Table Of Contents

A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X -

Index

ACLs (continued)

ACLs (continued)

CLI (continued)

configuration files (continued)

default configuration (continued)

DHCP snooping binding database (continued)

dynamic ARP inspection (continued)

embedded event manager (continued)

EtherChannel (continued)

files (continued)

HSRP (continued)

IGMP (continued)

IGMP snooping (continued)

interfaces (continued)

IP SLAs (continued)

IP unicast routing (continued)

IPv6 (continued)

Kerberos (continued)

MAC addresses (continued)

port-based authentication (continued)

port-based authentication (continued)

private VLANs (continued)

QoS (continued)

QoS (continued)

QoS (continued)

QoS (continued)

RADIUS (continued)

RSTP (continued)

SNMP (continued)

STP (continued)

STP (continued)

TACACS+ (continued)

UDLD (continued)

uploading (continued)

VLANs (continued)

VMPS (continued)

VTP (continued)

A

AAA down policy, NAC Layer 2 IP validation 1-9

abbreviating commands 2-3

ABRs 37-23

access-class command 34-19

access control entries

See ACEs

access control entry (ACE) 40-2

access-denied response, VMPS 12-26

access groups

applying IPv4 ACLs to interfaces 34-20

Layer 2 34-20

Layer 3 34-20

access lists

See ACLs

access ports

and Layer 2 protocol tunneling 16-11

defined 10-3

access template 6-1

accounting

with 802.1x 8-48

with IEEE 802.1x 8-14

with RADIUS 7-33

with TACACS+ 7-11, 7-17

ACEs

and QoS 35-7

defined 34-2

Ethernet 34-2

IP 34-2

ACLs

ACEs 34-2

any keyword 34-12

applying

on routed packets 34-39

on switched packets 34-38

time ranges to 34-16

to an interface 34-19, 40-6

to IPv6 interfaces 40-6

to QoS 35-7

classifying traffic for QoS 35-47

comments in 34-18

compiling 34-22

defined 34-2, 34-7

examples of 34-22, 35-47

extended IP, configuring for QoS classification 35-48

extended IPv4

creating 34-10

matching criteria 34-7

hardware and software handling 34-21

host keyword 34-12

IP

creating 34-7

fragments and QoS guidelines 35-36

implicit deny 34-9, 34-13, 34-15

implicit masks 34-9

matching criteria 34-7

undefined 34-20

IPv4

applying to interfaces 34-19

creating 34-7

matching criteria 34-7

named 34-14

numbers 34-8

terminal lines, setting on 34-18

unsupported features 34-6

IPv6

applying to interfaces 40-6

configuring 40-3, 40-4

displaying 40-7

interactions with other features 40-3

limitations 40-2

matching criteria 40-2

named 40-2

supported 40-2

unsupported features 40-2

Layer 4 information in 34-38

logging messages 34-8

MAC extended 34-27, 35-49

matching 34-7, 34-20, 40-2

monitoring 34-39, 40-7

named, IPv4 34-14

named, IPv6 40-2

names 40-3

number per QoS class map 35-36

port 34-2, 40-1

precedence of 34-3

QoS 35-7, 35-47

resequencing entries 34-14

router 34-2, 40-1

router ACLs and VLAN map configuration guidelines 34-37

standard IP, configuring for QoS classification 35-47

standard IPv4

creating 34-9

matching criteria 34-7

support for 1-7

support in hardware 34-21

time ranges 34-16

types supported 34-2

unsupported features, IPv4 34-6

unsupported features, IPv6 40-2

using router ACLs with VLAN maps 34-37

VLAN maps

configuration guidelines 34-30

configuring 34-29

active links 20-2

active router 41-1

active traffic monitoring, IP SLAs 42-1

address aliasing 23-2

addresses

displaying the MAC address table 5-30

dynamic

accelerated aging 17-8

changing the aging time 5-21

default aging 17-8

defined 5-19

learning 5-20

removing 5-22

IPv6 38-2

MAC, discovering 5-30

static

adding and removing 5-26

defined 5-19

address resolution 5-30, 37-7

Address Resolution Protocol

See ARP

adjacency tables, with CEF 37-37

administrative distances

defined 37-44

OSPF 37-28

routing protocol defaults 37-39

advertisements

CDP 25-1

LLDP 26-1, 26-2

RIP 37-17

VTP 12-18, 13-3, 13-4

aggregatable global unicast addresses 38-3

aggregated ports

See EtherChannel

aggregate policers 35-63

aggregate policing 1-10

aging, accelerating 17-8

aging time

accelerated

for MSTP 18-23

for STP 17-8, 17-21

MAC address table 5-21

maximum

for MSTP 18-23, 18-24

for STP 17-21, 17-22

alarms, RMON 29-3

allowed-VLAN list 12-20

area border routers

See ABRs

ARP

configuring 37-8

defined 1-4, 5-30, 37-7

encapsulation 37-9

static cache configuration 37-8

table

address resolution 5-30

managing 5-30

ASBRs 37-23

asymmetrical links, and IEEE 802.1Q tunneling 16-4

attributes, RADIUS

vendor-proprietary 7-36

vendor-specific 7-34

attribute-value pairs 8-19

audience xxxvii

authentication

HSRP 41-10

local mode with AAA 7-42

NTP associations 5-4

open1x 8-28

RADIUS

key 7-26

login 7-28

TACACS+

defined 7-11

key 7-13

login 7-14

See also port-based authentication

authentication compatibility with Catalyst 6000 switches 8-9

authentication failed VLAN

See restricted VLAN

authentication keys, and routing protocols 37-45

authentication manager

CLI commands 8-9

overview 8-8

single session ID 8-31

authoritative time source, described 5-2

authorization

with RADIUS 7-32

with TACACS+ 7-11, 7-16

authorized ports with IEEE 802.1x 8-11

autoconfiguration 3-3

auto enablement 8-30

automatic QoS

See QoS

auto-MDIX

configuring 10-16

described 10-15

autonegotiation

duplex mode 1-2

interface configuration guidelines 10-13

mismatches 43-8

autonomous system boundary routers

See ASBRs

autosensing, port speed 1-2

autostate exclude 10-5

auxiliary VLAN

See voice VLAN

availability, features 1-5

B

BackboneFast

described 19-5

disabling 19-14

enabling 19-13

support for 1-5

backup interfaces

See Flex Links

backup links 20-2

banners

configuring

login 5-19

message-of-the-day login 5-18

default configuration 5-17

when displayed 5-17

Berkeley r-tools replacement 7-54

binding database

address, DHCP server

See DHCP, Cisco IOS server database

DHCP snooping

See DHCP snooping binding database

bindings

address, Cisco IOS DHCP server 21-6

DHCP snooping database 21-6

IP source guard 21-15

binding table, DHCP snooping

See DHCP snooping binding database

blocking packets 24-7

Boolean expressions in tracked lists 41-14

booting

boot loader, function of 3-2

boot process 3-1

manually 3-18

specific image 3-19

boot loader

described 3-2

environment variables 3-21

trap-door mechanism 3-2

BPDU

error-disabled state 19-2

filtering 19-3

RSTP format 18-12

BPDU filtering

described 19-3

disabling 19-12

enabling 19-12

support for 1-6

BPDU guard

described 19-2

disabling 19-12

enabling 19-11

support for 1-6

break key detection 3-20, 43-2, 43-4

bridge protocol data unit

See BPDU

broadcast flooding 37-15

broadcast packets

directed 37-12

flooded 37-12

broadcast storm-control command 24-4

broadcast storms 24-1, 37-12

C

cables, monitoring for unidirectional links 27-1

Catalyst 6000 switches

authentication compatibility 8-9

CA trustpoint

configuring 7-51

defined 7-48

caution, described xxxviii

CDP

and trusted boundary 35-42

configuring 25-2

default configuration 25-2

defined with LLDP 26-1

described 25-1

disabling for routing device25-3to 25-4

enabling and disabling

on an interface 25-4

on a switch 25-3

Layer 2 protocol tunneling 16-8

monitoring 25-5

overview 25-1

support for 1-4

transmission timer and holdtime, setting 25-2

updates 25-2

CEF

defined 37-37

enabling 37-38

CGMP

as IGMP snooping learning method 23-9

joining multicast group 23-3

switch support of 1-2

CipherSuites 7-50

Cisco 7960 IP Phone 14-1

Cisco Discovery Protocol

See CDP

Cisco Express Forwarding

See CEF

Cisco Group Management Protocol

See CGMP

Cisco IOS Configuration Engine

management functions 1-3

Cisco IOS DHCP server

See DHCP, Cisco IOS DHCP server

Cisco IOS File System

See IFS

Cisco IOS IP SLAs 42-1

Cisco Secure ACS

attribute-value pairs for downloadable ACLs 8-19

attribute-value pairs for redirect URL 8-19

Cisco Secure ACS configuration guide 8-60

CISP 8-30

CIST regional root

See MSTP

CIST root

See MSTP

civic location 26-3

classless routing 37-6

class maps for QoS

configuring 35-50

described 35-7

displaying 35-83

class of service

See CoS

clearing interfaces 10-22

CLI

abbreviating commands 2-3

command modes 2-1

configuration logging 2-4

described 1-3

editing features

enabling and disabling 2-6

keystroke editing 2-7

wrapped lines 2-8

error messages 2-4

filtering command output 2-9

getting help 2-3

history

changing the buffer size 2-5

described 2-5

disabling 2-6

recalling commands 2-5

no and default forms of commands 2-4

Client Information Signalling Protocol

See CISP

client mode, VTP 13-3

client processes, tracking 41-12

clock

See system clock

clusters, switch

benefits 1-2

CNS

Configuration Engine

configID, deviceID, hostname 4-3

configuration service 4-2

described 4-1

event service 4-3

embedded agents

described 4-5

enabling automated configuration 4-6

enabling configuration agent 4-9

enabling event agent 4-8

CoA Request Commands 7-23

command-line interface

See CLI

command modes 2-1

commands

abbreviating 2-3

no and default 2-4

commands, setting privilege levels 7-8

common session ID

see single session ID 8-31

community ports 15-2

community strings

configuring 31-8

overview 31-4

community VLANs 15-2, 15-3

compatibility, feature 24-12

config.text 3-17

configurable leave timer, IGMP 23-6

configuration, initial

defaults 1-12

See also getting started guide and hardware installation guide

configuration changes, logging 30-10

configuration files

archiving B-19

clearing the startup configuration B-19

creating using a text editor B-10

default name 3-17

deleting a stored configuration B-19

described B-8

downloading

automatically 3-17

preparing B-11, B-13, B-16

reasons for B-9

using FTP B-13

using RCP B-17

using TFTP B-11

guidelines for creating and using B-9

guidelines for replacing and rolling back B-20

invalid combinations when copying B-5

limiting TFTP server access 31-16

obtaining with DHCP 3-8

password recovery disable considerations 7-5

replacing a running configuration B-19, B-20

rolling back a running configuration B-19, B-20

specifying the filename 3-18

system contact and location information 31-16

types and location B-10

uploading

preparing B-11, B-13, B-16

reasons for B-9

using FTP B-14

using RCP B-18

using TFTP B-12

configuration logger 30-10

configuration logging 2-4

configuration replacement B-19

configuration rollback B-19

configuration settings, saving 3-15

configure terminal command 10-7

configuring port-based authentication violation modes8-38to 8-39

configuring small-frame arrival rate 24-5

connections, secure remote 7-44

connectivity problems 43-10, 43-11, 43-13

consistency checks in VTP Version 2 13-4

console port, connecting to 2-9

control protocol, IP SLAs 42-4

conventions

command xxxviii

for examples xxxviii

publication xxxviii

text xxxviii

corrupted software, recovery steps with Xmodem 43-2

CoS

in Layer 2 frames 35-2

override priority 14-6

trust priority 14-6

CoS input queue threshold map for QoS 35-16

CoS output queue threshold map for QoS 35-19

CoS-to-DSCP map for QoS 35-66

counters, clearing interface 10-22

CPU utilization, troubleshooting 43-21

crashinfo file 43-18

critical authentication, IEEE 802.1x 8-52

critical VLAN 8-22

cross-stack EtherChannel

configuring

on Layer 2 interfaces 36-10

on Layer 3 physical interfaces 36-14

cryptographic software image

Kerberos 7-38

SSH 7-43

SSL 7-48

customizeable web pages, web-based authentication 9-6

D

DACL

See downloadable ACL

daylight saving time 5-13

debugging

enabling all system diagnostics 43-16

enabling for a specific feature 43-15

redirecting error message output 43-16

using commands 43-15

default commands 2-4

default configuration

802.1x 8-32

auto-QoS 35-21

banners 5-17

booting 3-17

CDP 25-2

DHCP 21-8

DHCP option 82 21-8

DHCP snooping 21-8

DHCP snooping binding database 21-8

DNS 5-16

dynamic ARP inspection 22-5

EtherChannel 36-9

Ethernet interfaces 10-11

Flex Links 20-5

HSRP 41-5

IEEE 802.1Q tunneling 16-4

IGMP filtering 23-25

IGMP snooping 23-7, 39-5, 39-6

IGMP throttling 23-25

initial switch information 3-3

IP addressing, IP routing 37-4

IP SLAs 42-5

IP source guard 21-17

IPv6 38-7

Layer 2 interfaces 10-11

Layer 2 protocol tunneling 16-11

LLDP 26-4

MAC address table 5-21

MAC address-table move update 20-5

MSTP 18-14

MVR 23-20

NTP 5-4

optional spanning-tree configuration 19-9

OSPF 37-24

password and privilege level 7-2

private VLANs 15-6

RADIUS 7-25

RIP 37-18

RMON 29-3

RSPAN 28-9

SDM template 6-3

SNMP 31-6

SPAN 28-9

SSL 7-50

standard QoS 35-34

STP 17-11

system message logging 30-3

system name and prompt 5-15

TACACS+ 7-13

UDLD 27-4

VLAN, Layer 2 Ethernet interfaces 12-18

VLANs 12-7

VMPS 12-27

voice VLAN 14-3

VTP 13-7

default gateway 3-14, 37-10

default networks 37-40

default router preference

See DRP

default routes 37-40

default routing 37-2

default web-based authentication configuration

802.1X 9-9

deleting VLANs 12-9

denial-of-service attack 24-1

description command 10-16

destination addresses

in IPv6 ACLs 40-4

destination addresses, in IPv4 ACLs 34-11

destination-IP address-based forwarding, EtherChannel 36-7

destination-MAC address forwarding, EtherChannel 36-7

detecting indirect link failures, STP 19-5

device B-23

device discovery protocol 25-1, 26-1

device manager

benefits 1-2

described 1-3

in-band management 1-5

requirements xxxviii

upgrading a switch B-23

DHCP

Cisco IOS server database

configuring 21-13

default configuration 21-8

described 21-6

enabling

relay agent 21-10

server 21-9

DHCP-based autoconfiguration

client request message exchange 3-4

configuring

client side 3-3

DNS 3-7

relay device 3-8

server side 3-6

server-side 21-9

TFTP server 3-7

example 3-9

lease options

for IP address information 3-6

for receiving the configuration file 3-6

overview 3-3

relationship to BOOTP 3-3

relay support 1-4, 1-11

support for 1-4

DHCP-based autoconfiguration and image update

configuring3-11to 3-13

understanding 3-5

DHCP binding database

See DHCP snooping binding database

DHCP binding table

See DHCP snooping binding database

DHCP option 82

circuit ID suboption 21-5

configuration guidelines 21-8

default configuration 21-8

displaying 21-15

forwarding address, specifying 21-10

helper address 21-10

overview 21-3

packet format, suboption

circuit ID 21-5

remote ID 21-5

remote ID suboption 21-5

DHCP server port-based address allocation

configuration guidelines 21-26

default configuration 21-25

described 21-25

displaying 21-28

enabling 21-26

reserved addresses 21-26

DHCP snooping

accepting untrusted packets form edge switch 21-3, 21-12

and private VLANs 21-13

binding database

See DHCP snooping binding database

configuration guidelines 21-8

default configuration 21-8

displaying binding tables 21-15

message exchange process 21-4

option 82 data insertion 21-3

trusted interface 21-2

untrusted interface 21-2

untrusted messages 21-2

DHCP snooping binding database

adding bindings 21-14

binding entries, displaying 21-15

binding file

format 21-7

location 21-6

bindings 21-6

clearing agent statistics 21-14

configuration guidelines 21-9

configuring 21-14

default configuration 21-8

deleting

binding file 21-14

bindings 21-14

database agent 21-14

described 21-6

displaying 21-15

binding entries 21-15

status and statistics 21-15

enabling 21-14

entry 21-6

renewing database 21-14

resetting

delay value 21-14

timeout value 21-14

DHCP snooping binding table

See DHCP snooping binding database

Differentiated Services architecture, QoS 35-2

Differentiated Services Code Point 35-2

directed unicast requests 1-4

directories

changing B-3

creating and removing B-4

displaying the working B-3

distance-vector protocols 37-2

distribute-list command 37-44

DNS

and DHCP-based autoconfiguration 3-7

default configuration 5-16

displaying the configuration 5-17

in IPv6 38-3

overview 5-15

setting up 5-16

support for 1-4

documentation, related xxxviii

document conventions xxxviii

domain names

DNS 5-15

VTP 13-8

Domain Name System

See DNS

dot1q-tunnel switchport mode 12-16

double-tagged packets

IEEE 802.1Q tunneling 16-2

Layer 2 protocol tunneling 16-10

downloadable ACL 8-18, 8-19, 8-60

downloading

configuration files

preparing B-11, B-13, B-16

reasons for B-9

using FTP B-13

using RCP B-17

using TFTP B-11

image files

deleting old image B-27

preparing B-25, B-28, B-32

reasons for B-23

using FTP B-29

using HTTP B-23

using RCP B-34

using TFTP B-26

using the device manager or Network Assistant B-23

drop threshold for Layer 2 protocol packets 16-11

DRP

configuring 38-8

described 38-4

IPv6 38-4

DSCP 1-10, 35-2

DSCP input queue threshold map for QoS 35-16

DSCP output queue threshold map for QoS 35-19

DSCP-to-CoS map for QoS 35-69

DSCP-to-DSCP-mutation map for QoS 35-70

DSCP transparency 35-43

DTP 1-6, 12-16

dual-action detection 36-5

dual IPv4 and IPv6 templates 6-2, 38-5

dual protocol stacks

IPv4 and IPv6 38-5

SDM templates supporting 38-5

dynamic access ports

characteristics 12-3

configuring 12-29

defined 10-3

dynamic addresses

See addresses

dynamic ARP inspection

ARP cache poisoning 22-1

ARP requests, described 22-1

ARP spoofing attack 22-1

clearing

log buffer 22-15

statistics 22-15

configuration guidelines 22-6

configuring

ACLs for non-DHCP environments 22-8

in DHCP environments 22-7

log buffer 22-13

rate limit for incoming ARP packets 22-4, 22-10

default configuration 22-5

denial-of-service attacks, preventing 22-10

described 22-1

DHCP snooping binding database 22-2

displaying

ARP ACLs 22-14

configuration and operating state 22-14

log buffer 22-15

statistics 22-15

trust state and rate limit 22-14

error-disabled state for exceeding rate limit 22-4

function of 22-2

interface trust states 22-3

log buffer

clearing 22-15

configuring 22-13

displaying 22-15

logging of dropped packets, described 22-4

man-in-the middle attack, described 22-2

network security issues and interface trust states 22-3

priority of ARP ACLs and DHCP snooping entries 22-4

rate limiting of ARP packets

configuring 22-10

described 22-4

error-disabled state 22-4

statistics

clearing 22-15

displaying 22-15

validation checks, performing 22-12

dynamic auto trunking mode 12-16

dynamic desirable trunking mode 12-16

Dynamic Host Configuration Protocol

See DHCP-based autoconfiguration

dynamic port VLAN membership

described 12-27

reconfirming 12-29, 12-30

troubleshooting 12-31

types of connections 12-29

dynamic routing 37-2

Dynamic Trunking Protocol

See DTP

E

editing features

enabling and disabling 2-6

keystrokes used 2-7

wrapped lines 2-8

EEM 3.2 33-5

EIGRP stub routing 37-35

ELIN location 26-3

embedded event manager

3.2 33-5

actions 33-4

configuring 33-1, 33-6

displaying information 33-7

environmental variables 33-5

event detectors 33-2

policies 33-4

registering and defining an applet 33-6

registering and defining a TCL script 33-7

understanding 33-1

enable password 7-3

enable secret password 7-3

encryption, CipherSuite 7-50

encryption for passwords 7-3

Enhanced IGRP

See EIGRP

enhanced object tracking

commands 41-12

defined 41-12

HSRP 41-17

IP routing state 41-13

line-protocol state 41-13

tracked lists 41-14

environmental variables, embedded event manager 33-5

environment variables, function of 3-22

equal-cost routing 1-11, 37-38

error-disabled state

BPDU 19-2

error messages during command entry 2-4

EtherChannel

automatic creation of 36-4, 36-5

channel groups

binding physical and logical interfaces 36-3

numbering of 36-3

configuration guidelines 36-9

configuring

Layer 2 interfaces 36-10

Layer 3 physical interfaces 36-14

Layer 3 port-channel logical interfaces 36-13

default configuration 36-9

described 36-2

displaying status 36-21

forwarding methods 36-7, 36-16

IEEE 802.3ad, described 36-5

interaction

with STP 36-10

with VLANs 36-10

LACP

described 36-5

displaying status 36-21

hot-standby ports 36-18

interaction with other features 36-6

modes 36-6

port priority 36-20

system priority 36-19

Layer 3 interface 37-3

load balancing 36-7, 36-16

logical interfaces, described 36-3

PAgP

aggregate-port learners 36-17

compatibility with Catalyst 1900 36-17

described 36-4

displaying status 36-21

interaction with other features 36-5

interaction with virtual switches 36-5

learn method and priority configuration 36-17

modes 36-4

support for 1-2

with dual-action detection 36-5

port-channel interfaces

described 36-3

numbering of 36-3

port groups 10-6

support for 1-2

EtherChannel guard

described 19-7

disabling 19-14

enabling 19-14

Ethernet VLANs

adding 12-8

defaults and ranges 12-8

modifying 12-8

EUI 38-3

event detectors, embedded event manager 33-2

events, RMON 29-3

examples

conventions for xxxviii

expedite queue for QoS 35-82

extended crashinfo file 43-18

extended-range VLANs

configuration guidelines 12-11

configuring 12-11

creating 12-12

creating with an internal VLAN ID 12-13

defined 12-1

extended system ID

MSTP 18-17

STP 17-4, 17-14

extended universal identifier

See EUI

Extensible Authentication Protocol over LAN 8-2

F

fa0 interface 1-5

features, incompatible 24-12

FIB 37-37

fiber-optic, detecting unidirectional links 27-1

files

basic crashinfo

description 43-19

location 43-19

copying B-4

crashinfo

description 43-18

deleting B-5

displaying the contents of B-8

extended crashinfo

description 43-19

location 43-19

tar

creating B-6

displaying the contents of B-6

extracting B-8

image file format B-24

file system

displaying file information B-3

local file system names B-1

network file system names B-4

setting the default B-3

filtering

in a VLAN 34-29

IPv6 traffic 40-3, 40-6

non-IP traffic 34-27

show and more command output 2-9

filtering show and more command output 2-9

filters, IP

See ACLs, IP

flash device, number of B-1

flexible authentication ordering

configuring 8-63

overview 8-28

Flex Links

configuration guidelines 20-5

configuring 20-6

configuring preferred VLAN 20-8

configuring VLAN load balancing 20-7

default configuration 20-5

description 20-1

link load balancing 20-2

monitoring 20-11

VLANs 20-2

flooded traffic, blocking 24-8

flow-based packet classification 1-10

flowcharts

QoS classification 35-6

QoS egress queueing and scheduling 35-17

QoS ingress queueing and scheduling 35-15

QoS policing and marking 35-10

flowcontrol

configuring 10-15

described 10-14

forward-delay time

MSTP 18-23

STP 17-21

Forwarding Information Base

See FIB

FTP

accessing MIB files A-3

configuration files

downloading B-13

overview B-12

preparing the server B-13

uploading B-14

image files

deleting old image B-31

downloading B-29

preparing the server B-28

uploading B-31

G

get-bulk-request operation 31-3

get-next-request operation 31-3, 31-4

get-request operation 31-3, 31-4

get-response operation 31-3

global configuration mode 2-2

global leave, IGMP 23-13

guest VLAN and 802.1x 8-20

guide

audience xxxvii

purpose of xxxvii

GUIs

See device manager and Network Assistant

H

hardware limitations and Layer 3 interfaces 10-18

hello time

MSTP 18-22

STP 17-20

help, for the command line 2-3

HFTM space 43-20

hierarchical policy maps 35-8

configuration guidelines 35-37

configuring 35-56

described 35-11

history

changing the buffer size 2-5

described 2-5

disabling 2-6

recalling commands 2-5

history table, level and number of syslog messages 30-10

host ports

configuring 15-11

kinds of 15-2

hosts, limit on dynamic ports 12-31

Hot Standby Router Protocol

See HSRP

HP OpenView 1-3

HQATM space 43-20

HSRP

authentication string 41-10

command-switch redundancy 1-1, 1-5

configuring 41-5

default configuration 41-5

definition 41-1

guidelines 41-5

monitoring 41-11

object tracking 41-17

overview 41-1

priority 41-7

routing redundancy 1-11

support for ICMP redirect messages 41-11

timers 41-10

tracking 41-7

HTTP(S) Over IPv6 38-6

HTTP over SSL

see HTTPS

HTTPS 7-48

configuring 7-52

self-signed certificate 7-49

HTTP secure server 7-48

Hulc Forwarding TCAM Manager

See HFTM space

Hulc QoS/ACL TCAM Manager

See HQATM space

I

ICMP

IPv6 38-3

redirect messages 37-10

support for 1-11

time-exceeded messages 43-13

traceroute and 43-13

unreachable messages 34-19

unreachable messages and IPv6 40-3

unreachables and ACLs 34-21

ICMP ping

executing 43-10

overview 43-10

ICMP Router Discovery Protocol

See IRDP

ICMPv6 38-3

IDS appliances

and ingress RSPAN 28-20

and ingress SPAN 28-13

IEEE 802.1D

See STP

IEEE 802.1p 14-1

IEEE 802.1Q

and trunk ports 10-3

configuration limitations 12-17

encapsulation 12-15

native VLAN for untagged traffic 12-22

tunneling

compatibility with other features 16-6

defaults 16-4

described 16-1

tunnel ports with other features 16-6

IEEE 802.1s

See MSTP

IEEE 802.1w

See RSTP

IEEE 802.1x

See port-based authentication

IEEE 802.3ad

See EtherChannel

IEEE 802.3x flow control 10-14

ifIndex values, SNMP 31-5

IFS 1-5

IGMP

configurable leave timer

described 23-6

enabling 23-11

flooded multicast traffic

controlling the length of time 23-12

disabling on an interface 23-14

global leave 23-13

query solicitation 23-13

recovering from flood mode 23-13

joining multicast group 23-3

join messages 23-3

leave processing, enabling 23-11, 39-9

leaving multicast group 23-5

queries 23-4

report suppression

described 23-6

disabling 23-16, 39-11

supported versions 23-3

support for 1-2

IGMP filtering

configuring 23-25

default configuration 23-25

described 23-24

monitoring 23-29

support for 1-3

IGMP groups

configuring filtering 23-28

setting the maximum number 23-27

IGMP helper 1-3

IGMP Immediate Leave

configuration guidelines 23-11

described 23-6

enabling 23-11

IGMP profile

applying 23-27

configuration mode 23-25

configuring 23-26

IGMP snooping

and address aliasing 23-2

configuring 23-7

default configuration 23-7, 39-5, 39-6

definition 23-2

enabling and disabling 23-8, 39-6

global configuration 23-8

Immediate Leave 23-6

method 23-8

monitoring 23-16, 39-11

querier

configuration guidelines 23-14

configuring 23-14

supported versions 23-3

support for 1-2

VLAN configuration 23-8

IGMP throttling

configuring 23-28

default configuration 23-25

described 23-25

displaying action 23-29

IGP 37-23

Immediate Leave, IGMP 23-6

enabling 39-9

inaccessible authentication bypass 8-22

support for multiauth ports 8-22

initial configuration

defaults 1-12

See also getting started guide and hardware installation guide

interface command 10-7

interface configuration mode 2-2

interface range macros 10-9

interfaces

auto-MDIX, configuring 10-15

configuration guidelines

duplex and speed 10-13

configuring

procedure 10-7

counters, clearing 10-22

default configuration 10-11

described 10-16

descriptive name, adding 10-16

displaying information about 10-21

flow control 10-14

management 1-3

monitoring 10-21

naming 10-16

physical, identifying 10-7

range of 10-8

restarting 10-22

shutting down 10-22

speed and duplex, configuring 10-13

status 10-21

supported 10-7

types of 10-1

interfaces range macro command 10-9

interface types 10-7

Interior Gateway Protocol

See IGP

Internet Control Message Protocol

See ICMP

Internet Protocol version 6

See IPv6

Inter-Switch Link

See ISL

inter-VLAN routing 1-11, 37-2

Intrusion Detection System

See IDS appliances

inventory management TLV 26-3, 26-7

IP ACLs

for QoS classification 35-7

implicit deny 34-9, 34-13

implicit masks 34-9

named 34-14

undefined 34-20

IP addresses

128-bit 38-2

classes of 37-5

default configuration 37-4

discovering 5-30

for IP routing 37-3

IPv6 38-2

MAC address association 37-7

monitoring 37-16

IP base image 1-1

IP broadcast address 37-14

ip cef distributed command 37-37

IP directed broadcasts 37-12

ip igmp profile command 23-25

IP information

assigned

manually 3-14

through DHCP-based autoconfiguration 3-3

default configuration 3-3

IP multicast routing and IGMP snooping 23-2

IP phones

and QoS 14-1

automatic classification and queueing 35-20

configuring 14-4

ensuring port security with QoS 35-42

trusted boundary for QoS 35-42

IP Port Security for Static Hosts

on a Layer 2 access port 21-19

on a PVLAN host port 21-23

IP precedence 35-2

IP-precedence-to-DSCP map for QoS 35-67

IP protocols

in ACLs 34-11

routing 1-11

IP routes, monitoring 37-46

IP routing

connecting interfaces with 10-7

disabling 37-17

enabling 37-17

IP Service Level Agreements

See IP SLAs

IP service levels, analyzing 42-1

IP SLAs

benefits 42-2

configuration guidelines 42-5

Control Protocol 42-4

default configuration 42-5

definition 42-1

measuring network performance 42-3

monitoring 42-6

operation 42-3

responder

described 42-4

enabling 42-6

response time 42-4

SNMP support 42-2

supported metrics 42-2

IP source guard

and 802.1x 21-18

and DHCP snooping 21-15

and EtherChannels 21-18

and port security 21-18

and private VLANs 21-18

and routed ports 21-17

and TCAM entries 21-18

and trunk interfaces 21-18

and VRF 21-18

binding configuration

automatic 21-15

manual 21-15

binding table 21-15

configuration guidelines 21-17

default configuration 21-17

described 21-15

disabling 21-19

displaying

bindings 21-25

configuration 21-25

enabling 21-18, 21-19

filtering

source IP address 21-16

source IP and MAC address 21-16

source IP address filtering 21-16

source IP and MAC address filtering 21-16

static bindings

adding 21-18, 21-19

deleting 21-19

static hosts 21-19

IP traceroute

executing 43-14

overview 43-13

IP unicast routing

address resolution 37-7

administrative distances 37-39, 37-44

ARP 37-7

assigning IP addresses to Layer 3 interfaces 37-5

authentication keys 37-45

broadcast

address 37-14

flooding 37-15

packets 37-12

storms 37-12

classless routing 37-6

configuring static routes 37-39

default

addressing configuration 37-4

gateways 37-10

networks 37-40

routes 37-40

routing 37-2

directed broadcasts 37-12

disabling 37-17

dynamic routing 37-2

enabling 37-17

EtherChannel Layer 3 interface 37-3

IGP 37-23

inter-VLAN 37-2

IP addressing

classes 37-5

configuring 37-3

IRDP 37-11

Layer 3 interfaces 37-3

MAC address and IP address 37-7

passive interfaces 37-43

protocols, distance-vector 37-2

proxy ARP 37-7

redistribution 37-41

reverse address resolution 37-7

routed ports 37-3

static routing 37-2

steps to configure 37-3

subnet mask 37-5

subnet zero 37-5

supernet 37-6

UDP 37-14

with SVIs 37-3

See also EIGRP

See also RIP

IPv4 ACLs

applying to interfaces 34-19

extended, creating 34-10

named 34-14

standard, creating 34-9

IPv6

ACLs

displaying 40-7

limitations 40-2

matching criteria 40-2

port 40-1

router 40-1

supported 40-2

addresses 38-2

address formats 38-2

applications 38-4

assigning address 38-7

autoconfiguration 38-4

default configuration 38-7

default router preference (DRP) 38-4

defined 38-1

forwarding 38-7

ICMP 38-3

monitoring 38-11

neighbor discovery 38-3

SDM templates 6-2, 39-1, 39-6, 40-1

Stateless Autoconfiguration 38-4

supported features 38-2

understanding static routes 38-5

IPv6 traffic, filtering 40-3

IRDP

configuring 37-11

definition 37-11

support for 1-11

ISL

and trunk ports 10-3

encapsulation 1-6, 12-15

trunking with IEEE 802.1 tunneling 16-5

isolated port 15-2

isolated VLANs 15-2, 15-3

J

join messages, IGMP 23-3

K

KDC

described 7-39

See also Kerberos

Kerberos

authenticating to

boundary switch 7-41

KDC 7-41

network services 7-41

configuration examples 7-38

configuring 7-42

credentials 7-39

cryptographic software image 7-38

described 7-39

KDC 7-39

operation 7-41

realm 7-40

server 7-40

support for 1-9

switch as trusted third party 7-39

terms 7-39

TGT 7-40

tickets 7-39

key distribution center

See KDC

L

l2protocol-tunnel command 16-13

LACP

Layer 2 protocol tunneling 16-9

See EtherChannel

Layer 2 frames, classification with CoS 35-2

Layer 2 interfaces, default configuration 10-11

Layer 2 protocol tunneling

configuring 16-10

configuring for EtherChannels 16-14

default configuration 16-11

defined 16-8

guidelines 16-11

Layer 2 traceroute

and ARP 43-12

and CDP 43-12

broadcast traffic 43-11

described 43-11

IP addresses and subnets 43-12

MAC addresses and VLANs 43-12

multicast traffic 43-12

multiple devices on a port 43-12

unicast traffic 43-11

usage guidelines 43-12

Layer 2 trunk failover

described 36-21

Layer 3 features 1-11

Layer 3 interfaces

assigning IP addresses to 37-5

assigning IPv6 addresses to 38-7

changing from Layer 2 mode 37-5

types of 37-3

Layer 3 packets, classification methods 35-2

LDAP 4-2

LEDs, switch

See hardware installation guide

lightweight directory access protocol

See LDAP

line configuration mode 2-2

Link Aggregation Control Protocol

See EtherChannel

Link Failure

detecting unidirectional 18-8

Link Layer Discovery Protocol

See CDP

link local unicast addresses 38-3

link redundancy

See Flex Links

links, unidirectional 27-1

link state advertisements (LSAs) 37-27

LLDP

configuring 26-4

characteristics 26-6

default configuration 26-4

enabling 26-5

monitoring and maintaining 26-10

overview 26-1

supported TLVs 26-2

switch stack considerations 26-2

transmission timer and holdtime, setting 26-6

LLDP-MED

configuring

procedures 26-4

TLVs 26-6

monitoring and maintaining 26-10

overview 26-1, 26-2

supported TLVs 26-2

LLDP Media Endpoint Discovery

See LLDP-MED

load balancing 41-4

local SPAN 28-2

location TLV 26-3, 26-7

logging messages, ACL 34-8

login authentication

with RADIUS 7-28

with TACACS+ 7-14

login banners 5-17

log messages

See system message logging

loop guard

described 19-9

enabling 19-15

support for 1-6

M

MAB aging timer 1-7

MAB inactivity timer

default setting 8-33

range 8-36

MAC/PHY configuration status TLV 26-2

MAC addresses

aging time 5-21

and VLAN association 5-20

building the address table 5-20

default configuration 5-21

disabling learning on a VLAN 5-29

discovering 5-30

displaying 5-30

displaying in the IP source binding table 21-25

dynamic

learning 5-20

removing 5-22

in ACLs 34-27

IP address association 37-7

static

adding 5-27

allowing 5-28, 5-29

characteristics of 5-26

dropping 5-28

removing 5-27

MAC address learning 1-4

MAC address learning, disabling on a VLAN 5-29

MAC address notification, support for 1-11

MAC address-table move update

configuration guidelines 20-5

configuring 20-9

default configuration 20-5

description 20-3

monitoring 20-11

MAC address-to-VLAN mapping 12-26

MAC authentication bypass 8-15

See MAB

MAC extended access lists

applying to Layer 2 interfaces 34-28

configuring for QoS 35-49

creating 34-27

defined 34-27

for QoS classification 35-5

macros

See Smartports macros

magic packet 8-26

manageability features 1-4

management access

in-band

browser session 1-5

CLI session 1-5

device manager 1-5

SNMP 1-5

out-of-band console port connection 1-5

management address TLV 26-2

management options

CLI 2-1

CNS 4-1

overview 1-3

mapping tables for QoS

configuring

CoS-to-DSCP 35-66

DSCP 35-65

DSCP-to-CoS 35-69

DSCP-to-DSCP-mutation 35-70

IP-precedence-to-DSCP 35-67

policed-DSCP 35-68

described 35-12

marking

action in policy map 35-52

action with aggregate policers 35-63

described 35-4, 35-8

matching

IPv6 ACLs 40-2

matching, IPv4 ACLs 34-7

maximum aging time

MSTP 18-23

STP 17-21

maximum hop count, MSTP 18-24

maximum number of allowed devices, port-based authentication 8-36

maximum-paths command 37-38

membership mode, VLAN port 12-3

memory consistency check errors

displaying 43-20

example 43-20

memory consistency check routines 1-3, 43-19

memory consistency integrity 1-3, 43-19

messages

to users through banners 5-17

messages, to users through banners 5-17

metric translations, between routing protocols 37-43

metro tags 16-2

MHSRP 41-4

MIBs

accessing files with FTP A-3

location of files A-3

overview 31-1

SNMP interaction with 31-4

supported A-1

mirroring traffic for analysis 28-1

mismatches, autonegotiation 43-8

module number 10-7

monitoring

access groups 34-39

cables for unidirectional links 27-1

CDP 25-5

CEF 37-38

features 1-11

Flex Links 20-11

HSRP 41-11

IEEE 802.1Q tunneling 16-18

IGMP

filters 23-29

snooping 23-16, 39-11

interfaces 10-21

IP

address tables 37-16

routes 37-46

IP SLAs operations 42-6

IPv4 ACL configuration 34-39

IPv6 38-11

IPv6 ACL configuration 40-7

Layer 2 protocol tunneling 16-18

MAC address-table move update 20-11

multicast router interfaces 23-17, 39-12

MVR 23-24

network traffic for analysis with probe 28-2

object tracking 41-19

OSPF 37-31

port

blocking 24-19

protection 24-19

private VLANs 15-14

SFP status 10-22, 43-9

speed and duplex mode 10-14

traffic flowing among switches 29-1

traffic suppression 24-19

tunneling 16-18

VLAN

filters 34-40

maps 34-40

VLANs 12-14

VMPS 12-30

VTP 13-16

MSTP

boundary ports

configuration guidelines 18-15

described 18-6

BPDU filtering

described 19-3

enabling 19-12

BPDU guard

described 19-2

enabling 19-11

CIST, described 18-3

CIST regional root 18-3

CIST root 18-5

configuration guidelines 18-15, 19-10

configuring

forward-delay time 18-23

hello time 18-22

link type for rapid convergence 18-24

maximum aging time 18-23

maximum hop count 18-24

MST region 18-16

neighbor type 18-25

path cost 18-20

port priority 18-19

root switch 18-17

secondary root switch 18-19

switch priority 18-21

CST

defined 18-3

operations between regions 18-4

default configuration 18-14

default optional feature configuration 19-9

displaying status 18-26

enabling the mode 18-16

EtherChannel guard

described 19-7

enabling 19-14

extended system ID

effects on root switch 18-17

effects on secondary root switch 18-19

unexpected behavior 18-18

IEEE 802.1s

implementation 18-6

port role naming change 18-7

terminology 18-5

instances supported 17-9

interface state, blocking to forwarding 19-2

interoperability and compatibility among modes 17-10

interoperability with IEEE 802.1D

described 18-8

restarting migration process 18-25

IST

defined 18-3

master 18-3

operations within a region 18-3

loop guard

described 19-9

enabling 19-15

mapping VLANs to MST instance 18-16

MST region

CIST 18-3

configuring 18-16

described 18-2

hop-count mechanism 18-5

IST 18-3

supported spanning-tree instances 18-2

optional features supported 1-6

overview 18-2

Port Fast

described 19-2

enabling 19-10

preventing root switch selection 19-8

root guard

described 19-8

enabling 19-15

root switch

configuring 18-18

effects of extended system ID 18-17

unexpected behavior 18-18

shutdown Port Fast-enabled port 19-2

status, displaying 18-26

multiauth

support for inaccessible authentication bypass 8-22

multiauth mode

See multiple-authentication mode

multicast groups

Immediate Leave 23-6

joining 23-3

leaving 23-5

static joins 23-10, 39-8

multicast packets

blocking 24-8

multicast packets, blocking 24-8

multicast router interfaces, monitoring 23-17, 39-12

multicast router ports, adding 23-9, 39-8

multicast storm 24-1

multicast storm-control command 24-4

multicast television application 23-18

multicast VLAN 23-17

Multicast VLAN Registration

See MVR

multiple authentication 8-12

Multiple HSRP

See MHSRP

MVR

and address aliasing 23-21

and IGMPv3 23-21

configuration guidelines 23-20

configuring interfaces 23-22

default configuration 23-20

described 23-17

example application 23-18

modes 23-21

monitoring 23-24

multicast television application 23-18

setting global parameters 23-21

support for 1-3

N

NAC

AAA down policy 1-9

critical authentication 8-22, 8-52

IEEE 802.1x authentication using a RADIUS server 8-57

IEEE 802.1x validation using RADIUS server 8-57

inaccessible authentication bypass 1-9, 8-52

Layer 2 IEEE 802.1x validation 1-9, 8-57

Layer 2 IEEE802.1x validation 8-31

Layer 2 IP validation 1-9

named IPv4 ACLs 34-14

NameSpace Mapper

See NSM

native VLAN

and IEEE 802.1Q tunneling 16-4

configuring 12-22

default 12-22

NEAT

configuring 8-58

overview 8-29

neighbor discovery, IPv6 38-3

Network Admission Control

NAC

Network Assistant

benefits 1-2

described 1-3

network configuration examples

increasing network performance 1-14

providing network services 1-15

server aggregation and Linux server cluster 1-16

network design

performance 1-15

services 1-15

Network Edge Access Topology

See NEAT

network management

CDP 25-1

RMON 29-1

SNMP 31-1

network performance, measuring with IP SLAs 42-3

network policy TLV 26-2, 26-7

Network Time Protocol

See NTP

no commands 2-4

nonhierarchical policy maps

configuration guidelines 35-37

configuring 35-52

described 35-9

non-IP traffic filtering 34-27

nontrunking mode 12-16

normal-range VLANs 12-4

configuration guidelines 12-6

configuration modes 12-7

configuring 12-4

defined 12-1

no switchport command 10-4

note, described xxxviii

not-so-stubby areas

See NSSA

NSM 4-3

NSSA, OSPF 37-27

NTP

associations

authenticating 5-4

defined 5-2

enabling broadcast messages 5-6

peer 5-5

server 5-5

default configuration 5-4

displaying the configuration 5-11

overview 5-2

restricting access

creating an access group 5-8

disabling NTP services per interface 5-10

source IP address, configuring 5-10

stratum 5-2

support for 1-4

synchronizing devices 5-5

time

services 5-2

synchronizing 5-2

O

object tracking

HSRP 41-17

monitoring 41-19

off mode, VTP 13-3

online diagnostics

overview 44-1

running tests 44-3

understanding 44-1

open1x

configuring 8-63

open1x authentication

overview 8-28

Open Shortest Path First

See OSPF

optimizing system resources 6-1

options, management 1-3

OSPF

area parameters, configuring 37-27

configuring 37-25

default configuration

metrics 37-28

route 37-28

settings 37-24

described 37-23

interface parameters, configuring 37-26

LSA group pacing 37-30

monitoring 37-31

router IDs 37-30

route summarization 37-28

support for 1-11

virtual links 37-28

out-of-profile markdown 1-10

P

packet modification, with QoS 35-19

PAgP

Layer 2 protocol tunneling 16-9

See EtherChannel

parallel paths, in routing tables 37-38

passive interfaces

OSPF 37-28

passive interfaces, configuring 37-43

passwords

default configuration 7-2

disabling recovery of 7-5

encrypting 7-3

for security 1-7

overview 7-1

recovery of 43-4

setting

enable 7-3

enable secret 7-3

Telnet 7-6

with usernames 7-6

VTP domain 13-8

path cost

MSTP 18-20

STP 17-18

percentage thresholds in tracked lists 41-16

performance, network design 1-14

performance features 1-2

persistent self-signed certificate 7-49

per-user ACLs and Filter-Ids 8-9

per-VLAN spanning-tree plus

See PVST+

physical ports 10-2

PIM

stub routing

configuration guidelines 37-33

enabling 37-33

overview 37-32

PIM-DVMRP, as snooping method 23-9

ping

character output description 43-11

executing 43-10

overview 43-10

policed-DSCP map for QoS 35-68

policers

configuring

for each matched traffic class 35-52

for more than one traffic class 35-63

described 35-4

displaying 35-83

number of 35-37

types of 35-9

policing

described 35-4

hierarchical

See hierarchical policy maps

token-bucket algorithm 35-9

policy maps for QoS

characteristics of 35-52

described 35-7

displaying 35-84

hierarchical 35-8

hierarchical on SVIs

configuration guidelines 35-37

configuring 35-56

described 35-11

nonhierarchical on physical ports

configuration guidelines 35-37

configuring 35-52

described 35-9

port ACLs

defined 34-2

types of 34-3

Port Aggregation Protocol

See EtherChannel

port-based authentication

accounting 8-14

authentication server

defined 8-3, 9-2

RADIUS server 8-3

client, defined 8-3, 9-2

configuration guidelines 8-34, 9-9

configuring

802.1x authentication 8-39

guest VLAN 8-49

host mode 8-42

inaccessible authentication bypass 8-52

manual re-authentication of a client 8-45

periodic re-authentication 8-44

quiet period 8-45

RADIUS server 8-42, 9-13

RADIUS server parameters on the switch 8-41, 9-12

restricted VLAN 8-50

switch-to-client frame-retransmission number 8-46, 8-47

switch-to-client retransmission time 8-46

violation mode 8-26

violation modes8-38to 8-39

default configuration 8-32, 9-9

described 8-1

device roles 8-3, 9-2

displaying statistics 8-65, 9-18

downloadable ACLs and redirect URLs

configuring8-60to 8-62

overview8-18to 8-20

EAPOL-start frame 8-6

EAP-request/identity frame 8-6

EAP-response/identity frame 8-6

enabling

802.1X authentication 9-12

encapsulation 8-3

flexible authentication ordering

configuring 8-63

overview 8-28

guest VLAN

configuration guidelines 8-21, 8-22

described 8-20

host mode 8-11

inaccessible authentication bypass

configuring 8-52

described 8-22

guidelines 8-35

initiation and message exchange 8-6

magic packet 8-26

maximum number of allowed devices per port 8-36

method lists 8-39

multiple authentication 8-12

multiple-hosts mode, described 8-12

per-user ACLs

AAA authorization 8-39

configuration tasks 8-17

described 8-17

RADIUS server attributes 8-17

ports

authorization state and dot1x port-control command 8-11

authorized and unauthorized 8-11

voice VLAN 8-25

port security

and voice VLAN 8-26

described 8-25

interactions 8-25

multiple-hosts mode 8-12

readiness check

configuring 8-36

described 8-15, 8-36

resetting to default values 8-65

statistics, displaying 8-65

switch

as proxy 8-3, 9-2

RADIUS client 8-3

switch supplicant

configuring 8-58

overview 8-29

user distribution

guidelines 8-24

overview 8-24

VLAN assignment

AAA authorization 8-39

characteristics 8-16

configuration tasks 8-16

described 8-16

voice aware 802.1x security

configuring 8-37

described 8-29, 8-37

voice VLAN

described 8-25

PVID 8-25

VVID 8-25

wake-on-LAN, described 8-26

port-based authentication methods, supported 8-8

port blocking 1-2, 24-7

port-channel

See EtherChannel

port description TLV 26-2

Port Fast

described 19-2

enabling 19-10

mode, spanning tree 12-27

support for 1-6

port membership modes, VLAN 12-3

port priority

MSTP 18-19

STP 17-16

ports

access 10-3

blocking 24-7

dynamic access 12-3

IEEE 802.1Q tunnel 12-4

protected 24-6

routed 10-4

secure 24-9

static-access 12-3, 12-10

switch 10-2

trunks 12-3, 12-15

VLAN assignments 12-10

port security

aging 24-17

and private VLANs 24-18

and QoS trusted boundary 35-42

configuring 24-13

default configuration 24-11

described 24-8

displaying 24-19

enabling 24-18

on trunk ports 24-14

sticky learning 24-9

violations 24-10

with other features 24-11

port-shutdown response, VMPS 12-26

port VLAN ID TLV 26-2

power management TLV 26-2, 26-7

preemption, default configuration 20-5

preemption delay, default configuration 20-5

preferential treatment of traffic

See QoS

preventing unauthorized access 7-1

primary links 20-2

primary VLANs 15-1, 15-3

priority

HSRP 41-7

overriding CoS 14-6

trusting CoS 14-6

private VLAN edge ports

See protected ports

private VLANs

across multiple switches 15-4

and SDM template 15-4

and SVIs 15-5

benefits of 15-1

community ports 15-2

community VLANs 15-2, 15-3

configuration guidelines 15-6, 15-7, 15-8

configuration tasks 15-6

configuring 15-9

default configuration 15-6

end station access to 15-3

IP addressing 15-3

isolated port 15-2

isolated VLANs 15-2, 15-3

mapping 15-13

monitoring 15-14

ports

community 15-2

configuration guidelines 15-8

configuring host ports 15-11

configuring promiscuous ports 15-12

described 12-4

isolated 15-2

promiscuous 15-2

primary VLANs 15-1, 15-3

promiscuous ports 15-2

secondary VLANs 15-2

subdomains 15-1

traffic in 15-5

privileged EXEC mode 2-2

privilege levels

changing the default for lines 7-9

exiting 7-9

logging into 7-9

overview 7-2, 7-7

setting a command with 7-8

promiscuous ports

configuring 15-12

defined 15-2

protected ports 1-7, 24-6

Protocol-Independent Multicast Protocol

See PIM

proxy ARP

configuring 37-9

definition 37-7

with IP routing disabled 37-10

pruning, VTP

disabling

in VTP domain 13-14

on a port 12-22

enabling

in VTP domain 13-14

on a port 12-21

examples 13-6

overview 13-5

pruning-eligible list

changing 12-21

for VTP pruning 13-5

VLANs 13-14

PVST+

described 17-9

IEEE 802.1Q trunking interoperability 17-10

instances supported 17-9

Q

QoS

and MQC commands 35-1

auto-QoS

categorizing traffic 35-21

configuration and defaults display 35-33

configuration guidelines 35-30

described 35-20

disabling 35-32

displaying generated commands 35-32

displaying the initial configuration 35-33

effects on running configuration 35-30

list of generated commands 35-23

basic model 35-4

classification

class maps, described 35-7

defined 35-4

DSCP transparency, described 35-43

flowchart 35-6

forwarding treatment 35-3

in frames and packets 35-3

IP ACLs, described 35-5, 35-7

MAC ACLs, described 35-5, 35-7

options for IP traffic 35-5

options for non-IP traffic 35-5

policy maps, described 35-7

trust DSCP, described 35-5

trusted CoS, described 35-5

trust IP precedence, described 35-5

class maps

configuring 35-50

displaying 35-83

configuration guidelines

auto-QoS 35-30

standard QoS 35-36

configuring

aggregate policers 35-63

auto-QoS 35-20

default port CoS value 35-41

DSCP maps 35-65

DSCP transparency 35-43

DSCP trust states bordering another domain 35-44

egress queue characteristics 35-76

ingress queue characteristics 35-71

IP extended ACLs 35-48

IP standard ACLs 35-47

MAC ACLs 35-49

policy maps, hierarchical 35-56

policy maps on physical ports 35-52

port trust states within the domain 35-39

trusted boundary 35-42

default auto configuration 35-21

default standard configuration 35-34

displaying statistics 35-83

DSCP transparency 35-43

egress queues

allocating buffer space 35-76

buffer allocation scheme, described 35-18

configuring shaped weights for SRR 35-80

configuring shared weights for SRR 35-81

described 35-4

displaying the threshold map 35-79

flowchart 35-17

mapping DSCP or CoS values 35-79

scheduling, described 35-4

setting WTD thresholds 35-76

WTD, described 35-19

enabling globally 35-38

flowcharts

classification 35-6

egress queueing and scheduling 35-17

ingress queueing and scheduling 35-15

policing and marking 35-10

implicit deny 35-7

ingress queues

allocating bandwidth 35-74

allocating buffer space 35-73

buffer and bandwidth allocation, described 35-16

configuring shared weights for SRR 35-74

configuring the priority queue 35-75

described 35-4

displaying the threshold map 35-73

flowchart 35-15

mapping DSCP or CoS values 35-72

priority queue, described 35-16

scheduling, described 35-4

setting WTD thresholds 35-72

WTD, described 35-16

IP phones

automatic classification and queueing 35-20

detection and trusted settings 35-20, 35-42

limiting bandwidth on egress interface 35-82

mapping tables

CoS-to-DSCP 35-66

displaying 35-83

DSCP-to-CoS 35-69

DSCP-to-DSCP-mutation 35-70

IP-precedence-to-DSCP 35-67

policed-DSCP 35-68

types of 35-12

marked-down actions 35-54, 35-60

marking, described 35-4, 35-8

overview 35-2

packet modification 35-19

policers

configuring 35-54, 35-60, 35-64

described 35-8

displaying 35-83

number of 35-37

types of 35-9

policies, attaching to an interface 35-8

policing

described 35-4, 35-8

token bucket algorithm 35-9

policy maps

characteristics of 35-52

displaying 35-84

hierarchical 35-8

hierarchical on SVIs 35-56

nonhierarchical on physical ports 35-52

QoS label, defined 35-4

queues

configuring egress characteristics 35-76

configuring ingress characteristics 35-71

high priority (expedite) 35-19, 35-82

location of 35-13

SRR, described 35-14

WTD, described 35-13

rewrites 35-19

support for 1-10

trust states

bordering another domain 35-44

described 35-5

trusted device 35-42

within the domain 35-39

quality of service

See QoS

queries, IGMP 23-4

query solicitation, IGMP 23-13

R

RADIUS

attributes

vendor-proprietary 7-36

vendor-specific 7-34

configuring

accounting 7-33

authentication 7-28

authorization 7-32

communication, global 7-26, 7-34

communication, per-server 7-26

multiple UDP ports 7-26

default configuration 7-25

defining AAA server groups 7-30

displaying the configuration 7-38

identifying the server 7-26

limiting the services to the user 7-32

method list, defined 7-25

operation of 7-19

overview 7-18

server load balancing 7-38

suggested network environments 7-18

support for 1-9

tracking services accessed by user 7-33

RADIUS Change of Authorization 7-19

range

macro 10-9

of interfaces 10-8

rapid convergence 18-10

rapid per-VLAN spanning-tree plus

See rapid PVST+

rapid PVST+

described 17-9

IEEE 802.1Q trunking interoperability 17-10

instances supported 17-9

Rapid Spanning Tree Protocol

See RSTP

RARP 37-7

RCP

configuration files

downloading B-17

overview B-15

preparing the server B-16

uploading B-18

image files

deleting old image B-35

downloading B-34

preparing the server B-32

uploading B-35

readiness check

port-based authentication

configuring 8-36

described 8-15, 8-36

reconfirmation interval, VMPS, changing 12-30

reconfirming dynamic VLAN membership 12-29

recovery procedures 43-1

redirect URL 8-18, 8-19, 8-60

redundancy

EtherChannel 36-2

HSRP 41-1

STP

backbone 17-8

path cost 12-24

port priority 12-23

redundant links and UplinkFast 19-13

reloading software 3-22

Remote Authentication Dial-In User Service

See RADIUS

Remote Copy Protocol

See RCP

Remote Network Monitoring

See RMON

Remote SPAN

See RSPAN

remote SPAN 28-2

report suppression, IGMP

described 23-6

disabling 23-16, 39-11

requirements

device manager xxxviii

resequencing ACL entries 34-14

reserved addresses in DHCP pools 21-26

resetting a UDLD-shutdown interface 27-6

responder, IP SLAs

described 42-4

enabling 42-6

response time, measuring with IP SLAs 42-4

restricted VLAN

configuring 8-50

described 8-21

using with IEEE 802.1x 8-21

restricting access

NTP services 5-8

overview 7-1

passwords and privilege levels 7-2

RADIUS 7-17

TACACS+ 7-10

retry count, VMPS, changing 12-30

reverse address resolution 37-7

Reverse Address Resolution Protocol

See RARP

RFC

1058, RIP 37-17

1112, IP multicast and IGMP 23-2

1157, SNMPv1 31-2

1166, IP addresses 37-5

1253, OSPF 37-23

1305, NTP 5-2

1587, NSSAs 37-23

1757, RMON 29-2

1901, SNMPv2C 31-2

1902 to 1907, SNMPv2 31-2

2236, IP multicast and IGMP 23-2

2273-2275, SNMPv3 31-2

RFC 5176 Compliance 7-20

RIP

advertisements 37-17

authentication 37-20

configuring 37-19

default configuration 37-18

described 37-17

hop counts 37-17

split horizon 37-21

summary addresses 37-21

support for 1-11

RMON

default configuration 29-3

displaying status 29-6

enabling alarms and events 29-3

groups supported 29-2

overview 29-1

statistics

collecting group Ethernet 29-5

collecting group history 29-5

support for 1-12

root guard

described 19-8

enabling 19-15

support for 1-6

root switch

MSTP 18-17

STP 17-14

route calculation timers, OSPF 37-29

routed packets, ACLs on 34-39

routed ports

configuring 37-3

defined 10-4

IP addresses on 10-18, 37-3

router ACLs

defined 34-2

types of 34-4

router ID, OSPF 37-30

route summarization, OSPF 37-28

routing

default 37-2

dynamic 37-2

redistribution of information 37-41

static 37-2

Routing Information Protocol

See RIP

routing protocol administrative distances 37-39

RSPAN

characteristics 28-8

configuration guidelines 28-15

default configuration 28-9

defined 28-2

destination ports 28-7

displaying status 28-23

interaction with other features 28-8

monitored ports 28-5

monitoring ports 28-7

overview 1-11, 28-1

received traffic 28-4

sessions

creating 28-16

defined 28-3

limiting source traffic to specific VLANs 28-22

specifying monitored ports 28-16

with ingress traffic enabled 28-20

source ports 28-5

transmitted traffic 28-5

VLAN-based 28-6

RSTP

active topology 18-9

BPDU

format 18-12

processing 18-13

designated port, defined 18-9

designated switch, defined 18-9

interoperability with IEEE 802.1D

described 18-8

restarting migration process 18-25

topology changes 18-13

overview 18-8

port roles

described 18-9

synchronized 18-11

proposal-agreement handshake process 18-10

rapid convergence

described 18-10

edge ports and Port Fast 18-10

point-to-point links 18-10, 18-24

root ports 18-10

root port, defined 18-9

See also MSTP

running configuration

replacing B-19, B-20

rolling back B-19, B-20

running configuration, saving 3-15

S

scheduled reloads 3-22

SCP

and SSH 7-54

configuring 7-55

SDM

described 6-1

templates

configuring 6-4

number of 6-1

SDM template 40-3

configuration guidelines 6-4

configuring 6-3

dual IPv4 and IPv6 6-2

types of 6-1

secondary VLANs 15-2

Secure Copy Protocol

See SCP

secure HTTP client

configuring 7-53

displaying 7-54

secure HTTP server

configuring 7-52

displaying 7-54

secure MAC addresses

deleting 24-16

maximum number of 24-10

types of 24-9

secure ports, configuring 24-9

secure remote connections 7-44

Secure Shell

See SSH

Secure Socket Layer

See SSL

security, port 24-8

security features 1-7

sequence numbers in log messages 30-8

server mode, VTP 13-3

service-provider network, MSTP and RSTP 18-1

service-provider networks

and customer VLANs 16-2

and IEEE 802.1Q tunneling 16-1

Layer 2 protocols across 16-8

Layer 2 protocol tunneling for EtherChannels 16-9

set-request operation 31-4

severity levels, defining in system messages 30-8

SFPs

monitoring status of 10-22, 43-9

security and identification 43-9

status, displaying 43-9

shaped round robin

See SRR

show access-lists hw-summary command 34-21

show and more command output, filtering 2-9

show cdp traffic command 25-5

show configuration command 10-16

show forward command 43-16

show interfaces command 10-14, 10-16

show l2protocol command 16-13, 16-15, 16-16

show lldp traffic command 26-11

show platform forward command 43-16

show platform tcam command 43-20

show running-config command

displaying ACLs 34-19, 34-20, 34-31, 34-34

interface description in 10-16

shutdown command on interfaces 10-22

shutdown threshold for Layer 2 protocol packets 16-11

Simple Network Management Protocol

See SNMP

single session ID 8-31

small-frame arrival rate, configuring 24-5

Smartports macros

applying Cisco-default macros 11-6

applying global parameter values 11-5, 11-6

applying macros 11-5

applying parameter values 11-5, 11-7

configuration guidelines 11-2

creating 11-4

default configuration 11-2

defined 11-1

displaying 11-8

tracing 11-3

SNAP 25-1

SNMP

accessing MIB variables with 31-4

agent

described 31-4

disabling 31-7

and IP SLAs 42-2

authentication level 31-10

community strings

configuring 31-8

overview 31-4

configuration examples 31-17

default configuration 31-6

engine ID 31-7

groups 31-6, 31-9

host 31-6

ifIndex values 31-5

in-band management 1-5

informs

and trap keyword 31-11

described 31-5

differences from traps 31-5

disabling 31-15

enabling 31-15

limiting access by TFTP servers 31-16

limiting system log messages to NMS 30-10

manager functions 1-3, 31-3

MIBs

location of A-3

supported A-1

notifications 31-5

overview 31-1, 31-4

security levels 31-3

setting CPU threshold notification 31-15

status, displaying 31-18

system contact and location 31-16

trap manager, configuring 31-13

traps

described 31-3, 31-5

differences from informs 31-5

disabling 31-15

enabling 31-11

enabling MAC address notification 5-22, 5-24, 5-25

overview 31-1, 31-4

types of 31-12

users 31-6, 31-9

versions supported 31-2

SNMP and Syslog Over IPv6 38-5

SNMPv1 31-2

SNMPv2C 31-2

SNMPv3 31-2

snooping, IGMP 23-2

software images

location in flash B-23

recovery procedures 43-2

scheduling reloads 3-23

tar file format, described B-24

See also downloading and uploading

source addresses

in IPv6 ACLs 40-4

source addresses, in IPv4 ACLs 34-11

source-and-destination-IP address based forwarding, EtherChannel 36-7

source-and-destination MAC address forwarding, EtherChannel 36-7

source-IP address based forwarding, EtherChannel 36-7

source-MAC address forwarding, EtherChannel 36-7

SPAN

configuration guidelines 28-10

default configuration 28-9

destination ports 28-7

displaying status 28-23

interaction with other features 28-8

monitored ports 28-5

monitoring ports 28-7

overview 1-11, 28-1

ports, restrictions 24-12

received traffic 28-4

sessions

configuring ingress forwarding 28-14, 28-21

creating 28-11

defined 28-3

limiting source traffic to specific VLANs 28-14

removing destination (monitoring) ports 28-12

specifying monitored ports 28-11

with ingress traffic enabled 28-13

source ports 28-5

transmitted traffic 28-5

VLAN-based 28-6

spanning tree and native VLANs 12-17

Spanning Tree Protocol

See STP

SPAN traffic 28-4

split horizon, RIP 37-21

SRR

configuring

shaped weights on egress queues 35-80

shared weights on egress queues 35-81

shared weights on ingress queues 35-74

described 35-14

shaped mode 35-14

shared mode 35-14

support for 1-10, 1-11

SSH

configuring 7-45

cryptographic software image 7-43

described 1-5, 7-44

encryption methods 7-44

user authentication methods, supported 7-44

SSL

configuration guidelines 7-51

configuring a secure HTTP client 7-53

configuring a secure HTTP server 7-52

cryptographic software image 7-48

described 7-48

monitoring 7-54

standby ip command 41-6

standby links 20-2

standby router 41-1

standby timers, HSRP 41-10

startup configuration

booting

manually 3-18

specific image 3-19

clearing B-19

configuration file

automatically downloading 3-17

specifying the filename 3-18

default boot configuration 3-17

static access ports

assigning to VLAN 12-10

defined 10-3, 12-3

static addresses

See addresses

static IP routing 1-11

static MAC addressing 1-7

static routes

understanding 38-5

static routes, configuring 37-39

static routing 37-2

static VLAN membership 12-2

statistics

802.1X 9-18

802.1x 8-65

CDP 25-5

interface 10-21

LLDP 26-10

LLDP-MED 26-10

NMSP 26-10

OSPF 37-31

QoS ingress and egress 35-83

RMON group Ethernet 29-5

RMON group history 29-5

SNMP input and output 31-18

VTP 13-16

sticky learning 24-9

storm control

configuring 24-3

described 24-1

disabling 24-5

displaying 24-19

support for 1-2

thresholds 24-1

STP

accelerating root port selection 19-4

BackboneFast

described 19-5

disabling 19-14

enabling 19-13

BPDU filtering

described 19-3

disabling 19-12

enabling 19-12

BPDU guard

described 19-2

disabling 19-12

enabling 19-11

BPDU message exchange 17-3

configuration guidelines 17-12, 19-10

configuring

forward-delay time 17-21

hello time 17-20

maximum aging time 17-21

path cost 17-18

port priority 17-16

root switch 17-14

secondary root switch 17-16

spanning-tree mode 17-13

switch priority 17-19

transmit hold-count 17-22

counters, clearing 17-22

default configuration 17-11

default optional feature configuration 19-9

designated port, defined 17-3

designated switch, defined 17-3

detecting indirect link failures 19-5

disabling 17-14

displaying status 17-22

EtherChannel guard

described 19-7

disabling 19-14

enabling 19-14

extended system ID

effects on root switch 17-14

effects on the secondary root switch 17-16

overview 17-4

unexpected behavior 17-14

features supported 1-5

IEEE 802.1D and bridge ID 17-4

IEEE 802.1D and multicast addresses 17-8

IEEE 802.1t and VLAN identifier 17-4

inferior BPDU 17-3

instances supported 17-9

interface state, blocking to forwarding 19-2

interface states

blocking 17-5

disabled 17-7

forwarding 17-5, 17-6

learning 17-6

listening 17-6

overview 17-4

interoperability and compatibility among modes 17-10

Layer 2 protocol tunneling 16-8

limitations with IEEE 802.1Q trunks 17-10

load sharing

overview 12-22

using path costs 12-24

using port priorities 12-23

loop guard

described 19-9

enabling 19-15

modes supported 17-9

multicast addresses, effect of 17-8

optional features supported 1-6

overview 17-2

path costs 12-24, 12-25

Port Fast

described 19-2

enabling 19-10

port priorities 12-23

preventing root switch selection 19-8

protocols supported 17-9

redundant connectivity 17-8

root guard

described 19-8

enabling 19-15

root port, defined 17-3

root switch

configuring 17-14

effects of extended system ID 17-4, 17-14

election 17-3

unexpected behavior 17-14

shutdown Port Fast-enabled port 19-2

status, displaying 17-22

superior BPDU 17-3

timers, described 17-20

UplinkFast

described 19-3

enabling 19-13

stratum, NTP 5-2

stub areas, OSPF 37-27

stub routing

PIM 37-33

stub routing, EIGRP 37-35

subdomains, private VLAN 15-1

subnet mask 37-5

subnet zero 37-5

success response, VMPS 12-26

summer time 5-13

SunNet Manager 1-3

supernet 37-6

supported port-based authentication methods 8-8

SVI autostate exclude

configuring 10-19

defined 10-5

SVI link state 10-5

SVIs

and IP unicast routing 37-3

and router ACLs 34-4

connecting VLANs 10-6

defined 10-4

routing between VLANs 12-2

switch 38-2

switch console port 1-5

Switch Database Management

See SDM

switched packets, ACLs on 34-38

Switched Port Analyzer

See SPAN

switched ports 10-2

switchport block multicast command 24-8

switchport block unicast command 24-8

switchport command 10-11

switchport mode dot1q-tunnel command 16-6

switchport protected command 24-7

switch priority

MSTP 18-21

STP 17-19

switch software features 1-1

switch virtual interface

See SVI

syslog

See system message logging

system capabilities TLV 26-2

system clock

configuring

daylight saving time 5-13

manually 5-11

summer time 5-13

time zones 5-12

displaying the time and date 5-12

overview 5-1

See also NTP

system description TLV 26-2

system message logging

default configuration 30-3

defining error message severity levels 30-8

disabling 30-4

displaying the configuration 30-13

enabling 30-4

facility keywords, described 30-13

level keywords, described 30-9

limiting messages 30-10

message format 30-2

overview 30-1

sequence numbers, enabling and disabling 30-8

setting the display destination device 30-5

synchronizing log messages 30-6

syslog facility 1-12

time stamps, enabling and disabling 30-7

UNIX syslog servers

configuring the daemon 30-12

configuring the logging facility 30-12

facilities supported 30-13

system MTU and IEEE 802.1Q tunneling 16-5

system name

default configuration 5-15

default setting 5-15

manual configuration 5-15

See also DNS

system name TLV 26-2

system prompt, default setting 5-14, 5-15

system resources, optimizing 6-1

T

TACACS+

accounting, defined 7-11

authentication, defined 7-11

authorization, defined 7-11

configuring

accounting 7-17

authentication key 7-13

authorization 7-16

login authentication 7-14

default configuration 7-13

displaying the configuration 7-17

identifying the server 7-13

limiting the services to the user 7-16

operation of 7-12

overview 7-10

support for 1-9

tracking services accessed by user 7-17

tagged packets

IEEE 802.1Q 16-3

Layer 2 protocol 16-8

tar files

creating B-6

displaying the contents of B-6

extracting B-8

image file format B-24

TCAM

memory consistency check errors

displaying 43-20

example 43-20

memory consistency check routines 1-3, 43-19

memory consistency integrity 1-3, 43-19

portions 43-20

space

HFTM 43-20

HQATM 43-20

unassigned 43-20

TCL script, registering and defining with embedded event manager 33-7

Telnet

accessing management interfaces 2-9

number of connections 1-5

setting a password 7-6

templates, SDM 6-1

temporary self-signed certificate 7-49

Terminal Access Controller Access Control System Plus

See TACACS+

terminal lines, setting a password 7-6

ternary content addressable memory

See TCAM

TFTP

configuration files

downloading B-11

preparing the server B-11

uploading B-12

configuration files in base directory 3-7

configuring for autoconfiguration 3-7

image files

deleting B-27

downloading B-26

preparing the server B-25

uploading B-27

limiting access by servers 31-16

TFTP server 1-4

threshold, traffic level 24-2

time

See NTP and system clock

time-range command 34-16

time ranges in ACLs 34-16

time stamps in log messages 30-7

time zones 5-12

TLVs

defined 26-1

LLDP 26-2

LLDP-MED 26-2

Token Ring VLANs

support for 12-6

VTP support 13-4

ToS 1-10

traceroute, Layer 2

and ARP 43-12

and CDP 43-12

broadcast traffic 43-11

described 43-11

IP addresses and subnets 43-12

MAC addresses and VLANs 43-12

multicast traffic 43-12

multiple devices on a port 43-12

unicast traffic 43-11

usage guidelines 43-12

traceroute command 43-14

See also IP traceroute

tracked lists

configuring 41-14

types 41-14

tracked objects

by Boolean expression 41-14

by threshold percentage 41-16

by threshold weight 41-15

tracking interface line-protocol state 41-13

tracking IP routing state 41-13

tracking objects 41-12

tracking process 41-12

traffic

blocking flooded 24-8

fragmented 34-5

fragmented IPv6 40-2

unfragmented 34-5

traffic policing 1-10

traffic suppression 24-1

transmit hold-count

see STP

transparent mode, VTP 13-3

trap-door mechanism 3-2

traps

configuring MAC address notification 5-22, 5-24, 5-25

configuring managers 31-11

defined 31-3

enabling 5-22, 5-24, 5-25, 31-11

notification types 31-12

overview 31-1, 31-4

troubleshooting

connectivity problems 43-10, 43-11, 43-13

CPU utilization 43-21

detecting unidirectional links 27-1

displaying crash information 43-18

setting packet forwarding 43-16

SFP security and identification 43-9

show forward command 43-16

with debug commands 43-15

with ping 43-10

with system message logging 30-1

with traceroute 43-13

trunking encapsulation 1-6

trunk ports

configuring 12-19

defined 10-3, 12-3

encapsulation 12-19, 12-24, 12-25

trunks

allowed-VLAN list 12-20

configuring 12-19, 12-24, 12-25

ISL 12-15

load sharing

setting STP path costs 12-24

using STP port priorities 12-23

native VLAN for untagged traffic 12-22

parallel 12-24

pruning-eligible list 12-21

to non-DTP device 12-16

trusted boundary for QoS 35-42

trusted port states

between QoS domains 35-44

classification options 35-5

ensuring port security for IP phones 35-42

support for 1-10

within a QoS domain 35-39

trustpoints, CA 7-48

tunneling

defined 16-1

IEEE 802.1Q 16-1

Layer 2 protocol 16-8

tunnel ports

defined 12-4

described 10-4, 16-1

IEEE 802.1Q, configuring 16-6

incompatibilities with other features 16-6

twisted-pair Ethernet, detecting unidirectional links 27-1

type of service

See ToS

U

UDLD

configuration guidelines 27-4

default configuration 27-4

disabling

globally 27-5

on fiber-optic interfaces 27-5

per interface 27-5

echoing detection mechanism 27-3

enabling

globally 27-5

per interface 27-5

Layer 2 protocol tunneling 16-10

link-detection mechanism 27-1

neighbor database 27-2

overview 27-1

resetting an interface 27-6

status, displaying 27-6

support for 1-5

UDP, configuring 37-14

unauthorized ports with IEEE 802.1x 8-11

unicast MAC address filtering 1-4

and adding static addresses 5-28

and broadcast MAC addresses 5-27

and CPU packets 5-27

and multicast addresses 5-27

and router MAC addresses 5-27

configuration guidelines 5-27

described 5-27

unicast storm 24-1

unicast storm control command 24-4

unicast traffic, blocking 24-8

UniDirectional Link Detection protocol

See UDLD

UNIX syslog servers

daemon configuration 30-12

facilities supported 30-13

message logging configuration 30-12

unrecognized Type-Length-Value (TLV) support 13-4

upgrading information

See release notes

upgrading software images

See downloading

UplinkFast

described 19-3

disabling 19-13

enabling 19-13

support for 1-5

uploading

configuration files

preparing B-11, B-13, B-16

reasons for B-9

using FTP B-14

using RCP B-18

using TFTP B-12

image files

preparing B-25, B-28, B-32

reasons for B-23

using FTP B-31

using RCP B-35

using TFTP B-27

User Datagram Protocol

See UDP

user EXEC mode 2-2

username-based authentication 7-6

V

version-dependent transparent mode 13-4

virtual router 41-1, 41-2

virtual switches and PAgP 36-5

vlan.dat file 12-5

VLAN 1, disabling on a trunk port 12-20

VLAN 1 minimization 12-20

VLAN ACLs

See VLAN maps

vlan-assignment response, VMPS 12-26

VLAN configuration

at bootup 12-7

saving 12-7

VLAN configuration mode 2-2

VLAN database

and startup configuration file 12-7

and VTP 13-1, 33-1

VLAN configuration saved in 12-7

VLANs saved in 12-4

vlan dot1q tag native command 16-5

VLAN filtering and SPAN 28-6

vlan global configuration command 12-7

VLAN ID, discovering 5-30

VLAN link state 10-5

VLAN load balancing on flex links 20-2

configuration guidelines 20-5

VLAN management domain 13-2

VLAN Management Policy Server

See VMPS

VLAN map entries, order of 34-30

VLAN maps

applying 34-34

common uses for 34-34

configuration guidelines 34-30

configuring 34-29

creating 34-31

defined 34-2

denying access to a server example 34-36

denying and permitting packets 34-32

displaying 34-40

examples of ACLs and VLAN maps 34-32

removing 34-34

support for 1-7

wiring closet configuration example 34-35

VLAN membership

confirming 12-29

modes 12-3

VLAN Query Protocol

See VQP

VLANs

adding 12-8

adding to VLAN database 12-8

aging dynamic addresses 17-9

allowed on trunk 12-20

and spanning-tree instances 12-3, 12-6, 12-11

configuration guidelines, extended-range VLANs 12-11

configuration guidelines, normal-range VLANs 12-6

configuration options 12-7

configuring 12-1

configuring IDs 1006 to 4094 12-11

connecting through SVIs 10-6

customer numbering in service-provider networks 16-3

default configuration 12-7

deleting 12-9

described 10-2, 12-1

displaying 12-14

extended-range 12-1, 12-11

features 1-6

illustrated 12-2

internal 12-12

limiting source traffic with RSPAN 28-22

limiting source traffic with SPAN 28-14

modifying 12-8

multicast 23-17

native, configuring 12-22

normal-range 12-1, 12-4

number supported 1-6

parameters 12-5

port membership modes 12-3

static-access ports 12-10

STP and IEEE 802.1Q trunks 17-10

supported 12-2

Token Ring 12-6

traffic between 12-2

VTP modes 13-3

VLAN Trunking Protocol

See VTP

VLAN trunks 12-15

VMPS

administering 12-30

configuration example 12-31

configuration guidelines 12-27

default configuration 12-27

description 12-26

dynamic port membership

described 12-27

reconfirming 12-30

troubleshooting 12-31

mapping MAC addresses to VLANs 12-26

monitoring 12-30

reconfirmation interval, changing 12-30

reconfirming membership 12-29

retry count, changing 12-30

voice aware 802.1x security

port-based authentication

configuring 8-37

described 8-29, 8-37

voice-over-IP 14-1

voice VLAN

Cisco 7960 phone, port connections 14-1

configuration guidelines 14-3

configuring IP phones for data traffic

override CoS of incoming frame 14-6

trust CoS priority of incoming frame 14-6

configuring ports for voice traffic in

802.1p priority tagged frames 14-5

802.1Q frames 14-5

connecting to an IP phone 14-4

default configuration 14-3

described 14-1

displaying 14-7

IP phone data traffic, described 14-2

IP phone voice traffic, described 14-2

VQP 1-6, 12-26

VRF-aware services

RADIUS 37-46

VTP

adding a client to a domain 13-15

advertisements 12-18, 13-3, 13-4

and extended-range VLANs 12-3, 13-2

and normal-range VLANs 12-2, 13-2

configuration

requirements 13-10

saving 13-8

configuration requirements 13-10

configuration revision number

guideline 13-15

resetting 13-16

configuring mode 13-10

consistency checks 13-4

default configuration 13-7

described 13-1

domain names 13-8

domains 13-2

Layer 2 protocol tunneling 16-8

modes

client 13-3

configuring 13-10

off 13-3

server 13-3

transitions 13-3

transparent 13-3

monitoring 13-16

passwords 13-8

pruning

disabling 13-14

enabling 13-14

examples 13-6

overview 13-5

support for 1-6

pruning-eligible list, changing 12-21

server mode, configuring 13-10, 13-13

statistics 13-16

support for 1-6

Token Ring support 13-4

transparent mode, configuring 13-10

using 13-1

Version

enabling 13-13

version, guidelines 13-9

Version 1 13-4

Version 2

configuration guidelines 13-9

overview 13-4

Version 3

overview 13-5

W

web authentication 8-15

configuring 9-17

described 1-7

web-based authentication

customizeable web pages 9-6

description 9-1

web-based authentication, interactions with other features 9-7

weighted tail drop

See WTD

weight thresholds in tracked lists 41-15

wired location service

configuring 26-9

displaying 26-10

location TLV 26-3

understanding 26-3

WTD

described 35-13

setting thresholds

egress queue-sets 35-76

ingress queues 35-72

support for 1-10, 1-11

X

Xmodem protocol 43-2