for SPAN session 1:
Router(config)# no monitor session 1 source interface fastethernet 5/2Network Security and ACL Configuration Examples
•
•
•
•
•
•
Creating Numbered Standard and Extended ACLs Example
The following example shows how to create a standard ACL to deny access to IP host 171.69.198.102, permit access to any others, and display the results:
Switch (config)# access-list 2 deny host 171.69.198.102Switch (config)# access-list 2 permit anySwitch(config)# endSwitch# show access-listsStandard IP access list 2deny 171.69.198.102permit anyThe following example shows that the switch accepts addresses on network 36.0.0.0 subnets and denies all packets coming from 56.0.0.0 subnets. The ACL is then applied to packets entering Gigabit Ethernet interface 0/1:
Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255Switch(config)# access-list 2 deny 56.0.0.0 0.255.255.255Switch(config)# interface gigabitethernet0/1Switch(config-if)# ip access-group 2 inThe following example shows how to create and display an extended access list to deny Telnet access from any host in network 171.69.198.0 to any host in network 172.20.52.0 and permit any others (the eq keyword after the destination address means to test for the TCP destination port number equaling Telnet):
Switch(config)# access-list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnetSwitch(config)# access-list 102 permit tcp any anySwitch(config)# endSwitch# show access-listsExtended IP access list 102deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnetpermit tcp any anyThe following example shows an extended ACL with a network connected to the Internet, and any host on the network being able to form TCP Telnet and SMTP connections to any host on the Internet:
Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 23Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 25Switch(config)# interface gigabitethernet0/1Switch(config-if)# ip access-group 102 inSMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The same port numbers are used throughout the life of the connection. Mail packets coming in from the Internet have a destination port of 25. Because the secure system behind the switch always accepts mail connections on port 25, the incoming services are controlled.
Creating Named Standard and Extended ACLs Example
The following example shows how you can delete individual ACEs from a named ACL:
Switch(config)# ip access-list extended border-listSwitch(config-ext-nacl)# no permit ip host 10.1.1.3 anyThe following example shows the Marketing_group ACL allowing any TCP Telnet traffic to the destination address and wildcard 171.69.0.0 0.0.255.255 and denying any other TCP traffic. It permits any other IP traffic:
Switch(config)# ip access-list extended marketing_groupSwitch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnetSwitch(config-ext-nacl)# deny tcp any anySwitch(config-ext-nacl)# permit ip any anyThe ACLs are applied to permit Gigabit Ethernet port 0/1, which is configured as a Layer 2 port, with the Marketing_group ACL applied to incoming traffic.
Switch(config)# interface gigabitethernet0/1Switch(config-if)# ip access-group marketing_group in...Including Comments About Entries in ACLs Example
The following example shows an IP numbered standard ACL using the access-list access-list number remark remark global configuration command to include a comment about an access list. In this example, the workstation belonging to Jones is allowed access, and the workstation belonging to Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation throughSwitch(config)# access-list 1 permit 171.69.2.88Switch(config)# access-list 1 remark Do not allow Smith workstation throughSwitch(config)# access-list 1 deny 171.69.3.13The following example shows an entry in a named IP ACL using the remark access-list global configuration command to include a comment about an access list. In this example, the Jones subnet is not allowed to use outbound Telnet:
Switch(config)# ip access-list extended telnettingSwitch(config-ext-nacl)# remark Do not allow Jones subnet to telnet outSwitch(config-ext-nacl)# deny tcp host 171.69.2.88 any eq telnetIn this example of a numbered ACL, the workstation belonging to Jones is allowed access, and the workstation belonging to Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation throughSwitch(config)# access-list 1 permit 171.69.2.88Switch(config)# access-list 1 remark Do not allow Smith workstation throughSwitch(config)# access-list 1 deny 171.69.3.13In this example of a numbered ACL, the Winter and Smith workstations are not allowed to browse the web:
Switch(config)# access-list 100 remark Do not allow Winter to browse the webSwitch(config)# access-list 100 deny host 171.69.3.85 any eq wwwSwitch(config)# access-list 100 remark Do not allow Smith to browse the webSwitch(config)# access-list 100 deny host 171.69.3.13 any eq wwwApplying the ACL to an Interface Example
The following example shows how to apply access list 2 on Gigabit Ethernet interface 0/3 to filter packets entering the interface:
Switch(config)# interface gigabitethernet0/3Router(config-if)# ip access-group 2 inDisplaying Standard and Extended ACLs Example
The following example displays all standard and extended ACLs:
Switch# show access-listsStandard IP access list 1permit 172.20.10.10Standard IP ACL 10permit 12.12.12.12Standard IP access list 12deny 1.3.3.2Standard IP access list 32permit 172.20.20.20Standard IP access list 34permit 10.24.35.56permit 23.45.56.34Extended IP access list 120The following example displays only IP standard and extended ACLs:
Switch# show ip access-listsStandard IP access list 1permit 172.20.10.10Standard IP access list 10permit 12.12.12.12Standard IP access list 12deny 1.3.3.2Standard IP access list 32permit 172.20.20.20Standard IP access list 34permit 10.24.35.56permit 23.45.56.34Extended IP access list 120Displaying Access Groups Example
You use the ip access-group interface configuration command to apply ACLs to a Layer 3 interface. When IP is enabled on an interface, you can use the show ip interface interface-id privileged EXEC command to view the input and output access lists on the interface, as well as other interface characteristics. If IP is not enabled on the interface, the access lists are not shown.
The following example shows how to view all access groups configured for VLAN 1 and for Gigabit Ethernet interface 0/2:
Switch# show ip interface vlan 1GigabitEthernet0/2 is up, line protocol is downInternet address is 10.20.30.1/16Broadcast address is 255.255.255.255Address determined by setup commandMTU is 1500 bytesHelper address is not setDirected broadcast forwarding is disabledOutgoing access list is permit AnyInbound access list is 13<information truncated>Switch# show ip interface f0/9FastEthernet0/9 is down, line protocol is downInbound access list is ip1The only way to ensure that you can view all configured access groups under all circumstances is to use the show running-config privileged EXEC command. To display the ACL configuration of a single interface, use the show running-config interface interface-id command.
The following example shows how to display the ACL configuration of Gigabit Ethernet interface 0/1:
Switch# show running-config interface gigabitethernet0/1Building configuration...Current configuration :112 bytes!interface GigabitEthernet0/1ip access-group 11 insnmp trap link-statusno cdp enableend!Compiling ACLs Example
For detailed information about compiling ACLs, refer to the Security Configuration Guide and the "IP Services" chapter of the Cisco IOS IP and IP Routing Configuration Guide for Cisco IOS Release 12.2.
Figure 21 shows a small networked office with a stack of Catalyst 2950 switches that are connected to a Cisco router with an Ethernet switch network module installed. A host is connected to the network through the Internet using a WAN link.
Use switch ACLs to do these:
•
•
Figure 21 Using Switch ACLs to Control Traffic
The following example uses a standard ACL to allow access to a specific Internet host with the address 172.20.128.64:
Switch(config)# access-list 6 permit 172.20.128.64 0.0.0.0Switch(config)# endSwitch(config)# interface gigabitethernet0/1Switch(config-if)# ip access-group 6 inThe following example uses an extended ACL to deny traffic from port 80 (HTTP). It permits all other types of traffic:
Switch(config)# access-list 106 deny tcp any any eq 80Switch(config)# access-list 106 permit ip any anySwitch(config)# interface gigabitethernet0/2Switch(config-if)# ip access-group 106 inQoS Configuration Examples
•
•
•
•
•
•
Classifying Traffic by Using ACL Example
The following example shows how to allow access for only those hosts on the two specified networks. The wildcard bits apply to the host portions of the network addresses. Any host with a source address that does not match the ACL statements is rejected.
Switch(config)# access-list 1 permit 192.5.255.0 0.0.0.255Switch(config)# access-list 1 permit 36.0.0.0 0.0.0.255Classifying Traffic by Using Class Maps Example
The following example shows how to configure the class map called class1. The class1 has one match criterion, which is an ACL called 103.
Switch(config)# access-list 103 permit any any tcp eq 80Switch(config)# class-map class1Switch(config-cmap)# match access-group 103Switch(config-cmap)# endSwitch#Classifying, Policing, and Marking Traffic by Using Policy Maps Example
The following example shows how to create a policy map and attach it to an ingress interface. In the configuration, the IP standard ACL permits traffic from network 10.1.0.0. For traffic matching this classification, the DSCP value in the incoming packet is trusted. If the matched traffic exceeds an average traffic rate of 48000 bps and a normal burst size of 8000 bytes, its DSCP is marked down to a value of 10 and transmitted.
Switch(config)# access-list 1 permit 10.1.0.0 0.0.255.255Switch(config)# class-map ipclass1Switch(config-cmap)# match access-group 1Switch(config-cmap)# exitSwitch(config)# policy-map flow1tSwitch(config-pmap)# class ipclass1Switch(config-pmap-c)# police 5000000 8192 exceed-action dscp 10Switch(config-pmap-c)# exitSwitch(config-pmap)# exitSwitch(config)# interface gigabitethernet0/1Switch(config-if)# switchport mode accessSwitch(config-if)# service-policy input flow1tConfiguring the CoS-to-DSCP Map Example
The following example shows how to modify and display the CoS-to-DSCP map:
Switch# configure terminalSwitch(config)# mls qos map cos-dscp 8 8 8 8 24 32 56 56Switch(config)# endSwitch# show mls qos maps cos-dscpCos-dscp map:cos: 0 1 2 3 4 5 6 7--------------------------------dscp: 8 8 8 8 24 32 56 56Configuring the DSCP-to-CoS Map Example
The following example shows how the DSCP values 26 and 48 are mapped to CoS value 7. For the remaining DSCP values, the DSCP-to-CoS mapping is the default.
Switch(config)# mls qos map dscp-cos 26 48 to 7Switch(config)# exitSwitch# show mls qos maps dscp-cosDscp-cos map:dscp: 0 8 10 16 18 24 26 32 34 40 46 48 56-----------------------------------------------cos: 0 1 1 2 2 3 7 4 4 5 5 7 7Displaying QoS Information Example
The following example shows how to display the DSCP-to-CoS maps:
Switch# show mls qos maps dscp-cosDscp-cos map:dscp: 0 8 10 16 18 24 26 32 34 40 46 48 56-----------------------------------------------cos: 0 1 1 2 2 3 3 4 4 5 5 6 7IGMP Snooping Example
Default IGMP Snooping Configuration
IGMP Snooping is enabled by default on a VLAN or subnet basis. Multicast routing has to be enabled on the router first and then PIM (Multicast routing protocol) has to be enabled on the VLAN interface so that the Ethernet switch network module acknowledges the IGMP join and leave messages that are sent from the hosts connected to the Ethernet switch network module.
Router(config)#ip multicast-routingRouter(config-if)#interface VLAN1Router(config-if)#ip-address 192.168.10.1 255.255.255.0Router(config-if)#ip pim sparse-modeThe following example shows the output from configuring IGMP snooping:
Router#show mac-address-table multicast igmp-snoopingSlot # :3--------------MACADDR VLANID INTERFACES0100.5e00.0001 10100.5e00.0002 10100.5e00.000d 10100.5e00.0016 10100.5e05.0505 1 Fa3/120100.5e06.0606 1 Fa3/130100.5e7f.ffff 1 Fa3/130100.5e00.0001 20100.5e00.0002 20100.5e00.000d 20100.5e00.0016 20100.5e00.0128 20100.5e05.0505 2 Fa3/100100.5e06.0606 2 Fa3/11Router#The following example shows output from the show running-config interface privileged EXEC command for VLAN 1:
Router#show running-config interface vlan 1Building configuration...Current configuration :82 bytes!interface Vlan1ip address 192.168.4.90 255.255.255.0ip pim sparse-modeendThe following example shows output from the show running-config interface privileged EXEC command for VLAN 2:
Router#show running-config interface vlan 2Building configuration...Current configuration :82 bytes!interface Vlan2ip address 192.168.5.90 255.255.255.0ip pim sparse-modeendThe following example shows output verifying multicasting support:
Router#show ip igmp groupIGMP Connected Group MembershipGroup Address Interface Uptime Expires Last Reporter239.255.255.255 Vlan1 01:06:40 00:02:20 192.168.41.101224.0.1.40 Vlan2 01:07:50 00:02:17 192.168.5.90224.5.5.5 Vlan1 01:06:37 00:02:25 192.168.41.100224.5.5.5 Vlan2 01:07:40 00:02:21 192.168.31.100224.6.6.6 Vlan1 01:06:36 00:02:22 192.168.41.101224.6.6.6 Vlan2 01:06:39 00:02:20 192.168.31.101The following example shows output from the multicast routing table:
Router#show ip mrouteIP Multicast Routing TableFlags:D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C -Connected,L - Local, P - Pruned, R - RP-bit set, F - Register flag,T - SPT-bit set, J - Join SPT, M - MSDP created entry,X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,U - URD, I - Received Source Specific Host ReportOutgoing interface flags:H - Hardware switchedTimers:Uptime/ExpiresInterface state:Interface, Next-Hop or VCD, State/Mode(*, 239.255.255.255), 01:06:43/00:02:17, RP 0.0.0.0, flags:DCIncoming interface:Null, RPF nbr 0.0.0.0Outgoing interface list:Vlan1, Forward/Sparse, 01:06:43/00:02:17(*, 224.0.1.40), 01:12:42/00:00:00, RP 0.0.0.0, flags:DCLIncoming interface:Null, RPF nbr 0.0.0.0Outgoing interface list:Vlan2, Forward/Sparse, 01:07:53/00:02:14(*, 224.5.5.5), 01:07:43/00:02:22, RP 0.0.0.0, flags:DCIncoming interface:Null, RPF nbr 0.0.0.0Outgoing interface list:Vlan1, Forward/Sparse, 01:06:40/00:02:22Vlan2, Forward/Sparse, 01:07:44/00:02:17(*, 224.6.6.6), 01:06:43/00:02:18, RP 0.0.0.0, flags:DCIncoming interface:Null, RPF nbr 0.0.0.0Outgoing interface list:Vlan1, Forward/Sparse, 01:06:40/00:02:18Vlan2, Forward/Sparse, 01:06:43/00:02:16Storm-Control Example
The following example shows global bandwidth-based multicast suppression being enabled at 70 percent on Gigabit Ethernet interface 1 and the configuration being verified:
Router# configure terminalRouter(config)# interface gigabitethernet0/2Router(config-if)# storm-control threshold 70Router(config-if)# endRouter# show storm-controlName: Gi0/2Switchport: EnabledAdministrative Mode: dynamic desirableOperational Mode: downAdministrative Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Port Protected: OffUnknown Unicast Traffic: AllowedUnknown Multicast Traffic: Not AllowedBroadcast Suppression Level: 100Multicast Suppression Level: 70Unicast Suppression Level: 100Ethernet Switching Examples
•
•
•
Subnets for Voice and Data Example
The following example shows separate subnets being configured for voice and data on the Ethernet switch network module:
interface FastEthernet5/1description DOT1Q port to IP Phoneswitchport native vlan 50switchport mode trunkswitchport voice vlan 150interface Vlan 150description voice vlanip address 10.150.1.1 255.255.255.0ip helper-address 172.20.73.14 (See Note below)interface Vlan 50description data vlanip address 10.50.1.1 255.255.255.0This configuration instructs the IP phone to generate a packet with an 802.1Q VLAN ID of 150 with an 802.1p value of 5 (default for voice bearer traffic).
Note
Cisco IOS supports a DHCP server function. If this function is used, the Ethernet switch network module serves as a local DHCP server and a helper address would not be required.
Inter-VLAN Routing Example
Configuring inter-VLAN routing is identical to the configuration on a Ethernet switch network module with an MSFC. Configuring an interface for WAN routing is consistent with other Cisco IOS platforms.
The following example provides a sample configuration:
interface Vlan 160description voice vlanip address 10.6.1.1 255.255.255.0interface Vlan 60description data vlanip address 10.60.1.1 255.255.255.0interface Serial1/0ip address 160.3.1.2 255.255.255.0
Note
Single Subnet Configuration Example
The Ethernet switch network module supports the use of an 802.1p-only option when configuring the voice VLAN. Using this option allows the IP phone to tag VoIP packets with a CoS of 5 on the native VLAN, while all PC data traffic is sent untagged.
The following example shows a single subnet configuration for the Ethernet switch network module switch:
Router# FastEthernet 5/2description Port to IP Phone in single subnetswitchport access vlan 40switchport voice vlan dot1pspanning-tree portfastThe Ethernet switch network module instructs the IP phone to generate an 802.1Q frame with a null VLAN ID value but with an 802.1p value (default is COS of 5 for bearer traffic). The voice and data VLANs are both 40 in this example.
Ethernet Ports on IP Phones with Multiple Ports Example
The following example illustrates the configuration on the IP phone:
interface FastEthernet2/2switchport voice vlan 5switchport mode trunkThe following example illustrates the configuration on the PC:
interface FastEthernet2/3switchport access vlan 10
Note
Intrachassis Stacking Example
The following example shows how to stack GE port 2/0 to GE port 3/0 to form an extended VLAN within one chassis:
Router #config terminalRouter(config)# interface Gigabit 2/0Router(config-if)# switchport stacking-link interface Gigabit3/0The following example shows interchassis stacking being verified between GE port 2/0 and GE port 3/0:GigabitEthernet2/0 is up, line protocol is downInternal Stacking Link Active : Gi2/0 is stacked with Gi3/0Hardware is Gigabit Ethernet, address is 001b.3f2b.2c24 (bia 001b.3f2b.2c24)MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Full-duplex mode, link type is force-up, media type is unknown 0output flow-control is off, input flow-control is offFull-duplex, 1000Mb/sARP type: ARPA, ARP Timeout 04:00:00Last input 1d22h, output never, output hang neverLast clearing of "show interface" counters 1d22hQueueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec250707 packets input, 19562597 bytes, 0 no bufferReceived 7 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 watchdog, 0 multicast, 0 pause input0 input packets with dribble condition detected7469804 packets output, 582910831 bytes, 0 underruns(0/0/0)0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier, 0 pause output0 output buffer failures, 0 output buffers swapped outFlow Control on Gigabit Ethernet Ports Example
The following examples show how to turn transmit and receive flow control on and how to verify the flow-control configuration:
Port 4/0 flow control send administration status set to on (port will send flowcontrol to far end):
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet4/0Switch(config-if)# flowcontrol send onSwitch(config-if)# endPort 4/0 flow control receive administration status set to on (port will require far end to send flowcontrol):
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet4/0Switch(config-if)# flowcontrol receive onSwitch(config-if)# endThe following example shows flow control configuration being verified:Switch# show interface gigabitethernet4/0GigabitEthernet4/0 is up, line protocol is upHardware is Gigabit Ethernet, address is 0087.c08b.4824 (bia0087.c08b.4824)MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)output flow-control is off, input flow-control is on0 pause input, 0 pause outputFull-duplex, 1000Mb/sARP type:ARPA, ARP Timeout 04:00:00Last input 00:00:01, output never, output hang neverLast clearing of "show interface" counters neverInput queue:0/75/0/0 (size/max/drops/flushes); Total output drops:0Queueing strategy:fifoOutput queue:0/40 (size/max)5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 1 packets/sec398301 packets input, 29528679 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected790904 packets output, 54653461 bytes, 0 underruns0 output errors, 0 collisions, 5 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outThe following example shows how to configure Gigabit Ethernet interface 0/10 as a routed port and to assign it an IP address:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet0/10Switch(config-if)# no switchportSwitch(config-if)# ip address 10.1.2.3 255.255.0.0Switch(config-if)# no shutdownSwitch(config-if)# endThe following is sample output from the show interfaces privileged EXEC command for Gigabit Ethernet interface 0/2:
Switch(config)# show interfaces gigabitethernet0/2GigabitEthernet0/2 is up, line protocol is upHardware is Gigabit Ethernet, address is 0002.4b29.4400 (bia 0002.4b29.4400)Internet address is 192.20.135.21/24MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Full-duplex, 100Mb/sinput flow-control is off, output flow-control is offARP type: ARPA, ARP Timeout 04:00:00Last input 00:00:02, output 00:00:08, output hang neverLast clearing of "show interface" counters neverQueueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec89604 packets input, 8480109 bytes, 0 no bufferReceived 81848 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected60665 packets output, 6029820 bytes, 0 underruns0 output errors, 0 collisions, 16 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outThe following is sample output from the show ip interface privileged EXEC command for Gigabit Ethernet interface 0/2:
Switch# show ip interface gigabitethernet0/2GigabitEthernet0/2 is up, line protocol is upInternet address is 192.20.135.21/24Broadcast address is 255.255.255.255Address determined by setup commandMTU is 1500 bytesHelper address is not setDirected broadcast forwarding is disabledMulticast reserved groups joined: 224.0.0.5 224.0.0.6Outgoing access list is not setInbound access list is not setProxy ARP is enabledLocal Proxy ARP is disabledSecurity level is defaultSplit horizon is enabledICMP redirects are always sentICMP unreachables are always sentICMP mask replies are never sentIP fast switching is enabledIP fast switching on the same interface is disabledIP Flow switching is disabledIP CEF switching is enabledIP CEF Fast switching turbo vectorIP multicast fast switching is enabledIP multicast distributed fast switching is disabledIP route-cache flags are Fast, CEFRouter Discovery is disabledIP output packet accounting is disabledIP access violation accounting is disabledTCP/IP header compression is disabledRTP/IP header compression is disabledProbe proxy name replies are disabledPolicy routing is disabledNetwork address translation is disabledWCCP Redirect outbound is disabledWCCP Redirect exclude is disabledBGP Policy Mapping is disabledThe following is sample output for the show running-config privileged EXEC command for Gigabit Ethernet interface 0/2:
Switch# show running-config interface gigabitethernet0/2Building configuration...Current configuration : 122 bytes!interface GigabitEthernet0/2no switchportip address 192.20.135.21 255.255.255.0speed 100mls qos trust dscpendConfiguring Layer 3 Interfaces Example
The following example shows how to configure Gigabit Ethernet interface 0/10 as a routed port and to assign it an IP address:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet0/10Switch(config-if)# no switchportSwitch(config-if)# ip address 10.1.2.3 255.255.0.0Switch(config-if)# no shutdownSwitch(config-if)# endThe following is sample output from the show interfaces privileged EXEC command for Gigabit Ethernet interface 0/2:
Switch(config)# show interfaces gigabitethernet0/2GigabitEthernet0/2 is up, line protocol is upHardware is Gigabit Ethernet, address is 0002.4b29.4400 (bia 0002.4b29.4400)Internet address is 192.20.135.21/24MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Full-duplex, 100Mb/sinput flow-control is off, output flow-control is offARP type: ARPA, ARP Timeout 04:00:00Last input 00:00:02, output 00:00:08, output hang neverLast clearing of "show interface" counters neverQueueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec89604 packets input, 8480109 bytes, 0 no bufferReceived 81848 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected60665 packets output, 6029820 bytes, 0 underruns0 output errors, 0 collisions, 16 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outThe following is sample output from the show ip interface privileged EXEC command for Gigabit Ethernet interface 0/2:
Switch# show ip interface gigabitethernet0/2GigabitEthernet0/2 is up, line protocol is upInternet address is 192.20.135.21/24Broadcast address is 255.255.255.255Address determined by setup commandMTU is 1500 bytesHelper address is not setDirected broadcast forwarding is disabledMulticast reserved groups joined: 224.0.0.5 224.0.0.6Outgoing access list is not setInbound access list is not setProxy ARP is enabledLocal Proxy ARP is disabledSecurity level is defaultSplit horizon is enabledICMP redirects are always sentICMP unreachables are always sentICMP mask replies are never sentIP fast switching is enabledIP fast switching on the same interface is disabledIP Flow switching is disabledIP CEF switching is enabledIP CEF Fast switching turbo vectorIP multicast fast switching is enabledIP multicast distributed fast switching is disabledIP route-cache flags are Fast, CEFRouter Discovery is disabledIP output packet accounting is disabledIP access violation accounting is disabledTCP/IP header compression is disabledRTP/IP header compression is disabledProbe proxy name replies are disabledPolicy routing is disabledNetwork address translation is disabledWCCP Redirect outbound is disabledWCCP Redirect exclude is disabledBGP Policy Mapping is disabledThe following is sample output for the show running-config privileged EXEC command for Gigabit Ethernet interface 0/2:
Switch# show running-config interface gigabitethernet0/2Building configuration...Current configuration : 122 bytes!interface GigabitEthernet0/2no switchportip address 192.20.135.21 255.255.255.0speed 100mls qos trust dscpendFallback Bridging Example
This section describes how to configure fallback bridging on your switch. It contains this configuration information:
•
•
•
•
•
Creating a Bridge Group Example
The following example shows how to create bridge group 10, specify the VLAN-bridge STP to run in the bridge group, and assign an interface to the bridge group:
Switch(config)# bridge 10 protocol vlan-bridgeSwitch(config)# interface gigabitethernet0/1Switch(config-if)# no switchportSwitch(config-if)# bridge-group 10Preventing the Forwarding of Dynamically Learned Stations Example
The following example shows how to prevent the switch from forwarding frames for stations that it has dynamically learned in bridge group 10:
Switch(config)# no bridge 10 acquireConfiguring the Bridge Table Aging Time Example
The following example shows how to change the bridge table aging time to 200 seconds for bridge group 10:
Switch(config)# bridge 10 aging-time 200Filtering Frames by a Specific MAC Address Example
The following example shows how to forward a frame with MAC address 0800.cb00.45e9 through an interface in bridge group 1:
Switch(config)# bridge 1 address 0800.cb00.45e9 forward gigabitethernet0/1Adjusting Spanning-Tree Parameters Examples
The following examples show how to adjust spanning-tree parameters:
•
•
•
•
•
Changing the Switch Priority Example
The following example shows how to set the switch priority to 100 for bridge group 10:
Switch(config)# bridge 10 priority 100Changing the Interface Priority Example
The following example shows how to change the priority of an interface to 20 in bridge group 10:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# bridge-group 10 priority 20Assigning a Path Cost Example
The following example shows how to change the path cost on an interface to 10 in bridge group 10:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# bridge-group 10 path-cost 20Adjusting BPDU Intervals Example
You can adjust BPDU intervals as described in these sections:
•
•
•
Adjusting the Interval between Hello BPDUs Example
The following example shows how to change the hello interval to 5 seconds in bridge group 10:
Switch(config)# bridge 10 hello-time 5Changing the Forward-Delay Interval Example
The following example shows how to change the forward-delay interval to 10 seconds in bridge group 10:
Switch(config)# bridge 10 forward-time 10Changing the Maximum-Idle Interval Example
The following example shows how to change the maximum-idle interval to 30 seconds in bridge group 10:
Switch(config)# bridge 10 max-age 30Disabling the Spanning Tree on an Interface Example
The following example shows how to disable spanning tree on an interface in bridge group 10:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# bridge group 10 spanning-disabledCommand Reference
This section documents new commands or existing commands that are newly ported to the 16- and 36-port Ethernet switch module. All other commands used with this feature are documented in the Cisco IOS Release 12.2 command reference publications.
•
•
•
•
•
•
aaa authentication dot1x
To specify one or more authentication, authorization, and accounting (AAA) methods for use on interfaces running IEEE 802.1x, use the aaa authentication dot1x command in global configuration mode. To disable authentication, use the no form of this command.
aaa authentication dot1x {default | listname} method1 [method2...]
no aaa authentication dot1x {default | listname} method1 [method2...]
Syntax Description
Defaults
No authentication is performed.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
The method argument identifies the list of methods that the authentication algorithm tries in the given sequence to validate the password provided by the client. The only method that is truly 802.1x-compliant is the group radius method, in which the client data is validated against a RADIUS authentication server. The remaining methods enable AAA to authenticate the client by using locally configured data. For example, the local and local-case methods use the username and password that are saved in the Cisco IOS configuration file. The enable and line methods use the enable and line passwords for authentication.
If you specify group radius, you must configure the RADIUS server by entering the radius-server host global configuration command.
If you are not using a RADIUS server, you can use the local or local-case methods, which access the local username database to perform authentication. By specifying the enable or line methods, you can supply the clients with a password to provide access to the switch.
Use the show running-config privileged EXEC command to display the configured lists of authentication methods.
Examples
The following example shows how to enable AAA and how to create an authentication list for 802.1x. This authentication first tries to contact a RADIUS server. If this action returns an error, the user is allowed access with no authentication:
Switch(config)# aaa new modelSwitch(config)# aaa authentication dot1x default group radius noneYou can verify your settings by entering the show running-config privileged EXEC command.
Related Commands
aaa new-model
Enables the AAA access control model.
show running-config
Displays the running configuration on the switch.
class
To define a traffic classification for the policy to act on using the class-map name or access group, use the class policy-map configuration command. To delete an existing class map, use the no form of this command.
class class-map-name [access-group acl-index-or-name]
no class class-map-name
Syntax Description
Defaults
No policy-map class maps are defined.
Command Modes
Policy-map configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Before you use the class command, use the policy-map global configuration command to identify the policy map and to enter policy-map configuration mode. After you specify a policy map, you can configure a policy for new classes or modify a policy for any existing classes in that policy map. You attach the policy map to an interface by using the service-policy interface configuration command; however, you cannot attach one that uses an ACL classification to the egress direction.
The class name that you specify in the policy map ties the characteristics for that class to the class map and its match criteria as configured by using the class-map global configuration command.
The class command performs the same function as the class-map global configuration command. Use the class command when a new classification, which is not shared with any other ports, is needed. Use the class-map command when the map is shared among many ports.
Note
After entering the class command, you enter policy-map class configuration mode. When you are in this mode, these configuration commands are available:
•
•
•
•
To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.
Note
Examples
The following example shows how to create a policy map named policy1. When attached to the ingress port, it matches all the incoming traffic defined in class1 and polices the traffic at an average rate of 1 Mbps and bursts at 131072 bytes. Traffic exceeding the profile is dropped:
Switch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# police 1000000 131072 exceed-action dropSwitch(config-pmap-c)# exitSwitch(config-pmap)#You can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
class-map
To create a class map to be used for matching packets and to enter class-map configuration mode, use the class-map command in global configuration mode. To delete an existing class map, use the no form of this command.
class-map class-map-name
no class-map class-map-name
Syntax Description
Defaults
No class maps are defined.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use this command to specify the name of the class for which you want to create or modify class-map match criteria and to enter class-map configuration mode. In this mode, you can enter one match command to configure the match criteria for this class.
The class-map command and its subcommands are used to define packet classification and marking as part of a globally named service policy applied on a per-interface basis.
In quality of service (QoS) class-map configuration mode, these configuration commands are available:
•
•
•
Only one match criteria per class map is supported. For example, when defining a class map, only one match command can be entered.
Only one access control list (ACL) can be configured in a class map. The ACL can have multiple access control entries (ACEs).
Note
Note
Examples
The following example shows how to configure the class map named class1. Class1 has one match criteria, which is a numbered ACL:
Switch(config)# access-list 103 permit tcp any any eq 80Switch(config)# class-map class1Switch(config-cmap)# match access-group 103Switch(config-cmap)# exitYou can verify your settings by entering the show class-map privileged EXEC command.
Related Commands
debug dot1x
To enable debugging of the 802.1x feature, use the debug dot1x command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug dot1x {all | authsm | backend | besm | core | reauthsm}
no debug dot1x {all | authsm | backend | besm | core | reauthsm}
Syntax Description
Defaults
Debugging is disabled.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
The undebug dot1x command is the same as the no debug dot1x command.
Related Commands
debug eswilp
To enable debugging of Ethernet switch network module features, use the debug eswilp command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug eswilp {dot1x | filtermgr | fltdrv | igmp | port-driver | power-supply | span | switch-pm}
no debug eswilp {dot1x | filtermgr | fltdrv | igmp | port-driver | power-supply | span | switch-pm}
Syntax Description
Defaults
Debugging is disabled.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The undebug eswilp command is the same as the no debug eswilp command.
Examples
The following example shows debugging messages for the IGMP snooping services on the Ethernet switch network module being displayed:
Router# debug eswilp igmpRelated Commands
show debugging
Displays information about the types of debugging that are enabled.
debug ip igmp snooping
To display debugging messages about Internet Group Management Protocol (IGMP) snooping services, use the debug ip igmp snooping command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug ip igmp snooping {group | management | router | timer}
no debug ip igmp snooping {group | management | router | timer}
Syntax Description
Defaults
Debugging is disabled.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use the debug ip igmp snooping command to troubleshoot the IGMP snooping feature.
Examples
The following example shows debugging messages for the IGMP snooping services being displayed:
Router# debug ip igmp snoopingIGMP snooping enabledRelated Commands
debug spanning-tree
To debug spanning-tree activities, use the debug spanning-tree command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug spanning-tree {all | backbonefast | bpdu | bpdu-opt | config | etherchannel | events | exceptions | general | pvst+ | root | snmp | uplinkfast}
no debug spanning-tree {all | backbonefast | bpdu | bpdu-opt | config | etherchannel | events | exceptions | general | pvst+ | root | snmp | uplinkfast}
Syntax Description
Defaults
Debugging is disabled.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
The undebug spanning-tree command is the same as the no debug spanning-tree command.
Related Commands
show debugging
Displays information about the types of debugging that are enabled.
Displays spanning-tree state information.
deny (access-list configuration)
To configure conditions for a named or numbered IP access control list (ACL), use the deny command in access-list configuration mode. To remove a deny condition from the IP ACL, use the no form of the command.
Use these commands with standard IP ACLs:
deny {source source-wildcard | host source | any}
no deny {source source-wildcard | host source | any}
Use these commands with extended IP ACLs:
deny protocol {source source-wildcard | host source | any} [operator port] {destination destination-wildcard | host source | any} [operator port]
no deny protocol {source source-wildcard | host source | any} [operator port] {destination destination-wildcard | host source | any} [operator port]
Syntax Description
Defaults
There are no specific conditions that deny packets in the named or numbered IP ACL.
The default ACL is always terminated by an implicit deny statement for all packets.
Command Modes
Access-list configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use this command after the ip access-list global configuration command to specify deny conditions for an IP ACL. You can specify a source IP address, destination IP address, IP protocol, TCP port, or UDP port. Specify the TCP and UDP port numbers only if protocol is tcp or udp and operator is eq.
Note
Examples
The following example shows how to create an extended IP ACL and to configure deny conditions for it:
Switch(config)#ip access-list extended InternetfilterSwitch(config-ext-nacl)#deny tcp host 190.5.88.10 anySwitch(config-ext-nacl)#deny tcp host 192.1.10.10 anyThe following is an example of a standard ACL that sets a deny conditions:
ip access-list standard Acclist1deny 192.5.34.0 0.0.0.255deny 128.88.10.0 0.0.0.255deny 36.1.1.0 0.0.0.255
Note
You can verify your settings by entering the show ip access-lists or show access-lists privileged EXEC command.
Related Commands
Controls access to an interface.
Defines an IP ACL.
Sets conditions for an IP ACL.
Displays ACLs configured on a switch.
Displays IP ACLs configured on the switch.
dot1x default
To reset the global 802.1x parameters to their default values, use the dot1x default command in global configuration mode.
dot1x default
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default setting.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Examples
The following example shows how to reset the global 802.1x parameters:
Switch(config)# dot1x defaultYou can verify your settings by entering the show dot1x privileged EXEC command.
Related Commands
dot1x max-req
To set the maximum number of times that the switch sends an Extensible Authentication Protocol (EAP)-request/identity frame (assuming that no response is received) before restarting the authentication process, use the dot1x max-req command in global configuration mode. To return to the default setting, use the no form of this command.
dot1x max-req count
no dot1x max-req
Syntax Description
count
Number of times that the switch sends an EAP-request/identify frame before restarting the authentication process. The range is 1 to 10.
Defaults
The default is 2 times.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers.
Examples
The following example shows how to set the number of times that the switch sends an EAP-request/identity frame to 5 before restarting the authentication process:
Switch(config)#dot1x max-req 5You can verify your settings by entering the show dot1x privileged EXEC command.
Related Commands
dot1x multiple-hosts
To allow multiple hosts (clients) on an 802.1x-authorized port that has the dot1x port-control interface configuration command set to auto, use the dot1x multiple-hosts command in interface configuration mode. To return to the default setting, use the no form of this command.
dot1x multiple-hosts
no dot1x multiple-hosts
Syntax Description
This command has no arguments or keywords.
Defaults
Multiple hosts are disabled.
Command Modes
Interface configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
This command enables you to attach multiple clients to a single 802.1x-enabled port. In this mode, only one of the attached hosts must be successfully authorized for all hosts to be granted network access. If the port becomes unauthorized (reauthentication fails, or an Extensible Authentication Protocol over LAN [EAPOL]-logoff message is received), all attached clients are denied access to the network.
Examples
The following example shows how to enable 802.1x on Fast Ethernet interface 0/1 and to allow multiple hosts:
Switch(config)# interface fastethernet0/1Switch(config-if)# dot1x port-control autoSwitch(config-if)# dot1x multiple-hostsYou can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command.
Related Commands
dot1x port-control
To enable manual control of the authorization state of the port, use the dot1x port-control command in interface configuration mode. To return to the default setting, use the no form of this command.
dot1x port-control {auto | force-authorized | force-unauthorized}
no dot1x port-control
Syntax Descriptionn
Defaults
The authorization state is force-authorized.
Command Modes
Interface configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
The 802.1x protocol is supported on Layer 2 static-access ports.
You can use the auto keyword only if the port is not configured as one of these types:
•
•
•
To globally disable 802.1x on the switch, you must disable it on each port. There is no global configuration command for this task.
Examples
The following example shows how to enable 802.1x on Fast Ethernet interface 0/1:
Switch(config)# interface fastethernet0/1Switch(config-if)# dot1x port-control autoYou can verify your settings by entering the show dot1x privileged EXEC command and checking the Status column in the 802.1x Port Summary section of the display. An enabled status means the port-control value is set to auto or to force-unauthorized.
Related Commands
Displays 802.1x statistics, administrative status, and operational status for the switch or for the specified interface.
dot1x re-authenticate
To manually initiate a reauthentication of all 802.1x-enabled ports or the specified 802.1x-enabled port, use the dot1x re-authenticate command in privileged EXEC mode.
dot1x re-authenticate [interface interface-id]
Syntax Description
Defaults
There is no default setting.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
You can use this command to reauthenticate a client without waiting for the configured number of seconds between reauthentication attempts (reauthperiod) and automatic reauthentication.
Examples
The following example shows how to manually reauthenticate the device connected to Fast Ethernet interface 0/1:
Switch# dot1x re-authenticate interface fastethernet 0/1Starting reauthentication on FastEthernet0/1.You can verify your settings by entering the show dot1x privileged EXEC command.
dot1x re-authentication
To enable periodic reauthentication of the client, use the dot1x re-authentication command in global configuration mode. To return to the default setting, use the no form of this command.
dot1x re-authentication
no dot1x re-authentication
Syntax Description
This command has no arguments or keywords.
Defaults
Periodic reauthentication is disabled.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
You configure the amount of time between periodic reauthentication attempts by using the dot1x timeout re-authperiod global configuration command.
Examples
The following example shows how to disable periodic reauthentication of the client:
Switch(config)# no dot1x re-authenticationThe following example shows how to enable periodic reauthentication and set the number of seconds between reauthentication attempts to 4000 seconds:
Switch(config)# dot1x re-authenticationSwitch(config)# dot1x timeout re-authperiod 4000You can verify your settings by entering the show dot1x privileged EXEC command.
Related Commands
dot1x timeout quiet-period
To set the number of seconds that the switch remains in the quiet state following a failed authentication exchange (for example, the client provided an invalid password), use the dot1x quiet-period command in global configuration mode. To return to the default setting, use the no form of this command.
dot1x timeout quiet-period seconds
no dot1x timeout quiet-period
Syntax Description
seconds
Time in seconds that the switch remains in the quiet state following a failed authentication exchange with the client. The range is 0 to 65535 seconds.
Defaults
The default time is 60 seconds.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
During the quiet period, the switch does not accept or initiate any authentication requests.
You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers.
If you want to provide a faster response time to the user, enter a smaller number than the default.
Examples
The following example shows how to set the quiet time on the switch to 30 seconds:
Switch(config)# dot1x timeout quiet-period 30You can verify your settings by entering the show dot1x privileged EXEC command.
Related Commands
Displays 802.1x statistics, administrative status, and operational status for the switch or for the specified interface.
dot1x timeout re-authperiod
To set the number of seconds between reauthentication attempts, use the dot1x timeout re-authperiod command in global configuration mode. To return to the default setting, use the no form of this command.
dot1x timeout re-authperiod seconds
no dot1x timeout re-authperiod
Syntax Description
Defaults
The default is 3600 seconds.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
The dot1x timeout re-authperiod global configuration command affects the behavior of the switch only if you have enabled periodic reauthentication by using the dot1x re-authentication global configuration command.
You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients or authentication servers.
Examples
The following example shows how to enable periodic reauthentication and set the number of seconds between reauthentication attempts to 4000 seconds:
Switch(config)# dot1x re-authenticationSwitch(config)# dot1x timeout re-authperiod 4000You can verify your settings by entering the show dot1x privileged EXEC command.
Related Commands
Enables periodic reauthentication of the client.
Displays 802.1x statistics, administrative status, and operational status for the switch or for the specified interface.
dot1x timeout tx-period
To set the number of seconds that the switch waits for a response to an Extensible Authentication Protocol (EAP)-request /identity frame from the client before retransmitting the request, use the dot1x timeout tx-period command in global configuration mode. To return to the default setting, use the no form of this command.
dot1x timeout tx-period seconds
no dot1x timeout tx-period
Syntax Description
seconds
Time in seconds that the switch should wait for a response to an EAP-request/identity frame from the client before retransmitting the request. The range is 1 to 65535 seconds.
Defaults
The default is 30 seconds.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients or authentication servers.
Examples
The following example shows how to set 60 as the number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before retransmitting the request:
Switch(config)# dot1x timeout tx-period 60You can verify your settings by entering the show dot1x privileged EXEC command.
Related Commands
ip access-group
To control access to an interface, use the ip access-group command in interface configuration mode. To remove an access group from an interface, use the no form of this command.
ip access-group {access-list-number | name} in
no ip access-group {access-list-number | name} in
Syntax Description
Defaults
No ACL is applied to the interface.
Command Modes
Interface configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
You can apply IP ACLs only to ingress interfaces.
The ACLs can be standard or extended.
For standard ACLs, after receiving a packet, the switch checks the packet source address. If the source address matches a defined address in the ACL and the list permits the address, the switch forwards the packet.
For extended ACLs, after receiving the packet, the switch checks the match conditions in the ACL. If the conditions are matched, the switch forwards the packet.
If the specified ACL does not exist, the switch forwards all packets.
IP access groups can be separated on Layer 2 and Layer 3 interfaces.
Note
Examples
The following example shows how to apply a numbered ACL to an interface:
Switch(config)#interface fastethernet0/1Switch(config-if)#ip access-group 101 inYou can verify your settings by entering the show access-lists or show ip access-lists privileged EXEC command.
Related Commands
Configures conditions for an IP ACL.
Defines an IP ACL.
Configures conditions for an IP ACL.
Displays IP ACLs configured on the switch.
Displays ACLs configured on the switch.
ip access-list
To create an IP access control list (ACL) to be used for matching packets to an ACL whose name or number you specify and to enter access-list configuration mode, use the ip access-list command in global configuration mode. To delete an existing IP ACL and return to global configuration mode, use the no form of this command.
ip access-list {standard | extended} {name | access-list-number}
no ip access-list {standard | extended} {name | access-list-number}
Syntax Description
Defaults
No named or numbered IP ACLs are defined.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use this command to specify the name or number of the IP ACL for which you want to create or modify ACL match criteria and to enter access-list configuration mode. In this mode, you must enter the permit and deny commands to configure the permit and deny access conditions for this list.
The ip access-list command and its subcommands are used to define packet classification and marking as part of a globally-named service policy applied on a per-interface basis or as an IP access group applied on a per-interface basis.
Specifying standard or extended with the ip access-list command determines the prompt you get when you enter access-list configuration mode.
Note
Examples
The following example shows how to configure a standard ACL named Internetfilter1:
Switch(config)#ip access-list standard Internetfilter1Switch(config-std-nacl)#permit 192.5.34.0 0.0.0.255Switch(config-std-nacl)#permit 192.5.32.0 0.0.0.255Switch(config-std-nacl)#exitThe following example shows how to configure an extended ACL named Internetfilter2:
Switch(config)#ip access-list extended Internetfilter2Switch(config-ext-nacl)#permit any 128.8.10.0 0.0.0.255 eq 80Switch(config-ext-nacl)#permit any 128.5.8.0 0.0.0.255 eq 80Switch(config-ext-nacl)#exit
Note
You can verify your settings by entering the show access-lists or show ip access-lists privileged EXEC command.
Related Commands
ip igmp snooping
To globally enable Internet Group Management Protocol (IGMP) snooping, use the ip igmp snooping command in global configuration mode. To disable IGMP snooping, use the no form of this command.
ip igmp snooping
no ip igmp snooping
Syntax Description
This command has no arguments or keywords.
Defaults
By default, IGMP snooping is globally enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
When IGMP snooping is globally enabled, it enables IGMP snooping on all the existing VLAN interfaces. When IGMP snooping is globally disabled, it disables IGMP snooping on all the existing VLAN interfaces.
The configuration is saved in nonvolatile RAM (NVRAM).
Examples
The following example shows how to globally enable IGMP snooping:
Switch(config)# ip igmp snoopingThe following example shows how to globally disable IGMP snooping:
Switch(config)# no ip igmp snoopingYou can verify your settings by entering the show ip igmp snooping privileged EXEC command.
Related Commands
ip igmp snooping vlan
To enable Internet Group Management Protocol (IGMP) snooping on a specific VLAN, use the ip igmp snooping vlan command in global configuration mode. To disable IGMP snooping on a VLAN interface, use the no form of this command.
ip igmp snooping vlan vlan-id
no ip igmp snooping vlan vlan-id
Syntax Description
Defaults
By default, IGMP snooping is enabled when each VLAN is created.
Command Modes
Global configuration
Command History
Usage Guidelines
This command automatically configures the VLAN if it is not already configured. The configuration is saved in nonvolatile RAM (NVRAM).
Examples
The following example shows how to enable IGMP snooping on VLAN 2:
Switch(config)# ip igmp snooping vlan 2The following example shows how to disable IGMP snooping on VLAN 2:
Switch(config)# no ip igmp snooping vlan 2You can verify your settings by entering the show ip igmp snooping vlan privileged EXEC command.
Related Commands
ip igmp snooping vlan immediate-leave
To enable Internet Group Management Protocol (IGMP) Immediate-Leave processing on a VLAN interface, use the ip igmp snooping immediate-leave command in global configuration mode. To disable Immediate-Leave processing on the VLAN interface, use the no form of this command.
ip igmp snooping vlan vlan-id immediate-leave
no ip igmp snooping vlan vlan-id immediate-leave
Syntax Description
Defaults
By default, IGMP Immediate-Leave processing is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the Immediate-Leave feature only when there is only one IP multicast receiver present on every port in the VLAN. The Immediate-Leave configuration is saved in nonvolatile RAM (NVRAM).
The Immediate-Leave feature is supported only with IGMP version 2 hosts.
Examples
The following example shows how to enable IGMP Immediate-Leave processing on VLAN 1:
Switch(config)# ip igmp snooping vlan 1 immediate-leaveThe following example shows how to disable IGMP Immediate-Leave processing on VLAN 1:
Switch(config)# no ip igmp snooping vlan 1 immediate-leaveYou can verify your settings by entering the show ip igmp snooping vlan privileged EXEC command.
Related Commands
ip igmp snooping vlan mrouter
To add a multicast router port and to configure the multicast router learning method, use the ip igmp snooping vlan mrouter command in global configuration mode. To remove the configuration, use the no form of this command.
ip igmp snooping vlan vlan-id mrouter {interface interface-id | learn pim-dvmrp}
no ip igmp snooping vlan vlan-id mrouter {interface interface-id | learn pim-dvmrp}
Syntax Description
Defaults
The default learning method is pim-dvmrp.
Command Modes
Global configuration
Command History
Usage Guidelines
The CGMP learning method is useful for controlling traffic in Cisco router environments.
The configured learning method is saved in nonvolatile RAM (NVRAM).
Static connections to multicast routers are supported only on switch ports.
Examples
The following example shows how to configure Fast Ethernet interface 0/6 as a multicast router port:
Switch(config)# ip igmp snooping vlan 1 mrouter interface fastethernet0/6You can verify your settings by entering the show ip igmp snooping mrouter privileged EXEC command.
Related Commands
ip igmp snooping vlan static
To add a Layer 2 port as a member of a multicast group, use the ip igmp snooping vlan vlan-id static command in global configuration mode. To remove the configuration, use the no form of this command.
ip igmp snooping vlan vlan-id static mac-address interface interface-id
no ip igmp snooping vlan vlan-id static mac-address interface interface-id
Syntax Description
Defaults
No Layer 2 ports are configured.
Command Modes
Global configuration
Command History
Usage Guidelines
The command is used to statically configure the IP multicast group member ports.
The static ports and groups are saved in nonvolatile RAM (NVRAM).
Static connections to multicast routers are supported only on switch ports.
Examples
The following example shows how to statically configure a host on an interface:
Switch(config)# ip igmp snooping vlan 1 static 0100.5e02.0203 interface fastethernet0/6Configuring port FastEthernet 0/6 on group 0100.5e02.0203You can verify your settings by entering the show mac-address-table multicast privileged EXEC command.
Related Commands
match (class-map configuration)
To define the match criteria to classify traffic, use the match command in class-map configuration mode. To remove the match criteria, use the no form of this command.
match {access-group acl-index-or-name}
no match {access-group acl-index-or-name}
Syntax Description
Defaults
No match criteria are defined.
Command Modes
Class-map configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
The match command is used to specify which fields in the incoming packets are examined to classify the packets. Only IP access groups are supported.
Only one match command per class map is supported.
Note
Examples
The following example shows how to classify traffic on an interface by using the access group named acl2:
Switch(config)# class-map class2Switch(config-cmap)# match access-group acl2Switch(config-cmap)# exitYou can verify your settings by entering the show class-map privileged EXEC command.
Related Commands
mls qos cos
To define the default class of service (CoS) value of a port or to assign the default CoS to all incoming packets on the port, use the mls qos cos command in interface configuration mode. To return to the default setting, use the no form of this command.
mls qos cos {default-cos | override}
no mls qos cos {default-cos | override}
Syntax Description
Defaults
The default CoS value for a port is 0.
CoS override is disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
You can use the default value to assign a CoS and DSCP value to all packets entering a port if the port has been configured by using the override keyword.
Use the override keyword when all incoming packets on certain ports deserve higher or lower priority than packets entering from other ports. Even if a port was previously set to trust DSCP or CoS, this command overrides that trust state, and all the incoming CoS values are assigned the default CoS value configured with the mls qos cos command. If an incoming packet is tagged, the CoS value of the packet is modified with the default CoS of the port at the ingress port.
Examples
The following example shows how to configure the default port CoS to 4:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# mls qos trust cosSwitch(config-if)# mls qos cos 4The following example shows how to assign all the packets entering a port to the default port CoS value of 4:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# mls qos cos 4Switch(config-if)# mls qos cos overrideYou can verify your settings by entering the show mls qos interface privileged EXEC command.
Related Commands
Defines the CoS-to-DSCP map or the DSCP-to-CoS map.
Configures the port trust state.
show interface fax/y switchport
Displays switchport interfaces.
Displays QoS information.
mls qos map
To define the class of service (CoS)-to-Differentiated Services Code Point (DSCP) map or DSCP-to-CoS map, use the mls qos map command in global configuration mode. To return to the default map, use the no form of this command.
mls qos map {cos-dscp dscp1...dscp8 | dscp-cos dscp-list to cos}
no mls qos map {cos-dscp | dscp-cos}
Syntax Description
Defaults
Table 18 shows the default CoS-to-DSCP map:
Table 19 shows the default DSCP-to-CoS map:
Table 19 Default DSCP-to-CoS Map
DSCP Values
0
8, 10
16, 18
24, 26
32, 34
40, 46
48
56
CoS Value
0
1
2
3
4
5
6
7
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
All the maps are globally defined. You apply all maps to all ports.
If you enter the mls qos trust cos command, the default CoS-to-DSCP map is applied.
If you enter the mls qos trust dscp command, the default DSCP-to-CoS map is applied.
After a default map is applied, you can define the CoS-to-DSCP or DSCP-to-CoS map by entering consecutive mls qos map commands.
The supported DSCP values are 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56. If the mls qos trust dscp command is entered and a packet with an untrusted DSCP value is at an ingress port, the packet CoS value is set to 0.
Examples
The following example shows how to define the DSCP-to-CoS map. DSCP values 16, 18, 24, and 26 are mapped to CoS 1. DSCP values 0, 8, and 10 are mapped to CoS 0:
Switch# configure terminalSwitch(config)# mls qos map dscp-cos 16 18 24 26 to 1Switch(config)# mls qos map dscp-cos 0 8 10 to 0The following example shows how to define the CoS-to-DSCP map. CoS values 0 to 7 are mapped to DSCP values 8, 8, 8, 8, 24, 32, 56, and 56:
Switch# configure terminalSwitch(config)# mls qos map cos-dscp 8 8 8 8 24 32 56 56You can verify your settings by entering the show mls qos maps privileged EXEC command.
Related Commands
Defines the default CoS value of a port or assigns the default CoS to all incoming packets on the port.
Configures the port trust state.
Displays QoS mapping information.
mls qos trust
To configure the port trust state and classify traffic by examining the class of service (CoS) or Differentiated Services Code Point (DSCP) value, use the mls qos trust command in interface configuration mode. To return a port to its untrusted state, use the no form of this command.
mls qos trust [cos | dscp]
no mls qos trust [cos | dscp]
Syntax Description
Defaults
The port is not trusted. If no keyword is specified, the default is dscp.
Command Modes
Interface configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Packets entering a quality of service (QoS) domain are classified at the edge of the QoS domain. Because the packets are classified at the edge, the switch port within the QoS domain can be configured to one of the trusted states; there is no need to classify the packets at every switch within the domain. Use this command to specify whether the port is trusted and which fields of the packet to use to classify traffic.
When a port is configured with trust DSCP and the incoming packet is a non-IP packet, the CoS value for the packet is set to 0, and the DSCP-to-CoS map is not applied.
If DSCP is trusted, the DSCP field of the IP packet is not modified. However, it is still possible that the CoS value of the packet is modified (according to the DSCP-to-CoS map).
If CoS is trusted, CoS of the packet is not modified, but DSCP can be modified (according to the CoS-to-DSCP map) if it is an IP packet.
Examples
The following example shows how to configure a port to be a DSCP-trusted port:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# mls qos trust dscpThe following example shows how to configure a VLAN interface to be a DSCP-trusted port. DSCP-to-COS mapping occurs for all packets with the configured VLAN ID of 60 egressing from the CPU to the physical port.
Switch(config)# interface vlan 60Switch(config-if)# mls qos trust dscpYou can verify your settings by entering the show mls qos interface privileged EXEC command.
Related Commands
permit (access-list configuration)
To configure conditions for a named or numbered IP access control list (ACL), use the permit command in access-list configuration mode. To remove a permit condition from the IP ACL, use the no form of the command.
Use these commands with standard IP ACLs:
permit {source source-wildcard | host source | any}
no permit {source source-wildcard | host source | any}
Use these commands with extended IP ACLs:
permit protocol {source source-wildcard | host source | any} [operator port] {destination destination-wildcard | host source | any} [operator port]
no permit protocol {source source-wildcard | host source | any} [operator port] {destination destination-wildcard | host source | any} [operator port]
Syntax Description
Defaults
There are no specific conditions that permit packets in a named or numbered IP ACL.
The default ACL is always terminated by an implicit deny statement for all packets.
Command Modes
Access-list configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use this command after the ip access-list global configuration command to specify permit conditions for a named or numbered IP ACL. You can specify a source IP address, destination IP address, IP protocol, TCP port, or UDP port. Specify the TCP and UDP port numbers only if protocol is tcp or udp and operator is eq.
Note
Examples
The following example shows how to create an extended IP ACL and configure permit conditions for it:
Switch(config)#ip access-list extended Internetfilter2Switch(config-ext-nacl)#permit host 36.10.10.5 anySwitch(config-ext-nacl)#permit host 192.1.10.8 anyThe following is an example of a standard ACL that sets permit conditions:
ip access-list standard Acclist1permit 192.5.34.0 0.0.0.255permit 128.88.10.0 0.0.0.255permit 36.1.1.0 0.0.0.255
Note
You can verify your settings by entering the show ip access-lists or show access-lists privileged EXEC command.
Related Commands
Sets deny conditions for an IP ACL.
Controls access to an interface.
Defines an IP ACL.
Displays ACLs configured on a switch.
Displays IP ACLs configured on the switch.
police
To define a policer for classified traffic, use the police command in policy-map class configuration mode. To remove an existing policer, use the no form of this command.
police {bps | cir bps} [burst-byte | bc burst-byte] conform-action transmit [exceed-action {drop | dscp dscp-value}]
police {bps | cir bps} [burst-byte | bc burst-byte] conform-action transmit [exceed-action {drop | dscp dscp-value}]
Syntax Description
Defaults
No policers are defined.
Command Modes
Policy-map class configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
You can configure up to six policers on ingress Fast Ethernet ports.
You can configure up to 60 policers on ingress Gigabit-capable Ethernet ports.
Policers cannot be configured on egress Fast Ethernet and Gigabit-capable Ethernet ports.
To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.
Note
Examples
The following example shows how to configure a policer that sets the DSCP value to 46 if traffic does not exceed a 1-Mbps average rate with a burst size of 65536 bytes and drops packets if traffic exceeds these conditions:
Switch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# set ip dscp 46Switch(config-pmap-c)# police 1000000 65536 exceed-action dropSwitch(config-pmap-c)# exitYou can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
Creates or modifies a policy map that can be attached to multiple interfaces, and enters policy-map configuration mode.
Displays QoS policy maps.
policy-map
To create or modify a policy map that can be attached to multiple interfaces and to enter policy-map configuration mode, use the policy-map command in global configuration mode. To delete an existing policy map and return to global configuration mode, use the no form of this command.
policy-map policy-map-name
no policy-map policy-map-name
Syntax Description
Defaults
No policy maps are defined.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Entering the policy-map command enables the policy-map configuration mode. These configuration commands are available:
•
•
•
•
•
Note
To return to global configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.
Before you can configure policies for classes whose match criteria are defined in a class map, use the policy-map command to specify the name of the policy map to be created or modified. Entering this command also enables the policy-map configuration mode in which you can configure or modify the class policies for that policy map.
You can configure class policies in a policy map only if the classes have match criteria defined for them. Use the class-map and match commands to configure the match criteria for a class. Only one match command per class map is supported.
Only one policy map per interface per direction is supported. You can apply the same policy map to multiple interfaces but only in the ingress direction.
Note
Examples
The following example shows how to create a policy map called policy1. When attached to the ingress direction, it matches all the incoming traffic defined in class1 and polices the traffic at an average rate of 1 Mbps and bursts at 65536 bytes. Traffic exceeding the profile is dropped:
Switch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# police 1000000 65536 exceed-action dropSwitch(config-pmap-c)# exitSwitch(config-pmap)#The following example shows how to delete policymap2:
Switch(config)# no policy-map policymap2You can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
service-policy
To apply a policy map defined by the policy-map command to the input of a particular interface, use the service-policy command in interface configuration mode. To remove the policy map and interface association, use the no form of this command.
service-policy input policy-map-name
no service-policy input policy-map-name
Syntax Description
Defaults
No policy maps are attached to the interface.
Command Modes
Interface configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Only one policy map per ingress interface is supported.
Service policy maps cannot be defined on egress interfaces.
Note
Examples
The following example shows how to apply plcmap1 to an ingress interface:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# service-policy input plcmap1You can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy.
Displays QoS policy maps.
show access-lists
To display access control lists (ACLs) configured on the switch, use the show access-lists command in privileged EXEC mode.
show access-lists [name | number]
Syntax Description
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.
Examples
The following is sample output from the show access-lists command:
Switch# show access-listsStandard IP access list testingaclpermit 10.10.10.2Standard IP access list wizard_1-1-1-2permit 1.1.1.2Extended IP access list 103permit tcp any any eq wwwExtended IP access list CMP-NAT-ACLDynamic Cluster-HSRP deny ip any anyDynamic Cluster-NAT permit ip any anypermit ip host 10.123.222.192 anypermit ip host 10.228.215.0 anypermit ip host 10.245.137.0 anypermit ip host 10.245.155.128 anypermit ip host 10.221.111.64 anypermit ip host 10.216.25.128 anypermit ip host 10.186.122.64 anypermit ip host 10.169.110.128 anypermit ip host 10.146.106.192 anyRelated Commands
Configures an IP ACL on the switch.
Displays the IP ACLs configured on a switch.
show class-map
To display quality of service (QoS) class maps, which define the match criteria to classify traffic, use the show class-map command in privileged EXEC mode.
show class-map [class-map-name]
Syntax Description
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
If you do not specify a class-map-name, all class maps appear.
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.
Examples
The following is sample output from the show class-map test command:
Switch# show class-map testClass Map match-all test (id 2)Match access-group name testingaclThe following is sample output from the show class-map command:
Switch# show class-mapClass Map match-all wizard_1-1-1-2 (id 3)Match access-group name videowizard_1-1-1-2Class Map match-all test (id 2)Match access-group name testingaclClass Map match-any class-default (id 0)Match anyClass Map match-all class1 (id 5)Match access-group 103Class Map match-all classtest (id 4)Description: This is a test.Match access-group name testingaclRelated Commands
Creates a class map to be used for matching packets to the class whose name you specify.
Defines the match criteria to classify traffic.
show dot1x
To display the 802.1x statistics, administrative status, and operational status for the switch or for the specified interface, use the show dot1x command in privileged EXEC mode.
show dot1x [statistics] [interface interface-id]
Syntax Description
statistics
(Optional) Displays 802.1x statistics.
interface interface-id
(Optional) Slot and port number of the interface to reauthenticate.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
If you do not specify an interface, global parameters and a summary appear. If you specify an interface, details for that interface appear.
If you specify an interface with the statistics keyword, statistics appear for all physical ports.
Examples
The following is sample output from the show dot1x command:
Switch# show dot1xGlobal 802.1X Parametersreauth-enabled noreauth-period 3600quiet-period 60tx-period 30supp-timeout 30server-timeout 30reauth-max 2max-req 2802.1X Port SummaryPort Name Status Mode AuthorizedGi0/1 disabled n/a n/aGi0/2 enabled Auto (negotiate) no802.1X Port Details802.1X is disabled on GigabitEthernet0/1802.1X is enabled on GigabitEthernet0/2Status UnauthorizedPort-control AutoSupplicant 0060.b0f8.fbfbMultiple Hosts DisallowedCurrent Identifier 2Authenticator State MachineState AUTHENTICATINGReauth Count 1Backend State MachineState RESPONSERequest Count 0Identifier (Server) 2Reauthentication State MachineState INITIALIZE
Note
In the 802.1x Port Summary section of the example, the Status column shows whether the port is enabled for 802.1x (the dot1x port-control interface configuration command is set to auto or force-unauthorized). The Mode column shows the operational status of the port; for example, if you configure the dot1x port-control interface configuration command to force-unauthorized, but the port has not changed to that state, the Mode column displays auto. If you disable 802.1x, the Mode column displays n/a.
The Authorized column shows the authorization state of the port. For information about port states, refer to the "Configuring 802.1x Port-Based Authentication" chapter in the Catalyst 2950 Desktop Switch Software Configuration Guide.
The following is sample output from the show dot1x interface gigabitethernet0/2 privileged EXEC command. Table 20 describes the fields in the output.
Switch# show dot1x interface gigabitethernet0/2802.1X is enabled on GigabitEthernet0/2Status AuthorizedPort-control AutoSupplicant 0060.b0f8.fbfbMultiple Hosts DisallowedCurrent Identifier 3Authenticator State MachineState AUTHENTICATEDReauth Count 0Backend State MachineState IDLERequest Count 0Identifier (Server) 2Reauthentication State MachineState INITIALIZE
Table 20 show dot1x interface Field Descriptions
Status
Status of the port (authorized or unauthorized). The status of a port appears as authorized if the dot1x port-control interface configuration command is set to auto, and authentication was successful.
Port-control
Setting of the dot1x port-control interface configuration command.
Supplicant
Ethernet MAC address of the client, if one exists. If the switch has not discovered the client, this field displays Not set.
Multiple Hosts
Setting of the dot1x multiple-hosts interface configuration command (allowed or disallowed).
Current Identifier1
Each exchange between the switch and the client includes an identifier, which matches requests with responses. This number is incremented with each exchange and can be reset by the authentication server.
1 This field and the remaining fields in the output show internal state information. For a detailed description of these state machines and their settings, refer to the IEEE 802.1x standard.
The following is sample output from the show dot1x statistics interface gigiabitethernet0/1 command. Table 21 describes the fields in the example.
Switch# show dot1x statistics interface gigabitethernet0/1GigabitEthernet0/1Rx: EAPOL EAPOL EAPOL EAPOL EAP EAP EAPStart Logoff Invalid Total Resp/Id Resp/Oth LenError0 0 0 21 0 0 0Last LastEAPOLVer EAPOLSrc1 0002.4b29.2a03Tx: EAPOL EAP EAPTotal Req/Id Req/Oth622 445 0
Table 21 show dot1x statistics Field Descriptions
RX EAPOL1 Start
Number of valid EAPOL-start frames that have been received.
RX EAPOL Logoff
Number of EAPOL-logoff frames that have been received.
RX EAPOL Invalid
Number of EAPOL frames that have been received and have an unrecognized frame type.
RX EAPOL Total
Number of valid EAPOL frames of any type that have been received.
RX EAP2 Resp/ID
Number of EAP-response/identity frames that have been received.
RX EAP Resp/Oth
Number of valid EAP-response frames (other than response/identity frames) that have been received.
RX EAP LenError
Number of EAPOL frames that have been received in which the packet body length field is invalid.
Last EAPOLVer
Protocol version number carried in the most recently received EAPOL frame.
LAST EAPOLSrc
Source MAC address carried in the most recently received EAPOL frame.
TX EAPOL Total
Number of EAPOL frames of any type that have been sent.
TX EAP Req/Id
Number of EAP-request/identity frames that have been sent.
TX EAP Req/Oth
Number of EAP-request frames (other than request/identity frames) that have been sent.
1 EAPOL = Extensible Authentication Protocol over LAN
2 EAP = Extensible Authentication Protocol
Related Commands
show ip access-lists
To display IP access control lists (ACLs) configured on the switch, use the show ip access-lists command in privileged EXEC mode.
show ip access-lists [name | number]
Syntax Description
name
(Optional) ACL name.
number
(Optional) ACL number. The range is from 1 to 199 and from 1300 to 2699.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.
Examples
The following is sample output from the show ip access-lists command:
Switch# show ip access-listsStandard IP access list testingaclpermit 10.10.10.2Standard IP access list wizard_1-1-1-2permit 1.1.1.2Extended IP access list 103permit tcp any any eq wwwExtended IP access list CMP-NAT-ACLDynamic Cluster-HSRP deny ip any anyDynamic Cluster-NAT permit ip any anypermit ip host 10.245.155.128 anypermit ip host 10.245.137.0 anypermit ip host 10.146.106.192 anypermit ip host 10.216.25.128 anypermit ip host 10.228.215.0 anypermit ip host 10.221.111.64 anypermit ip host 10.123.222.192 anypermit ip host 10.169.110.128 anypermit ip host 10.186.122.64 anyThe following is sample output from the show ip access-lists 103 command:
Switch# show ip access-lists 103Extended IP access list 103permit tcp any any eq wwwRelated Commands
show ip igmp snooping
To display the Internet Group Management Protocol (IGMP) snooping configuration of the switch or the VLAN, use the show ip igmp snooping command in privileged EXEC mode.
show ip igmp snooping [vlan vlan-id]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use this command to display snooping characteristics for the switch or for a specific VLAN.
Examples
The following is sample output from the show ip igmp snooping command:
Switch#show ip igmp snoopingvlan 1----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is enabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this Vlanvlan 2----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is enabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this Vlanvlan 3----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is disabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this Vlanvlan 4----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is disabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this Vlanvlan 5----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is disabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this Vlanvlan 33----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is disabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this VlanThe following is sample output from the show ip igmp snooping vlan 1 command:
Switch#show ip igmp snooping vlan 1vlan 1----------IGMP snooping is globally enabledIGMP snooping is enabled on this VlanIGMP snooping immediate-leave is enabled on this VlanIGMP snooping mrouter learn mode is pim-dvmrp on this VlanRelated Commands
show ip igmp snooping mrouter
To display information on dynamically learned and manually configured multicast router ports, use the show ip igmp snooping mrouter command in privileged EXEC mode.
show ip igmp snooping mrouter [vlan vlan-id]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
You can also use the show mac-address-table multicast command to display entries in the MAC address table for a VLAN that has Internet Group Management Protocol (IGMP) snooping enabled.
Examples
The following is sample output from the show ip igmp snooping mrouter vlan 1 command:
Note
Switch#show ip igmp snooping mrouter vlan 1Vlan ports---- -----1 Fa0/2(static), Fa0/3(dynamic)Related Commands
show mls masks
To display the details of the Access Control Parameters (ACPs) used for quality of service (QoS) and security access control lists (ACLs), use the show mls masks command in privileged EXEC mode.
show mls masks [qos | security]
Syntax Description
qos
(Optional) Displays ACPs used for QoS ACLs.
security
(Optional) Displays ACPs used for security ACLs.
Note
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use the show mls mask command without keywords to display all ACPs configured on the switch.
Use this command with the qos keyword to display the ACPs used for QoS ACLs.
Use this command with the security keyword to display the ACPs used for security ACLs.
Note
Examples
The following is sample output from the show mls masks command:
Switch# show mls masksMask1Type : qosFields : ip-sa(0.0.0.255), ip-da(host), dest-portPolicymap: pmap1Interfaces: Fa0/9, Gi0/1Policymap: pmap2Interfaces: Fa0/1, Fa0/5, Fa0/13In this example, Mask 1 is a QoS ACP consisting an IP source address (with wildcard bits 0.0.0.255), an IP destination address, and Layer 4 destination port fields. This ACP is used by the QoS policy maps pmap1 and pmap2.
Related Commands
Applies an IP ACL to an interface.
Creates or modifies a policy map that can be attached to multiple interfaces and enters policy-map configuration mode.
show mls qos interface
To display quality of service (QoS) information at the interface level, use the show mls qos interface command in privileged EXEC mode.
show mls qos interface [interface-id] [policers]
Syntax Description
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use the show mls qos interface command without keywords to display parameters for all interfaces.
Use the show mls qos interface interface-id command to display the parameters for a specific interface.
Examples
The following is sample output from the show mls qos interface fastethernet0/1 command:
Switch# show mls qos interface fastethernet0/1FastEthernet0/1trust state: trust cosCOS override: disdefault COS: 0Related Commands
show mls qos maps
To display quality of service (QoS) mapping information, use the show mls qos maps command in privileged EXEC mode.
show mls qos maps [cos-dscp | dscp-cos]
Syntax Description
cos-dscp
(Optional) Displays the class of service (CoS)-to-DSCP map.
dscp-cos
(Optional) Displays the DSCP-to-CoS map.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Maps are used to generate an internal Differentiated Services Code Point (DSCP) value, which represents the priority of the traffic. Use the show mls qos maps command without keywords to display all maps.
Use this command with the cos-dscp keyword to display the CoS-to-DSCP map.
Use this command with the dscp-cos keyword to display the DSCP-to-CoS map.
Examples
The following is sample output from the show mls qos maps cos-dscp command:
Switch# show mls qos maps cos-dscpCos-dscp map:cos: 0 1 2 3 4 5 6 7--------------------------------dscp: 8 8 8 8 24 32 56 56The following is sample output from the show mls qos maps dscp-cos command:
Switch# show mls qos maps dscp-cosDscp-cos map:dscp: 0 8 10 16 18 24 26 32 34 40 46 48 56-----------------------------------------------cos: 0 1 1 1 2 2 3 3 4 4 5 6 7The following is sample output from the show mls qos maps command:
Switch# show mls qos mapsDscp-cos map:dscp: 0 8 10 16 18 24 26 32 34 40 46 48 56-----------------------------------------------cos: 0 1 1 2 2 3 7 4 4 5 5 7 7Cos-dscp map:cos: 0 1 2 3 4 5 6 7--------------------------------dscp: 0 8 16 24 32 40 48 56Related Commands
show policy-map
To display quality of service (QoS) policy maps, which define classification criteria for incoming traffic, use the show policy-map command in privileged EXEC mode. Policy maps can include policers that specify the bandwidth limitations and the action to take if the limits are exceeded.
show policy-map [policy-map-name [class class-name]]
Syntax Description
policy-map-name
(Optional) Displays the specified policy-map name.
class class-name
(Optional) Displays QoS policy actions for a individual class.
Command Modes
Privileged EXEC
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the following platforms: Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Use the show policy-map command without keywords to display all policy maps configured on the switch.
Note
Examples
The following is sample output from the show policy-map command:
Switch# show policy-mapPolicy Map wandDescription: this is a description.Policy Map wizard_policy3class wizard_1-1-1-2Policy Map testPolicy Map policytestclass classtestpolice 10000000 8192 exceed-action dropThe following is sample output from the show policy-map policytest command:
Switch# show policy-map policytestPolicy Map policytestclass classtestpolice 10000000 8192 exceed-action dropThe following is sample output from the show policy-map policytest class classtest command:
Switch# show policy-map policytest class classtestpolice 10000000 8192 exceed-action dropRelated Commands
Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy.
show spanning-tree
To display spanning-tree information for the specified spanning-tree instances, use the show spanning-tree command in privileged EXEC mode.
show spanning-tree [bridge-group] [active | backbonefast | blockedports | bridge | brief | inconsistentports | interface interface-id | pathcost method | root | summary [totals] | uplinkfast | vlan vlan-id]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
If the variable vlan-id is omitted, the command applies to the spanning-tree instance for all VLANs.
Examples
The following is sample output from the show spanning-tree summary command:
Switch# show spanning-tree summaryUplinkFast is disabledName Blocking Listening Learning Forwarding STP Active-------------------- -------- --------- -------- ---------- ----------VLAN1 23 0 0 1 24-------------------- -------- --------- -------- ---------- ----------1 VLAN 23 0 0 1 24The following is sample output from the show spanning-tree brief command:
Switch# show spanning-tree briefVLAN1Spanning tree enabled protocol IEEEROOT ID Priority 32768Address 0030.7172.66c4Hello Time 2 sec Max Age 20 sec Forward Delay 15 secVLAN1Spanning tree enabled protocol IEEEROOT ID Priority 32768Address 0030.7172.66c4Port DesignatedName Port ID Prio Cost Sts Cost Bridge ID Port ID------- ------- ---- ---- --- ---- -------------- -------Fa0/11 128.17 128 100 BLK 38 0404.0400.0001 128.17Fa0/12 128.18 128 100 BLK 38 0404.0400.0001 128.18Fa0/13 128.19 128 100 BLK 38 0404.0400.0001 128.19Fa0/14 128.20 128 100 BLK 38 0404.0400.0001 128.20Fa0/15 128.21 128 100 BLK 38 0404.0400.0001 128.21Fa0/16 128.22 128 100 BLK 38 0404.0400.0001 128.22Fa0/17 128.23 128 100 BLK 38 0404.0400.0001 128.23Fa0/18 128.24 128 100 BLK 38 0404.0400.0001 128.24Fa0/19 128.25 128 100 BLK 38 0404.0400.0001 128.25Fa0/20 128.26 128 100 BLK 38 0404.0400.0001 128.26Fa0/21 128.27 128 100 BLK 38 0404.0400.0001 128.27Port DesignatedName Port ID Prio Cost Sts Cost Bridge ID Port ID------- ------- ---- ---- --- ---- -------------- -------Fa0/22 128.28 128 100 BLK 38 0404.0400.0001 128.28Fa0/23 128.29 128 100 BLK 38 0404.0400.0001 128.29Fa0/24 128.30 128 100 BLK 38 0404.0400.0001 128.30 Hello Time 2 sec Max Age 20 sec Forward Delay 15 secThe following is sample output from the show spanning-tree vlan 1 command:
Switch# show spanning-tree vlan 1Spanning tree 1 is executing the IEEE compatible Spanning Tree protocolBridge Identifier has priority 32768, address 00e0.1eb2.ddc0Configured hello time 2, max age 20, forward delay 15Current root has priority 32768, address 0010.0b3f.ac80Root port is 5, cost of root path is 10Topology change flag not set, detected flag not set, changes 1Times: hold 1, topology change 35, notification 2hello 2, max age 20, forward delay 15Timers: hello 0, topology change 0, notification 0Interface Fa0/1 in Spanning tree 1 is downPort path cost 100, Port priority 128Designated root has priority 32768, address 0010.0b3f.ac80Designated bridge has priority 32768, address 00e0.1eb2.ddc0Designated port is 1, path cost 10Timers: message age 0, forward delay 0, hold 0BPDU: sent 0, received 0...The following is sample output from the show spanning-tree interface fastethernet0/3 command:
Switch# show spanning-tree interface fastethernet0/3Interface Fa0/3 (port 3) in Spanning tree 1 is downPort path cost 100, Port priority 128Designated root has priority 6000, address 0090.2bba.7a40Designated bridge has priority 32768, address 00e0.1e9f.4abfDesignated port is 3, path cost 410Timers: message age 0, forward delay 0, hold 0BPDU: sent 0, received 0Related Commands
show storm-control
To display the packet-storm control information, use the show storm-control command in privileged EXEC mode. This command also displays the action that the switch takes when the thresholds are reached.
show storm-control [interface-id] [broadcast | multicast | unicast | history]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
If the interface-id value is omitted, the show storm-control command displays storm-control settings for all ports on the switch.
You can display broadcast, multicast, or unicast packet-storm information by using the corresponding keyword. When no option is specified, the default is to display broadcast storm-control information.
Examples
The following is sample output from the show storm-control broadcast command:
Switch# show storm-control broadcastInterface Filter State Upper Lower Current--------- ------------- ------- ------- -------Fa0/1 <inactive> 100.00% 100.00% 0.00%Fa0/2 <inactive> 100.00% 100.00% 0.00%Fa0/3 <inactive> 100.00% 100.00% 0.00%Fa0/4 Forwarding 30.00% 20.00% 20.32%...Table 22 describes the fields shown in the display.
The following is sample output from the show storm-control fastethernet0/4 history command, which displays the ten most recent storm events for an interface:
Switch# show storm-control fastethernet0/4 historyInterface Fa0/4 Storm Event HistoryEvent Type Event Start Time Duration (seconds)------------------ ---------------- ------------------Unicast 04:58:18 206Broadcast 05:01:54 n/aMulticast 05:01:54 n/aUnicast 05:01:54 108Broadcast 05:05:00 n/aMulticast 05:05:00 n/aUnicast 05:06:00 n/aBroadcast 05:09:39 n/aMulticast 05:09:39 n/aBroadcast 05:11:32 172
Note
Related Commands
spanning-tree backbonefast
To enable the BackboneFast feature, use the spanning-tree backbonefast command in global configuration mode. To return to the default setting, use the no form of the command.
spanning-tree backbonefast
no spanning-tree backbonefast
Syntax Description
This command has no arguments or keywords.
Defaults
BackboneFast is disabled.
Command Modes
Global configuration
Command History
12.1(6)EA2
This command was introduced.
12.2(15)ZJ
This command was implemented on the Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
BackboneFast should be enabled on all of the Catalyst 2950 switches to allow for the detection of indirect link failures and to start the spanning-tree reconfiguration sooner.
Examples
The following example shows how to enable BackboneFast on the switch:
Switch(config)# spanning-tree backbonefastYou can verify your settings by entering the show spanning-tree privileged EXEC command.
Related Commands
storm-control
To enable broadcast, multicast, or unicast storm control on a port and to specify the action taken when a storm occurs on a port, use the storm-control command in interface configuration mode. To disable storm control for broadcast, multicast, or unicast traffic and disable the specified storm-control action, use the no form of this command.
storm-control {{{broadcast | multicast | unicast} level level [lower-level]} | action shutdown}
no storm-control {{broadcast | multicast | unicast} level} | action}
Syntax Description
Defaults
Broadcast, multicast, and unicast storm control are disabled.
The default action is to filter traffic.
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the storm-control command to enable or disable broadcast, multicast, or unicast storm control on a port. After a port is disabled during a storm, use the no shutdown interface configuration command to enable the port.
The suppression levels are entered as a percentage of total bandwidth. A suppression value of 100 percent means that no limit is placed on the specified traffic type. This feature is enabled only when the rising suppression level is less than 100 percent. If no other storm-control configuration is specified, the default action is to filter the traffic causing the storm.
When a storm occurs and the action is to filter traffic, if the falling suppression level is not specified, the switch blocks all traffic until the traffic rate drops below the rising suppression level. If the falling suppression level is specified, the switch blocks traffic until the traffic rate drops below this level.
When a multicast or unicast storm occurs and the action is to filter traffic, the switch blocks all traffic (broadcast, multicast, and unicast traffic) and sends only Spanning Tree Protocol (STP) packets.
When a broadcast storm occurs and the action is to filter traffic, the switch blocks only broadcast traffic.
Examples
The following example shows how to enable broadcast storm control on a port with a 75.67 percent rising suppression level:
Switch(config-if)# storm-control broadcast level 75.67The following example shows how to enable multicast storm control on a port with a 87 percent rising suppression level and a 65 percent falling suppression level:
Switch(config-if)# storm-control multicast level 87 65The following example shows how to enable the shutdown action on a port:
Switch(config-if)# storm-control action shutdownThe following example shows how to disable the shutdown action on a port:
Switch(config-if)# no storm-control action shutdownYou can verify your settings by entering the show storm-control privileged EXEC command.
Related Commands
switchport
To set an interface that is in Layer 3 mode into Layer 2 mode for Layer 2 configuration, use the switchport command in interface configuration mode. To set an interface in Layer 3 mode, use the no form of this command.
switchport
no switchport
Use the no switchport command (without parameters) to set the interface to the routed-interface status and to erase all Layer 2 configurations. You must use this command before assigning an IP address to a routed port.
Note
Syntax Description
This command has no arguments or keywords.
Defaults
By default, all interfaces are in Layer 2 mode.
Command Modes
Interface configuration
Command History
12.1(4)EA1
This command was introduced.
12.2(15)ZJ
This command was implemented on the Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.
Usage Guidelines
Entering the no switchport command shuts the port down and then reenables it, which might generate messages on the device to which the port is connected.
Examples
The following example shows how to cause an interface to cease operating as a Layer 2 port and become a Cisco-routed port:
Switch(config-if)#no switchportThe following example shows how to cause the port interface to cease operating as a Cisco-routed port and convert to a Layer 2-switched interface:
Switch(config-if)#switchport
Note
You can verify the switchport status of an interface by entering the show running-config privileged EXEC command.
Related Commands
Glossary
802.1d—IEEE standard for MAC bridges.
802.1p—IEEE standard for queuing and multicast support.
802.1q—IEEE standard for VLAN frame tagging.
802.1x—IEEE standard for port-based network access control.
ACE—access control entry. Entry in an access control list.
ACL—access control list. Used for security or as a general means to classify traffic.
AgPort—aggregate port (another name for EtherChannel).
ATM—Asynchronous Transfer Mode. The international standard for cell relay in which multiple service types (such as voice, video, or data) are conveyed in fixed-length (53-byte) cells. Fixed-length cells allow cell processing to occur in hardware, thereby reducing transit delays. ATM is designed to take advantage of high-speed transmission media such as E3, SONET, and T3.
authentication server—Entity that validates the credentials of a host trying to obtain access to the network.
authenticator—Entity that enforces authentication rules for hosts connecting to a LAN via one of its ports.
authorization state—The state of a controlled port. It can be authorized (access allowed) or unauthorized (access denied).
AVVID—Architecture for voice, video, and integrated data.
BRI—Basic Rate Interface. ISDN interface comprising two B channels and one D channel for circuit-switched communication of voice, video, and data.
CAC—connection admission control. Set of actions taken by each ATM switch during connection setup to determine whether a connection's requested QoS will violate the QoS guarantees for established connections. CAC is also used when routing a connection request through an ATM network.
candidate—Switch that is not part of a cluster, but is eligible to join a cluster because it meets the qualification criteria of the cluster.
classification—Process of sorting incoming packets by examining fields of interest in the packet header. Fields can be addresses, ports, DSCP value, and so on.
CBWFQ—class-based weighted fair queuing. Extends the standard WFQ functionality to provide support for user-defined traffic classes.
CCN—Cisco Communications Network (Cisco IP phones and IP PBX).
cluster—Group of switches that are managed as a single device. A cluster comprises one commander and multiple members.
cluster commander—Switch that provides the primary management interface to a cluster.
cluster member—Member switch that is managed through the cluster commander.
CoS—Class of Service. An indication of how an upper-layer protocol requires a lower-layer protocol to treat its messages. In SNA subarea routing, CoS definitions are used by subarea nodes to determine the optimal route to establish a session. A CoS definition comprises a virtual route number and a transmission priority field. Also called ToS.
DSCP—differentiated services code point. In QoS, a modification of the type of service byte. Six bits of this byte are being reallocated for use as the DSCP field, where each DSCP specifies a particular per-hop behavior that is applied to a packet.
DSL—digital subscriber line. Public network technology that delivers high bandwidth over conventional copper wiring at limited distances. There are four types of DSL: ADSL, HDSL, SDSL, and VDSL. All are provisioned via modem pairs, with one modem at a central office and the other at the customer site. Because most DSL technologies do not use the whole bandwidth of the twisted pair, there is room remaining for a voice channel.
EAP—Extensible Authentication Protocol. A mechanism (originally designed for PPP in RFC 2284) that provides authentication of hosts requesting access to a network.
EAPOL—EAP over LAN. EAP over LAN framing instead of PPP.
Frame Relay—The capability to carry normal telephony-style voice over an IP-based network with POTS-like functionality, reliability, and voice quality. VoIP lets a router carry voice traffic (such as telephone calls and faxes) over an IP network. In VoIP, the DSP segments the voice signal into frames, which then are coupled in groups of two and stored in voice packets. These voice packets are transported using IP in compliance with ITU-T specification H.323.
FXO—Foreign Exchange Office. An FXO interface connects to the Public Switched Telephone Network (PSTN) central office and is the interface offered on a standard telephone. Cisco's FX interface is an RJ-11 connector that allows an analog connection at the PSTN's central office or to a station interface on a PBX.
FXS—Foreign Exchange Station. An FXS interface connects directly to a standard telephone and supplies ring, voltage, and dial tone. Cisco's FXS interface is an RJ-11 connector that allows connections to basic telephone service equipment, keysets, and PBXs.
HSRP—Hot Standby Router Protocol. Provides high network availability and transparent network topology changes. HSRP creates a hot standby router group with a lead router that services all packets sent to the hot standby address. The lead router is monitored by other routers in the group, and if it fails, one of these standby routers inherits the lead position and the hot standby group address.
IGMP—Internet Group Management Protocol. Used by IP hosts to report their multicast group memberships to an adjacent multicast router.
ISL—InterSwitch Link, which is used to carry traffic for multiple VLANs. A method of encapsulating tagged LAN frames and transporting them over a full-duplex, point-to-point Ethernet link. The encapsulated frames can be token-ring or Fast Ethernet and are carried unchanged from transmitter to receiver.
MIB—Management Information Base. Database of network management information that is used and maintained by a network management protocol, such as SNMP or CMIP. The value of a MIB object can be changed or retrieved using SNMP or CMIP commands, usually through a GUI network management system. MIB objects are organized in a tree structure that includes public (standard) and private (proprietary) branches.
policing—Process of ensuring whether a stream of classified incoming packets conforms to a particular traffic profile. An action (drop or remark) is taken based on the rate of arrival of packets.
PRI—primary rate interface. ISDN interface to primary rate access. Primary rate access consists of one 64-kbps D channel and 23 (T1) or 30 (E1) B channels for voice or data. Compare with BRI.
PSTN—public switched telephone network. General term referring to the variety of telephone networks and services in place worldwide. Also called POTS.
PVC—permanent virtual circuit. Virtual circuit that is permanently established. PVCs save bandwidth associated with circuit establishment and tear down in situations where certain virtual circuits must exist all the time. In ATM terminology, called a permanent virtual connection. Compare with SVC.
PVST—Per-VLAN spanning tree. Support for dot1q trunks to map multiple spanning trees to a single spanning tree.
QoS—quality of service. Measure of performance for a transmission system that reflects its transmission quality and service availability.
RADIUS—Remote Access Dial-In User Service. A service used to authenticate and authorize clients.
RMON—remote monitoring. MIB agent specification described in RFC 1271 that defines functions for the remote monitoring of networked devices. The RMON specification provides numerous monitoring, problem detection, and reporting capabilities.
RSVP—Resource Reservation Protocol. Protocol that supports the reservation of resources across an IP network. Applications running on IP end systems can use RSVP to indicate to other nodes the nature (bandwidth, jitter, maximum burst, and so on) of the packet streams they want to receive. RSVP depends on IPv6. Also known as Resource Reservation Setup Protocol.
SIP—Session Initiation Protocol. Protocol developed by the IETF MMUSIC Working Group as an alternative to H.323. SIP features are compliant with IETF RFC 2543, which was published in March 1999. SIP equips platforms to signal the setup of voice and multimedia calls over IP networks.
SNMP—Simple Network Management Protocol. Network management protocol used almost exclusively in TCP/IP networks. SNMP provides a means to monitor and control network devices and to manage configurations, statistics collection, performance, and security.
stacking—Connecting two switches so they behave as one entity for management purposes. Regarding an Ethernet switch network module, stacking means connecting two Ethernet switch network modules inside a chassis so that they behave as one switch.
STP—Spanning Tree Protocol. Bridge protocol that uses the spanning-tree algorithm, which enables a learning bridge to dynamically work around loops in a network topology by creating a spanning tree. Bridges exchange BPDU messages with other bridges to detect loops and then remove the loops by shutting down selected bridge interfaces. Refers to both the IEEE 802.1 Spanning-Tree Protocol standard and the earlier Digital Equipment Corporation Spanning-Tree Protocol upon which it is based. The IEEE version supports bridge domains and allows the bridge to construct a loop-free topology across an extended LAN. The IEEE version generally is preferred over the Digital version.
supplicant—Entity requesting access to the network via the authenticator.
SVI—Switch Virtual Interface. Represents a VLAN of switch ports as one interface to the routing or bridging function in a system.
VBR—variable bit rate. QoS class defined by the ATM Forum for ATM networks. VBR is subdivided into a real time (RT) class and non-real time (NRT) class. VBR (RT) is used for connections in which there is a fixed timing relationship between samples. VBR (NRT) is used for connections in which there is no fixed timing relationship between samples but that still need a guaranteed QoS. Compare with ABR, CBR, and UBR.
VLAN—virtual LAN. Group of devices on one or more LANs that are configured (using management software) so that they can communicate as if they were attached to the same wire, when in fact they are on separate LAN segments. Because VLANs are based on logical instead of physical connections, they are extremely flexible.
VoIP—Voice over IP. Ability to carry normal telephony-style voice over an IP-based internet with POTS-like functionality, reliability, and voice quality. VoIP enables a router to carry voice traffic (such as telephone calls and faxes) over an IP network. In VoIP, the DSP segments the voice signal into frames, which then are coupled in groups of two and stored in voice packets. These voice packets are transported using IP in compliance with ITU-T specification H.323.
VoIPoFR—Voice-over-IP over Frame-Relay.
VPN—Virtual Private Network. Enables IP traffic to travel securely over a public TCP/IP network by encrypting all traffic from one network to another. A VPN uses "tunneling" to encrypt all information at the IP level.
VQP—VLAN Query Protocol.
VTP—VLAN Trunking Protocol.
WAN—wide area network. A communications network that covers a wide geographic area such as state or country. A LAN (local area network) is within a building or complex, and a MAN (metropolitan area network) generally covers a city or suburb.
WFQ—weighted fair queuing. In QoS, a flow-based queuing algorithm that schedules low-volume traffic first while letting high-volume traffic share the remaining bandwidth. This is handled by assigning a weight to each flow, where lower weights are the first to be serviced.
WRR—Weighted Round-Robin. Type of round-robin scheduling that prevents low-priority queues from being completely neglected during periods of high-priority traffic. The WRR scheduler transmits some packets from each queue in turn. The number of packets it transmits corresponds to the relative importance of the queue.
Feedback