 Feedback
|
Table Of Contents
Device Manager System Requirements
Finding the Software Version and Feature Set
Upgrading a Switch by Using the Device Manager
Upgrading a Switch by Using the CLI
Recovering from a Software Failure
logging event-spanning-tree Command
Updates to Software Configuration Guide
Configuration Replacement and Rollback
Understanding Configuration Replacement and Rollback
Configuring the Configuration Archive
Performing a Configuration Replacement or Rollback Operation
Updates to Command Reference Guide
location (global configuration)
location (interface configuration)
set and unset Bootloader Commands
Updates to Getting Started Guide
Updates to System Messages Guides
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Notes for the Cisco Catalyst Blade Switch 3020 for HP, Cisco IOS Release 12.2(40)SE1 and Later
Revised January 9, 2008
Cisco IOS Release 12.2(40)SE1 and 12.2(40)SE2 run on the Cisco Catalyst Blade Switch 3020 for HP, also referred to as the switch.
Note
If you wish to use Device Manager to upgrade the switch from Cisco IOS Release 12.2(35)SE through Cisco IOS Release 12.2(40)SE1 (the LAN Base image) to Cisco IOS Release 12.2(44)SE or later (the IP base image), you must first upgrade to Cisco IOS Release 12.2(40)SE2.
These release notes include important information about Cisco IOS Release 12.2(40)SE1 and later and any limitations, restrictions, and caveats that apply to them. Verify that these release notes are correct for your switch:
•
•
•
For the complete list of Cisco Catalyst Blade Switch 3020 for HP documentation, see the "Related Documentation" section.
You can download the switch software from this site (registered Cisco.com users with a login password):
http://tools.cisco.com/support/downloads/go/MDFTree.x?butype=switches
This software release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future software releases become available, they will be posted to Cisco.com in the Cisco IOS software area.
Contents
This information is in the release notes:
•
•
•
•
•
•
•
System Requirements
The system requirements are described in these sections:
•
Hardware Supported
Table 1 lists the hardware supported on this release.
Table 1 Supported Hardware
Cisco Catalyst Blade Switch 3020 for HP
24-Gigabit Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(35)SE
SFP1 modules
1000BASE-LX, -SX, and -T
Cisco IOS Release 12.2(35)SE
1 SFP = small form-factor pluggable
Device Manager System Requirements
These sections describes the hardware and software requirements for using the device manager:
•
•
Hardware Requirements
Table 2 lists the minimum hardware requirements for running the device manager.
Table 2 Minimum Hardware Requirements
Intel Pentium II1
64 MB2
256
1024 x 768
Small
1 We recommend Intel Pentium 4.
2 We recommend 256-MB DRAM.
Software Requirements
Table 3 lists the supported operating systems and browsers for using the device manager, which does not require a plug-in. The device manager verifies the browser version when starting a session to ensure that the browser is supported.
Note
Table 3 Supported Operating Systems and Browsers
Windows 2000
None
5.5 or 6.0
7.1
Windows XP
None
5.5 or 6.0
7.1
1 Service Pack 1 or higher is required for Internet Explorer 5.5.
Upgrading the Switch Software
These are the procedures for downloading software. Before downloading software, read this section for important information:
•
•
•
•
•
Finding the Software Version and Feature Set
The Cisco IOS image is stored as a bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line of the display shows the version.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Deciding Which Files to Use
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains the Cisco IOS image file and the files needed for the embedded device manager. You must use the combined tar file to upgrade the switch through the device manager. To upgrade the switch through the command-line interface (CLI), use the tar file and the archive download-sw privileged EXEC command.
Note
Table 4 lists the filenames for this software release.
Archiving Software Images
Before upgrading your switch software, make sure that you have archived copies of the current Cisco IOS release and the Cisco IOS release to which you are upgrading. You should keep these archived images until you have upgraded all devices in the network to the new Cisco IOS image and until you have verified that the new Cisco IOS image works properly in your network.
Cisco routinely removes old Cisco IOS versions from Cisco.com. See Product Bulletin 2863 for more information:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/prod_bulletin0900aecd80281c0e.html
You can copy the bin software image file on the flash memory to the appropriate TFTP directory on a host by using the copy flash: tftp: privileged EXEC command.
Note
You can also configure the switch as a TFTP server to copy files from one switch to another without using an external TFTP server by using the tftp-server global configuration command. For more information about the tftp-server command, see the "Basic File Transfer Services Commands" section of the Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 at this URL:
Upgrading a Switch by Using the Device Manager
You can upgrade switch software by using the device manager. For detailed instructions, click Help.
Note
Upgrading a Switch by Using the CLI
This procedure is for copying the combined tar file to the switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.
To download software, follow these steps:
Step 1
Step 2
http://www.cisco.com/public/sw-center/sw-lan.shtml
Step 3
For more information, see Appendix B in the software configuration guide for this release.
Step 4
Step 5
Switch# ping tftp-server-addressFor more information about assigning an IP address and default gateway to the switch, see the software configuration guide for this release.
Step 6
Switch# archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tarThe /overwrite option overwrites the software image in flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:
Switch# archive download-sw /overwrite tftp://198.30.20.19/cbs30x0lanbase-mzYou can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Recovering from a Software Failure
For additional recovery procedures, see the "Troubleshooting" chapter in the software configuration guide for this release.
Installation Notes
You can assign IP information to your switch by using these methods:
•
•
•
•
New Software Features
•
•
•
•
•
Limitations and Restrictions
You should review this section before you begin working with the switch. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
This section contains these limitations:
•
•
Cisco IOS Limitations
These limitations apply to switch:
•
•
Configuration
These are the configuration limitations:
•
This problem occurs under these conditions:
–
–
–
The workaround is to reconfigure the static IP address. (CSCea71176 and CSCdz11708)
•
The workaround is to configure the port for 10 Mb/s and half duplex or to connect a hub or a nonaffected device to the switch. (CSCed39091)
•
The workaround is to enter the no switchport block unicast interface configuration command on that specific interface. (CSCee93822)
•
There is no workaround. This is a cosmetic error and does not affect the functionality of the switch. (CSCef59331)
Ethernet
This is the Ethernet limitation:
•
If this happens, traffic distribution is uneven on EtherChannel ports.
Changing the load balance distribution method or changing the number of ports in the EtherChannel can resolve this problem. Use any of these workarounds to improve EtherChannel load balancing:
–
–
–
–
For example, with load balance configured as dst-ip with 150 distinct incrementing destination IP addresses, and the number of ports in the EtherChannel set to either 2, 4, or 8, load distribution is optimal. (CSCeh81991)
IP
This is the IP limitation:
When the rate of received DHCP requests exceeds 2,000 packets per minute for a long time, the response time might be slow when you are using the console. The workaround is to use rate limiting on DHCP traffic to prevent a denial of service attack from occurring. (CSCeb59166)
IP Telephony
These are the IP telephony limitations:
•
•
MAC Addressing Multicasting
These are the multicasting limitations:
•
•
•
–
–
There is no workaround. (CSCec20128)
•
The switchport block multicast interface configuration command is only applicable to non-IP multicast traffic.
There is no workaround. (CSCee16865)
•
–
–
The workaround is to enter the clear ip mroute privileged EXEC command on the interface. (CSCef42436)
After you configure a switch to join a multicast group by entering the ip igmp join-group group-address interface configuration command, the switch does not receive join packets from the client, and the switch port connected to the client is removed from the IGMP snooping forwarding table.
Use one of these workarounds:
–
–
logging event-spanning-tree Command
When the logging event-spanning-tree interface configuration command is configured and logging to the console is enabled, a topology change might generate a large number of logging messages, causing high CPU utilization. CPU utilization can increase with the number of spanning-tree instances and the number of interfaces configured with the logging event-spanning-tree interface configuration command. This condition adversely affects how the switch operates and could cause problems such as STP convergence delay.
High CPU utilization can also occur with other conditions, such as when debug messages are logged at a high rate to the console.
Use one of these workarounds:
•
•
Remove the logging event spanning-tree interface configuration command from the interfaces.
QoS
These are the quality of service (QoS) limitations:
•
•
•
SPAN and RSPAN
These are the SPAN and Remote SPAN (RSPAN) limitations.
•
•
•
Trunking
These are the trunking limitations:
•
•
•
VLAN
This is the VLAN limitation:
•
The workaround is to reduce the number of VLANs or trunks. (CSCeb31087)
Device Manager Limitations
These are the Device Manager limitations for this release:
•
The workaround is to click Yes when you are prompted to accept the certificate. (CSCef45718)
•
There is no workaround (CSCsd98457).
Important Notes
These sections describe the important notes related to this software release:
•
Cisco IOS Notes
These notes apply to Cisco IOS software:
•
If the switch has interfaces with automatic QoS for voice over IP (VoIP) configured and you upgrade the switch software to Cisco IOS Release 12.2(40)SE1 (or later), when you enter the auto qos voip cisco-phone interface configuration command on another interface, you might see this message:
AutoQoS Error: ciscophone input service policy was not properly appliedpolicy map AutoQoS-Police-CiscoPhone not configuredIf this happens, enter the no auto qos voip cisco-phone interface command on all interface with this configuration to delete it. Then enter the auto qos voip cisco-phone command on each of these interfaces to reapply the configuration.
•
•
•
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.If this message appears, check that there is network connectivity between the switch and the ACS. You should also check that the switch has been properly configured as an AAA client on the ACS.
Device Manager Notes
These notes apply to the device manager:
•
From Microsoft Internet Explorer:
1.
2.
3.
4.
5.
•
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
•
If you change the HTTP port, you must include the new port number when you enter the IP address in the browser Location or Address field (for example, http://10.1.126.45:184 where 184 is the new HTTP port number). You should write down the port number through which you are connected. Use care when changing the switch IP information.
If you are not using the default method of authentication (the enable password), you need to configure the HTTP server interface with the method of authentication used on the switch.
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
•
Open Caveats
This section describes the open severity 3 caveats for this software release.
Open Cisco IOS Caveats
This section describes the open severity 3 Cisco IOS configuration caveats with possible unexpected activity in this software release:
•
When an IEEE 802.1x restricted VLAN is configured on a port and a hub with multiple devices are connected to that port, syslog messages are now generated.
This is not a supported configuration. Only one host should be connected to an IEEE 802.1x restricted VLAN port.
•
When the Control Plane Policing (CoPP) policy is configured to drop packets that have IP options, packets with incorrectly created IP options are ignored.
The workaround is to configure CoPP to filter IP packets by source or destination address and not use the IP option for ACL filtering with CoPP.
•
If traffic is passing through VMPS ports and you perform a shut operation, a dynamic VLAN is not assigned and a VLAN with a null ID appears.
The workaround is to clear the MAC address table. This forces the VMPS server to correctly reassign the VLAN.
•
The switch might display tracebacks similar to these examples when a large number of IEEE 802.1x supplicants try to repeatedly log in and log out.
Examples:
Jan 3 17:54:32 L3A3 307: Jan 3 18:04:13.459: %SM-4-BADEVENT: Event 'eapReq' is invalid for the current state 'auth_bend_idle': dot1x_auth_bend Fa9
Jan 3 17:54:32 L3A3 308: -Traceback= B37A84 18DAB0 2FF6C0 2FF260 8F2B64 8E912C Jan 3 19:06:13 L3A3 309: Jan 3 19:15:54.720: %SM-4-BADEVENT: Event 'eapReq_no_reAuthMax' is invalid for the current ate 'auth_restart': dot1x_auth Fa4
Jan 3 19:06:13 L3A3 310: -Traceback= B37A84 18DAB0 3046F4 302C80 303228 8F2B64 8E912C Jan 3 20:41:44 L3A3 315: .Jan 3 20:51:26.249: %SM-4-BADEVENT: Event 'eapSuccess' is invalid for the current state 'auth_restart': dot1x_auth Fa9
Jan 3 20:41:44 L3A3 316: -Traceback= B37A84 18DAB0 304648 302C80 303228 8F2B64 8E912C
There is no workaround.
•
When you globally disable IEEE 802.1x on the switch by using the no dot1x system-auth-control global configuration command, some interface level configuration commands, including the dot1x timeout and dot1x mac-auth-bypass commands, become unavailable.
The workaround is to enable the dot1x system-auth-control global configuration command before you attempt to configure interface level IEEE 802.1x parameters.
•
When you enter the no speed interface configuration command, the Ethernet interface speed does not return to its default setting. This affects interfaces Gi0/17 to Gi0/20, Gi0/23, and Gi0/24. This does not affect interfaces Gi0/21 and Gi0/22.
The workaround is either to enter the speed interface configuration command auto keyword to change the interface speed to the default setting or to explicitly set the speed.
•
If you enter the test cable-diagnostics tdr privileged EXEC command on the dual-media interfaces Gi0/23 and Gi0/24, the Ethernet interface that is being tested shuts down and then comes back up.
There is no workaround.
•
When you change the media-type interface configuration command keyword from auto to rj45, the interface loses its link and does not recover it. This only affects the dual-media Ethernet interfaces Gi0/17 to Gi0/20, Gi0/23, and Gi0/24 when the interface is physically linked with the RJ-45 interface; it does not affect interfaces Gi0/21 or Gi0/22. This occurs when you have explicitly configured the duplex interface configuration command or the the speed interface configuration command to a keyword other than auto.
The workaround is to reconfigure the Ethernet interface for media-type rj45. Set the speed and duplex to auto. Then change the media-type to auto-select. Speed and duplex configurations are not permitted if the media-type is set to auto-select.
•
The Ethernet interface fa0 loses and regains its link because of a DHCP IP address timeout. This situation exists when the HP Onboard Administrator acts as the DHCP server and provides the IP address to the fa0 interface. This occurs when using the clear arp-cache privileged EXEC command to explicitly clear the ARP table.
The workaround is to add a static ARP table entry for the DHCP server (in this case, the Onboard Administrator) to the switch and to increase the lease time of the DHCP IP address on the server.
•
Fiber optic small form-factor pluggable (SFP) modules do not establish a link when you configure the Ethernet interfaces with the speed nonegotiate interface configuration command.
The workaround is to remove the speed nonegotiate setting for the Ethernet interface that has the fiber SFP installed. This configuration has to be done on the link partner device as well.
•
When MAC addresses are learned on an Etherchannel port, the addresses are incorrectly deleted from the MAC address table even when the MAC address table aging timeout value is configured to be longer than the ARP timeout value. This causes intermittent unicast packet flooding in the network.
The MAC address is automatically relearned after the ARP refresh. The workaround is to enter the ping ip address privileged EXEC command from the switch to the next hop router to avoid the intermittent flooding.
•
When the flowcontrol setting for received pause frames is enabled, the switch shows the operational state as off.
There is no workaround.
•
Changing the spanning tree mode from rapid STP to MSTP can cause tracebacks when the virtual port error-disable feature is enabled when the STP mode is changed.
There is no workaround.
•
When system jumbo MTU size is configured on a switch and the egress ports can support jumbo frames, the egress SPAN jumbo frames are not forwarded to the SPAN destination ports.
There is no workaround.
•
In Cisco IOS Release 12.2(37)SE or later, the TxBufferFullDropCount counter always increments even when the switch is a standalone switch.
There is no workaround.
•
In Cisco IOS Release 12.2(37)SE or later, the Total output drops field in the show interfaces privileged EXEC command output displays ASIC drops.
–
–
There is no workaround.
•
The switch does not correctly update the entPhysicalChildIndex objects from the ENTITY-MIB, and some of the entPhysicalChildIndex entries are missing from the table. This adversely affects network management applications such as CiscoWorks CiscoView because they cannot manage the switch.
There is no workaround.
•
In Cisco IOS Release 12.2(35)SE and Cisco IOS Release 12.2(37)SE, if you enter a space before a comma in the define interface-range or the interface range global configuration command, the space before the comma is not saved in the switch configuration.
There is no workaround.
•
A switch configured for Link Layer Discovery Protocol (LLDP) might not correctly report the enabled switch capabilities in the LLDP type, length, and value (TLV) attributes. System capabilities appear correctly, but the enabled capabilities are not identified if the switch is configured only as a Layer 2 switch.
There is no workaround.
Resolved Caveats
These sections describe the caveats that have been resolved in this release:
•
When dynamic ARP inspection is configured on a VLAN, and the ARP traffic on a port in the VLAN is within the configured rate limit, the port might go into an error-disabled state.
The workaround is to configure the burst interval to more than 1 second.
•
If IEEE 802.1x critical authentication is not enabled and the RADIUS authentication server is unavailable during MAC authentication bypass (MAB) reauthentication, when the RADIUS server comes back up, MAB now correctly authenticates previously authenticated clients.
•
This message no longer appears when the ternary content addressable memory (TCAM) is full:
%PLATFORM_PM-3-HOSTACCESSFAIL: Unable to configure hardware to restrict host access on Fa1/0/47. Port may not behave as expected.•
MAC flap-notification no longer occurs when a switch is running VLAN bridge spanning-tree protocol (STP) and fallback bridging is configured on the VLANs running STP.
•
Multiple Spanning-Tree Protocol (MSTP) convergence time has been improved for Cisco IOS Release 12.2.
•
When IEEE 802.1x and port security is enabled, port security now relearns the supplicant address.
•
When changing the administrative state of a port using the snmpset command, the switch no longer fails.
•
You can use Device Manager to upgrade the switch from Cisco IOS Release 12.2(35)SE through Cisco IOS Release 12.2(40)SE1 (the LAN Base image) to Cisco IOS Release12.2(44)SE or later (the IP base image). However, to do this, you must first upgrade to Cisco IOS Release 12.2(40)SE2.
If you wish to upgrade from a LAN base image to the IP base image without first upgrading to Cisco IOS Release 12.2(40)SE2, you must use one of these methods to upgrade the switch:
–
–
Documentation Updates
This section contains these documentation updates:
•
•
•
•
•
Updates to Software Configuration Guide
These features were added to the software configuration guide:
•
•
•
•
•
dot1x Timeout TX-Period
In the switch software configuration guide and command reference, this information about the dot1x timeout tx-period seconds interface configuration command is incorrect:
The range for seconds is from 5 to 65535.
The correct range is from 1 to 65535 seconds.
MAC Address-Table Move Update
This information in the "MAC Address-Table Move Update" section of the "Understanding Flex Links and the MAC Address-Table Move Update" chapter of the software configuration guide is incorrect:
The switch then starts forwarding traffic from the server to the PC through port 4, which reduces the loss of traffic from the server to the PC.
This is the correct information:
Switch A does not need to wait for the MAC address-table update. The switch detects a failure on port 1 and immediately starts forwarding server traffic from port 2, the new forwarding port. This change occurs in 100 milliseconds (ms). The PC is directly connected to switch A, and the connection status does not change. Switch A does not need to update the PC entry in the MAC address table.
Configuration Replacement and Rollback
The configuration replacement and rollback feature replaces the running configuration with any saved Cisco IOS configuration file. You can use the rollback function to roll back to a previous configuration.
These sections contain this information:
•
•
•
Understanding Configuration Replacement and Rollback
To use the configuration replacement and rollback feature, you should understand these concepts:
Archiving a Configuration
The configuration archive provides a mechanism to store, organize, and manage an archive of configuration files. The configure replace privileged EXEC command increases the configuration rollback capability. As an alternative, you can save copies of the running configuration by using the copy running-config destination-url privileged EXEC command, storing the replacement file either locally or remotely. However, this method lacks any automated file management. The configuration replacement and rollback feature can automatically save copies of the running configuration to the configuration archive.
You use the archive config privileged EXEC command to save configurations in the configuration archive by using a standard location and filename prefix that is automatically appended with an incremental version number (and optional timestamp) as each consecutive file is saved. You can specify how many versions of the running configuration are kept in the archive. After the maximum number of files are saved, the oldest file is automatically deleted when the next, most recent file is saved. The show archive privileged EXEC command displays information for all the configuration files saved in the configuration archive.
The Cisco IOS configuration archive, in which the configuration files are stored and available for use with the configure replace command, is in any of these file systems: FTP, HTTP, RCP, TFTP.
Replacing a Configuration
The configure replace privileged EXEC command replaces the running configuration with any saved configuration file. When you enter the configure replace command, the running configuration is compared with the specified replacement configuration, and a set of configuration differences is generated. The resulting differences are used to replace the configuration. The configuration replacement operation is usually completed in no more than three passes. To prevent looping behavior no more than five passes are performed.
You can use the copy source-url running-config privileged EXEC command to copy a stored configuration file to the running configuration. When using this command as an alternative to the configure replace target-url privileged EXEC command, note these major differences:
•
•
Rolling Back a Configuration
You can also use the configure replace command to roll back changes that were made since the previous configuration was saved. Instead of basing the rollback operation on a specific set of changes that were applied, the configuration rollback capability reverts to a specific configuration based on a saved configuration file.
If you want the configuration rollback capability, you must first save the running configuration before making any configuration changes. Then, after entering configuration changes, you can use that saved configuration file to roll back the changes by using the configure replace target-url command.
You can specify any saved configuration file as the rollback configuration. You are not limited to a fixed number of rollbacks, as is the case in some rollback models.
Configuration Guidelines
Follow these guidelines when configuring and performing configuration replacement and rollback:
•
•
•
–
–
•
Note
Configuring the Configuration Archive
Using the configure replace command with the configuration archive and with the archive config command is optional but offers significant benefit for configuration rollback scenarios. Before using the archive config command, you must first configure the configuration archive. Starting in privileged EXEC mode, follow these steps to configure the configuration archive:
Performing a Configuration Replacement or Rollback Operation
Starting in privileged EXEC mode, follow these steps to replace the running configuration file with a saved configuration file:
LLDP-Med Location TLV
This release supports the Link Layer Discovery Protocol Media Extensions (LLDP-MED) location TLV. The location TLV provides location information from the switch to the endpoint device. It can send this information:
•
Provides the civic address information and postal information. Examples of civic location information are street address, road name, and postal community name information.
•
Provides the location information of a caller. The location is determined by the Emergency location identifier number (ELIN), which is a phone number that routes an emergency call to the local public safety answering point (PSAP) and which the PSAP can use to call back the emergency caller.
Configuring Private VLANs
This section describes how to configure private VLANs on the Cisco Catalyst Blade Switch 3020 for HP.
Note
The chapter consists of these sections:
Note
Understanding Private VLANs
The private-VLAN feature addresses two problems that service providers face when using VLANs:
•
•
Using private VLANs addresses the scalability problem and provides IP address management benefits for service providers and Layer 2 security for customers.
Private VLANs partition a regular VLAN domain into subdomains and can have multiple VLAN pairs—one for each subdomain. A subdomain is represented by a primary VLAN and a secondary VLAN.
All VLAN pairs in a private VLAN share the same primary VLAN. The secondary VLAN ID differentiates one subdomain from another. See Figure 1.
Figure 1 Private-VLAN Domain
There are two types of secondary VLANs:
•
•
Private VLANs provide Layer 2 isolation between ports within the same private VLAN. Private-VLAN ports are access ports that are one of these types:
•
•
•
Note
Primary and secondary VLANs have these characteristics:
•
•
•
A promiscuous port can serve only one primary VLAN, one isolated VLAN, and multiple community VLANs. Layer 3 gateways are typically connected to the switch through a promiscuous port. With a promiscuous port, you can connect a wide range of devices as access points to a private VLAN. For example, you can use a promiscuous port to monitor or back up all the private-VLAN servers from an administration workstation.
In a switched environment, you can assign an individual private VLAN and an associated IP subnet to each individual or common group of end stations. The end stations need to communicate with only a default gateway to communicate outside the private VLAN.
You can use private VLANs to control access to end stations in these ways:
•
•
You can extend private VLANs across multiple devices by trunking the primary, isolated, and community VLANs to other devices that support private VLANs. To maintain the security of your private-VLAN configuration and to avoid other use of the VLANs configured as private VLANs, configure private VLANs on all intermediate devices, including devices that have no private-VLAN ports.
IP Addressing Scheme with Private VLANs
Assigning a separate VLAN to each customer creates an inefficient IP addressing scheme:
•
•
These problems are reduced by using private VLANs, where all members in the private VLAN share a common address space, which is allocated to the primary VLAN. Hosts are connected to secondary VLANs, and the DHCP server assigns them IP addresses from the block of addresses allocated to the primary VLAN. Subsequent IP addresses can be assigned to customer devices in different secondary VLANs, but in the same primary VLAN. When new devices are added, the DHCP server assigns them the next available address from a large pool of subnet addresses.
Private VLANs across Multiple Switches
As with regular VLANs, private VLANs can span multiple switches. A trunk port carries the primary VLAN and secondary VLANs to a neighboring switch. The trunk port treats the private VLAN as any other VLAN. A feature of private VLANs across multiple switches is that traffic from an isolated port in switch A does not reach an isolated port on Switch B. See Figure 2.
Figure 2 Private VLANs across Switches
Because VTP does not support private VLANs, you must manually configure private VLANs on all switches in the Layer 2 network. If you do not configure the primary and secondary VLAN association in some switches in the network, the Layer 2 databases in these switches are not merged. This can result in unnecessary flooding of private-VLAN traffic on those switches.
Note
Private-VLAN Interaction with Other Features
Private VLANs have specific interaction with some other features, described in these sections:
•
You should also see the "Secondary and Primary VLAN Configuration" section under the "Private-VLAN Configuration Guidelines" section.
Private VLANs and Unicast, Broadcast, and Multicast Traffic
In regular VLANs, devices in the same VLAN can communicate with each other at the Layer 2 level, but devices connected to interfaces in different VLANs must communicate at the Layer 3 level. In private VLANs, the promiscuous ports are members of the primary VLAN, while the host ports belong to secondary VLANs. Because the secondary VLAN is associated to the primary VLAN, members of the these VLANs can communicate with each other at the Layer 2 level.
In a regular VLAN, broadcasts are forwarded to all ports in that VLAN. Private VLAN broadcast forwarding depends on the port sending the broadcast:
•
•
•
Multicast traffic is routed or bridged across private-VLAN boundaries and within a single community VLAN. Multicast traffic is not forwarded between ports in the same isolated VLAN or between ports in different secondary VLANs.
Private VLANs and SVIs
In a Layer 3 switch, a switch virtual interface (SVI) represents the Layer 3 interface of a VLAN. Layer 3 devices communicate with a private VLAN only through the primary VLAN and not through secondary VLANs. Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the VLAN is configured as a secondary VLAN.
•
•
When the primary VLAN is associated with and mapped to the secondary VLAN, any configuration on the primary VLAN is propagated to the secondary VLAN SVIs. For example, if you assign an IP subnet to the primary VLAN SVI, this subnet is the IP subnet address of the entire private VLAN.
Configuring Private VLANs
These sections contain this configuration information:
•
•
•
•
•
•
•
Tasks for Configuring Private VLANs
To configure a private VLAN, perform these steps:
Step 1
Step 2
Note
Step 3
Step 4
Step 5
Step 6
Default Private-VLAN Configuration
No private VLANs are configured.
Private-VLAN Configuration Guidelines
Guidelines for configuring private VLANs fall into these categories:
•
•
•
Secondary and Primary VLAN Configuration
Follow these guidelines when configuring private VLANs:
•
•
•
•
•
•
•
•
•
•
•
•
Note
Connecting a device with a different MAC address but with the same IP address generates a message and the ARP entry is not created. Because the private-VLAN port sticky ARP entries do not age out, you must manually remove private-VLAN port ARP entries if a MAC address changes.
–
–
•
•
–
–
To filter out specific IP traffic for a private VLAN, you should apply the VLAN map to both the primary and secondary VLANs.
•
•
•
–
–
Private-VLAN Port Configuration
Follow these guidelines when configuring private-VLAN ports:
•
•
•
•
•
Limitations with Other Features
When configuring private VLANs, remember these limitations with other features:
Note
•
•
•
For more information about SPAN, see the software configuration guide.
•
–
–
–
–
–
–
–
•
•
•
Note
•
Configuring and Associating VLANs in a Private VLAN
Beginning in privileged EXEC mode, follow these steps to configure a private VLAN:
Note
When you associate secondary VLANs with a primary VLAN, note this syntax information:
•
•
•
•
•
This example shows how to configure VLAN 20 as a primary VLAN, VLAN 501 as an isolated VLAN, and VLANs 502 and 503 as community VLANs, to associate them in a private VLAN, and to verify the configuration:
Switch# configure terminalSwitch(config)# vlan 20Switch(config-vlan)# private-vlan primarySwitch(config-vlan)# exitSwitch(config)# vlan 501Switch(config-vlan)# private-vlan isolatedSwitch(config-vlan)# exitSwitch(config)# vlan 502Switch(config-vlan)# private-vlan communitySwitch(config-vlan)# exitSwitch(config)# vlan 503Switch(config-vlan)# private-vlan communitySwitch(config-vlan)# exitSwitch(config)# vlan 20Switch(config-vlan)# private-vlan association 501-503Switch(config-vlan)# endSwitch(config)# show vlan private vlanPrimary Secondary Type Ports------- --------- ----------------- ------------------------------------------20 501 isolated20 502 community20 503 community20 504 non-operationalConfiguring a Layer 2 Interface as a Private-VLAN Host Port
Beginning in privileged EXEC mode, follow these steps to configure a Layer 2 interface as a private-VLAN host port and to associate it with primary and secondary VLANs:
Note
This example shows how to configure an interface as a private-VLAN host port, associate it with a private-VLAN pair, and verify the configuration:
Switch# configure terminalSwitch(config)# interface gigabitethernet1/0/22Switch(config-if)# switchport mode private-vlan hostSwitch(config-if)# switchport private-vlan host-association 20 25Switch(config-if)# endSwitch# show interfaces gigabitethernet1/0/22 switchportName: Gi1/0/22Switchport: EnabledAdministrative Mode: private-vlan hostOperational Mode: private-vlan hostAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: nativeNegotiation of Trunking: OffAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: 20 (VLAN0020) 25 (VLAN0025)Administrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: noneAdministrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: noneAdministrative private-vlan trunk private VLANs: noneOperational private-vlan:20 (VLAN0020) 25 (VLAN0025)<output truncated>Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port
Beginning in privileged EXEC mode, follow these steps to configure a Layer 2 interface as a private-VLAN promiscuous port and map it to primary and secondary VLANs:
Note
When you configure a Layer 2 interface as a private-VLAN promiscuous port, note this syntax information:
•
•
•
This example shows how to configure an interface as a private-VLAN promiscuous port and map it to a private VLAN. The interface is a member of primary VLAN 20 and secondary VLANs 501 to 503 are mapped to it.
Switch# configure terminalSwitch(config)# interface gigabitethernet1/0/2Switch(config-if)# switchport mode private-vlan promiscuousSwitch(config-if)# switchport private-vlan mapping 20 add 501-503Switch(config-if)# endUse the show vlan private-vlan or the show interface status privileged EXEC command to display primary and secondary VLANs and private-VLAN ports on the switch.
Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface
If you use the private VLAN for inter-VLAN routing, you must configure an SVI for the primary VLAN and map secondary VLANs to the SVI.
Note
Beginning in privileged EXEC mode, follow these steps to map secondary VLANs to the SVI of a primary VLAN to allow Layer 3 switching of private-VLAN traffic:
Note
When you map secondary VLANs to the Layer 3 VLAN interface of a primary VLAN, note this syntax information:
•
•
•
This example shows how to map the interfaces of VLANs 501and 502 to primary VLAN 10, which permits routing of secondary VLAN ingress traffic from private VLANs 501 to 502:
Switch# configure terminalSwitch(config)# interface vlan 10Switch(config-if)# private-vlan mapping 501-502Switch(config-if)# endSwitch# show interfaces private-vlan mappingInterface Secondary VLAN Type--------- -------------- -----------------vlan10 501 isolatedvlan10 502 communityMonitoring Private VLANs
Table 5 shows the privileged EXEC commands for monitoring private-VLAN activity.
This is an example of the output from the show vlan private-vlan command:
Switch(config)# show vlan private-vlanPrimary Secondary Type Ports------- --------- ----------------- ------------------------------------------10 501 isolated Gi2/0/1, Gi3/0/2, Gi3/0/310 502 community Gi2/0/1, Gi3/0/2, Gi3/0/410 503 non-operationalUpdates to Command Reference Guide
This section contains these updates to the command reference:
•
•
•
•
•
•
•
Information Updates
These are information updates to the command reference:
•
These are the correct usage guidelines for the set command:
Environment variables are case sensitive and must be entered as documented.
Environment variables that have values are stored in flash memory outside of the flash file system.
Under normal circumstances, it is not necessary to alter the setting of the environment variables.
The MANUAL_BOOT environment variable can also be set by using the boot manual global configuration command.
The BOOT environment variable can also be set by using the boot system filesystem:/file-url global configuration command.
The ENABLE_BREAK environment variable can also be set by using the boot enable-break global configuration command.
The HELPER environment variable can also be set by using the boot helper filesystem:/file-url global configuration command.
The CONFIG_FILE environment variable can also be set by using the boot config-file flash:/file-url global configuration command.
The HELPER_CONFIG_FILE environment variable can also be set by using the boot helper-config-file filesystem:/file-url global configuration command.
The bootloader prompt string (PS1) can be up to 120 printable characters except the equal sign (=).
These are the correct guidelines for the unset command:
Under normal circumstances, it is not necessary to alter the setting of the environment variables.
The MANUAL_BOOT environment variable can also be reset by using the no boot manual global configuration command.
The BOOT environment variable can also be reset by using the no boot system global configuration command.
The ENABLE_BREAK environment variable can also be reset by using the no boot enable-break global configuration command.
The HELPER environment variable can also be reset by using the no boot helper global configuration command.
The CONFIG_FILE environment variable can also be reset by using the no boot config-file global configuration command.
The HELPER_CONFIG_FILE environment variable can also be reset by using the no boot helper-config-file global configuration command.
•
The range for seconds is from 5 to 65535.
The correct range is from 1 to 65535 seconds.
location (global configuration)
Use the location global configuration command to configure location information for an endpoint. Use the no form of this command to remove the location information.
location {admin-tag string | civic-location identifier id | elin-location string identifier id}
no location {admin-tag string | civic-location identifier id | elin-location string identifier id}
Syntax DescriptionSyntax
Description
Defaults
This command has no default setting.
Command Modes
Global Configuration
Command History
Usage Guidelines
After entering the location civic-location identifier id global configuration command, you enter civic location configuration mode. In this mode, you can enter the civic location and the postal location information.
Use the no lldp med-tlv-select location information interface configuration command to disable the location TLV. The location TLV is enabled by default. For more information, see the "Configuring LLDP and LLDP-MED" chapter of the software configuration guide for this release.
Examples
This example shows how to configure civic location information on the switch:
Switch(config)# location civic-location identifier 1 Switch(config-civic)# number 3550 Switch(config-civic)# primary-road-name "Cisco Way" Switch(config-civic)# city "San Jose" Switch(config-civic)# state CA Switch(config-civic)# building 19 Switch(config-civic)# room C6 Switch(config-civic)# county "Santa Clara" Switch(config-civic)# country US Switch(config-civic)# endYou can verify your settings by entering the show location civic-location privileged EXEC command.
This example shows how to configure the emergency location information on the switch:
Switch (config)# location elin-location 14085553881 identifier 1You can verify your settings by entering the show location elin privileged EXEC command.
Related Commands
location (interface configuration)
Configures the location information for an interface.
show location
Displays the location information for an endpoint.
location (interface configuration)
Use the location interface command to enter location information for an interface. Use the no form of this command to remove the interface location information.
location {additional-location-information word | civic-location-id id | elin-location-id id}
no location {additional-location-information word | civic-location-id id | elin-location-id id}
Syntax Description
Defaults
This command has no default setting.
Command Modes
Interface configuration
Command History
Usage Guidelines
After entering the location civic-location-id id interface configuration command, you enter civic location configuration mode. In this mode, you can enter the additional location information.
Examples
These examples show how to enter civic location information for an interface:
Switch(config-if)# int g1/0/1 Switch(config-if)# location civic-location-id 1 Switch(config-if)# endSwitch(config-if)# int g2/0/1 Switch(config-if)# location civic-location-id 1 Switch(config-if)# endYou can verify your settings by entering the show location civic interface privileged EXEC command.
This example shows how to enter emergency location information for an interface:
Switch(config)# int g2/0/2 Switch(config-if)# location elin-location-id 1 Switch(config-if)# endYou can verify your settings by entering the show location elin interface privileged EXEC command.
Related Commands
link state group
Configures the location information for an endpoint.
Displays the location information for an endpoint.
private-vlan
Use the private-vlan VLAN configuration command to configure private VLANs and to configure the association between private-VLAN primary and secondary VLANs. Use the no form of this command to return the VLAN to normal VLAN configuration.
private-vlan {association [add | remove] secondary-vlan-list | community | isolated | primary}
no private-vlan {association | community | isolated | primary}
Syntax Description
Defaults
The default is to have no private VLANs configured.
Command Modes
VLAN configuration
Command History
Usage Guidelines
Before configuring private VLANs, you must disable VTP (VTP mode transparent). After you configure a private VLAN, you should not change the VTP mode to client or server.
VTP does not propagate private-VLAN configuration. You must manually configure private VLANs on all switches in the Layer 2 network to merge their Layer 2 databases and to prevent flooding of private-VLAN traffic.
You cannot include VLAN 1 or VLANs 1002 to 1005 in the private-VLAN configuration. Extended VLANs (VLAN IDs 1006 to 4094) can be configured in private VLANs.
You can associate a secondary (isolated or community) VLAN with only one primary VLAN. A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it.
•
•
•
A community VLAN carries traffic among community ports and from community ports to the promiscuous ports on the corresponding primary VLAN.
An isolated VLAN is used by isolated ports to communicate with promiscuous ports. It does not carry traffic to other community ports or isolated ports with the same primary vlan domain.
A primary VLAN is the VLAN that carries traffic from a gateway to customer end stations on private ports.
Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the VLAN is configured as a secondary VLAN.
The private-vlan commands do not take effect until you exit from VLAN configuration mode.
Do not configure private-VLAN ports as EtherChannels. While a port is part of the private-VLAN configuration, any EtherChannel configuration for it is inactive.
Do not configure a private VLAN as a Remote Switched Port Analyzer (RSPAN) VLAN.
Do not configure a private VLAN as a voice VLAN.
Do not configure fallback bridging on switches with private VLANs.
Although a private VLAN contains more than one VLAN, only one STP instance runs for the entire private VLAN. When a secondary VLAN is associated with the primary VLAN, the STP parameters of the primary VLAN are propagated to the secondary VLAN.
For information about configuring host ports and promiscuous ports, see the switchport mode private-vlan command.
For more information about private-VLAN interaction with other features, see the software configuration guide for this release.
Examples
This example shows how to configure VLAN 20 as a primary VLAN, VLAN 501 as an isolated VLAN, and VLANs 502 and 503 as community VLANs, and to associate them in a private VLAN:
Switch# configure terminalSwitch(config)# vlan 20Switch(config-vlan)# private-vlan primarySwitch(config-vlan)# exitSwitch(config)# vlan 501Switch(config-vlan)# private-vlan isolatedSwitch(config-vlan)# exitSwitch(config)# vlan 502Switch(config-vlan)# private-vlan communitySwitch(config-vlan)# exitSwitch(config)# vlan 503Switch(config-vlan)# private-vlan communitySwitch(config-vlan)# exitSwitch(config)# vlan 20Switch(config-vlan)# private-vlan association 501-503Switch(config-vlan)# endYou can verify your setting by entering the show vlan private-vlan or show interfaces status privileged EXEC command.
Related Commands
private-vlan mapping
Use the private-vlan mapping interface configuration command on a switch virtual interface (SVI) to create a mapping between a private-VLAN primary and secondary VLANs so that both VLANs share the same primary VLAN SVI. Use the no form of this command to remove private-VLAN mappings from the SVI.
private-vlan mapping {[add | remove] secondary-vlan-list}
no private-vlan mapping
Syntax Description
Defaults
The default is to have no private VLAN SVI mapping configured.
Command Modes
Interface configuration
Command History
Usage Guidelines
The switch must be in VTP transparent mode when you configure private VLANs.
The SVI of the primary VLAN is created at Layer 3.
Configure Layer 3 VLAN interfaces (SVIs) only for primary VLANs. You cannot configure Layer 3 VLAN interfaces for secondary VLANs. SVIs for secondary VLANs are inactive while the VLAN is configured as a secondary VLAN.
The secondary_vlan_list parameter cannot contain spaces. It can contain multiple comma-separated items. Each item can be a single private-VLAN ID or a hyphenated range of private-VLAN IDs. The list can contain one isolated VLAN and multiple community VLANs.
Traffic that is received on the secondary VLAN is routed by the SVI of the primary VLAN.
A secondary VLAN can be mapped to only one primary SVI. IF you configure the primary VLAN as a secondary VLAN, all SVIs specified in this command are brought down.
If you configure a mapping between two VLANs that do not have a valid Layer 2 private-VLAN association, the mapping configuration does not take effect.
Examples
This example shows how to map the interface of VLAN 20 to the SVI of VLAN 18:
Switch# configure terminalSwitch# interface vlan 18Switch(config-if)# private-vlan mapping 20Switch(config-vlan)# endThis example shows how to permit routing of secondary VLAN traffic from secondary VLANs 303 to 305 and 307 through VLAN 20 SVI:
Switch# configure terminalSwitch# interface vlan 20Switch(config-if)# private-vlan mapping 303-305, 307Switch(config-vlan)# endYou can verify your setting by entering the show interfaces private-vlan mapping privileged EXEC command.
Related Commands
show interfaces private-vlan mapping
Display private-VLAN mapping information for the VLAN SVIs.
show location
Use the show location user EXEC command to display location information for an endpoint.
show location admin-tag | [ | {begin | exclude | include} expression]
show location civic-location {identifier id number | interface interface-id | static } | {begin | exclude | include} expression]
show location elin-location {identifier id number | interface interface-id | static } | {begin | exclude | include} expression]
Syntax Description
Command Modes
User EXEC
Command History
Usage Guidelines
Use the show location command to display location information for an endpoint.
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.
Examples
This is an example of output from the show location civic-location command that displays location information for an interface:
Switch> show location civic interface g2/0/1Civic location information--------------------------Identifier : 1County : Santa ClaraStreet number : 3550Building : 19Room : C6Primary road name : Cisco WayCity : San JoseState : CACountry : USThis is an example of output from the show location civic-location command that displays all the civic location information:
Switch> show location civic-location staticCivic location information--------------------------Identifier : 1County : Santa ClaraStreet number : 3550Building : 19Room : C6Primary road name : Cisco WayCity : San JoseState : CACountry : USPorts : Gi2/0/1--------------------------Identifier : 2Street number : 24568Street number suffix : WestLandmark : Golden Gate BridgePrimary road name : 19th AveCity : San FranciscoCountry : US--------------------------This is an example of output from the show location elin-location command that displays the emergency location information:Switch> show location elin-location identifier 1Elin location information--------------------------Identifier : 1Elin : 14085553881Ports : Gi2/0/2This is an example of output from the show location elin static command that displays all emergency location information:Switch> show location elin staticElin location information--------------------------Identifier : 1Elin : 14085553881Ports : Gi2/0/2--------------------------Identifier : 2Elin : 18002228999--------------------------Related Commands
Configures the global location information for an endpoint.
Configures the location information for an interface.
set and unset Bootloader Commands
The usage guidelines for the set and unset bootloader commands in the command reference are incorrect.
These are the correct usage guidelines for the set command:
Environment variables are case sensitive and must be entered as documented.
Environment variables that have values are stored in flash memory outside of the flash file system.
Under normal circumstances, it is not necessary to alter the setting of the environment variables.
The MANUAL_BOOT environment variable can also be set by using the boot manual global configuration command.
The BOOT environment variable can also be set by using the boot system filesystem:/file-url global configuration command.
The ENABLE_BREAK environment variable can also be set by using the boot enable-break global configuration command.
The HELPER environment variable can also be set by using the boot helper filesystem:/file-url global configuration command.
The CONFIG_FILE environment variable can also be set by using the boot config-file flash:/file-url global configuration command.
The HELPER_CONFIG_FILE environment variable can also be set by using the boot helper-config-file filesystem:/file-url global configuration command.
The bootloader prompt string (PS1) can be up to 120 printable characters except the equal sign (=).
These are the correct guidelines for the unset command:
Under normal circumstances, it is not necessary to alter the setting of the environment variables.
The MANUAL_BOOT environment variable can also be reset by using the no boot manual global configuration command.
The BOOT environment variable can also be reset by using the no boot system global configuration command.
The ENABLE_BREAK environment variable can also be reset by using the no boot enable-break global configuration command.
The HELPER environment variable can also be reset by using the no boot helper global configuration command.
The CONFIG_FILE environment variable can also be reset by using the no boot config-file global configuration command.
The HELPER_CONFIG_FILE environment variable can also be reset by using the no boot helper-config-file global configuration command.
switchport mode private-vlan
Use the switchport mode private-vlan interface configuration command to configure a port as a promiscuous or host private VLAN port. Use the no form of this command to reset the mode to the appropriate default for the device.
switchport mode private-vlan {host | promiscuous}
no switchport mode private-vlan
Syntax Description
Defaults
The default private-VLAN mode is neither host nor promiscuous.
The default switchport mode is dynamic auto.
Command Modes
Interface configuration
Command History
Usage Guidelines
A private-VLAN host or promiscuous port cannot be a Switched Port Analyzer (SPAN) destination port. If you configure a SPAN destination port as a private-VLAN host or promiscuous port, the port becomes inactive.
Do not configure private VLAN on ports with these other features:
•
•
•
•
•
•
A private-VLAN port cannot be a SPAN destination port.
While a port is part of the private-VLAN configuration, any EtherChannel configuration for it is inactive.
A private-VLAN port cannot be a secure port and should not be configured as a protected port.
For more information about private-VLAN interaction with other features, see the software configuration guide for this release.
We strongly recommend that you enable spanning tree Port Fast and bridge-protocol-data-unit (BPDU) guard on isolated and community host ports to prevent STP loops due to misconfigurations and to speed up STP convergence.
If you configure a port as a private-VLAN host port and you do not configure a valid private-VLAN association by using the switchport private-vlan host-association interface configuration command, the interface becomes inactive.
If you configure a port as a private-VLAN promiscuous port and you do not configure a valid private VLAN mapping by using the switchport private-vlan mapping interface configuration command, the interface becomes inactive.
Examples
This example shows how to configure an interface as a private-VLAN host port and associate it to primary VLAN 20. The interface is a member of secondary isolated VLAN 501 and primary VLAN 20.
Note
Switch# configure terminalSwitch(config)# interface fastethernet 1/0/1Switch(config-if)# switchport mode private-vlan hostSwitch(config-if)# switchport private-vlan host-association 20 501Switch(config-if)# endThis example shows how to configure an interface as a private VLAN promiscuous port and map it to a private VLAN. The interface is a member of primary VLAN 20 and secondary VLANs 501 to 503 are mapped to it.
Switch# configure terminalSwitch(config)# interface fastethernet 1/0/2Switch(config-if)# switchport mode private-vlan promiscuousSwitch(config-if)# switchport private-vlan mapping 20 501-503Switch(config-if)# endYou can verify private VLAN switchport mode by using the show interfaces interface-id switchport privileged EXEC command.
Related Commands
switchport private-vlan
Use the switchport private-vlan interface configuration command on the switch stack or on a standalone switch to define a private-VLAN association for an isolated or community port or a mapping for a promiscuous port. Use the no form of this command to remove the private-VLAN association or mapping from the port.
switchport private-vlan {association {host primary-vlan-id secondary-vlan-id | mapping primary-vlan-id {add | remove} secondary-vlan-list} | host-association primary-vlan-id secondary-vlan-id | mapping primary-vlan-id {add | remove} secondary-vlan-list}
no switchport private-vlan {association {host | mapping} | host-association | mapping
Syntax Description
Defaults
The default is to have no private-VLAN association or mapping configured.
Command Modes
Interface configuration
Command History
Usage Guidelines
Private-VLAN association or mapping has no effect on the port unless the port has been configured as a private-VLAN host or promiscuous port by using the switchport mode private-vlan {host | promiscuous} interface configuration command.
If the port is in private-VLAN host or promiscuous mode but the VLANs do not exist, the command is allowed, but the port is made inactive.
The secondary_vlan_list parameter cannot contain spaces. It can contain multiple comma-separated items. Each item can be a single private-VLAN ID or a hyphenated range of private-VLAN IDs. The list can contain one isolated VLAN and multiple community VLANs.
You can map a promiscuous port to only one primary VLAN. If you enter the switchport private-vlan mapping command on a promiscuous port that is already mapped to a primary and secondary VLAN, the primary VLAN mapping is overwritten.
You can add or remove secondary VLANs from promiscuous port private-VLAN mappings by using the add and remove keywords.
Entering the switchport private-vlan association host command has the same effect as entering the switchport private-vlan host-association interface configuration command.
Entering the switchport private-vlan association mapping command has the same effect as entering the switchport private-vlan mapping interface configuration command.
Examples
This example shows how to configure an interface as a private VLAN host port and associate it with primary VLAN 20 and secondary VLAN 501:
Switch# configure terminalSwitch(config)# interface fastethernet 0/1Switch(config-if)# switchport mode private-vlan hostSwitch(config-if)# switchport private-vlan host-association 20 501Switch(config-if)# endThis example shows how to configure an interface as a private-VLAN promiscuous port and map it to a primary VLAN and secondary VLANs:
Switch# configure terminalSwitch(config)# interface fastethernet 0/2Switch(config-if)# switchport mode private-vlan promiscuousSwitch(config-if)# switchport private-vlan mapping 20 501-502Switch(config-if)# endYou can verify private-VLAN mapping by using the show interfaces private-vlan mapping privileged EXEC command. You can verify private VLANs and interfaces configured on the switch by using the show vlan private-vlan privileged EXEC command.
Related Commands
Updates to Getting Started Guide
This illustration in the Cisco Catalyst Blade Switch 3020 for HP Getting Started Guide has been updated:
Figure 3 The Catalyst Blade Switch 3020 for HP
Switch module
Health LED
Release latch
SFP module port LEDs for ports 17 to 20
System status LEDs
SFP module ports 17 to 20
Mode button
Gigabit Ethernet ports LEDs for ports 17x to 24x
Console port
Gigabit Ethernet ports 17x to 24x
UID1 LED
1 UID: unit identifier.
Updates to System Messages Guides
These system messages were added to this release:
Error Message DOT1X_SWITCH-5-ERR_ADDING_ADDRESS: Unable to add address [enet] on [chars]Explanation The client MAC address could not be added to the MAC address table because the hardware memory is full or the address is a secure address on another port. [enet] is the supplicant MAC address, and [chars] is the interface. This message might appear if the IEEE 802.1x feature is enabled.
Recommended Action If the hardware memory is full, remove some of the dynamic MAC addresses. If the client address is on another port, manually remove it from that port.
Error Message SPANTREE-6-PORTADD_ALL_VLANS: [chars] added to all VlansExplanation The interface has been added to all VLANs. [chars] is the added interface.
Recommended Action No action is required.
Error Message SPANTREE-6-PORTDEL_ALL_VLANS: [chars] deleted from all VlansExplanation The interface has been deleted from all VLANs. [chars] is the deleted interface.
Recommended Action No action is required.
Error Message SW_VLAN-6-VTP_DOMAIN_NAME_CHG: VTP domain name changed to [chars].Explanation The VLAN Trunking Protocol (VTP) domain name was changed through the configuration to the name specified in the message. [chars] is the changed domain name.
Recommended Action No action is required.
Error Message PLATFORM_UCAST-6-PREFIX: One or more, more specific prefixes could not be programmed into TCAM and are being covered by a less specific prefixExplanation A more specific prefix could not be programmed into Ternary Content Addressable Memory (TCAM) and is covered by a less specific prefix. This could be a temporary condition. The output of the show platform ip unicast failed route privileged EXEC command lists the failed prefixes.
Recommended Action No action is required.
Changed System Messages
This system message has changed (both explanation and action).
Error Message EC-5-CANNOT_BUNDLE1: Port-channel [chars] is down, port [chars] will remain stand-alone.Explanation The aggregation port is down. The port remains standalone until the aggregation port is up. The first [chars] is the EtherChannel. The second [chars] is the port number.
Recommended Action Ensure that the other ports in the bundle have the same configuration.
Related Documentation
These documents provide complete information about the Cisco Catalyst Blade Switch 3020 for HP and are available at Cisco.com:
•
These documents provide complete information about the Cisco Catalyst Blade Switch 3020 for HP:
•
•
•
•
•
Obtaining Documentation, Obtaining Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Copyright © 2007-2008 Cisco Systems, Inc. All rights reserved.
