Table Of Contents
Prerequisites for the EtherSwitch Network Module
Restrictions for the EtherSwitch Network Module
Information About the EtherSwitch Network Module
EtherSwitch Network Module: Benefits
Ethernet Switching in Cisco AVVID Architecture
Inline Power for Cisco IP Phones
Using the Spanning Tree Protocol with the EtherSwitch network module
Flow Control on Gigabit Ethernet Ports
IP Multicast Layer 3 Switching
Network Security with ACLs at Layer 2
Quality of Service for the EtherSwitch Network Module
How to Configure the EtherSwitch Network Module
VLAN Removal from the Database
Configuring VLAN Trunking Protocol
Configuring Spanning Tree on a VLAN
Verifying Spanning Tree on a VLAN
Configuring Layer 2 Interfaces
Interface Speed and Duplex Mode Guidelines
Configuring an Ethernet Interface as a Layer 2 Trunk
Configuring an Ethernet Interface as a Layer 2 Access
Configuring Separate Voice and Data VLANs
Voice Traffic and Voice VLAN ID (VVID) Using the EtherSwitch Network Module
Configuring a Single Voice and Data VLAN
Managing the EtherSwitch network module
IP Information Assigned to the Switch
Use of Ethernet Ports to Support Cisco IP Phones with Multiple Ports
Domain Name Mapping and DNS Configuration
Port Connection to a Cisco 7960 IP Phone
Inline Power on an EtherSwitch Network Module
Verifying Cisco Discovery Protocol
Configuring the MAC Table to Provide Port Security
Configuring 802.1x Authentication
802.1x Authentication Guidelines for the EtherSwitch network module
Enabling 802.1x Authentication
Configuring the Switch-to-RADIUS-Server Communication
Configuring 802.1x Parameters (Retransmissions and Timeouts)
Configuring Power Management on the Interfaces
Enabling Per-Port Storm Control
Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)
Configuring Flow Control on Gigabit Ethernet Ports
Configuring Intrachassis Stacking
Configuring Switched Port Analyzer (SPAN)
Configuring Layer 3 Interfaces
Layer 3 Interface Support for the EtherSwitch network module
Enabling and Verifying IP Multicast Layer 3 Switching
IGMP Snooping on the EtherSwitch Network Module
IGMP Immediate-Leave Processing
Static Configuration of an Interface to Join a Multicast Group
Understanding the Default Fallback Bridging Configuration
Adjusting Spanning-Tree Parameters
Disabling the Spanning Tree on an Interface
Configuring Network Security with ACLs at Layer 2
Creating Standard and Extended IP ACLs
Including Comments About Entries in ACLs
Configuring a Numbered Standard ACL
Configuring a Numbered Extended ACL
Configuring a Named Standard ACL
Configuring a Named Extended ACL
Applying the ACL to an Interface
Configuring Quality of Service (QoS) on the EtherSwitch network module
Trust State on Ports and SVIs Within the QoS Domain
Configuring Classification Using Port Trust States
Classifying Traffic by Using ACLs
Classifying Traffic Using Class Maps
Classifying, Policing, and Marking Traffic Using Policy Maps
Configuring the CoS-to-DSCP Map
Configuring the DSCP-to-CoS Map
Configuration Examples for the EtherSwitch Network Module
Configuring Spanning Tree: Examples
Configuring Layer 2 Interfaces: Examples
Single Range Configuration: Example
Multiple Range Configuration: Example
Range Macro Definition: Example
Optional Interface Features: Example
Configuring an Ethernet Interface as a Layer 2 Trunk: Example
Configuring Voice and Data VLANs: Examples
Separate Voice and Data VLANs: Example
Single Subnet Configuration: Example
Ethernet Ports on IP Phones with Multiple Ports: Example
Configuring 802.1x Authentication: Examples
Enabling 802.1x Authentication: Example
Configuring the Switch-to-RADIUS-Server Communication: Example
Configuring 802.1x Parameters: Example
Configuring Storm-Control: Example
Configuring Layer 2 EtherChannels: Example
Layer 2 EtherChannels: Example
Removing an EtherChannel: Example
Configuring Flow Control on Gigabit Ethernet Ports: Example
Intrachassis Stacking: Example
Configuring Switched Port Analyzer (SPAN): Example
Configuring Layer 3 Interfaces: Example
Configuring Fallback Bridging: Examples
Creating a Bridge Group: Example
Adjusting Spanning Tree Parameters: Example
Disabling the Spanning Tree on an Interface: Example
Fallback Bridging with DLSW: Example
Configuring Network Security with ACLs at Layer 2: Examples
Creating Numbered Standard and Extended ACLs: Example
Creating Named Standard and Extended ACLs: Example
Including Comments About Entries in ACLs: Example
Applying the ACL to an Interface: Example
Displaying Standard and Extended ACLs: Example
Displaying Access Groups: Example
Configuring QoS on the EtherSwitch network module: Examples
Classifying Traffic by Using ACLs: Example
Classifying Traffic by Using Class Maps: Example
Classifying, Policing, and Marking Traffic by Using Policy Maps: Example
Configuring the CoS-to-DSCP Map: Example
Configuring the DSCP-to-CoS Map: Example
Displaying QoS Information: Example
EtherSwitch Network Module
This document explains how to configure the EtherSwitch network module. This network module is supported on Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. The EtherSwitch network module is a modular, high-density voice network module that provides Layer 2 switching across Ethernet ports. The EtherSwitch network module has sixteen 10/100 switched Ethernet ports with integrated inline power and QoS features that are designed to extend Cisco AVVID-based voice-over-IP (VoIP) networks to small branch offices.
Feature History for the EtherSwitch Module Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for the EtherSwitch Network Module
•
•
•
•
Prerequisites for the EtherSwitch Network Module
•
•
In addition, complete the following tasks before configuring this feature:
•
For more information on IP routing, refer to the Cisco IOS IP Configuration Guide.
•
For more information on setting up call agents, refer to the documentation that accompanies the call agents used in your network configuration.
Restrictions for the EtherSwitch Network Module
The following functions are not supported by the EtherSwitch network module:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Information About the EtherSwitch Network Module
To configure the EtherSwitch network module, you should understand the following concepts:
•
•
•
•
•
•
•
•
EtherSwitch Network Module: Benefits
•
•
•
•
•
•
The Interface Range Specification feature makes configuration easier for these reasons:
•
•
Ethernet Switching in Cisco AVVID Architecture
The EtherSwitch network module is designed to work as part of the Cisco Architecture for Voice, Video, and Integrated Data (AVVID) solution. The EtherSwitch network module has sixteen 10/100 switched Ethernet ports with integrated inline power and QoS features that allow for extending Cisco AVVID-based voice-over-IP (VoIP) networks to small branch offices.
The 16-port EtherSwitch network module has sixteen 10/100BASE-TX ports and an optional 10/100/1000BASE-T Gigabit Ethernet port. The 36-port EtherSwitch network module has thirty six 10/100BASE-TX ports and two optional 10/100/1000BASE-T Gigabit Ethernet ports. The gigabit Ethernet can be used as an uplink port to a server or as a stacking link to another 16- or 36-port EtherSwitch network module in the same system. The 36-port EtherSwitch network module requires a double-wide slot. An optional power module can also be added to provide inline power for IP telephones.
As an access gateway switch, the EtherSwitch network module can be deployed as a component of a centralized call-processing network using a centrally deployed Cisco CallManager (CCM). Instead of deploying and managing key systems or PBXs in small branch offices, applications are centrally located at the corporate headquarters or data center and are accessed via the IP WAN.
By default, the EtherSwitch network module provides the following settings with respect to Cisco AVVID:
•
•
•
•
VLANs
Virtual local-area networks (VLANs) are a group of end stations with a common set of requirements, independent of physical location. VLANs have the same attributes as a physical LAN but allow you to group end stations even if they are not located physically on the same LAN segment.
VLAN Trunk Protocol
VLAN Trunk Protocol (VTP) is a Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs within a VTP domain. A VTP domain (also called a VLAN management domain) is made up of one or more switches that share the same VTP domain name and that are interconnected with trunks. VTP minimizes misconfigurations and configuration inconsistencies that can result in a number of problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations. Before you create VLANs, you must decide whether to use VTP in your network. With VTP, you can make configuration changes centrally on one or more switches and have those changes automatically communicated to all the other switches in the network.
VTP Domain
A VTP domain (also called a VLAN management domain) is made up of one or more interconnected switches that share the same VTP domain name. A switch can be configured to be in only one VTP domain. You make global VLAN configuration changes for the domain using either the command-line interface (CLI) or Simple Network Management Protocol (SNMP).
By default, the switch is in VTP server mode and is in an un-named domain state until the switch receives an advertisement for a domain over a trunk link or until you configure a management domain. You cannot create or modify VLANs on a VTP server until the management domain name is specified or learned.
If the switch receives a VTP advertisement over a trunk link, it inherits the management domain name and the VTP configuration revision number. The switch ignores advertisements with a different management domain name or an earlier configuration revision number.
If you configure the switch as VTP transparent, you can create and modify VLANs, but the changes affect only the individual switch.
When you make a change to the VLAN configuration on a VTP server, the change is propagated to all switches in the VTP domain. VTP advertisements are transmitted out all trunk connections using IEEE 802.1Q encapsulation.
VTP maps VLANs dynamically across multiple LAN types with unique names and internal index associations. Mapping eliminates excessive device administration required from network administrators.
VTP Modes
You can configure a switch to operate in any one of these VTP modes:
•
•
•
VTP Advertisements
Each switch in the VTP domain sends periodic advertisements out each trunk interface to a reserved multicast address. VTP advertisements are received by neighboring switches, which update their VTP and VLAN configurations as necessary.
The following global configuration information is distributed in VTP advertisements:
•
•
•
•
•
VTP Version 2
If you use VTP in your network, you must decide whether to use VTP version 1 or version 2. VTP version 2 supports the following features not supported in version 1:
Unrecognized Type-Length-Value (TLV) Support—A VTP server or client propagates configuration changes to its other trunks, even for TLVs it is not able to parse. The unrecognized TLV is saved in NVRAM.
Version-Dependent Transparent Mode—In VTP version 1, a VTP transparent switch inspects VTP messages for the domain name and version, and forwards a message only if the version and domain name match. Since only one domain is supported in the NM-16ESW software, VTP version 2 forwards VTP messages in transparent mode, without checking the version.
Consistency Checks—In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI or SNMP. Consistency checks are not performed when new information is obtained from a VTP message, or when information is read from NVRAM. If the digest on a received VTP message is correct, its information is accepted without consistency checks.
VTP Configuration Guidelines and Restrictions
Follow these guidelines and restrictions when implementing VTP in your network:
•
•
•
•
•
•
•
Inline Power for Cisco IP Phones
The EtherSwitch network module can supply inline power to a Cisco 7960 IP phone, if required. The Cisco 7960 IP phone can also be connected to an AC power source and supply its own power to the voice circuit. When the Cisco 7960 IP phone is supplying its own power, a EtherSwitch network module can forward IP voice traffic to and from the phone.
A detection mechanism on the EtherSwitch network module determines whether it is connected to a Cisco 7960 IP phone. If the switch senses that there is no power on the circuit, the switch supplies the power. If there is power on the circuit, the switch does not supply it.
You can configure the switch to never supply power to the Cisco 7960 IP phone and to disable the detection mechanism.
Using the Spanning Tree Protocol with the EtherSwitch network module
Spanning Tree Protocol (STP) is a Layer 2 link management protocol that provides path redundancy while preventing undesirable loops in the network. For a Layer 2 Ethernet network to function properly, only one active path can exist between any two stations. Spanning tree operation is transparent to end stations, which cannot detect whether they are connected to a single LAN segment or to a switched LAN of multiple segments.
The EtherSwitch network module uses STP (the IEEE 802.1D bridge protocol) on all VLANs. By default, a single instance of STP runs on each configured VLAN (provided that you do not manually disable STP). You can enable and disable STP on a per-VLAN basis.
When you create fault-tolerant internetworks, you must have a loop-free path between all nodes in a network. The spanning tree algorithm calculates the best loop-free path throughout a switched Layer 2 network. Switches send and receive spanning tree frames at regular intervals. The switches do not forward these frames but use the frames to construct a loop-free path.
Spanning Tree Protocol (STP) defines a tree with a root switch and a loop-free path from the root to all switches in the Layer 2 network. STP forces redundant data paths into a standby (blocked) state. If a network segment in the spanning tree fails and a redundant path exists, the spanning tree algorithm recalculates the spanning tree topology and activates the standby path.
When two ports on a switch are part of a loop, the spanning tree port priority and port path cost setting determine which port is put in the forwarding state and which port is put in the blocking state. The spanning tree port priority value represents the location of an interface in the network topology and how well located it is to pass traffic. The spanning tree port path cost value represents media speed.
Bridge Protocol Data Units
The stable active spanning tree topology of a switched network is determined by the following:
•
•
•
The Bridge Protocol Data Units (BPDU) are transmitted in one direction from the root switch, and each switch sends configuration BPDUs to communicate and compute the spanning tree topology. Each configuration BPDU contains the following minimal information:
•
•
•
•
•
•
When a switch transmits a BPDU frame, all switches connected to the LAN on which the frame is transmitted receive the BPDU. When a switch receives a BPDU, it does not forward the frame but instead uses the information in the frame to calculate a BPDU, and, if the topology changes, initiate a BPDU transmission.
A BPDU exchange results in the following:
•
•
•
•
•
•
For each VLAN, the switch with the highest bridge priority (the lowest numerical priority value) is elected as the root switch. If all switches are configured with the default priority (32768), the switch with the lowest MAC address in the VLAN becomes the root switch.
The spanning tree root switch is the logical center of the spanning tree topology in a switched network. All paths that are not needed to reach the root switch from anywhere in the switched network are placed in spanning tree blocking mode.
BPDUs contain information about the transmitting bridge and its ports, including bridge and MAC addresses, bridge priority, port priority, and path cost. Spanning tree uses this information to elect the root bridge and root port for the switched network, as well as the root port and designated port for each switched segment.
STP Timers
Table 1 describes the STP timers that affect the entire spanning tree performance.
Table 1
STP Timers
Spanning Tree Port States
Propagation delays can occur when protocol information passes through a switched LAN. As a result, topology changes can take place at different times and at different places in a switched network. When a Layer 2 interface changes directly from nonparticipation in the spanning tree topology to the forwarding state, it can create temporary data loops. Ports must wait for new topology information to propagate through the switched LAN before starting to forward frames. They must allow the frame lifetime to expire for frames that have been forwarded using the old topology.
Each Layer 2 interface on a switch using spanning tree exists in one of the following five states:
•
•
•
•
•
A Layer 2 interface moves through these five states as follows:
•
•
•
•
•
Figure 1 illustrates how a port moves through the five stages.
Figure 1 STP Port States
Boot-up Initialization
When you enable spanning tree, every port in the switch, VLAN, or network goes through the blocking state and the transitory states of listening and learning at power up. If properly configured, each Layer 2 interface stabilizes to the forwarding or blocking state.
When the spanning tree algorithm places a Layer 2 interface in the forwarding state, the following process occurs:
1.
2.
3.
4.
Blocking State
A Layer 2 interface in the blocking state does not participate in frame forwarding, as shown in Figure 2. After initialization, a BPDU is sent out to each Layer 2 interface in the switch. A switch initially assumes it is the root until it exchanges BPDUs with other switches. This exchange establishes which switch in the network is the root or root bridge. If only one switch is in the network, no exchange occurs, the forward delay timer expires, and the ports move to the listening state. A port always enters the blocking state following switch initialization.
Figure 2 Interface 2 in Blocking State
A Layer 2 interface in the blocking state performs as follows:
•
•
•
•
•
•
Listening State
The listening state is the first transitional state a Layer 2 interface enters after the blocking state. The Layer 2 interface enters this state when STP determines that the Layer 2 interface should participate in frame forwarding. Figure 3 shows a Layer 2 interface in the listening state.
Figure 3 Interface 2 in Listening State
A Layer 2 interface in the listening state performs as follows:
•
•
•
•
•
•
Learning State
A Layer 2 interface in the learning state prepares to participate in frame forwarding. The Layer 2 interface enters the learning state from the listening state. Figure 4 shows a Layer 2 interface in the learning state.
Figure 4 Interface 2 in Learning State
A Layer 2 interface in the learning state performs as follows:
•
•
•
•
•
•
Forwarding State
A Layer 2 interface in the forwarding state forwards frames, as shown in Figure 5. The Layer 2 interface enters the forwarding state from the learning state.
Figure 5 Interface 2 in Forwarding State
A Layer 2 interface in the forwarding state performs as follows:
•
•
•
•
•
•
Disabled State
A Layer 2 interface in the disabled state does not participate in frame forwarding or spanning tree, as shown in Figure 6. A Layer 2 interface in the disabled state is virtually nonoperational.
Figure 6 Interface 2 in Disabled State
A disabled Layer 2 interface performs as follows:
•
•
•
•
•
MAC Address Allocation
The MAC address allocation manager has a pool of MAC addresses that are used as the bridge IDs for the VLAN spanning trees. In Table 2 you can view the number of VLANs allowed for each platform.
Table 2 Number of VLANs Allowed by Platform
Cisco 3640 or higher
64 VLANs
Cisco 2600
32 VLANs
MAC addresses are allocated sequentially, with the first MAC address in the range assigned to VLAN 1, the second MAC address in the range assigned to VLAN 2, and so forth.
For example, if the MAC address range is 00-e0-1e-9b-2e-00 to 00-e0-1e-9b-31-ff, the VLAN 1 bridge ID is 00-e0-1e-9b-2e-00, the VLAN 2 bridge ID is 00-e0-1e-9b-2e-01, the VLAN 3 bridge ID is 00-e0-1e-9b-2e-02, and so forth.
Default Spanning Tree Configuration
Table 3 shows the default Spanning Tree configuration values.
Spanning Tree Port Priority
In the event of a loop, spanning tree considers port priority when selecting an interface to put into the forwarding state. You can assign higher priority values to interfaces that you want spanning tree to select first, and lower priority values to interfaces that you want spanning tree to select last. If all interfaces have the same priority value, spanning tree puts the interface with the lowest interface number in the forwarding state and blocks other interfaces. The possible priority range is 0 to 255, configurable in increments of 4 (the default is 128).
Cisco IOS software uses the port priority value when the interface is configured as an access port and uses VLAN port priority values when the interface is configured as a trunk port.
Spanning Tree Port Cost
The spanning tree port path cost default value is derived from the media speed of an interface. In the event of a loop, spanning tree considers port cost when selecting an interface to put into the forwarding state. You can assign lower cost values to interfaces that you want spanning tree to select first and higher cost values to interfaces that you want spanning tree to select last. If all interfaces have the same cost value, spanning tree puts the interface with the lowest interface number in the forwarding state and blocks other interfaces.
The possible cost range is 0 to 65535 (the default is media-specific).
Spanning tree uses the port cost value when the interface is configured as an access port and uses VLAN port cost values when the interface is configured as a trunk port.
BackboneFast
BackboneFast is initiated when a root port or blocked port on a switch receives inferior BPDUs from its designated bridge. An inferior BPDU identifies one switch as both the root bridge and the designated bridge. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated bridge has lost its connection to the root switch). Under STP rules, the switch ignores inferior BPDUs for the configured maximum aging time specified by the spanning-tree max-age global configuration command.
The switch tries to determine if it has an alternate path to the root switch. If the inferior BPDU arrives on a blocked port, the root port and other blocked ports on the switch become alternate paths to the root switch. (Self-looped ports are not considered alternate paths to the root switch.) If the inferior BPDU arrives on the root port, all blocked ports become alternate paths to the root switch. If the inferior BPDU arrives on the root port and there are no blocked ports, the switch assumes that it has lost connectivity to the root switch, causes the maximum aging time on the root to expire, and becomes the root switch according to normal STP rules.
If the switch has alternate paths to the root switch, it uses these alternate paths to transmit a new kind of Protocol Data Unit (PDU) called the Root Link Query PDU. The switch sends the Root Link Query PDU on all alternate paths to the root switch. If the switch determines that it still has an alternate path to the root, it causes the maximum aging time on the ports on which it received the inferior BPDU to expire. If all the alternate paths to the root switch indicate that the switch has lost connectivity to the root switch, the switch causes the maximum aging times on the ports on which it received an inferior BPDU to expire. If one or more alternate paths can still connect to the root switch, the switch makes all ports on which it received an inferior BPDU its designated ports and moves them out of the blocking state (if they were in the blocking state), through the listening and learning states, and into the forwarding state.
Figure 7 shows an example topology with no link failures. Switch A, the root switch, connects directly to Switch B over link L1 and to Switch C over link L2. The interface on Switch C that connects directly to Switch B is in the blocking state.
Figure 7 BackboneFast Example Before Indirect Link Failure
If link L1 fails, Switch C cannot detect this failure because it is not connected directly to link L1. However, because Switch B is directly connected to the root switch over L1, it detects the failure, elects itself the root, and begins sending BPDUs to Switch C, identifying itself as the root. When Switch C receives the inferior BPDUs from Switch B, Switch C assumes that an indirect failure has occurred. At that point, BackboneFast allows the blocked port on Switch C to move immediately to the listening state without waiting for the maximum aging time for the port to expire. BackboneFast then changes the interface on Switch C to the forwarding state, providing a path from Switch B to Switch A. This switchover takes approximately 30 seconds, twice the Forward Delay time if the default Forward Delay time of 15 seconds is set. Figure 8 shows how BackboneFast reconfigures the topology to account for the failure of link L1.
Figure 8 BackboneFast Example After Indirect Link Failure
If a new switch is introduced into a shared-medium topology as shown in Figure 9, BackboneFast is not activated because the inferior BPDUs did not come from the recognized designated bridge (Switch B). The new switch begins sending inferior BPDUs that say it is the root switch. However, the other switches ignore these inferior BPDUs, and the new switch learns that Switch B is the designated bridge to Switch A, the root switch.
Figure 9 Adding a Switch in a Shared-Medium Topology
Layer 2 Ethernet Switching
EtherSwitch network modules support simultaneous, parallel connections between Layer 2 Ethernet segments. Switched connections between Ethernet segments last only for the duration of the packet. New connections can be made between different segments for the next packet.
The EtherSwitch network module solves congestion problems caused by high-bandwidth devices and a large number of users by assigning each device (for example, a server) to its own 10-, 100-, or 1000-Mbps segment. Because each Ethernet interface on the switch represents a separate Ethernet segment, servers in a properly configured switched environment achieve full access to the bandwidth.
Because collisions are a major bottleneck in Ethernet networks, an effective solution is full-duplex communication. Normally, Ethernet operates in half-duplex mode, which means that stations can either receive or transmit. In full-duplex mode, two stations can transmit and receive at the same time. When packets can flow in both directions simultaneously, effective Ethernet bandwidth doubles to 20 Mbps for 10-Mbps interfaces and to 200 Mbps for Fast Ethernet interfaces.
Switching Frames Between Segments
Each Ethernet interface on an EtherSwitch network module can connect to a single workstation or server, or to a hub through which workstations or servers connect to the network.
On a typical Ethernet hub, all ports connect to a common backplane within the hub, and the bandwidth of the network is shared by all devices attached to the hub. If two stations establish a session that uses a significant level of bandwidth, the network performance of all other stations attached to the hub is degraded.
To reduce degradation, the switch treats each interface as an individual segment. When stations on different interfaces need to communicate, the switch forwards frames from one interface to the other at wire speed to ensure that each session receives full bandwidth.
To switch frames between interfaces efficiently, the switch maintains an address table. When a frame enters the switch, it associates the MAC address of the sending station with the interface on which it was received.
Building the Address Table
The EtherSwitch network module builds the address table by using the source address of the frames received. When the switch receives a frame for a destination address not listed in its address table, it floods the frame to all interfaces of the same virtual local-area network (VLAN) except the interface that received the frame. When the destination station replies, the switch adds its relevant source address and interface ID to the address table. The switch then forwards subsequent frames to a single interface without flooding to all interfaces. The address table can store at least 8,191 address entries without flooding any entries. The switch uses an aging mechanism, defined by a configurable aging timer; so if an address remains inactive for a specified number of seconds, it is removed from the address table.
Note
VLAN Trunks
A trunk is a point-to-point link between one or more Ethernet switch interfaces and another networking device such as a router or a switch. Trunks carry the traffic of multiple VLANs over a single link and allow you to extend VLANs across an entire network and supports only one encapsulation on all Ethernet interfaces: 802.1Q-802.1Q is an industry-standard trunking encapsulation. You can configure a trunk on a single Ethernet interface or on an EtherChannel bundle.
Layer 2 Interface Modes
Table 4 Default Layer 2 Ethernet Interface Configuration
When you connect a Cisco switch to a device other than a Cisco device through an 802.1Q trunk, the Cisco switch combines the spanning tree instance of the VLAN trunk with the spanning tree instance of the other 802.1Q switch. However, spanning tree information for each VLAN is maintained by Cisco switches separated by a cloud of 802.1Q switches that are not Cisco switches. The 802.1Q cloud separating the Cisco switches that is not Cisco devised, is treated as a single trunk link between the switches.
Make sure that the native VLAN for an 802.1Q trunk is the same on both ends of the trunk link. If the VLAN on one end of the trunk is different from the VLAN on the other end, spanning tree loops might result. Inconsistencies detected by a Cisco switch mark the line as broken and block traffic for the specific VLAN.
Disabling spanning tree on the VLAN of an 802.1Q trunk without disabling spanning tree on every VLAN in the network can potentially cause spanning tree loops. Cisco recommends that you leave spanning tree enabled on the VLAN of an 802.1Q trunk or that you disable spanning tree on every VLAN in the network. Make sure that your network is loop-free before disabling spanning tree.
Layer 2 Interface Configuration Guidelines and Restrictions
Cisco Discovery Protocol
Cisco Discovery Protocol (CDP) is a protocol that runs over Layer 2 (the data link layer) on all Cisco routers, bridges, access servers, and switches. CDP allows network management applications to discover Cisco devices that are neighbors of already known devices, in particular, neighbors running lower-layer, transparent protocols. With CDP, network management applications can learn the device type and the SNMP agent address of neighboring devices. This feature enables applications to send SNMP queries to neighboring devices.
CDP runs on all LAN and WAN media that support Subnetwork Access Protocol (SNAP). Each CDP-configured device sends periodic messages to a multicast address. Each device advertises at least one address at which it can receive SNMP messages. The advertisements also contain the time-to-live, or hold-time information, which indicates the length of time a receiving device should hold CDP information before discarding it.
Port Security
You can use port security to block input to an Ethernet, Fast Ethernet, or Gigabit Ethernet port when the MAC address of the station attempting to access the port is different from any of the MAC addresses specified for that port. Alternatively, you can use port security to filter traffic destined to or received from a specific host based on the host MAC address.
802.1x Authentication
This section describes how to configure IEEE 802.1x port-based authentication to prevent unauthorized devices (clients) from gaining access to the network. As LANs extend to hotels, airports, and corporate lobbies, insecure environments could be created.
Understanding 802.1x Port-Based Authentication
The IEEE 802.1x standard defines a client/server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports. The authentication server authenticates each client connected to a switch port before making available any services offered by the switch or the LAN.
Until the client is authenticated, 802.1x access control allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port.
Device Roles
With 802.1x port-based authentication, the devices in the network have specific roles as shown in Figure 10.
Figure 10 802.1x Device Roles
•
Note
http://support.microsoft.com/support/kb/articles/Q303/5/97.ASP•
•
When the switch receives EAPOL frames and relays them to the authentication server, the Ethernet header is stripped and the remaining EAP frame is reencapsulated in the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the authentication server must support EAP within the native frame format. When the switch receives frames from the authentication server, the server's frame header is removed, leaving the EAP frame, which is then encapsulated for Ethernet and sent to the client.
The devices that can act as intermediaries include the Catalyst 3550 multilayer switch, Catalyst 2950 switch, or a wireless access point. These devices must be running software that supports the RADIUS client and 802.1x.
Authentication Initiation and Message Exchange
The switch or the client can initiate authentication. If you enable authentication on a port by using the dot1x port-control auto interface configuration command, the switch must initiate authentication when it determines that the port link state changes from down to up. It then sends an EAP-request/identity frame to the client to request its identity (typically, the switch sends an initial identity/request frame followed by one or more requests for authentication information). Upon receipt of the frame, the client responds with an EAP-response/identity frame.
However, if during bootup, the client does not receive an EAP-request/identity frame from the switch, the client can initiate authentication by sending an EAPOL-start frame, which prompts the switch to request the client's identity.
Note
When the client supplies its identity, the switch begins its role as the intermediary, passing EAP frames between the client and the authentication server until authentication succeeds or fails. If the authentication succeeds, the switch port becomes authorized.
The specific exchange of EAP frames depends on the authentication method being used. Figure 11 shows a message exchange initiated by the client using the One-Time-Password (OTP) authentication method with a RADIUS server.
Figure 11 Message Exchange
Ports in Authorized and Unauthorized States
The switch port state determines whether or not the client is granted access to the network. The port starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except for 802.1x packets. When a client is successfully authenticated, the port changes to the authorized state, allowing all traffic for the client to flow normally.
If a client that does not support 802.1x is connected to an unauthorized 802.1x port, the switch requests the client's identity. In this situation, the client does not respond to the request, the port remains in the unauthorized state, and the client is not granted access to the network.
In contrast, when an 802.1x-enabled client connects to a port that is not running 802.1x, the client initiates the authentication process by sending the EAPOL-start frame. When no response is received, the client sends the request for a fixed number of times. Because no response is received, the client begins sending frames as if the port is in the authorized state.
If the client is successfully authenticated (receives an Accept frame from the authentication server), the port state changes to authorized, and all frames from the authenticated client are allowed through the port. If the authentication fails, the port remains in the unauthorized state, but authentication can be retried. If the authentication server cannot be reached, the switch can retransmit the request. If no response is received from the server after the specified number of attempts, authentication fails, and network access is not granted.
When a client logs off, it sends an EAPOL-logoff message, causing the switch port to change to the unauthorized state.
If the link state of a port changes from up to down, or if an EAPOL-logoff frame is received, the port returns to the unauthorized state.
Supported Topologies
The 802.1x port-based authentication is supported in two topologies:
•
•
In a point-to-point configuration (see Figure 10), only one client can be connected to the 802.1x-enabled switch port. The switch detects the client when the port link state changes to the up state. If a client leaves or is replaced with another client, the switch changes the port link state to down, and the port returns to the unauthorized state.
Figure 12 shows 802.1x-port-based authentication in a wireless LAN. The 802.1x port is configured as a multiple-host port that becomes authorized as soon as one client is authenticated. When the port is authorized, all other hosts indirectly attached to the port are granted access to the network. If the port becomes unauthorized (reauthentication fails or an EAPOL-logoff message is received), the switch denies access to the network to all of the attached clients. In this topology, the wireless access point is responsible for authenticating the clients attached to it, and the wireless access point acts as a client to the switch.
Figure 12 Wireless LAN Example
Storm Control
A traffic storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation or in the network configuration can cause a storm. Storm control can be implemented globally or on a per-port basis. Global storm control and per-port storm control cannot be enabled at the same time.
Global Storm Control
Global storm control prevents switchports on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the interfaces. Global storm control monitors incoming traffic statistics over a time period and compares the measurement with a predefined suppression level threshold. The threshold represents the percentage of the total available bandwidth of the port. If the threshold of a traffic type is reached, further traffic of that type is suppressed until the incoming traffic falls below the threshold level. Global storm control is disabled by default.
The switch supports global storm control for broadcast, multicast, and unicast traffic. This example of broadcast suppression can also be applied to multicast and unicast traffic.
The graph in Figure 13 shows broadcast traffic patterns on an interface over a given period of time. In this example, the broadcast traffic exceeded the configured threshold between time intervals T1 and T2 and between T4 and T5. When the amount of specified traffic exceeds the threshold, all traffic of that kind is dropped. Therefore, broadcast traffic is blocked during those intervals. At the next time interval, if broadcast traffic does not exceed the threshold, it is again forwarded.
Figure 13 Broadcast Suppression Example
When global storm control is enabled, the switch monitors packets passing from an interface to the switching bus and determines if the packet is unicast, multicast, or broadcast. The switch monitors the number of broadcast, multicast, or unicast packets received within the 1-second time interval, and when a threshold for one type of traffic is reached, that type of traffic is dropped. This threshold is specified as a percentage of total available bandwidth that can be used by broadcast (multicast or unicast) traffic.
The combination of broadcast suppression threshold numbers and the 1-second time interval control the way the suppression algorithm works. A higher threshold allows more packets to pass through. A threshold value of 100 percent means that no limit is placed on the traffic.
Note
The switch continues to monitor traffic on the port, and when the utilization level is below the threshold level, the type of traffic that was dropped is forwarded again.
Per-Port Storm Control
A packet storm occurs when a large number of broadcast, unicast, or multicast packets are received on a port. Forwarding these packets can cause the network to slow down or to time out. By default, per-port storm control is disabled.
Per-port storm control uses rising and falling thresholds to block and then restore the forwarding of broadcast, unicast, or multicast packets. You can also set the switch to shut down the port when the rising threshold is reached.
Per-port storm control uses a bandwidth-based method to measure traffic activity. The thresholds are expressed as a percentage of the total available bandwidth that can be used by the broadcast, multicast, or unicast traffic.
The rising threshold is the percentage of total available bandwidth associated with multicast, broadcast, or unicast traffic before forwarding is blocked. The falling threshold is the percentage of total available bandwidth below which the switch resumes normal forwarding. In general, the higher the level, the less effective the protection against broadcast storms.
EtherChannel
EtherChannel bundles up to eight individual Ethernet links into a single logical link that provides bandwidth of up to 1600 Mbps (Fast EtherChannel full duplex) between the network module and another switch or host.
An EtherSwitch network module system supports a maximum of six EtherChannels. All interfaces in each EtherChannel must have the same speed duplex and mode.
Load Balancing
EtherChannel balances traffic load across the links in a channel by reducing part of the binary pattern formed from the addresses in the frame to a numerical value that selects one of the links in the channel.
EtherChannel load balancing can use MAC addresses or IP addresses; either source or destination or both source and destination. The selected mode applies to all EtherChannels configured on the switch.
Use the option that provides the greatest variety in your configuration. For example, if the traffic on a channel is going only to a single MAC address, using the destination MAC address always chooses the same link in the channel; using source addresses or IP addresses may result in better load balancing.
EtherChannel Configuration Guidelines and Restrictions
If improperly configured, some EtherChannel interfaces are disabled automatically to avoid network loops and other problems. Follow these guidelines and restrictions to avoid configuration problems:
•
•
•
•
For Layer 2 EtherChannels:
•
An EtherChannel supports the same allowed range of VLANs on all interfaces in a trunking Layer 2 EtherChannel. If the allowed range of VLANs is not the same, the interfaces do not form an EtherChannel.
Interfaces with different Spanning Tree Protocol (STP) port path costs can form an EtherChannel as long they are otherwise compatibly configured. Setting different STP port path costs does not, by itself, make interfaces incompatible for the formation of an EtherChannel.
After you configure an EtherChannel, configuration that you apply to the port-channel interface affects the EtherChannel.
Flow Control on Gigabit Ethernet Ports
Flow control is a feature that Gigabit Ethernet ports use to inhibit the transmission of incoming packets. If a buffer on a Gigabit Ethernet port runs out of space, the port transmits a special packet that requests remote ports to delay sending packets for a period of time. This special packet is called a pause frame. The send and receive keywords of the set port flowcontrol command are used to specify the behavior of the pause frames.
Intrachassis Stacking
Multiple switch modules may be installed simultaneously by connecting the Gigabit Ethernet (GE) ports of the EtherSwitch network module. This connection sustains a line-rate traffic similar to the switch fabric found in Cisco Catalyst switches and forms a single VLAN consisting of all ports in multiple EtherSwitch network modules. The stacking port must be configured for multiple switch modules to operate correctly in the same chassis.
•
•
Switched Port Analyzer
Switched Port Analyzer Session
A Switched Port Analyzer (SPAN) session is an association of a destination interface with a set of source interfaces. You configure SPAN sessions using parameters that specify the type of network traffic to monitor. SPAN sessions allow you to monitor traffic on one or more interfaces and to send either ingress traffic, egress traffic, or both to one destination interface. You can configure one SPAN session with separate or overlapping sets of SPAN source interfaces or VLANs. Only switched interfaces can be configured as SPAN sources or destinations on the same network module.
SPAN sessions do not interfere with the normal operation of the switch. You can enable or disable SPAN sessions with command-line interface (CLI) or SNMP commands. When enabled, a SPAN session might become active or inactive based on various events or actions, and this would be indicated by a syslog message. The show monitor session command displays the operational status of a SPAN session.
A SPAN session remains inactive after system power-up until the destination interface is operational.
Destination Interface
A destination interface (also called a monitor interface) is a switched interface to which SPAN sends packets for analysis. You can have one SPAN destination interface. Once an interface becomes an active destination interface, incoming traffic is disabled. You cannot configure a SPAN destination interface to receive ingress traffic. The interface does not forward any traffic except that required for the SPAN session.
An interface configured as a destination interface cannot be configured as a source interface. EtherChannel interfaces cannot be SPAN destination interfaces.
Specifying a trunk interface as a SPAN destination interface stops trunking on the interface.
Source Interface
A source interface is an interface monitored for network traffic analysis. One or more source interfaces can be monitored in a single SPAN session with user-specified traffic types (ingress, egress, or both) applicable for all the source interfaces.
You can configure source interfaces in any VLAN. You can configure EtherChannel as source interfaces, which means that all interfaces in the specified VLANs are source interfaces for the SPAN session.
Trunk interfaces can be configured as source interfaces and mixed with nontrunk source interfaces; however, the destination interface never encapsulates.
Traffic Types
Ingress SPAN (Rx) copies network traffic received by the source interfaces for analysis at the destination interface. Egress SPAN (Tx) copies network traffic transmitted from the source interfaces. Specifying the configuration option both copies network traffic received and transmitted by the source interfaces to the destination interface.
SPAN Traffic
Network traffic, including multicast, can be monitored using SPAN. Multicast packet monitoring is enabled by default. In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination interface. For example, a bidirectional (both ingress and egress) SPAN session is configured for sources a1 and a2 to a destination interface d1. If a packet enters the switch through a1 and gets switched to a2, both incoming and outgoing packets are sent to destination interface d1; both packets would be the same (unless a Layer-3 rewrite had occurred, in which case the packets would be different).
Note
SPAN Configuration Guidelines and Restrictions
Follow these guidelines and restrictions when configuring SPAN:
•
•
•
•
•
•
•
•
•
•
•
•
•
Switched Virtual Interface
A switch virtual interface (SVI) represents a VLAN of switch ports as one interface to the routing or bridging function in the system. Only one SVI can be associated with a VLAN, but it is necessary to configure an SVI for a VLAN only when you wish to route between VLANs, fallback-bridge nonroutable protocols between VLANs, or to provide IP host connectivity to the switch. By default, an SVI is created for the default VLAN (VLAN 1) to permit remote switch administration. Additional SVIs must be explicitly configured. You can configure routing across SVIs.
SVIs are created the first time that you enter the vlan interface configuration command for a VLAN interface. The VLAN corresponds to the VLAN tag associated with data frames on an ISL or 802.1Q encapsulated trunk or the VLAN ID configured for an access port. Configure a VLAN interface for each VLAN for which you want to route traffic, and assign it an IP address.
SVIs support routing protocol and bridging configurations. For more information about configuring IP routing across SVIs, see the "Enabling and Verifying IP Multicast Layer 3 Switching" section.
Routed Ports
A routed port is a physical port that acts like a port on a router; it does not have to be connected to a router. A routed port is not associated with a particular VLAN, as is an access port. A routed port behaves like a regular router interface, except that it does not support subinterfaces. Routed ports can be configured with a Layer 3 routing protocol.
Configure routed ports by putting the interface into Layer 3 mode with the no switchport interface configuration command. Then assign an IP address to the port, enable routing, and assign routing protocol characteristics by using the ip routing and router protocol global configuration commands.
Caution
The number of routed ports and SVIs that you can configure is not limited by software; however, the interrelationship between this number and the number of other features being configured might have an impact on CPU utilization because of hardware limitations.
Routed ports support only Cisco Express Forwarding (CEF) switching (IP fast switching is not supported).
IP Multicast Layer 3 Switching
The maximum number of configured VLANs must be less than or equal to 242. The maximum number of multicast groups is related to the maximum number of VLANs. The number of VLANs is determined by multiplying the number of VLANs by the number of multicast groups. For example, the maximum number for 10 VLANs and 20 groups would be 200, under the 242 limit. This feature also provides support for Protocol Independent Multicast (PIM) sparse mode/dense mode/sparse-dense mode.
IGMP Snooping
Internet Group Management Protocol (IGMP) snooping constrains the flooding of multicast traffic by dynamically configuring the interfaces so that multicast traffic is forwarded only to those interfaces associated with IP multicast devices. The LAN switch snoops on the IGMP traffic between the host and the router and keeps track of multicast groups and member ports. When the switch receives an IGMP join report from a host for a particular multicast group, the switch adds the host port number to the associated multicast forwarding table entry. When it receives an IGMP Leave Group message from a host, it removes the host port from the table entry. After it relays the IGMP queries from the multicast router, it deletes entries periodically if it does not receive any IGMP membership reports from the multicast clients.
When IGMP snooping is enabled, the multicast router sends out periodic IGMP general queries to all VLANs. The switch responds to the router queries with only one join request per MAC multicast group, and the switch creates one entry per VLAN in the Layer 2 forwarding table for each MAC group from which it receives an IGMP join request. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry.
Layer 2 multicast groups learned through IGMP snooping are dynamic. However, you can statically configure MAC multicast groups by using the ip igmp snooping vlan static command. If you specify group membership for a multicast group address statically, your setting supersedes any automatic manipulation by IGMP snooping. Multicast group membership lists can consist of both user-defined and IGMP snooping-learned settings.
EtherSwitch network modules support a maximum of 255 IP multicast groups and support both IGMP version 1 and IGMP version 2.
If a port spanning-tree, a port group, or a VLAN ID change occurs, the IGMP snooping-learned multicast groups from this port on the VLAN are deleted.
In the IP multicast-source-only environment, the switch learns the IP multicast group from the IP multicast data stream and only forwards traffic to the multicast router ports.
Immediate-Leave Processing
IGMP snooping Immediate-Leave processing allows the switch to remove an interface that sends a leave message from the forwarding table without first sending out MAC-based general queries to the interface. The VLAN interface is pruned from the multicast tree for the multicast group specified in the original leave message. Immediate-Leave processing ensures optimal bandwidth management for all hosts on a switched network, even when multiple multicast groups are in use simultaneously.
Note
Setting the Snooping Method
Multicast-capable router ports are added to the forwarding table for every IP multicast entry. The switch learns of such ports through one of these methods:
•
•
You can configure the switch to snoop on PIM/Distance Vector Multicast Routing Protocol (PIM/DVMRP) packets. By default, the switch snoops on PIM/DVMRP packets on all VLANs. To learn of multicast router ports through PIM-DVMRP packets, use the ip igmp snooping vlan vlan-id mrouter learn pim-dvmrp interface configuration command.
Joining a Multicast Group
When a host connected to the switch wants to join an IP multicast group, it sends an IGMP join message, specifying the IP multicast group it wants to join. When the switch receives this message, it adds the port to the IP multicast group port address entry in the forwarding table.
Refer to Figure 14. Host 1 wants to join multicast group 224.1.2.3 and send a multicast message of an unsolicited IGMP membership report (IGMP join message) to the group with the equivalent MAC destination address of 0100.5E01.0203. The switch recognizes IGMP packets and forwards them to the CPU. When the CPU receives the IGMP multicast report by Host 1, the CPU uses the information to set up a multicast forwarding table entry as shown in Table 5 that includes the port numbers of Host 1 and the router.
Figure 14 Initial IGMP Join Message
Table 5 IP Multicast Forwarding Table
0100.5e01.0203
!IGMP
1, 2
Note that the switch architecture allows the CPU to distinguish IGMP information packets from other packets for the multicast group. The switch recognizes the IGMP packets through its filter engine. This prevents the CPU from becoming overloaded with multicast frames.
The entry in the multicast forwarding table tells the switching engine to send frames addressed to the 0100.5E01.0203 multicast MAC address that are not IGMP packets (!IGMP) to the router and to the host that has joined the group.
If another host (for example, Host 4) sends an IGMP join message for the same group (Figure 15), the CPU receives that message and adds the port number of Host 4 to the multicast forwarding table as shown in Table 6.
Figure 15 Second Host Joining a Multicast Group
Table 6 Updated Multicast Forwarding Table
0100.5e01.0203
!IGMP
1, 2, 5
Leaving a Multicast Group
The router sends periodic IP multicast general queries, and the switch responds to these queries with one join response per MAC multicast group. As long as at least one host in the VLAN needs multicast traffic, the switch responds to the router queries, and the router continues forwarding the multicast traffic to the VLAN. The switch only forwards IP multicast group traffic to those hosts listed in the forwarding table for that IP multicast group.
When hosts need to leave a multicast group, they can either ignore the periodic general-query requests sent by the router, or they can send a leave message. When the switch receives a leave message from a host, it sends out a group-specific query to determine if any devices behind that interface are interested in traffic for the specific multicast group. If, after a number of queries, the router processor receives no reports from a VLAN, it removes the group for the VLAN from its multicast forwarding table.
Fallback Bridging
With fallback bridging, the switch bridges together two or more VLANs or routed ports, essentially connecting multiple VLANs within one bridge domain. Fallback bridging forwards traffic that the multilayer switch does not route and forwards traffic belonging to a nonroutable protocol such as DECnet.
Fallback bridging does not allow the spanning trees from the VLANs being bridged to collapse; each VLAN has its own Spanning Tree Protocol (STP) instance and a separate spanning tree, called the VLAN-bridge spanning tree, which runs on top of the bridge group to prevent loops.
A VLAN bridge domain is represented using the switch virtual interface (SVI). A set of SVIs and routed ports (which do not have any VLANs associated with them) can be configured to form a bridge group.
Recall that an SVI represents a VLAN of switch ports as one interface to the routing or bridging function in the system. Only one SVI can be associated with a VLAN, and it is only necessary to configure an SVI for a VLAN when you want to route between VLANs, to fallback-bridge nonroutable protocols between VLANs, or to provide IP host connectivity to the switch. A routed port is a physical port that acts like a port on a router, but it is not connected to a router. A routed port is not associated with a particular VLAN, does not support subinterfaces, but behaves like a normal routed interface.
A bridge group is an internal organization of network interfaces on a switch. Bridge groups cannot be used to identify traffic switched within the bridge group outside the switch on which they are defined. Bridge groups on the same switch function as distinct bridges; that is, bridged traffic and bridge protocol data units (BPDUs) cannot be exchanged between different bridge groups on a switch. An interface can be a member of only one bridge group. Use a bridge group for each separately bridged (topologically distinct) network connected to the switch.
The purpose of placing network interfaces into a bridge group is twofold:
•
•
Figure 16 shows a fallback bridging network example. The multilayer switch has two interfaces configured as SVIs with different assigned IP addresses and attached to two different VLANs. Another interface is configured as a routed port with its own IP address. If all three of these ports are assigned to the same bridge group, non-IP protocol frames can be forwarded among the end stations connected to the switch.
Figure 16 Fallback Bridging Network Example
Network Security with ACLs at Layer 2
Network security on your EtherSwitch network module can be implemented using access control lists (ACLs), which are also referred to in commands and tables as access lists.
Understanding ACLs
Packet filtering can limit network traffic and restrict network use by certain users or devices. ACLs can filter traffic as it passes through a switch and permit or deny packets from crossing specified interfaces. An ACL is a sequential collection of permit and deny conditions that apply to packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied ACLs to verify that the packet has the required permissions to be forwarded, based on the criteria specified in the access lists. The switch tests the packet against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packet. Because the switch stops testing conditions after the first match, the order of conditions in the list is critical. If no conditions match, the switch rejects the packet. If there are no restrictions, the switch forwards the packet; otherwise, the switch drops the packet.
You configure access lists on a Layer 2 switch to provide basic security for your network. If you do not configure ACLs, all packets passing through the switch could be allowed onto all parts of the network. You can use ACLs to control which hosts can access different parts of a network or to decide which types of traffic are forwarded or blocked at switch interfaces. For example, you can allow e-mail traffic to be forwarded but not Telnet traffic. ACLs can be configured to block inbound traffic.
An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny depends on the context in which the ACL is used.
The EtherSwitch network module supports IP ACLs to filter IP traffic, including TCP or User Datagram Protocol (UDP) traffic (but not both traffic types in the same ACL).
ACLs
You can apply ACLs on physical Layer 2 interfaces. ACLs are applied on interfaces only on the inbound direction.
•
•
The switch examines access lists associated with features configured on a given interface and a direction. As packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface are examined.
ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL. For example, you can use ACLs to allow one host to access a part of a network, but to prevent another host from accessing the same part. In Figure 17, ACLs applied at the switch input allow Host A to access the Human Resources network, but prevent Host B from accessing the same network.
Figure 17 Using ACLs to Control Traffic to a Network
Handling Fragmented and Unfragmented Traffic
IP packets can be fragmented as they cross the network. When this happens, only the fragment containing the beginning of the packet contains the Layer 4 information, such as TCP or UDP port numbers, ICMP type and code, and so on. All other fragments are missing this information.
Some ACEs do not check Layer 4 information and therefore can be applied to all packet fragments. ACEs that do test Layer 4 information cannot be applied in the standard manner to most of the fragments in a fragmented IP packet. When the fragment contains no Layer 4 information and the ACE tests some Layer 4 information, the matching rules are modified:
•
•
Consider access list 102, configured with these commands, applied to three fragmented packets:
Router(config)# access-list 102 permit tcp any host 10.1.1.1 eq smtpRouter(config)# access-list 102 deny tcp any host 10.1.1.2 eq telnetRouter(config)# access-list 102 deny tcp any any
Note
•
•
•
•
Understanding Access Control Parameters
Before configuring ACLs on the EtherSwitch network module, you must have a thorough understanding of the Access Control Parameters (ACPs). ACPs are referred to as masks in the switch CLI commands, and output.
Each ACE has a mask and a rule. The Classification Field or mask is the field of interest on which you want to perform an action. The specific values associated with a given mask are called rules.
Packets can be classified on these Layer 3 and Layer 4 fields.
•
–
–
You can use any combination or all of these fields simultaneously to define a flow.
•
–
–
Note
There are two types of masks:
•
•
Router(config-ext-nacl)# permit tcp any anyRouter(config-ext-nacl)# deny tcp any anyRouter(config-ext-nacl)# permit udp any anyRouter(config-ext-nacl)# deny udp any anyRouter(config-ext-nacl)# permit ip any anyRouter(config-ext-nacl)# deny ip any anyRouter(config-ext-nacl)# deny any anyRouter(config-ext-nacl)# permit any any
Note
The EtherSwitch network module ACL configuration is consistent with Cisco Catalyst switches. However, there are significant restrictions as well as differences for ACL configurations on the EtherSwitch network module.
Guidelines for Configuring ACLs on the EtherSwitch network module
These configuration guidelines apply to ACL filters:
•
•
The following example shows the same mask in an ACL:
Router(config)# ip access-list extended acl2Router(config-ext-nacl)# permit tcp 10.1.1.1 0.0.0.0 any eq 80Router(config-ext-nacl)# permit tcp 20.1.1.1 0.0.0.0 any eq 23In this example, the first ACE permits all the TCP packets coming from the host 10.1.1.1 with a destination TCP port number of 80. The second ACE permits all TCP packets coming from the host 20.1.1.1 with a destination TCP port number of 23. Both the ACEs use the same mask; therefore, a EtherSwitch network module supports this ACL.
•
Table 7 lists a summary of the ACL restrictions on EtherSwitch network modules.
Quality of Service for the EtherSwitch Network Module
Quality of service (QoS) can be implemented on your EtherSwitch network module. With this feature, you can provide preferential treatment to certain types of traffic. Without QoS, the switch offers best-effort service to each packet, regardless of the packet contents or size. It transmits the packets without any assurance of reliability, delay bounds, or throughput.
Understanding Quality of Service)
Typically, networks operate on a best-effort delivery basis, which means that all traffic has equal priority and an equal chance of being delivered in a timely manner. When congestion occurs, all traffic has an equal chance of being dropped.
With the QoS feature configured on your EtherSwitch network module, you can select specific network traffic, prioritize it according to its relative importance, and use congestion-management and congestion-avoidance techniques to provide preferential treatment. Implementing QoS in your network makes network performance more predictable and bandwidth utilization more effective.
The QoS implementation for this release is based on the DiffServ architecture, an emerging standard from the Internet Engineering Task Force (IETF). This architecture specifies that each packet is classified upon entry into the network. The classification is carried in the IP packet header, using six bits from the deprecated IP type of service (ToS) field to carry the classification (class) information. Classification can also be carried in the Layer 2 frame. These special bits in the Layer 2 frame or a Layer 3 packet are described here and shown in Figure 18:
•
Layer 2 802.1Q frame headers have a 2-byte Tag Control Information field that carries the CoS value in the three most-significant bits, which are called the User Priority bits. On interfaces configured as Layer 2 802.1Q trunks, all traffic is in 802.1Q frames except for traffic in the native VLAN.
Other frame types cannot carry Layer 2 CoS values.
Layer 2 CoS values range from 0 for low priority to 7 for high priority.
•
Layer 3 IP packets can carry a Differentiated Services Code Point (DSCP) value. The supported DSCP values are 0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56.
Figure 18 QoS Classification Layers in Frames and Packets
Note
Note
All switches and routers across the Internet rely on the class information to provide the same forwarding treatment to packets with the same class information and different treatment to packets with different class information. The class information in the packet can be assigned by end hosts or by switches or routers along the way, based on a configured policy, detailed examination of the packet, or both. Detailed examination of the packet is expected to happen closer to the edge of the network so that the core switches and routers are not overloaded.
Switches and routers along the path can use the class information to limit the amount of resources allocated per traffic class. The behavior of an individual device when handling traffic in the DiffServ architecture is called per-hop behavior. If all devices along a path provide a consistent per-hop behavior, you can construct an end-to-end QoS solution.
Implementing QoS in your network can be a simple or complex task and depends on the QoS features offered by your internetworking devices, the traffic types and patterns in your network, and the granularity of control you need over incoming and outgoing traffic.
The EtherSwitch network module can function as a Layer 2 switch connected to a Layer 3 router. When a packet enters the Layer 2 engine directly from a switch port, it is placed into one of four queues in the dynamic, 32-MB shared memory buffer. The queue assignment is based on the dot1p value in the packet. Any voice bearer packets that come in from the Cisco IP phones on the voice VLAN are automatically placed in the highest priority (Queue 3) based on the 802.1p value generated by the IP phone. The queues are then serviced on a weighted round robin (WRR) basis. The control traffic, which uses a CoS or ToS of 3, is placed in Queue 2.
Table 8 summarizes the queues, CoS values, and weights for Layer 2 QoS on the EtherSwitch network module.
Table 8 Queues, CoS values, and Weights for Layer 2 QoS
The weights specify the number of packets that are serviced in the queue before moving on to the next queue. Voice Realtime Transport Protocol (RTP) bearer traffic marked with a CoS or ToS of 5 and Voice Control plane traffic marked with a CoS/ToS of 3 are placed into the highest priority queues. If the queue has no packets to be serviced, it is skipped. Weighted Random Early Detection (WRED) is not supported on the Fast Ethernet ports.
You cannot configure port-based QoS on the Layer 2 switch ports.
Basic QoS Model
Figure 19 shows the basic QoS model. Actions at the ingress interface include classifying traffic, policing, and marking:
•
•
•
Actions at the egress interface include queueing and scheduling:
•
•
Figure 19 Basic QoS Model
Classification
Classification is the process of distinguishing one kind of traffic from another by examining the fields in the packet.
Classification occurs only on a physical interface basis. No support exists for classifying packets at the VLAN or the switched virtual interface level.
You specify which fields in the frame or packet that you want to use to classify incoming traffic.
Classification Based on QoS ACLs
You can use IP standard or IP extended ACLs to define a group of packets with the same characteristics (class). In the QoS context, the permit and deny actions in the access control entries (ACEs) have different meanings than with security ACLs:
•
•
•
•
•
–
–
–
Note
•
After a traffic class has been defined with the ACL, you can attach a policy to it. A policy might contain multiple classes with actions specified for each one of them. A policy might include commands to rate-limit the class. This policy is then attached to a particular port on which it becomes effective.
You implement IP ACLs to classify IP traffic by using the access-list global configuration command.
Classification Based on Class Maps and Policy Maps
A class map is a mechanism that you use to isolate and name a specific traffic flow (or class) from all other traffic. The class map defines the criteria used to match against a specific traffic flow to further classify it; the criteria can include matching the access group defined by the ACL. If you have more than one type of traffic that you want to classify, you can create another class map and use a different name. After a packet is matched against the class-map criteria, you further classify it through the use of a policy map.
A policy map specifies which traffic class to act on. Actions can include setting a specific DSCP value in the traffic class or specifying the traffic bandwidth limitations and the action to take when the traffic is out of profile. Before a policy map can be effective, you must attach it to an interface.
The policy map can also contain commands that define the policer, the bandwidth limitations of the traffic, and the action to take if the limits are exceeded. For more information, see the "Policing and Marking" section.
A policy map also has these characteristics:
•
•
•
For configuration information, see the "Configuring a QoS Policy" section.
Policing and Marking
Policing involves creating a policer that specifies the bandwidth limits for the traffic. Packets that exceed the limits are out of profile or nonconforming. Each policer specifies the action to take for packets that are in or out of profile. These actions, carried out by the marker, include dropping the packet, or marking down the packet with a new value that is user-defined.
You can create this type of policer:
Individual—QoS applies the bandwidth limits specified in the policer separately to each matched traffic class. You configure this type of policer within a policy map by using the policy-map configuration command.
For non-IP traffic, you have these marking options:
•
•
The trust DSCP configuration is meaningless for non-IP traffic. If you configure a port with this option and non-IP traffic is received, the switch assigns the default port CoS value and classifies traffic based on the CoS value.
For IP traffic, you have these classification options:
•
•
When configuring policing and policers, keep these items in mind:
•
•
•
•
•
–
–
–
•
•
Note
Mapping Tables
The EtherSwitch network modules support these types of marking to apply to the switch:
•
•
Note
Before the traffic reaches the scheduling stage, QoS uses the configurable DSCP-to-CoS map to derive a CoS value from the internal DSCP value.
The CoS-to-DSCP and DSCP-to-CoS map have default values that might or might not be appropriate for your network.
How to Configure the EtherSwitch Network Module
This section contains the following tasks:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Configuring VLANs
Perform this task to configure the VLANs on an EtherSwitch network module.
VLAN Removal from the Database
You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Examples
Sample Output for the show vlan-switch Command
In the following example, output information is displayed to verify the VLAN configuration:
Router# show vlan-switch name vlan0003VLAN Name Status Ports---- -------------------------------- --------- -------------------------------1 default active Fa1/0, Fa1/1, Fa1/2, Fa1/3Fa1/4, Fa1/5, Fa1/6, Fa1/7Fa1/8, Fa1/9, Fa1/10, Fa1/11Fa1/12, Fa1/13, Fa1/14, Fa1/151002 fddi-default active1003 token-ring-default active1004 fddinet-default active1005 trnet-default activeVLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------1 enet 100001 1500 - - - - - 1002 10031002 fddi 101002 1500 - - - - - 1 10031003 tr 101003 1500 1005 0 - - srb 1 10021004 fdnet 101004 1500 - - 1 ibm - 0 01005 trnet 101005 1500 - - 1 ibm - 0 0In the following example, the brief keyword is used to verify that VLAN 2 has been deleted:
Router# show vlan-switch briefVLAN Name Status Ports---- -------------------------------- --------- -------------------------------1 default active Fa0/2, Fa0/9, Fa0/14, Gi0/03 VLAN0003 active Fa0/4, Fa0/5, Fa0/10, Fa0/114 VLAN0004 active Fa0/6, Fa0/7, Fa0/12, Fa0/135 VLAN0005 active40 VLAN0040 active Fa0/1550 VLAN0050 active1000 VLAN1000 active1002 fddi-default active1003 token-ring-default active1004 fddinet-default active1005 trnet-default activeConfiguring VLAN Trunking Protocol
Perform this task to configure the VLAN Trunking Protocol (VTP) on an EtherSwitch network module.
VTP Mode Behavior
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Examples
Sample Output for the show vtp Command
In the following example, output information about the VTP management domain is displayed:
Router# show vtp statusVTP Version : 2Configuration Revision : 247Maximum VLANs supported locally : 1005Number of existing VLANs : 33VTP Operating Mode : ClientVTP Domain Name : Lab_NetworkVTP Pruning Mode : EnabledVTP V2 Mode : DisabledVTP Traps Generation : DisabledMD5 digest : 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80Configuration last modified by 0.0.0.0 at 8-12-99 15:04:49Configuring Spanning Tree on a VLAN
Perform this task to enable spanning tree on a per-VLAN basis and configure various spanning tree features. The EtherSwitch network module maintains a separate instance of spanning tree for each VLAN (except on VLANs on which you disable spanning tree).
VLAN Root Bridge
The EtherSwitch network module maintains a separate instance of spanning tree for each active VLAN configured on the device. A bridge ID, consisting of the bridge priority and the bridge MAC address, is associated with each instance. For each VLAN, the switch with the lowest bridge ID will become the root bridge for that VLAN.
To configure a VLAN instance to become the root bridge, the bridge priority can be modified from the default value (32768) to a significantly lower value so that the bridge becomes the root bridge for the specified VLAN. Use the spanning-tree vlan vlan-id root command to alter the bridge priority.
The switch checks the bridge priority of the current root bridges for each VLAN. The bridge priority for the specified VLANs is set to 8192 if this value will cause the switch to become the root for the specified VLANs.
If any root switch for the specified VLANs has a bridge priority lower than 8192, the switch sets the bridge priority for the specified VLANs to 1 less than the lowest bridge priority.
For example, if all switches in the network have the bridge priority for VLAN 100 set to the default value of 32768, entering the spanning-tree vlan 100 root primary command on a switch will set the bridge priority for VLAN 100 to 8192, causing the switch to become the root bridge for VLAN 100.
Note
Use the diameter keyword to specify the Layer 2 network diameter (that is, the maximum number of bridge hops between any two end stations in the Layer 2 network). When you specify the network diameter, the switch automatically picks an optimal hello time, forward delay time, and maximum age time for a network of that diameter, which can significantly reduce the spanning tree convergence time. You can use the hello-time keyword to override the automatically calculated hello time.
Note
VLAN Bridge Priority
Caution
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 3
spanning-tree vlan vlan-id [forward-time seconds | hello-time seconds | max-age seconds | priority priority | protocol protocol | [root {primary | secondary} [diameter net-diameter] [hello-time seconds]]]]
Example:Router(config)# spanning-tree vlan 200
Configures spanning tree on a per-VLAN basis.
•
•
Step 4
spanning-tree vlan vlan-id [priority priority]
Example:Router(config)# spanning-tree vlan 200 priority 33792
(Optional) Configures the bridge priority of a VLAN.
•
•
•
Step 5
spanning-tree vlan vlan-id [root {primary | secondary} [diameter net-diameter] [hello-time seconds]]
Example:Router(config)# spanning-tree vlan 200 root primary diameter 4
(Optional) Configures the EtherSwitch network module as the root bridge.
•
Step 6
spanning-tree vlan vlan-id [hello-time seconds]
Example:Router(config)# spanning-tree vlan 200 hello-time 7
(Optional) Configures the hello time of a VLAN.
•
•
Step 7
spanning-tree vlan vlan-id [forward-time seconds]
Example:Router(config)# spanning-tree vlan 200 forward-time 21
(Optional) Configures the spanning tree forward delay time of a VLAN.
•
•
Step 8
spanning-tree vlan vlan-id [max-age seconds]
Example:Router(config)# spanning-tree vlan 200 max-age 36
(Optional) Configures the maximum aging time of a VLAN.
•
•
Step 9
spanning-tree backbonefast
Example:Router(config)# spanning-tree vlan 200 max-age 36
(Optional) Enables BackboneFast on the EtherSwitch network module.
•
Note
Step 10
interface {ethernet | fastethernet | gigabitethernet} slot/port
Example:Router(config)# interface fastethernet 5/8
Selects the Ethernet interface to configure and enters interface configuration mode.
•
Step 11
spanning-tree port-priority port-priority
Example:Router(config-if)# spanning-tree port-priority 64
(Optional) Configures the port priority for an interface.
•
Step 12
spanning-tree cost cost
Example:Router(config-if)# spanning-tree cost 18
(Optional) Configures the port cost for an interface.
•
Step 13
exit
Example:Router(config-if)# exit
Exits interface configuration mode and returns the router to global configuration mode.
Verifying Spanning Tree on a VLAN
Perform this optional task to verify the spanning tree configuration on a VLAN.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Step 1
Enables privileged EXEC mode. Enter your password if prompted:
Router> enableStep 2
Use this command with the vlan keyword to display spanning tree information about a specified VLAN:
Router# show spanning-tree vlan 200VLAN200 is executing the ieee compatible Spanning Tree protocolBridge Identifier has priority 32768, address 0050.3e8d.6401Configured hello time 2, max age 20, forward delay 15Current root has priority 16384, address 0060.704c.7000Root port is 264 (FastEthernet5/8), cost of root path is 38Topology change flag not set, detected flag not setNumber of topology changes 0 last change occurred 01:53:48 agoTimes: hold 1, topology change 24, notification 2hello 2, max age 14, forward delay 10Timers: hello 0, topology change 0, notification 0Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 19, Port priority 128, Port Identifier 129.9.Designated root has priority 16384, address 0060.704c.7000Designated bridge has priority 32768, address 00e0.4fac.b000Designated port id is 128.2, designated path cost 19Timers: message age 3, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 3, received 3417Use this command with the interface keyword to display spanning tree information about a specified interface:
Router# show spanning-tree interface fastethernet 5/8Port 264 (FastEthernet5/8) of VLAN200 is forwardingPort path cost 19, Port priority 100, Port Identifier 129.8.Designated root has priority 32768, address 0010.0d40.34c7Designated bridge has priority 32768, address 0010.0d40.34c7Designated port id is 128.1, designated path cost 0Timers: message age 2, forward delay 0, hold 0Number of transitions to forwarding state: 1BPDU: sent 0, received 13513Use this command with the bridge, brief, and vlan keywords to display the bridge priority information:
Router# show spanning-tree bridge brief vlan 200Hello Max FwdVlan Bridge ID Time Age Delay Protocol---------------- -------------------- ---- ---- ----- --------VLAN200 33792 0050.3e8d.64c8 2 20 15 ieee
Configuring Layer 2 Interfaces
Perform this task to configure a range of interfaces, define a range macro, set the interface speed, set the duplex mode, and add a description for the interface.
Interface Speed and Duplex Mode Guidelines
When configuring an interface speed and duplex mode, note these guidelines:
•
•
•
Caution
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Examples
Sample Output for the show interfaces fastethernet Command
In the following example, output information is displayed to verify the speed and duplex mode of a Fast Ethernet interface:
Router# show interfaces fastethernet 1/4FastEthernet1/4 is up, line protocol is downHardware is Fast Ethernet, address is 0000.0000.0c89 (bia 0000.0000.0c89)MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Auto-duplex, Auto-speedARP type: ARPA, ARP Timeout 04:00:00Last input never, output never, output hang neverLast clearing of "show interface" counters neverQueueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected3 packets output, 1074 bytes, 0 underruns(0/0/0)0 output errors, 0 collisions, 5 interface resets0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outConfiguring an Ethernet Interface as a Layer 2 Trunk
Perform this task to configure an Ethernet interface as a Layer 2 trunk.
Restrictions
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Examples
Sample Output for the show interfaces fastethernet Command
In the following two examples, output information is displayed to verify the configuration of Fast Ethernet interface as a Layer 2 trunk:
Router# show interfaces fastethernet 5/8 switchportName: Fa5/8Switchport: EnabledAdministrative Mode: static accessOperational Mode: static accessAdministrative Trunking Encapsulation: dot1qOperational Trunking Encapsulation: nativeNegotiation of Trunking: DisabledAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Protected: falseUnknown unicast blocked: falseUnknown multicast blocked: falseBroadcast Suppression Level: 100Multicast Suppression Level: 100Unicast Suppression Level: 100Voice VLAN: noneAppliance trust: noneRouter# show interfaces fastethernet 5/8 trunkPort Mode Encapsulation Status Native vlanFa1/15 off 802.1q not-trunking 1Port Vlans allowed on trunkFa1/15 1Port Vlans allowed and active in management domainFa1/15 1Port Vlans in spanning tree forwarding state and not prunedFa1/15 1Configuring an Ethernet Interface as a Layer 2 Access
Perform this task to configure an Ethernet interface as a Layer 2 access.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Configuring Separate Voice and Data VLANs
Perform this task to configure separate voice and data VLANs on the EtherSwitch network module.
Separate Voice and Data VLANs
For ease of network administration and increased scalability, network managers can configure the EtherSwitch network module to support Cisco IP phones such that the voice and data traffic reside on separate VLANs. We recommend configuring separate VLANs when you are able to segment the existing IP address space of your branch office.
User priority bits in the 802.1p portion of the 802.1Q standard header are used to provide prioritization in Ethernet switches. This is a vital component in designing Cisco AVVID networks.
The EtherSwitch network module provides the performance and intelligent services of Cisco IOS software for branch office applications. The EtherSwitch network module can identify user applications—such as voice or multicast video—and classify traffic with the appropriate priority levels. QoS policies are enforced using Layer 2 and 3 information such as 802.1p, IP precedence, and DSCP.
Note
Voice Traffic and Voice VLAN ID (VVID) Using the EtherSwitch Network Module
The EtherSwitch network module can automatically configure voice VLAN. This capability overcomes the management complexity of overlaying a voice topology onto a data network while maintaining the quality of voice traffic. With the automatically configured voice VLAN feature, network administrators can segment phones into separate logical networks, even though the data and voice infrastructure is physically the same. The voice VLAN feature places the phones into their own VLANs without the need for end-user intervention. A user can plug the phone into the switch, and the switch provides the phone with the necessary VLAN information.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Configuring a Single Voice and Data VLAN
Perform this task to configure a Cisco IP phone to send voice and data traffic on the same VLAN on the EtherSwitch network module.
Single Voice and Data VLAN
For network designs with incremental IP telephony deployment, network managers can configure the EtherSwitch network module so that the voice and data traffic coexist on the same subnet. This might be necessary when it is impractical either to allocate an additional IP subnet for IP phones or to divide the existing IP address space into an additional subnet at the remote branch, it might be necessary to use a single IP address space for branch offices. (This is one of the simpler ways to deploy IP telephony.) When this is the case, you must still prioritize voice above data at both Layer 2 and Layer 3.
Layer 3 classification is already handled because the phone sets the type of service (ToS) bits in all media streams to an IP Precedence value of 5. (With Cisco CallManager Release 3.0(5), this marking changed to a Differentiated Services Code Point ([DSCP]) value of EF.) However, to ensure that there is
Layer 2 classification for admission to the multiple queues in the branch office switches, the phone must also use the User Priority bits in the Layer 2 802.1p header to provide class of service (CoS) marking. Setting the bits to provide marking can be done by having the switch look for 802.1p headers on the native VLAN.This configuration approach must address two key considerations:
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Managing the EtherSwitch network module
Use this task to perform basic management tasks such as adding a trap manager and assigning IP information on the EtherSwitch network module with the Cisco IOS CLI. You might find this information useful when you configure the EtherSwitch network module for the previous scenarios.
Trap Managers
A trap manager is a management station that receives and processes traps. When you configure a trap manager, community strings for each member switch must be unique. If a member switch has an IP address assigned to it, the management station accesses the switch by using its assigned IP address.
By default, no trap manager is defined, and no traps are issued.
IP Addressing
The recommended configuration for using multiple cables to connect IP phones to the Cisco AVVID network is to use a separate IP subnet and separate VLANs for IP telephony.
IP Information Assigned to the Switch
You can use a BOOTP server to automatically assign IP information to the switch; however, the BOOTP server must be set up in advance with a database of physical MAC addresses and corresponding IP addresses, subnet masks, and default gateway addresses. In addition, the switch must be able to access the BOOTP server through one of its ports. At startup, a switch without an IP address requests the information from the BOOTP server; the requested information is saved in the switch running the configuration file. To ensure that the IP information is saved when the switch is restarted, save the configuration by entering the write memory command in privileged EXEC mode.
You can change the information in these fields. The mask identifies the bits that denote the network number in the IP address. When you use the mask to subnet a network, the mask is then referred to as a subnet mask. The broadcast address is reserved for sending messages to all hosts. The CPU sends traffic to an unknown IP address through the default gateway.
Use of Ethernet Ports to Support Cisco IP Phones with Multiple Ports
You might want to use multiple ports to connect the Cisco IP phones if any of the following conditions apply to your Cisco IP telephony network:
•
•
•
You want to limit the number of switches that need Uninterruptible Power Supply (UPS) power.
Domain Name Mapping and DNS Configuration
Each unique IP address can have a host name associated with it. IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain. Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco Systems is a commercial organization that IP identifies by a com domain name, so its domain name is cisco.com. A specific device in this domain, the FTP system, for example, is identified as ftp.cisco.com.
To track domain names, IP has defined the concept of a domain name server (DNS), the purpose of which is to hold a cache (or database) of names mapped to IP addresses. To map domain names to IP addresses, you must first identify the host names and then specify a name server and enable the DNS, the Internet's global naming scheme that uniquely identifies network devices.
You can specify a default domain name that the software uses to complete domain name requests. You can specify either a single domain name or a list of domain names. When you specify a domain name, any IP host name without a domain name has that domain name appended to it before being added to the host table.
You can specify up to six hosts that can function as a name server to supply name information for the DNS.
If your network devices require connectivity with devices in networks for which you do not control name assignment, you can assign device names that uniquely identify your devices within the entire internetwork. The Internet's global naming scheme, the DNS, accomplishes this task. This service is enabled by default.
ARP Table Management
To communicate with a device (on Ethernet, for example), the software first must determine the 48-bit MAC or local data link address of that device. The process of determining the local data link address from an IP address is called address resolution.
The Address Resolution Protocol (ARP) associates a host IP address with the corresponding media or MAC addresses and VLAN ID. Taking an IP address as input, ARP determines the associated MAC address. Once a MAC address is determined, the IP-MAC address association is stored in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP). By default, standard Ethernet-style ARP encapsulation (represented by the arpa keyword) is enabled on the IP interface.
When you manually add entries to the ARP Table by using the CLI, you must be aware that these entries do not age and must be manually removed.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Configuring Voice Ports
Perform this task to instruct the Cisco 7960 IP phone to give voice traffic a higher priority and to forward all traffic through the 802.1Q native VLAN on the EtherSwitch network module. This task also disables inline power to a Cisco 7960 IP phone to allow voice traffic to be forwarded to and from the phone.
The EtherSwitch network module can connect to a Cisco 7960 IP phone and carry IP voice traffic. If necessary, the EtherSwitch network module can supply electrical power to the circuit connecting it to the Cisco 7960 IP phone.
Because the sound quality of an IP telephone call can deteriorate if the data is unevenly transmitted, the current release of the Cisco IOS software supports QoS based on IEEE 802.1p CoS. QoS uses classification and scheduling to transmit network traffic from the switch in a predictable manner.
The Cisco 7960 IP phone contains an integrated three-port 10/100 switch. The ports are dedicated to connect to the following devices:
•
•
•
Port Connection to a Cisco 7960 IP Phone
Because a Cisco 7960 IP phone also supports connection to a PC or other device, a port connecting a EtherSwitch network module to a Cisco 7960 IP phone can carry a mix of traffic. There are three ways to configure a port connected to a Cisco 7960 IP phone:
•
•
•
Inline Power on an EtherSwitch Network Module
The EtherSwitch network module can supply inline power to a Cisco 7960 IP phone, if necessary. The Cisco 7960 IP phone can also be connected to an AC power source and supply its own power to the voice circuit. When the Cisco 7960 IP phone is supplying its own power, an EtherSwitch network module can forward IP voice traffic to and from the phone.
A detection mechanism on the EtherSwitch network module determines whether it is connected to a Cisco 7960 IP phone. If the switch senses that there is no power on the circuit, the switch supplies the power. If there is power on the circuit, the switch does not supply it.
You can configure the switch to never supply power to the Cisco 7960 IP phone and to disable the detection mechanism.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Verifying Cisco Discovery Protocol
Perform this optional task to verify that Cisco Discovery Protocol (CDP) is enabled globally, enabled on an interface, and to display information about neighboring equipment. CDP is enabled by default. For more details on CDP commands refer to the Configuration Fundamentals and Network Management Command Reference, Release 12.3 T.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Step 1
Enables privileged EXEC mode. Enter your password if prompted:
Router> enableStep 2
Use this command to verify that CDP is globally enabled:
Router# show cdpGlobal CDP information:Sending CDP packets every 120 secondsSending a holdtime value of 180 secondsSending CDPv2 advertisements is enabledStep 3
Use this command to verify the CDP configuration on an interface:
Router# show cdp interface fastethernet 5/1FastEthernet5/1 is up, line protocol is upEncapsulation ARPASending CDP packets every 120 secondsHoldtime is 180 secondsStep 4
Use this command to verify information about the neighboring equipment:
Router# show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - RepeaterDevice ID Local Intrfce Holdtme Capability Platform Port IDJAB023807H1 Fas 5/3 127 T S WS-C2948 2/46JAB023807H1 Fas 5/2 127 T S WS-C2948 2/45JAB023807H1 Fas 5/1 127 T S WS-C2948 2/44JAB023807H1 Gig 1/2 122 T S WS-C2948 2/50JAB023807H1 Gig 1/1 122 T S WS-C2948 2/49JAB03130104 Fas 5/8 167 T S WS-C4003 2/47JAB03130104 Fas 5/9 152 T S WS-C4003 2/48
Configuring the MAC Table to Provide Port Security
Perform this task to enable the MAC address secure option, create a static or dynamic entry in the MAC address table, and configure the aging timer.
Port security is implemented by providing the user with the option to make a port secure by allowing only well-known MAC addresses to send in data traffic.
MAC Addresses and VLANs
The EtherSwitch network module uses the MAC address tables to forward traffic between ports. All MAC addresses in the address tables are associated with one or more ports. These MAC tables include the following types of addresses:
•
•
•
The address tables list the destination MAC address and the associated VLAN ID, module, and port number associated with the address.
All addresses are associated with a VLAN. An address can exist in more than one VLAN and have different destinations in each. Multicast addresses, for example, could be forwarded to port 1 in VLAN 1 and ports 9, 10, and 11 in VLAN 5.
Each VLAN maintains its own logical address table. A known address in one VLAN is unknown in another until it is learned or statically associated with a port in the other VLAN. An address can be secure in one VLAN and dynamic in another. Addresses that are statically entered in one VLAN must be static addresses in all other VLANs.
Address Aging Time
Dynamic addresses are source MAC addresses that the switch learns and then drops when they are not in use. Use the Aging Time field to define how long the switch retains unseen addresses in the table. This parameter applies to all VLANs.
Setting too short an aging time can cause addresses to be prematurely removed from the table. Then when the switch receives a packet for an unknown destination, it floods the packet to all ports in the same VLAN as the receiving port. This unnecessary flooding can impact performance. Setting too long an aging time can cause the address table to be filled with unused addresses; it can cause delays in establishing connectivity when a workstation is moved to a new port.
Caution
Secure Addresses
The secure address table contains secure MAC addresses and their associated ports and VLANs. A secure address is a manually entered unicast address that is forwarded to only one port per VLAN. If you enter an address that is already assigned to another port, the switch reassigns the secure address to the new port.
You can enter a secure port address even when the port does not yet belong to a VLAN. When the port is later assigned to a VLAN, packets destined for that address are forwarded to the port.
Static Addresses
A static address has the following characteristics:
•
•
•
Because all ports are associated with at least one VLAN, the switch acquires the VLAN ID for the address from the ports that you select on the forwarding map. A static address in one VLAN must be a static address in other VLANs. A packet with a static address that arrives on a VLAN where it has not been statically entered is flooded to all ports and not learned.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Examples
Sample Output for the show mac-address-table Command
In the following example, output information is displayed to verify the configuration of the secure port:
Router# show mac-address-table secureSecure Address Table:Destination Address Address Type VLAN Destination Port------------------- ------------ ---- --------------------0003.0003.0003 Secure 1 FastEthernet 2/8In the following example, information about static and dynamic addresses in the MAC address table is displayed:Router# show mac-address-tableDestination Address Address Type VLAN Destination Port------------------- ------------ ---- --------------------0001.6443.6440 Static 1 Vlan10004.c16d.9be1 Dynamic 1 FastEthernet2/130004.ddf0.0282 Dynamic 1 FastEthernet2/130006.0006.0006 Dynamic 1 FastEthernet2/13001b.001b.ad45 Dynamic 1 FastEthernet2/13In the following example, information about the MAC address aging timer is displayed:Router# show mac-address-table aging-timerMac address aging time 23Configuring 802.1x Authentication
Perform the following tasks to configure 802.1x port-based authentication on the EtherSwitch network module:
•
•
•
802.1x Authentication Guidelines for the EtherSwitch network module
These are the 802.1x authentication configuration guidelines:
•
•
–
–
Switch Port Analyzer (SPAN) destination port—You can enable 802.1x on a port that is a SPAN destination port; however, 802.1x is disabled until the port is removed as a SPAN destination. You can enable 802.1x on a SPAN source port.
Table 9 shows the default 802.1x configuration.
Enabling 802.1x Authentication
To enable 802.1x port-based authentication, you must enable AAA and specify the authentication method list. A method list describes the sequence and authentication methods to be queried to authenticate a user.
The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other authentication methods are attempted.
You control the port authorization state by using the dot1x port-control interface configuration command and these keywords:
•
•
•
To disable AAA, use the no aaa new-model global configuration command. To disable 802.1x AAA authentication, use the no form of the aaa authentication dot1x global configuration command. To disable 802.1x, use the dot1x port-control command with the force-authorized keyword or the no form of the dot1x port-control interface configuration command.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 3
aaa new-model
Example:Router (config)# aaa new-model
Enables AAA.
Step 4
aaa authentication dot1x default group radius
Example:Router (config)# aaa authentication dot1x default group radius
Creates an 802.1x authentication method list.
To create a default list that is used when a named list is not specified in the authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces.
Enter at least one of these keywords:
•
•
Step 5
interface type slot/port
Example:Router (config)# interface fastethernet 5/1
Enters interface configuration mode and specifies the interface to be enabled for 802.1x port-based authentication.
Step 6
dot1x port-control [auto | force-authorized | force-unauthorized]
Example:Router (config-if)# dot1x port-control auto
Enables 802.1x port-based authentication on the interface.
For feature interaction information with trunk, dynamic, dynamic-access, EtherChannel, secure, and SPAN ports, see the "802.1x Authentication Guidelines for the EtherSwitch network module" section.
Step 7
exit
Example:Router(config)# exit
Exits interface configuration mode and returns the router to privileged EXEC mode.
•
Configuring the Switch-to-RADIUS-Server Communication
Perform this task to configure RADIUS server parameters.
RADIUS Security Servers
RADIUS security servers are identified by their host name or IP address, host name and specific UDP port numbers, or IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service—for example, authentication—the second host entry configured acts as the fail-over backup to the first one. The RADIUS host entries are tried in the order that they were configured.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Configuring 802.1x Parameters (Retransmissions and Timeouts)
Perform this task to configure various 802.1x retransmission and timeout parameters. Because all of these parameters have default values, configuring them is optional.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
DETAILED STEPS
Step 1
Router> enable
Enables privileged EXEC mode.
•
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode.
Step 3
interface {ethernet | fastethernet | gigabitethernet} slot/port
Example:Router(config)# interface fastethernet 5/6
Specifies the interface to which multiple hosts are indirectly attached and enters interface configuration mode.
Step 4
dot1x port-control [auto | force-authorized | force-unauthorized]
Example:Router (config-if)# dot1x port-control auto
Enables 802.1x port-based authentication on the interface.
For feature interaction information with trunk, dynamic, dynamic-access, EtherChannel, secure, and SPAN ports, see the "802.1x Authentication Guidelines for the EtherSwitch network module" section.
Step 5
dot1x multiple-hosts
Example:Router (config-if)# dot1x multiple-hosts
Allows multiple hosts (clients) on an 802.1x-authorized port.
Note
Step 6
exit
Example:Router(config-if)# exit
Exits interface configuration mode and returns the router to global configuration mode.
Step 7
dot1x max-req number-of-retries
Example:Router (config)# dot1x max-req 3
Sets the number of times that the switch sends an EAP-request/identity frame to the client before restarting the authentication process.
•
Step 8
dot1x re-authentication
Example:Router (config)# dot1x reauthentication
Enables periodic reauthentication of the client, which is disabled by default.
•
Step 9
dot1x timeout re-authperiod value
Example:Router (config)# dot1x timeout re-authperiod 1800
Sets the number of seconds between reauthentication attempts.
•
Note
Step 10
dot1x timeout tx-period value
Example:Router (config)# dot1x timeout tx-period 60
Sets the number of seconds that the EtherSwitch network module waits for a response to an EAP-request/identity frame from the client before retransmitting the request.
•
Step 11
dot1x timeout quiet-period value
Example:Router (config)# dot1x timeout quiet-period 600
Sets the number of seconds that the EtherSwitch network module remains in a quiet state following a failed authentication exchange with the client.
•
Step 12
dot1x default
Example:Router (config)# dot1x default
Resets the configurable 802.1x parameters to the default values.
Step 13
exit
Example:Router(config)# exit
Exits global configuration mode and returns the router to privileged EXEC mode.
Step 14
show dot1x [statistics] [interface interface-type interface-number]
Example:Router# show dot1x statistics interface fastethernet 0/1
(Optional) Displays 802.1x statistics, administrative status, and operational status for the EtherSwitch network module or a specified interface.
Examples
Sample Output for the show dot1x Command
In the following example, statistics appear for all the physical ports for the specified interface:
Router# show dot1x statistics fastethernet 0/1FastEthernet0/1Rx: EAPOL EAPOL EAPOL EAPOL EAP EAP EAPStart Logoff Invalid Total Resp/Id Resp/Oth LenError0 0 0 21 0 0 0Last LastEAPOLVer EAPOLSrc1 0002.4b29.2a03Tx: EAPOL EAP EAPTotal Req/Id Req/Oth622 445 0In the following example, global 802.1x parameters and a summary are displayed:
Router# show dot1xGlobal 802.1X Parametersreauth-enabled noreauth-period 3600quiet-period 60tx-period 30supp-timeout 30server-timeout 30reauth-max 2max-req 2802.1X Port SummaryPort Name Status Mode AuthorizedGi0/1 disabled n/a n/aGi0/2 enabled Auto (negotiate) no802.1X Port Details802.1X is disabled on GigabitEthernet0/1802.1X is enabled on GigabitEthernet0/2Status UnauthorizedPort-control AutoSupplicant 0060.b0f8.fbfbMultiple Hosts DisallowedCurrent Identifier 2Authenticator State MachineState AUTHENTICATINGReauth Count 1Backend State MachineState RESPONSERequest Count 0Identifier (Server) 2Reauthentication State MachineState INITIALIZEConfiguring Power Management on the Interfaces
Perform this task to manage the powering of the Cisco IP phones.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Examples
Sample Output for the show power inline Command
In the following example, output information is displayed to verify the power configuration on the ports:
Router# show power inlinePowerSupply SlotNum. Maximum Allocated Status----------- -------- ------- --------- ------EXT-PS 1 165.000 20.000 PS1 GOOD PS2 ABSENTInterface Config Phone Powered PowerAllocated--------- ------ ----- ------- --------------FastEthernet1/0 auto no off 0.000 WattsFastEthernet1/1 auto no off 0.000 WattsFastEthernet1/2 auto no off 0.000 WattsFastEthernet1/3 auto no off 0.000 WattsFastEthernet1/4 auto unknown off 0.000 WattsFastEthernet1/5 auto unknown off 0.000 WattsFastEthernet1/6 auto unknown off 0.000 WattsFastEthernet1/7 auto unknown off 0.000 WattsFastEthernet1/8 auto unknown off 0.000 WattsFastEthernet1/9 auto unknown off 0.000 WattsFastEthernet1/10 auto unknown off 0.000 WattsFastEthernet1/11 auto yes on 6.400 WattsFastEthernet1/12 auto yes on 6.400 WattsFastEthernet1/13 auto no off 0.000 WattsFastEthernet1/14 auto unknown off 0.000 WattsFastEthernet1/15 auto unknown off 0.000 WattsConfiguring Storm Control
This section consists of two tasks. The first task enables global storm control, and the second task configures storm control on a per-port basis.
•
•
Enabling Global Storm Control
Perform this task to enable a specified type of global storm control.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Examples
Sample Output for the show interface counters Command
In the following example, output information is displayed to verify the number of packets discarded for the specified storm control suppression:
Router# show interface counters broadcastPort BcastSuppDiscardsFa0/1 0Fa0/2 0Enabling Per-Port Storm Control
Perform this task to configure storm control on a specified interface.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Examples
Sample Output for the show storm-control Command
In the following example, output information is displayed to verify the number of packets discarded for the specified storm control suppression:
Router# show storm-control broadcastInterface Filter State Upper Lower Current--------- ------------- ------- ------- -------Fa0/1 <inactive> 100.00% 100.00% 0.00%Fa0/2 <inactive> 100.00% 100.00% 0.00%Fa0/3 <inactive> 100.00% 100.00% 0.00%Fa0/4 Forwarding 30.00% 20.00% 20.32%Configuring Layer 2 EtherChannels (Port-Channel Logical Interfaces)
Perform this task to configure Layer 2 Ethernet interfaces as a Layer 2 EtherChannel, configure EtherChannel load balancing, and remove an Ethernet interface from an EtherChannel.
To configure Layer 2 EtherChannels, configure the Ethernet interfaces with the channel-group command, which creates the port-channel logical interface. You do not have to create a port-channel interface before assigning a physical interface to a channel group. A port-channel interface is created automatically when the channel group gets its first physical interface, if it is not already created.
Restrictions
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
Examples
Sample Output for the show interfaces fastethernet Command
In the following example, output information is displayed to verify the configuration of Fast Ethernet interface as a Layer 2 EtherChannel:
Router# show interfaces fastethernet 5/6 etherchannelPort state = EC-Enbld Up In-Bndl Usr-ConfigChannel group = 2 Mode = Desirable Gcchange = 0Port-channel = Po2 GC = 0x00020001Port indx = 1 Load = 0x55Flags: S - Device is sending Slow hello. C - Device is in Consistent state.A - Device is in Auto mode. P - Device learns on physical port.Timers: H - Hello timer is running. Q - Quit timer is running.S - Switching timer is running. I - Interface timer is running.Local information:Hello Partner PAgP Learning GroupPort Flags State Timers Interval Count Priority Method IfindexFa5/6 SC U6/S7 30s 1 128 Any 56Partner's information:Partner Partner Partner Partner GroupPort Name Device ID Port Age Flags Cap.Fa5/6 JAB031301 0050.0f10.230c 2/47 18s SAC 2FAge of the port in the current state: 00h:10m:57sSample Output for the show etherchannel Command
In the following example, output information about port channels for EtherChannel group 2 is displayed:
Router# show etherchannel 2 port-channelPort-channels in the group:----------------------Port-channel: Po2------------Age of the Port-channel = 00h:23m:33sLogical slot/port = 10/2 Number of ports in agport = 2GC = 0x00020001 HotStandBy port = nullPort state = Port-channel Ag-InusePorts in the Port-channel:Index Load Port-------------------1 55 Fa5/60 AA Fa5/7Time since last port bundled: 00h:23m:33s Fa5/6Configuring Flow Control on Gigabit Ethernet Ports
