-
Catalyst 2960 Switch Command Reference, 12.2(37)SE
-
Index
-
Preface
-
Using the Command Line Interface
-
Catalyst 2960 Switch Cisco IOS Commands - aaa accounting through renew ip dhcp
-
Catalyst 2960 Switch Cisco IOS Commands - rmon collection through show vtp
-
Catalyst 2960 Switch Cisco IOS Commands - shutdown through vtp
-
Catalyst 2960 Switch Bootloader Commands
-
Catalyst 2960 Switch Debug Commands
-
Catalyst 2960 Switch Show Platform Commands
-
Table Of Contents
spanning-tree etherchannel guard misconfig
spanning-tree extend system-id
spanning-tree loopguard default
spanning-tree mst configuration
spanning-tree mst forward-time
spanning-tree mst port-priority
spanning-tree mst pre-standard
spanning-tree portfast (global configuration)
spanning-tree portfast (interface configuration)
spanning-tree transmit hold-count
switchport port-security aging
vmps reconfirm (privileged EXEC)
vmps reconfirm (global configuration)
2V]shutdown
Use the shutdown interface configuration command to disable an interface. Use the no form of this command to restart a disabled interface.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Defaults
The port is enabled (not shut down).
Command Modes
Interface configuration
Command History
Usage Guidelines
The shutdown command causes a port to stop forwarding. You can enable the port with the no shutdown command.
The no shutdown command has no effect if the port is a static-access port assigned to a VLAN that has been deleted, suspended, or shut down. The port must first be a member of an active VLAN before it can be re-enabled.
The shutdown command disables all functions on the specified interface.
This command also marks the interface as unavailable. To see if an interface is disabled, use the show interfaces privileged EXEC command. An interface that has been shut down is shown as administratively down in the display.
Examples
These examples show how to disable and re-enable a port:
Switch(config)# interface gigabitethernet0/2Switch(config-if)# shutdownSwitch(config)# interface gigabitethernet0/2Switch(config-if)# no shutdownYou can verify your settings by entering the show interfaces privileged EXEC command.
Related Commands
Displays the statistical information specific to all interfaces or to a specific interface.
shutdown vlan
Use the shutdown vlan global configuration command to shut down (suspend) local traffic on the specified VLAN. Use the no form of this command to restart local traffic on the VLAN.
shutdown vlan vlan-id
no shutdown vlan vlan-id
Syntax Description
Defaults
No default is defined.
Command Modes
Global configuration
Command History
Usage Guidelines
The shutdown vlan command does not change the VLAN information in the VTP database. The command shuts down local traffic, but the switch still advertises VTP information.
Examples
This example shows how to shut down traffic on VLAN 2:
Switch(config)# shutdown vlan 2You can verify your setting by entering the show vlan privileged EXEC command.
Related Commands
snmp-server enable traps
Use the snmp-server enable traps global configuration command to enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS). Use the no form of this command to return to the default setting.
snmp-server enable traps [bridge [newroot] [topologychange] | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature] | errdisable [notification-rate value] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate value] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate value | stpx [inconsistency] [root-inconsistency] [loop-inconsistency] | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]
no snmp-server enable traps [bridge [newroot] [topologychange] | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature] | errdisable [notification-rate] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate | stpx [inconsistency] [root-inconsistency] [loop-inconsistency] | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]
Syntax Description
Note
Though visible in the command-line help strings, the cpu [threshold], insertion, and removal keywords are not supported. The snmp-server enable informs global configuration command is not supported. To enable the sending of SNMP inform notifications, use the snmp-server enable traps global configuration command combined with the snmp-server host host-addr informs global configuration command.
Defaults
The sending of SNMP traps is disabled.
Command Modes
Global configuration
Command History
12.2(25)FX
This command was introduced.
12.2(37)SE
The errdisable notification-rate value keywords were added.
Usage Guidelines
Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.
When supported, use the snmp-server enable traps command to enable sending of traps or informs.
Note
To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.
Examples
This example shows how to send VTP traps to the NMS:
Switch(config)# snmp-server enable traps vtpYou can verify your setting by entering the show vtp status or the show running-config privileged EXEC command.
Related Commands
snmp-server host
Use the snmp-server host global configuration command to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host.
snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth| priv}] [vrf vrf-instance] {community-string [notification-type]}
no snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth | priv}] [vrf vrf-instance] community-string
Syntax Description
Defaults
This command is disabled by default. No notifications are sent.
If you enter this command with no keywords, the default is to send all trap types to the host. No informs are sent to this host.
If no version keyword is present, the default is Version 1.
If Version 3 is selected and no authentication keyword is entered, the default is the noauth (noAuthNoPriv) security level.
Command Modes
Global configuration
Command History
12.2(25)FX
This command was introduced.
12.2(37)SE
The errdisable notification-rate value keywords were added.
Usage Guidelines
SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations.
However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.
If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.
If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.
When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.
The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.
The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.
Examples
This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10:
Switch(config)# snmp-server community comaccess ro 10Switch(config)# snmp-server host 172.20.2.160 comaccessSwitch(config)# access-list 10 deny anyThis example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:
Switch(config)# snmp-server enable trapsSwitch(config)# snmp-server host myhost.cisco.com comaccess snmpThis example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public:
Switch(config)# snmp-server enable trapsSwitch(config)# snmp-server host myhost.cisco.com publicYou can verify your settings by entering the show running-config privileged EXEC command.
Related Commands
snmp trap mac-notification
Use the snmp trap mac-notification interface configuration command to enable the Simple Network Management Protocol (SNMP) MAC address notification trap on a specific Layer 2 interface. Use the no form of this command to return to the default setting.
snmp trap mac-notification {added | removed}
no snmp trap mac-notification {added | removed}
Syntax Description
added
Enable the MAC notification trap whenever a MAC address is added on this interface.
removed
Enable the MAC notification trap whenever a MAC address is removed from this interface.
Defaults
By default, the traps for both address addition and address removal are disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
Even though you enable the notification trap for a specific interface by using the snmp trap mac-notification command, the trap is generated only when you enable the snmp-server enable traps mac-notification and the mac address-table notification global configuration commands.
Examples
This example shows how to enable the MAC notification trap when a MAC address is added to a port:
Switch(config)# interface gigabitethernet0/2Switch(config-if)# snmp trap mac-notification addedYou can verify your settings by entering the show mac address-table notification interface privileged EXEC command.
Related Commands
clear mac address-table notification
Clears the MAC address notification global counters.
Enables the MAC address notification feature.
Displays the MAC address notification settings for all interfaces or on the specified interface when the interface keyword is appended.
Sends the SNMP MAC notification traps when the mac-notification keyword is appended.
spanning-tree backbonefast
Use the spanning-tree backbonefast global configuration command to enable the BackboneFast feature. Use the no form of the command to return to the default setting.
spanning-tree backbonefast
no spanning-tree backbonefast
Syntax Description
This command has no arguments or keywords.
Defaults
BackboneFast is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
You can configure the BackboneFast feature for rapid PVST+ or for multiple spanning-tree (MST) mode, but the feature remains disabled (inactive) until you change the spanning-tree mode to PVST+.
BackboneFast starts when a root port or blocked port on a switch receives inferior BPDUs from its designated switch. An inferior BPDU identifies a switch that declares itself as both the root bridge and the designated switch. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated switch has lost its connection to the root switch. If there are alternate paths to the root switch, BackboneFast causes the maximum aging time on the interfaces on which it received the inferior BPDU to expire and allows a blocked port to move immediately to the listening state. BackboneFast then transitions the interface to the forwarding state. For more information, see the software configuration guide for this release.
Enable BackboneFast on all supported switches to allow the detection of indirect link failures and to start the spanning-tree reconfiguration sooner.
Examples
This example shows how to enable BackboneFast on the switch:
Switch(config)# spanning-tree backbonefastYou can verify your setting by entering the show spanning-tree summary privileged EXEC command.
Related Commands
show spanning-tree summary
Displays a summary of the spanning-tree interface states.
spanning-tree bpdufilter
Use the spanning-tree bpdufilter interface configuration command to prevent an interface from sending or receiving bridge protocol data units (BPDUs). Use the no form of this command to return to the default setting.
spanning-tree bpdufilter {disable | enable}
no spanning-tree bpdufilter
Syntax Description
disable
Disable BPDU filtering on the specified interface.
enable
Enable BPDU filtering on the specified interface.
Defaults
BPDU filtering is disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
You can enable the BPDU filtering feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.
Caution
You can globally enable BPDU filtering on all Port Fast-enabled interfaces by using the spanning-tree portfast bpdufilter default global configuration command.
You can use the spanning-tree bpdufilter interface configuration command to override the setting of the spanning-tree portfast bpdufilter default global configuration command.
Examples
This example shows how to enable the BPDU filtering feature on a port:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# spanning-tree bpdufilter enableYou can verify your setting by entering the show running-config privileged EXEC command.
Related Commands
spanning-tree bpduguard
Use the spanning-tree bpduguard interface configuration command to put an interface in the error-disabled state when it receives a bridge protocol data unit (BPDU). Use the no form of this command to return to the default setting.
spanning-tree bpduguard {disable | enable}
no spanning-tree bpduguard
Syntax Description
disable
Disable BPDU guard on the specified interface.
enable
Enable BPDU guard on the specified interface.
Defaults
BPDU guard is disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
The BPDU guard feature provides a secure response to invalid configurations because you must manually put the interface back in service. Use the BPDU guard feature in a service-provider network to prevent an interface from being included in the spanning-tree topology.
You can enable the BPDU guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.
You can globally enable BPDU guard on all Port Fast-enabled interfaces by using the spanning-tree portfast bpduguard default global configuration command.
You can use the spanning-tree bpduguard interface configuration command to override the setting of the spanning-tree portfast bpduguard default global configuration command.
Examples
This example shows how to enable the BPDU guard feature on a port:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# spanning-tree bpduguard enableYou can verify your setting by entering the show running-config privileged EXEC command.
Related Commands
spanning-tree cost
Use the spanning-tree cost interface configuration command to set the path cost for spanning-tree calculations. If a loop occurs, spanning tree considers the path cost when selecting an interface to place in the forwarding state. Use the no form of this command to return to the default setting.
spanning-tree [vlan vlan-id] cost cost
no spanning-tree [vlan vlan-id] cost
Syntax Description
Defaults
The default path cost is computed from the interface bandwidth setting. These are the IEEE default path cost values:
•
•
•
Command Modes
Interface configuration
Command History
Usage Guidelines
When you configure the cost, higher values represent higher costs.
If you configure an interface with both the spanning-tree vlan vlan-id cost cost command and the spanning-tree cost cost command, the spanning-tree vlan vlan-id cost cost command takes effect.
Examples
This example shows how to set the path cost to 250 on a port:
Switch(config)# interface gigabitethernet0/1Switch(config-if)# spanning-tree cost 250This example shows how to set a path cost to 300 for VLANs 10, 12 to 15, and 20:
Switch(config-if)# spanning-tree vlan 10,12-15,20 cost 300You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command.
Related Commands
show spanning-tree interface interface-id
Displays spanning-tree information for the specified interface.
Configures an interface priority.
spanning-tree vlan priority
Sets the switch priority for the specified spanning-tree instance.
spanning-tree etherchannel guard misconfig
Use the spanning-tree etherchannel guard misconfig global configuration command to display an error message when the switch detects an EtherChannel misconfiguration. Use the no form of this command to disable the feature.
spanning-tree etherchannel guard misconfig
no spanning-tree etherchannel guard misconfig
Syntax Description
This command has no arguments or keywords.
Defaults
EtherChannel guard is enabled on the switch.
Command Modes
Global configuration
Command History
Usage Guidelines
When the switch detects an EtherChannel misconfiguration, this error message appears:
PM-4-ERR_DISABLE: Channel-misconfig error detected on [chars], putting [chars] in err-disable state.To show switch ports that are in the misconfigured EtherChannel, use the show interfaces status err-disabled privileged EXEC command. To verify the EtherChannel configuration on a remote device, use the show etherchannel summary privileged EXEC command on the remote device.
When a port is in the error-disabled state because of an EtherChannel misconfiguration, you can bring it out of this state by entering the errdisable recovery cause channel-misconfig global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.
Examples
This example shows how to enable the EtherChannel guard misconfiguration feature:
Switch(config)# spanning-tree etherchannel guard misconfigYou can verify your settings by entering the show spanning-tree summary privileged EXEC command.
Related Commands
errdisable recovery cause channel-misconfig
Enables the timer to recover from the EtherChannel misconfiguration error-disabled state.
show etherchannel summary
Displays EtherChannel information for a channel as a one-line summary per channel-group.
show interfaces status err-disabled
Displays the interfaces in the error-disabled state.
spanning-tree extend system-id
Use the spanning-tree extend system-id global configuration command to enable the extended system ID feature.
spanning-tree extend system-id
Note
Syntax Description
This command has no arguments or keywords.
Defaults
The extended system ID is enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
The switch supports the IEEE 802.1t spanning-tree extensions. Some of the bits previously used for the switch priority are now used for the extended system ID (VLAN identifier for the per-VLAN spanning-tree plus [PVST+] and rapid PVST+ or as an instance identifier for the multiple spanning tree [MST]).
The spanning tree uses the extended system ID, the switch priority, and the allocated spanning-tree MAC address to make the bridge ID unique for each VLAN or multiple spanning-tree instance.
Support for the extended system ID affects how you manually configure the root switch, the secondary root switch, and the switch priority of a VLAN. For more information, see the "spanning-tree mst root" and the "spanning-tree vlan" sections.
If your network consists of switches that do not support the extended system ID and switches that do support it, it is unlikely that the switch with the extended system ID support will become the root switch. The extended system ID increases the switch priority value every time the VLAN number is greater than the priority of the connected switches.
Related Commands
show spanning-tree summary
Displays a summary of spanning-tree interface states.
Configures the MST root switch priority and timers based on the network diameter.
spanning-tree vlan priority
Sets the switch priority for the specified spanning-tree instance.
spanning-tree guard
Use the spanning-tree guard interface configuration command to enable root guard or loop guard on all the VLANs associated with the selected interface. Root guard restricts which interface is allowed to be the spanning-tree root port or the path-to-the root for the switch. Loop guard prevents alternate or root ports from becoming designated ports when a failure creates a unidirectional link. Use the no form of this command to return to the default setting.
spanning-tree guard {loop | none | root}
no spanning-tree guard
Syntax Description
Defaults
Root guard is disabled.
Loop guard is configured according to the spanning-tree loopguard default global configuration command (globally disabled).
Command Modes
Interface configuration
Command History
Usage Guidelines
You can enable root guard or loop guard when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.
When root guard is enabled, if spanning-tree calculations cause an interface to be selected as the root port, the interface transitions to the root-inconsistent (blocked) state to prevent the customer's switch from becoming the root switch or being in the path to the root. The root port provides the best path from the switch to the root switch.
When the no spanning-tree guard or the no spanning-tree guard none command is entered, root guard is disabled for all VLANs on the selected interface. If this interface is in the root-inconsistent (blocked) state, it automatically transitions to the listening state.
Do not enable root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state. The UplinkFast feature is not available when the switch is operating in the rapid-PVST+ or MST mode.
Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports. When the switch is operating in MST mode, BPDUs are not sent on nonboundary interfaces if the interface is blocked by loop guard in all MST instances. On a boundary interface, loop guard blocks the interface in all MST instances.
To disable root guard or loop guard, use the spanning-tree guard none interface configuration command. You cannot enable both root guard and loop guard at the same time.
You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command.
Examples
This example shows how to enable root guard on all the VLANs associated with the specified port:
Switch(config)# interface gigabitethernet0/2Switch(config-if)# spanning-tree guard rootThis example shows how to enable loop guard on all the VLANs associated with the specified port:
Switch(config)# interface gigabitethernet0/2Switch(config-if)# spanning-tree guard loopYou can verify your settings by entering the show running-config privileged EXEC command.
Related Commands
show running-config
Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
Sets the path cost for spanning-tree calculations.
Prevents alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link.
Configures the path cost for MST calculations.
Configures an interface priority.
Configures the MST root switch priority and timers based on the network diameter.
Configures an interface priority.
spanning-tree vlan priority
Sets the switch priority for the specified spanning-tree instance.
spanning-tree link-type
Use the spanning-tree link-type interface configuration command to override the default link-type setting, which is determined by the duplex mode of the interface, and to enable rapid spanning-tree transitions to the forwarding state. Use the no form of this command to return to the default setting.
spanning-tree link-type {point-to-point | shared}
no spanning-tree link-type
Syntax Description
point-to-point
Specify that the link type of an interface is point-to-point.
shared
Specify that the link type of an interface is shared.
Defaults
The switch derives the link type of an interface from the duplex mode. A full-duplex interface is considered a point-to-point link, and a half-duplex interface is considered a shared link.
Command Modes
Interface configuration
Command History
Usage Guidelines
You can override the default setting of the link type by using the spanning-tree link-type command. For example, a half-duplex link can be physically connected point-to-point to a single interface on a remote switch running the Multiple Spanning Tree Protocol (MSTP) or the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol and be enabled for rapid transitions.
Examples
This example shows how to specify the link type as shared (regardless of the duplex setting) and to prevent rapid transitions to the forwarding state:
Switch(config-if)# spanning-tree link-type sharedYou can verify your setting by entering the show spanning-tree mst interface interface-id or the show spanning-tree interface interface-id privileged EXEC command.
Related Commands
