-
Catalyst 4500 Series Switch Cisco IOS Command Reference, 12.2(50)SG
-
Quick Links to Catalyst 4500 Series Switch Cisco IOS Commands
-
Index
-
Preface
-
Command-Line Interface
-
aaa accounting dot1x default start-stop group radius through instance
-
interface port-channel through shape
-
show access-group mode interface through show vtp
-
snmp ifindex clear through vtp v2-mode
-
Acronyms and Abbreviations
-
Table Of Contents
Cisco IOS Commands for the Catalyst 4500 Series Switches
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
access-list hardware capture mode
authentication control-direction
authentication critical recovery delay
clear interface gigabitethernet
clear ip arp inspection statistics
clear ip dhcp snooping binding
clear ip dhcp snooping database
clear ip dhcp snooping database statistics
clear ip igmp snooping membership
clear mac-address-table dynamic
clear pppoe intermediate-agent statistics
debug platform packet protocol lacp
debug platform packet protocol pagp
debug pppoe intermediate-agent
debug spanning-tree backbonefast
debug spanning-tree uplinkfast
hw-module uplink mode shared-backplane
Cisco IOS Commands for the Catalyst 4500 Series Switches
This chapter contains an alphabetical listing of Cisco IOS commands for the Catalyst 4500 series switches. For information about Cisco IOS commands that are not included in this publication, refer to Cisco IOS Release 12.2 configuration guides and command references at this URL:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_product_indices_list.html
#macro keywords
To specify the help string for the macro keywords, use the #macro keywords command.
#macro keywords [keyword1] [keyword2] [keyword3]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Global configuration mode
Command History
12.2(18)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
If you do not specify the mandatory keywords for a macro, the macro is to be considered invalid and fails when you attempt to apply it. By enteringthe #macro keywords command, you will receive a message indicating what you need to include to make the syntax valid.
Examples
This example shows how to specify the help string for keywords associated with a macro named test:
Switch(config)# macro name testmacro name testEnter macro commands one per line. End with the character '@'.#macro keywords $VLAN $MAXswichport@Switch(config)# int gi1/1Switch(config-if)# macro apply test ?WORD Keyword to replace with a value e.g $VLAN, $MAX << It is shown as help<cr>Related Commands
aaa accounting dot1x default start-stop group radius
To enable accounting for 802.1X authentication sessions, use the aaa accounting dot1x default start-stop group radius command. To disable accounting, use the no form of this command.
aaa accounting dot1x default start-stop group radius
no aaa accounting dot1x default start-stop group radius
Syntax Description
This command has no arguments or keywords.
Defaults
Accounting is disabled.
Command Modes
Global configuration mode
Command History
12.2(18)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
802.1X accounting requires a RADIUS server.
This command enables the Authentication, Authorization, and Accounting (AAA) client's accounting feature to forward 802.1X update and watchdog packets from the 802.1X supplicant (workstation client) to the authentication (RADIUS) server. (Watchdog packets are defined as EAPOL-LOGON, EAPOL-LOGOFF, and EAPOL-INTERIM messages.) Successful authentication and authorization of the supplicant by the authentication server is required before these packets are considered valid and are forwarded. When the client is reauthenticated, an interim-update accounting notice is sent to the accounting server.
Examples
This example shows how to configure 802.1X accounting:
Switch(config)# aaa accounting dot1x default start-stop group radius
Note
The RADIUS authentication server must be properly configured to accept and log update or watchdog packets from the AAA client.
Related Commands
aaa accounting system default start-stop group radius
To receive the session termination messages after the switch reboots, use the aaa accounting system default start-stop group radius command. To disable accounting, use the no form of this command.
aaa accounting system default start-stop group radius
no aaa accounting system default start-stop group radius
Syntax Description
This command has no arguments or keywords.
Defaults
Accounting is disabled.
Command Modes
Global configuration mode
Command History
12.2(18)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
802.1X accounting requires the RADIUS server.
This command enables the AAA client's accounting feature to forward 802.1X update and watchdog packets from the 802.1X supplicant (workstation client) to the authentication (RADIUS) server. (Watchdog packets are defined as EAPOL-LOGON, EAPOL-LOGOFF, and EAPOL-INTERIM messages.) Successful authentication and authorization of the supplicant by the authentication server is required before these packets are considered valid and are forwarded. When the client is reauthenticated, an interim-update accounting notice is sent to the accounting server.
Examples
This example shows how to generate a logoff after a switch reboots:
Switch(config)# aaa accounting system default start-stop group radius
Note
Related Commands
access-group mode
To specify the override modes (for example, VACL overrides PACL) and the non-override modes (for example, merge or strict mode), use the access-group mode command. To return to preferred port mode, use the no form of this command.
access-group mode {prefer {port | vlan} | merge}
no access-group mode {prefer {port | vlan} | merge}
Syntax Description
Defaults
PACL override mode
Command Modes
Interface configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
On the Layer 2 interface, prefer port, prefer VLAN, and merge modes are supported. A Layer 2 interface can have one IP ACL applied in either direction (one inbound and one outbound).
Examples
This example shows how to make the PACL mode on the switch take effect:
(config-if)# access-group mode prefer portThis example shows how to merge applicable ACL features:
(config-if)# access-group mode mergeRelated Commands
access-list hardware capture mode
To select the mode of capturing control packets, use the access-list hardware capture mode command.
access-list hardware capture mode {global | vlan}
Syntax Description
global
Specifies the capture of control packets globally on all VLANs.
vlan
Specifies the capture of control packets on a specific VLAN.
Defaults
The control packets are globally captured.
Command Modes
Global configuration mode
Command History
12.2(40)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
This command is not supported on the Supervisor Engine 6-E and Catalyst 4900M chassis.
Before configuring the capture mode, it is best to examine and modify your configuration to globally disable features such as DHCP snooping or IGMP snooping, and instead enable them on specific VLANs.
When changing to path managed mode, be aware that control traffic may be bridged in hardware or dropped initially until the per-vlan CAM entries are programmed in hardware.
You must ensure that any access control configuration on a member port or VLAN does not deny or drop the control packets from being forwarded to the CPU for the features which are enabled on the VLAN. If control packets are not permitted then the specific feature does not function.
Examples
This example shows how to configure the switch to capture control packets on VLANs that are configured to enable capturing control packets.
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# access-list hardware capture mode vlanSwitch(config)# endSwitch#This example shows how to configure the switch to capture control packets globally across all VLANs (using a static ACL).
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# access-list hardware capture mode globalSwitch(config)# endSwitch#This example shows another way to configure the switch to capture control packets globally across all VLANs.
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# no access-list hardware capture mode vlanSwitch(config)# endSwitch#access-list hardware entries
To designate how ACLs are programmed into the switch hardware, use the access-list hardware entries command.
access-list hardware entries {packed | scattered}
Syntax Description
Defaults
The ACLs are programmed as packed.
Command Modes
Global configuration mode
Command History
12.2(20)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
Two types of hardware resources are used when ACLs are programmed: entries and masks. If one of these resources is consumed, no additional ACLs can be programmed into the hardware. If the masks are consumed, but the entries are available, change the programming algorithm from packed to scattered to make the masks available. This action allows additional ACLs to be programmed into the hardware.
The goal is to use TCAM resources more efficiently; that is, to minimize the number of masks per ACL entries. To compare TCAM utilization when using the scattered or packed algorithms, use the
show platform hardware acl statistics utilization brief command. To change the algorithm from packed to scattered, use the access-list hardware entries command.Examples
This example shows how to program ACLs into the hardware as packed. After they are programmed, you will need 89 percent of the masks to program only 49 percent of the ACL entries.
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# access-list hardware entries packedSwitch(config)# endSwitch#01:15:34: %SYS-5-CONFIG_I: Configured from console by consoleSwitch#Switch# show platform hardware acl statistics utilization briefEntries/Total(%) Masks/Total(%)----------------- ---------------Input Acl(PortAndVlan) 2016 / 4096 ( 49) 460 / 512 ( 89)Input Acl(PortOrVlan) 6 / 4096 ( 0) 4 / 512 ( 0)Input Qos(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Input Qos(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Acl(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Acl(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Qos(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Qos(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0)L4Ops: used 2 out of 64Switch#This example shows how to reserve space (scatter) between ACL entries in the hardware. The number of masks required to program 49 percent of the entries has decreased to 49 percent.Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# access-list hardware entries scatteredSwitch(config)# endSwitch#01:39:37: %SYS-5-CONFIG_I: Configured from console by consoleSwitch#Switch# show platform hardware acl statistics utilization briefEntries/Total(%) Masks/Total(%)----------------- ---------------Input Acl(PortAndVlan) 2016 / 4096 ( 49) 252 / 512 ( 49)Input Acl(PortOrVlan) 6 / 4096 ( 0) 5 / 512 ( 0)Input Qos(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Input Qos(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Acl(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Acl(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Qos(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0)Output Qos(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0)L4Ops: used 2 out of 64Switch#access-list hardware region
To modify the balance between TCAM regions in hardware, use the access-list hardware region command.
access-list hardware region {feature | qos} {input | output} balance {bal-num}
Syntax Description
Defaults
The default region balance for each TCAM is 50.
Command Modes
Global configuration mode
Command History
12.2(31)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
PandV is a TCAM region containing entries which mask in both the port and VLAN tag portions of the flow label.
PorV is a TCAM region containing entries which mask in either the port or VLAN tag portion of the flow label, but not both.
A balance of 1 allocates the minimum number of PandV region entries and the maximum number of PorV region entries. A balance of 99 allocates the maximum number of PandV region entries and the minimum number of PorV region entries. A balance of 50 allocates equal numbers of PandV and PorV region entries in the specified TCAM.
Balances for the four TCAMs can be modified independently.
Examples
This example shows how to enable the MAC notification trap when a MAC address is added to a port:
Switch# configure terminalSwitch(config)# access-list hardware region feature input balance 75Switch(config)#action
To specify an action to be taken when a match occurs in a VACL, use the action command. To remove an action clause, use the no form of this command.
action {drop | forward}
no action {drop | forward}
Syntax Description
drop
Sets the action to drop packets.
forward
Sets the action to forward packets to their destination.
Defaults
This command has no default settings.
Command Modes
VLAN access-map
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
In a VLAN access map, if at least one ACL is configured for a packet type (IP or MAC), the default action for the packet type is drop (deny).
If an ACL is not configured for a packet type, the default action for the packet type is forward (permit).
If an ACL for a packet type is configured and the ACL is empty or undefined, the configured action will be applied to the packet type.
Examples
This example shows how to define a drop action:
Switch(config-access-map)# action dropSwitch(config-access-map)#This example shows how to define a forward action:
Switch(config-access-map)# action forwardSwitch(config-access-map)#Syntax Description
ancp client port identifier
To create a mapping fore an ANCP client to identify an interface on which ANCP should start or stop a multicast stream, use the ancp client port identifier command.
ancp client port identifier identifying name vlan vlan number interface interface
Syntax Description
identifier name
Identifier that is used by the ANCP server to specify an interface member of a VLAN.
vlan vlan number
VLAN identifier.
interface interface
Interface member of this VLAN.
Defaults
This command has no default settings.
Command Modes
Configuration mode
Command History
12.2(50)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
The ANCP server can use either the DHCP option 82 circuit ID to identify the port or an identifier created with this command. Use only one of the two methods; do not interchange them. If you use the DHCP option 82, the port identifier used by the ANCP server should be (in hex) 0x01060004[vlan][intf]. For example, VLAN 19 and interface Fast Ethernet 2/3 will provide: 0x0106000400130203. If you use the port identifier, however, use the exact string provided on the CLI.
Note
Examples
This example shows how to identify interface FastEthernet 7/3 on VLAN 10 with the string NArmstrong:
Switch# ancp client port identifier NArmstrong vlan 10 interface FastEthernet 7/3Switch#Related Commands
ancp client server
To set the IP address of the remote ANCP server, use the ancp client server command.
ancp client server ipaddr of server interface interface
Syntax Description
ipaddr of server
IP address of the ANCP server the client must connect with TCP
interface interface
Interface to use for the connection
Defaults
This command has no default settings.
Command Modes
Configuration mode
Command History
12.2(50)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
The interface can be the direct interface connected towards the ANCP server (if only one) or a loopback interface if several interfaces are available for connecting to the server and proper routing is set. (An IP address must be configured on this interface and it should not be in shutdown state.) Along with the ancp mode client command, the ancp client server command is required in order to activate the ANCP client. Once you enter this command, the ANCP client tries to connect to the remote server.
Examples
This example shows how to indicate to the ANCP client the IP address of the ANCP server it needs to connect to.
Switch# ancp client server 10.1.2.31 interface FastEthernet 2/1Switch#Related Commands
ancp mode client
To set the router to become an ANCP client, use the ancp mode client command.
ancp mode client
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Configuration mode
Command History
12.2(50)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
To fully activate ANCP, the administrator must also set the ANCP server IP address to which the ANCP client must connect.
Examples
This example shows how to set the router to become an ANCP client:
Switch# ancp mode clientSwitch#Related Commands
apply
To implement a new VLAN database, increment the configuration number, save the configuration number in NVRAM, and propagate the configuration number throughout the administrative domain, use the apply command.
apply
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
VLAN configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
The apply command implements the configuration changes that you made after you entered VLAN database mode and uses them for the running configuration. This command keeps you in VLAN database mode.
You cannot use this command when the switch is in the VTP client mode.
You can verify that the VLAN database changes occurred by entering the show vlan command from privileged EXEC mode.
Examples
This example shows how to implement the proposed new VLAN database and to recognize it as the current database:
Switch(config-vlan)# applySwitch(config-vlan)#Related Commands
arp access-list
To define an ARP access list or add clauses at the end of a predefined list, use the arp access-list command.
arp access-list name
Syntax Description
Defaults
None
Command Modes
Configuration
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to define an ARP access list named static-hosts:
Switch(config)# arp access-list static-hostsSwitch(config)#Related Commands
attach module
To remotely connect to a specific module, use the attach module configuration command.
attach module mod
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
This command applies only to the Access Gateway Module on Catalyst 4500 series switches.
The valid values for mod depend on the chassis that are used. For example, if you have a Catalyst 4506 chassis, valid values for the module are from 2 to 6. If you have a 4507R chassis, valid values are from 3 to 7.
When you execute the attach module mod command, the prompt changes to Gateway#.
This command is identical in the resulting action to the session module mod and the remote login module mod commands.
Examples
This example shows how to remotely log in to an Access Gateway Module:
Switch# attach module 5Attaching console to module 5Type 'exit' at the remote prompt to end the sessionGateway>Related Commands
Remotely connects to a specific module.
Logs in to the standby supervisor engine using a virtual console.
authentication control-direction
To change the port control to unidirectional or bidirectional, use the authentication control-direction command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication control-direction {both | in}
no authentication control-direction
Syntax Description
Command Default
Bidirectional control on the port is enabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
The authentication control-direction command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:
dot1x control-direction {both | in}
The IEEE 802.1X standard defines a client-server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports.IEEE 802.1X controls network access by creating two distinct virtual access points at each port. One access point is an uncontrolled port; the other is a controlled port. All traffic through the single port is available to both access points. IEEE 802.1X authenticates each user device that connects to a switch port and assigns the port to a VLAN before making available any services that are offered by the switch or the LAN. Until the device authenticates, 802.1X access control allows only Extensible Authentication Protocol (EAP) over LAN (EAPOL) traffic through the port to which the device connects. After authentication succeeds, normal traffic can pass through the port.
Unidirectional State—When you configure a port as unidirectional with the
dot1x control-direction interface configuration command, the port changes to the spanning-tree forwarding state.When the Unidirectional Controlled Port is enabled, the connected host is in sleeping mode or power-down state. The host does not exchange traffic with other devices in the network. If the host connected to the unidirectional port that cannot send traffic to the network, the host can only receive traffic from other devices in the network.
Bidirectional State—When you configure a port as bidirectional with the dot1x control-direction interface configuration command, the port is access-controlled in both directions. In this state, the switch port sends only EAPOL.
Using the both keyword or using the no form of this command changes the port to its bidirectional default setting.
Setting the port as bidirectional enables 802.1X authentication with Wake-on-LAN (WoL).
You can verify your settings by entering the show authentication privileged EXEC command.
Examples
The following example shows how to enable unidirectional control:
Switch(config-if)# authentication control-direction inSwitch(config-if)#The following example shows how to enable bidirectional control:
Switch(config-if)# authentication control-direction bothSwitch(config-if)#The following example shows how to return to the default settings:
Switch(config-if)# no authentication control-directionSwitch(config-if)#Related Commands
authentication critical recovery delay
To configure the 802.1X critical authentication parameters, use the
authentication critical recovery delay command in global configuration mode. To return to the default settings, use the no form of this command.authentication critical recovery delay milliseconds
no authentication critical recovery delay
Syntax Description
milliseconds
Specifies the recovery delay period in milliseconds to wait to reinitialize a critical port when an unavailable RADIUS server becomes available. Range: 1 to 10000.
Command Default
10,000 milliseconds
Command Modes
Global configuration
Command History
Usage Guidelines
The authentication critical recovery delay command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:
dot1x critical recovery delay milliseconds
You can verify your settings by entering the show authentication privileged EXEC command.
Examples
This example shows how to set the recovery delay period that the switch waits to reinitialize a critical port when an unavailable RADIUS server becomes available:
Switch(config)# authentication critical recovery delay 1500Switch(config)#Related Commands
authentication event
To configure the actions for authentication events, use the authentication event interface configuration command. To return to the default settings, use the no form of this command.
authentication event fail [retry count] action [authorize vlan vlan | next-method}
authentication event server {alive action reinitialize | dead action authorize [vlan vlan]}
authentication event no-response action authorize vlan vlan
no authentication event {fail} | {server {alive | dead}} | {no-response}
Syntax Description
Command Default
The default settings are as follows:
•
•
Command Modes
Interface configuration
Command History
Usage Guidelines
The authentication event fail command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:
•
•
The authentication event fail command is supported only for dot1x to signal authentication failures. By default, this type of failure causes the authentication method to be retried. You can configure to either authorize the port in the configured VLAN or failover to the next authentication method. Optionally, you can specify the number of authentication retries before performing this action.
The authentication event server command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:
•
•
•
The authentication event server command specifies the behavior when the AAA server becomes unreachable, ports are authorized in the specified VLAN.
The authentication server alive action command specifies the action to be taken once the AAA server becomes reachable again.
You can verify your settings by entering the show authentication privileged EXEC command.
The authentication event no-response command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:
•
The authentication event no-response command specifies the action to be taken when the client doesn't support 802.1x.
Examples
The following example shows how to specify that when an authentication fails due to bad user credentials, the process advances to the next authentication method:
Switch(config-if)# authentication event fail action next-methodSwitch(config-if)#The following example shows how to specify the AAA server alive actions as reinitialize all authorized clients for authentication events:
Switch(config-if)# authentication event server alive action reinitializeSwitch(config-if)#The following example shows how to specify the AAA server dead actions that authorize the port for authentication events:
Switch(config-if)# authentication event server dead action authorizeSwitch(config-if)#The following example shows how to specify the conditions when a client doesn't support 802.1X to authorize the port for authentication events:
Switch(config-if)# authentication event authentication event no-response action authorize vlan 10Switch(config-if)#Related Commands
authentication fallback
To enable WebAuth fallback and to specify the fallback profile to use when failing over to WebAuth, use the authentication fallback interface command. To return to the default setting, use the no form of this command.
authentication fallback profile
Syntax Description
Command Default
Disabled
Command Modes
Interface configuration
Command History
Usage Guidelines
By default, if 802.1X times out and if MAB fails, WebAuth is enabled.
The authentication fallback command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:
[no] dot1x fallback profile
The Webauth fallback feature allows you to have those clients that do not have an 802.1X supplicant and are not managed devices to fall back to the WebAuth method.
You can verify your settings with the show authentication privileged EXEC command.
Examples
This example shows how to enable WebAuth fallback and specify the fallback profile to use when failing over to WebAuth:
Switch(config-if)# authentication fallback fallbacktest1Switch(config-if)#This example shows how to disable WebAuth fallback:
Switch(config-if)# no authentication fallback fallbacktest1Switch(config-if)#Related Commands
authentication host-mode
To define the classification of a session that will be used to apply the access-policies in host-mode configuration, use the authentication host-mode command in interface configuration mode. To return to the default settings, use the no form of this command.
authentication host-mode {single-host | multi-auth | multi-domain | multi-host} [open]
Syntax Description
Command Default
This command has no default settings.
Command Modes
Interface configuration
Command History
Usage Guidelines
Single-host mode classifies the session as an interface session (for example, one MAC per interface). Only one client is allowed on the port, and any policies that are downloaded for the client are applied to the whole port. A security violation is triggered if more than one client is detected.
Multi-host mode classifies the session as an interface session, but the difference with this host-mode is that it allows more than one client to attach to the port. Only the first client that is detected on the port will be authenticated and the rest will inherit the same access as the first client. The policies that are downloaded for the first client will be applied to the whole port.
Multi-domain mode classifies the session based on a combination of MAC address and domain, with the restriction that only one MAC is allowed per domain. The domain in the switching environment refers to the VLAN, and the two supported domains are the DATA domain and the voice domain. Only one client is allowed on a particular domain. So, only two clients (MACs) per port are supported. Each one is required to authenticate separately. Any policies that are downloaded for the client will be applied for that client's MAC/IP only and will not affect the other on the same port. The clients can be authenticated using different methods (like 802.1X for PC, MAB for IP phone, or vice versa). No restriction exists on the authentication order.
The only caveat with the above statement is that web-based authentication is only available for data devices because a user is probably operating the device and HTTP capability exists. Also, if web-based authentication is configured in MDA mode, the only form of enforcement for all types of devices is downloadable ACLs (dACL). The restriction is in place because VLAN assignment is not supported for web-based authentication. Furthermore, if you use dACLs for data devices and not for voice devices, when the user's data falls back to webauth, voice traffic is affected by the ACL that is applied based on the fallback policy. Therefore if webauth is configured as a fallback on an MDA enabled port, dACL is the only supported enforcement method.
Multi-auth mode classifies the session as a MAC-based. No limit exists for the number of clients allowed on a port data domain. Only one client is allowed in a voice domain and each one is required to authenticate separately. Any policies that are downloaded for the client are applied for that client's MAC or IP only and do not affect others on the same port.
The optional pre-authentication open access mode allows you to gain network access before authentication is performed.This is primarily required for the PXE boot scenario, but not limited to just that use case, where a device needs to access the network before PXE times out and downloads a bootable image possibly containing a supplicant.
The configuration related to this feature is attached to the host-mode configuration whereby the host-mode itself is significant for the control plane, while the open access configuration is significant for the data plane. Open-access configuration has absolutely no bearing on the session classification. The host-mode configuration still controls this. If the open-access is defined for single-host mode, the port still allows only one MAC address. The port forwards traffic from the start and is only restricted by what is configured on the port. Such configurations are independent of 802.1X. So, if there is no form of access-restriction configured on the port, the client devices have full access on the configured VLAN.
You can verify your settings with the show authentication privileged EXEC command.
Examples
This example shows how to define the classification of a session that are used to apply the access-policies using the host-mode configuration:
Switch(config-if)# authentication host-mode single-hostSwitch(config-if)#Related Commands
authentication open
To enable open access on this port, use the authentication open command in interface configuration mode. To disable open access on this port, use the no form of this command.
authentication open
no authentication open
Syntax Description
This command has no arguments or keywords.
Command Default
Disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
Open Access allows clients or devices to gain network access before authentication is performed.
You can verify your settings with the show authentication privileged EXEC command.
This command overrides the authentication host-mode session-type open global configuration mode command for the port only.
Examples
The following example shows how to enable open access to a port:
Switch(config-if)# authentication openSwitch(config-if)#The following example shows how to enable open access to a port:
Switch(config-if)# no authentication openSwitch(config-if)#Related Commands
authentication order
To specify the order in which authentication methods should be attempted for a client on an interface, use the authentication order command in interface configuration mode. To return to the default settings, use the no form of this command.
authentication order method1 [method2] [method3]
no authentication order
Syntax Description
Command Default
The default order is dot1x, MAB, then WebAuth.
Command Modes
Interface configuration
Command History
Usage Guidelines
Once you enter the authentication order command, only those methods explicitly listed will run. Each method may be entered only once in the run list and no methods may be entered after you enter the webauth keyword.
Authentication methods are applied in the configured (or default) order until authentication succeeds. For authentication fails, failover to the next authentication method occurs (subject to the configuration of authentication event handling).
You can verify your settings with the show authentication privileged EXEC command.
Examples
The following example shows how to specify the order in which authentication methods should be attempted for a client on an interface:
Switch(config-if)# authentication order mab dot1x webauthSwitch(config-if)#Related Commands
authentication periodic
To enable reauthentication for this port, use the authentication periodic command in interface configuration mode. To disable reauthentication for this port, use the no form of this command.
authentication periodic
no authentication periodic
Syntax Description
This command has no arguments or keywords.
Command Default
Disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
The authentication periodic command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:
[no] dot1x reauthentication
The reauthentication period can be set using the authentication timer command.
You can verify your settings by entering the show authentication privileged EXEC command.
Examples
The following example shows how to enable reauthentication for this port:
Switch(config-if)# authentication reauthenticationSwitch(config-if)#The following example shows how to disable reauthentication for this port:
Switch(config-if)# no authentication reauthenticationSwitch(config-if)#Related Commands
Configures the authentication timer.
Displays Authentication Manager information.
authentication port-control
To configure the port-control value, use the authentication port-control command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication port-control [auto | force-authorized | force-unauthorized]
no authentication port-control
Syntax Description
Command Default
All access through the interface is denied.
Command Modes
Interface configuration
Command History
Usage Guidelines
The authentication port-control command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:
[no] dot1x port-control [auto | force-authorized | force-unauthorized]
The following guidelines apply to Ethernet switch network modules:
•
•
–
–
–
To globally disable 802.1X on the device, you must disable it on each port. There is no global configuration command for this task.
You can verify your settings with the show authentication privileged EXEC command.
Examples
The following example shows that the authentication status of the client PC will be determined by the authentication process:
Switch(config-if)# authentication port-control autoSwitch(config-if)#Related Commands
authentication priority
To specify the priority of authentication methods on an interface, use the authentication priority command in interface configuration mode. To return to the default settings, use the no form of this command.
authentication priority method1 [method2] [method3]
no authentication priority
Syntax Description
Command Default
The default order is dot1x, MAB, then webauth.
Command Modes
Interface configuration
Command History
Usage Guidelines
Configuring priorities for authentication methods allows a higher priority method (not currently running) to interrupt an authentication in progress with a lower priority method. Alternatively, if the client is already authenticated, an interrupt from a higher priority method can cause a client, which was previously authenticated using a lower priority method, to reauthenticate.
The default priority of a method is equivalent to its position in the order of execution list. If you do not configure a priority, the relative priorities (highest first) are dot1x, MAB and then webauth. If you enter the authentication order command, the default priorities are the same as the configured order.
You can verify your settings with the show authentication privileged EXEC command.
Examples
The following example shows how to specify the priority in which authentication methods should be attempted for a client on an interface:
Switch(config-if)# authentication priority mab dot1x webauthSwitch(config-if)#Related Commands
Specifies the order in which authentication methods should be attempted for a client on an interface.
Displays Authentication Manager information.
authentication timer
To configure the authentication timer, use the authentication timer command in interface configuration mode. To return to the default settings, use the no form of this command.
authentication timer {{inactivity value} | {reauthenticate {server | value}} | {restart value}}
no authentication timer {{inactivity value} | {reauthenticate value} | {restart value}}
Syntax Description
Command Default
The default settings are as follows:•
•
•
Command Modes
Interface configuration
Command History
Usage Guidelines
Reauthentication only occurs if it is enabled on the interface.
The authentication timer reauthenticate value command replaces the following dot1x command that is deprecated in Cisco IOS Release 12.2(50)SG and later releases:
[no] dot1x timeout {reauth-period seconds | quiet-period seconds | tx-period seconds | supp-timeout seconds | server-timeout seconds}
Note
During the inactivity period, the Ethernet switch network module does not accept or initiate any authentication requests. If you want to provide a faster response time to the user, enter a number less than the default.
The reauthenticate keyword affects the behavior of the Ethernet switch network module only if you have enabled periodic reauthentication with the authentication reauthentication global configuration command.
Examples
The following example shows how to specify that the reauthentication period value for the client should be obtained from the authentication, authorization, and accounting (AAA) server as Session-Timeout (RADIUS Attribute 27):
Switch(config-if)# authentication timer reauthenticate serverSwitch(config-if)#Related Commands
auto qos voip
To automatically configure quality of service (auto-QoS) for Voice over IP (VoIP) within a QoS domain, use the auto qos voip interface configuration command. To change the auto-QoS configuration settings to the standard QoS defaults, use the no form of this command.
auto qos voip {cisco-phone | trust}
no auto qos voip {cisco-phone | trust}
Syntax Description
Defaults
Auto-QoS is disabled on all interfaces.
Command Modes
Interface configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
Use this command to configure the QoS that is appropriate for VoIP traffic within the QoS domain. The QoS domain includes the switch, the interior of the network, and the edge devices that can classify incoming traffic for QoS.
Use the cisco-phone keyword on the ports at the edge of the network that are connected to Cisco IP phones. The switch detects the telephone through the Cisco Discovery Protocol (CDP) and trusts the CoS labels in packets that are received from the telephone.
Use the trust keyword on the ports that are connected to the interior of the network. Because it is assumed that the traffic has already been classified by the other edge devices, the CoS/DSCP labels in these packets are trusted.
When you enable the auto-QoS feature on the specified interface, these actions automatically occur:
•
•
•
•
You can enable auto-QoS on static, dynamic-access, voice VLAN access, and trunk ports.
To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. Use the debug auto qos privileged EXEC command to enable auto-QoS debugging.
To disable auto-QoS on an interface, use the no auto qos voip interface configuration command. When you enter this command, the switch enables standard QoS and changes the auto-QoS settings to the standard QoS default settings for that interface. This action will not change any global configuration performed by auto-QoS; the global configuration remains the same.
Examples
This example shows how to enable auto-QoS and to trust the CoS and DSCP labels that are received in the incoming packets when the switch or router that is connected to Gigabit Ethernet interface 1/1 is a trusted device:
Switch(config)# interface gigabitethernet1/1Switch(config-if)# auto qos voip trustThis example shows how to enable auto-QoS and to trust the CoS labels that are received in incoming packets when the device connected to Fast Ethernet interface 2/1 is detected as a Cisco IP phone:
Switch(config)# interface fastethernet2/1Switch(config-if)# auto qos voip cisco-phoneThis example shows how to display the QoS configuration that is automatically generated when auto-QoS is enabled on an interface on Supervisor Engines other than a Supervisor Engine 6-E:
Switch# debug auto qosAutoQoS debugging is onSwitch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet1/1Switch(config-if)# auto qos voip trustSwitch(config-if)#00:00:56:qos00:00:57:qos map cos 3 to dscp 2600:00:57:qos map cos 5 to dscp 4600:00:58:qos map dscp 32 to tx-queue 100:00:58:qos dbl00:01:00:policy-map autoqos-voip-policy00:01:00: class class-default00:01:00: dbl00:01:00:interface GigabitEthernet1/100:01:00: qos trust cos00:01:00: tx-queue 300:01:00: priority high00:01:00: shape percent 3300:01:00: service-policy output autoqos-voip-policySwitchconfig-if)# interface gigabitethernet1/1Switch(config-if)# auto qos voip cisco-phoneSwitch(config-if)#00:00:55:qos00:00:56:qos map cos 3 to dscp 2600:00:57:qos map cos 5 to dscp 4600:00:58:qos map dscp 32 to tx-queue 100:00:58:qos dbl00:00:59:policy-map autoqos-voip-policy00:00:59: class class-default00:00:59: dbl00:00:59:interface GigabitEthernet1/100:00:59: qos trust device cisco-phone00:00:59: qos trust cos00:00:59: tx-queue 300:00:59: priority high00:00:59: shape percent 3300:00:59: bandwidth percent 3300:00:59: service-policy output autoqos-voip-policyThis example shows how to display the QoS configuration that is automatically generated when auto-QoS is enabled on an interface on a Supervisor Engine 6-E:
Switch#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)#interface gigabitethernet3/10Switch(config-if)#auto qos voip trustSwitch(config-if)#1d03h: service-policy input AutoQos-VoIP-Input-Cos-Policy1d03h: service-policy output AutoQos-VoIP-Output-PolicySwitch(config-if)#intface gigabitethernet3/11Switch(config-if)#auto qos voipcisco-phoneSwitch(config-if)#1d03h: qos trust device cisco-phone1d03h: service-policy input AutoQos-VoIP-Input-Cos-Policy1d03h: service-policy output AutoQos-VoIP-Output-PolicySwitch(config-if)#endSwitch#You can verify your settings by entering the show auto qos interface command.
Related Commands
auto-sync
To enable automatic synchronization of the configuration files in NVRAM, use the auto-sync command. To disable automatic synchronization, use the no form of this command.
auto-sync {startup-config | config-register | bootvar | standard}
no auto-sync {startup-config | config-register | bootvar | standard}
Syntax Description
Defaults
Standard automatic synchronization of all configuration files
Command Modes
Redundancy main-cpu
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch (Catalyst 4507R only).
Usage Guidelines
If you enter the no auto-sync standard command, no automatic synchronizations occur.
Examples
This example shows how (from the default configuration) to enable automatic synchronization of the configuration register in the main CPU:
Switch# config terminalSwitch (config)# redundancySwitch (config-r)# main-cpuSwitch (config-r-mc)# no auto-sync standardSwitch (config-r-mc)# auto-sync configure-registerSwitch (config-r-mc)#Related Commands
bandwidth
To specify or modify the minimum bandwidth provided to a class belonging to a policy map attached to a physical port, use the bandwidth policy-map class command. To return to the default setting, use the no form of this command.
bandwidth {bandwidth-kbps | percent percent | remaining percent percent}
no bandwidth
Syntax Description
Defaults
No bandwidth is specified.
Command Modes
Policy-map class configuration
Command History
12.2(40)SG
This command was introduced on the Catalyst 4500 series switch using a Supervisor Engine 6E.
Usage Guidelines
Use the bandwidth command only in a policy map attached to a physical port.
The bandwidth command specifies the minimum bandwidth for traffic in that class when there is traffic congestion in the switch. If the switch is not congested, the class receives more bandwidth than you specify with this command.
When queuing class is configured without any explicit bandwidth configuration, since the queue is not guaranteed any minimum bandwidth, this queue will get a share of any unallocated bandwidth on the port.
If there is no unallocated bandwidth for the new queue or if the unallocated bandwidth is not sufficient to meet the minimum configurable rate for all queues which do not have any explicit bandwidth configuration, then the policy association is rejected.
These restrictions apply to the bandwidth command:
•
•
•
Examples
This example shows how to set the minimum bandwidth to 2000 kbps for a class called silver-class. The class already exists in the switch configuration.
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# policy-map polmap6Switch(config-pmap)# class silver-classSwitch(config-pmap-c)# bandwidth 2000Switch(config-pmap-c)# endThis example shows how to guarantee 30 percent of the bandwidth for class1 and 25 percent of the bandwidth for class2 when CBWFQ is configured. A policy map with two classes is created and is then attached to a physical port.
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# bandwidth percent 50Switch(config-pmap-c)# exitSwitch(config-pmap)# class class2Switch(config-pmap-c)# bandwidth percent 25Switch(config-pmap-c)# exitSwitch(config-pmap)# endSwitch(config)# interface gigabitethernet1/1Switch(config-if)# service-policy input policy1Switch(config-if)# endThis example shows how bandwidth is guaranteed if low-latency queueing (LLQ) and bandwidth are configured. In this example, LLQ is enabled in a class called voice1.
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# bandwidth remaining percent 50Switch(config-pmap-c)# exitSwitch(config-pmap)# class class2Switch(config-pmap-c)# bandwidth remaining percent 25Switch(config-pmap-c)# exitSwitch(config-pmap)# class voice1Switch(config-pmap-c)# prioritySwitch(config-pmap-c)# exitSwitch(config-pmap)# endSwitch(config)# interface gigabitethernet1/1Switch(config-if)# service-policy output policy1Switch(config-if)# endYou can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
channel-group
To assign and configure an EtherChannel interface to an EtherChannel group, use the channel-group command. To remove a channel group configuration from an interface, use the no form of this command.
channel-group number mode {active | on | auto [non-silent]} | {passive | desirable [non-silent]}
no channel-group
Syntax Description
Defaults
No channel groups are assigned.
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(13)EW
Support for LACP was added.
Usage Guidelines
You do not have to create a port-channel interface before assigning a physical interface to a channel group. If a port-channel interface has not been created, it is automatically created when the first physical interface for the channel group is created.
If a specific channel number is used for the PAgP-enabled interfaces of a channel group, that same channel number cannot be used for configuring a channel that has LACP-enabled interfaces or vice versa.
You can also create port channels by entering the interface port-channel command. This will create a Layer 3 port channel. To change the Layer 3 port channel into a Layer 2 port channel, use the switchport command before you assign physical interfaces to the channel group. A port channel cannot be changed from Layer 3 to Layer 2 or vice versa when it contains member ports.
You do not have to disable the IP address that is assigned to a physical interface that is part of a channel group, but we recommend that you do so.
Any configuration or attribute changes that you make to the port-channel interface are propagated to all interfaces within the same channel group as the port channel (for example, configuration changes are also propagated to the physical interfaces that are not part of the port channel, but are part of the channel group).
You can create in on mode a usable EtherChannel by connecting two port groups together.
Caution
Examples
This example shows how to add Gigabit Ethernet interface 1/1 to the EtherChannel group that is specified by port-channel 45:
Switch(config-if)# channel-group 45 mode onCreating a port-channel interface Port-channel45Switch(config-if)#Related Commands
Accesses or creates a port-channel interface.
show interfaces port-channel (refer to Cisco IOS documentation)
Displays the information about the Fast EtherChannel.
channel-protocol
To enable LACP or PAgP on an interface, use the channel-protocol command. To disable the protocols, use the no form of this command.
channel-protocol {lacp | pagp}
no channel-protocol {lacp | pagp}
Syntax Description
Defaults
PAgP
Command Modes
Interface configuration mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
This command is not supported on systems that are configured with a Supervisor Engine I.
You can also select the protocol using the channel-group command.
If the interface belongs to a channel, the no form of this command is rejected.
All ports in an EtherChannel must use the same protocol; you cannot run two protocols on one module.
PAgP and LACP are not compatible; both ends of a channel must use the same protocol.
You can manually configure a switch with PAgP on one side and LACP on the other side in the on mode.
You can change the protocol at any time, but this change causes all existing EtherChannels to reset to the default channel mode for the new protocol. You can use the channel-protocol command to restrict anyone from selecting a mode that is not applicable to the selected protocol.
Configure all ports in an EtherChannel to operate at the same speed and duplex mode (full duplex only for LACP mode).
For a complete list of guidelines, refer to the "Configuring EtherChannel" section of the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
Examples
This example shows how to select LACP to manage channeling on the interface:
Switch(config-if)# channel-protocol lacpSwitch(config-if)#Related Commands
Assigns and configures an EtherChannel interface to an EtherChannel group.
Displays EtherChannel information for a channel.
class
To specify the name of the class whose traffic policy you want to create or change, use the class policy-map configuration command. To delete an existing class from a policy map, use the no form of this command.
class class-name
no class class-name
Syntax Description
Defaults
No classes are defined; except for the class-default.
Command Modes
Policy-map configuration
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
Before using the class command, you must create a class map for matching packets to the class by using the class-map global configuration command. You also must use the policy-map global configuration command to identify the policy map and to enter policy-map configuration mode. After specifying a policy map, you can configure a traffic policy for new classes or modify a traffic policy for any existing classes in that policy map. The class name that you specify with the class command in the policy map ties the characteristics for that class—that is, its policy—to the class map and its match criteria, as configured through the class-map global configuration command. You attach the policy map to a port by using the service-policy (interface configuration) configuration command.
After you enter the class command, the switch enters policy-map class configuration mode, and these configuration commands are available:
•
•
•
•
•
•
•
•
•
•
The switch supports up to 256 classes, including the default class, in a policy map. Packets that fail to meet any of the matching criteria are classified as members of the default traffic class. You configure the default traffic class by specifying class-default as the class name in the class policy-map class configuration command. You can manipulate the default traffic class (for example, set policies to police or to shape it) just like any other traffic class, but you cannot delete it.
To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.
Examples
This example shows how to create a policy map called policy1. When attached to an ingress port, the policy matches all the inbound traffic defined in class1, sets the IP DSCP to 10, and polices the traffic at an average rate of 1 Mbps and bursts of 20 KB. Traffic exceeding the profile is marked down to a Traffic exceeding the profile is marked down to a DSCP value obtained from the policed-DSCP map and then sent.
Switch# configure terminalSwitch(config)# class-map class1Switch(config-cmap)# exitSwitch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# set ip dscp 10Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmitSwitch(config-pmap-c)# exitSwitch(config-pmap)# exitSwitch(config)# interface fastethernet1/0/4Switch(config-if)# service-policy input policy1Switch#You can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
class-map
To create a class map to be used for matching packets to the class whose name you specify and to enter class-map configuration mode, use the class-map global configuration command. To delete an existing class map and to return to global configuration mode, use the no form of this command.
class-map [match-all | match-any] class-map-name
no class-map [match-all | match-any] class-map-name
Syntax Description
Defaults
No class maps are defined.
If neither the match-all nor the match-any keyword is specified, the default is match-all.
Command Modes
Global configuration
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
Use this command to specify the name of the class for which you want to create or modify class-map match criteria and to enter class-map configuration mode. Packets are checked against the match criteria configured for a class map to decide if the packet belongs to that class. If a packet matches the specified criteria, the packet is considered a member of the class and is forwarded according to the quality of service (QoS) specifications set in the traffic policy.
After you enter the class-map command, the switch enters class-map configuration mode, and these configuration commands are available:
•
•
•
•
Examples
This example shows how to configure the class map called class1 with one match criterion, which is an access list called 103:
Switch# configure terminalSwitch(config)# access-list 103 permit any any dscp 10Switch(config)# class-map class1Switch(config-cmap)# match access-group 103Switch(config-cmap)# exitSwitch#This example shows how to delete the class1 class map:
Switch# configure terminalSwitch(config)# no class-map class1Switch#You can verify your settings by entering the show class-map privileged EXEC command.
Related Commands
clear counters
To clear the interface counters, use the clear counters command.
clear counters [{FastEthernet interface_number} | {GigabitEthernet interface_number} |
{null interface_number} | {port-channel number} | {vlan vlan_id}]Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses was added.
Usage Guidelines
This command clears all the current interface counters from all the interfaces unless you specify an interface.
Note
Examples
This example shows how to clear all the interface counters:
Switch# clear countersClear "show interface" counters on all interfaces [confirm] ySwitch#This example shows how to clear the counters on a specific interface:
Switch# clear counters vlan 200Clear "show interface" counters on this interface [confirm]ySwitch#Related Commands
show interface counters (refer to Cisco IOS documentation)
Displays interface counter information.
clear hw-module slot password
To clear the password on an intelligent line module, use the clear hw-module slot password command.
clear hw-module slot slot_num password
Syntax Description
Defaults
The password is not cleared.
Command Modes
Privileged EXEC mode
Command History
12.2(18)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
You only need to change the password once unless the password is reset.
Examples
This example shows how to clear the password from slot 5 on a line module:
Switch# clear hw-module slot 5 passwordSwitch#Related Commands
clear interface gigabitethernet
To clear the hardware logic from a Gigabit Ethernet IEEE 802.3z interface, use the clear interface gigabitethernet command.
clear interface gigabitethernet mod/port
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the hardware logic from a Gigabit Ethernet IEEE 802.3z interface:
Switch# clear interface gigabitethernet 1/1Switch#Related Commands
clear interface vlan
To clear the hardware logic from a VLAN, use the clear interface vlan command.
clear interface vlan number
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses added.
Examples
This example shows how to clear the hardware logic from a specific VLAN:
Switch# clear interface vlan 5Switch#Related Commands
clear ip access-template
To clear the statistical information in access lists, use the clear ip access-template command.
clear ip access-template access-list
Syntax Description
access-list
Number of the access list; valid values are from 100 to 199 for an IP extended access list, and from 2000 to 2699 for an expanded range IP extended access list.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the statistical information for an access list:
Switch# clear ip access-template 201Switch#clear ip arp inspection log
To clear the status of the log buffer, use the clear ip arp inspection log command.
clear ip arp inspection log
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the contents of the log buffer:
Switch# clear ip arp inspection logSwitch#Related Commands
Defines an ARP access list or adds clauses at the end of a predefined list.
Displays the status of the log buffer.
clear ip arp inspection statistics
To clear the dynamic ARP inspection statistics, use the clear ip arp inspection statistics command.
clear ip arp inspection statistics [vlan vlan-range]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the DAI statistics from VLAN 1 and how to verify the removal:
Switch# clear ip arp inspection statistics vlan 1Switch# show ip arp inspection statistics vlan 1Vlan Forwarded Dropped DHCP Drops ACL Drops---- --------- ------- ---------- ----------1 0 0 0 0Vlan DHCP Permits ACL Permits Source MAC Failures---- ------------ ----------- -------------------1 0 0 0Vlan Dest MAC Failures IP Validation Failures---- ----------------- ----------------------1 0 0Switch#Related Commands
Defines an ARP access list or adds clauses at the end of a predefined list.
Clears the status of the log buffer.
Displays the status of the log buffer.
clear ip dhcp snooping binding
To clear the DHCP snooping binding, use the clear ip dhcp snooping binding command.
clear ip dhcp snooping binding [*] [ip-address] [vlan vlan_num] [interface interface_num]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.2(44)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
These commands are mainly used to clear DHCP snooping binding entries.
DHCP snooping is enabled on a VLAN only if both the global snooping and the VLAN snooping are enabled.
Examples
This example shows how to clear all the DHCP snoop binding entries:
Switch#clear ip dhcp snooping binding *Switch#This example shows how to clear a specific DHCP snoop binding entry:
Switch#clear ip dhcp snooping binding 1.2.3.4Switch#This example shows how to clear all the DHCP snoop binding entries on the GigabitEthernet interface 1/1:
Switch#clear ip dhcp snooping binding interface gigabitEthernet 1/1Switch#This example shows how to clear all the DHCP snoop binding entries on VLAN 40:
Switch#clear ip dhcp snooping binding vlan 40Switch#Related Commands
clear ip dhcp snooping database
To clear the DHCP binding database, use the clear ip dhcp snooping database command.
clear ip dhcp snooping database
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the DHCP binding database:
Switch# clear ip dhcp snooping databaseSwitch#Related Commands
clear ip dhcp snooping database statistics
To clear the DHCP binding database statistics, use the clear ip dhcp snooping database statistics command.
clear ip dhcp snooping database statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the DHCP binding database:
Switch# clear ip dhcp snooping database statisticsSwitch#Related Commands
clear ip igmp group
To delete the IGMP group cache entries, use the clear ip igmp group command.
clear ip igmp group [{fastethernet mod/port} | {GigabitEthernet mod/port} | {host_name | group_address} {Loopback interface_number} | {null interface_number} |
{port-channel number} | {vlan vlan_id}]Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
The IGMP cache contains a list of the multicast groups of which hosts on the directly connected LAN are members.
To delete all the entries from the IGMP cache, enter the clear ip igmp group command with no arguments.
Examples
This example shows how to clear the entries for a specific group from the IGMP cache:
Switch# clear ip igmp group 224.0.255.1Switch#This example shows how to clear the IGMP group cache entries from a specific interface:
Switch# clear ip igmp group gigabitethernet 2/2Switch#Related Commands
clear ip igmp snooping membership
To clear the explicit host tracking database, use the clear ip igmp snooping membership command.
clear ip igmp snooping membership [vlan vlan_id]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(20)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
By default, the explicit host tracking database maintains a maximum of 1-KB entries. After you reach this limit, no additional entries can be created in the database. To create more entries, you will need to delete the database with the clear ip igmp snooping statistics vlan command.
Examples
This example shows how to display the IGMP snooping statistics for VLAN 25:
Switch# clear ip igmp snooping membership vlan 25Switch#Related Commands
clear ip mfib counters
To clear the global MFIB counters and the counters for all active MFIB routes, use the clear ip mfib counters command.
clear ip mfib counters
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear all the active MFIB routes and global counters:
Switch# clear ip mfib countersSwitch#Related Commands
clear ip mfib fastdrop
To clear all the MFIB fast-drop entries, use the clear ip mfib fastdrop command.
clear ip mfib fastdrop
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
If new fast-dropped packets arrive, the new fast-drop entries are created.
Examples
This example shows how to clear all the fast-drop entries:
Switch# clear ip mfib fastdropSwitch#Related Commands
Enables MFIB fast drop.
Displays all currently active fast-drop entries and shows whether fast drop is enabled.
clear lacp counters
To clear the statistics for all the interfaces belonging to a specific channel group, use the clear lacp counters command.
clear lacp [channel-group] counters
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
This command is not supported on systems that are configured with a Supervisor Engine I.
If you do not specify a channel group, all channel groups are cleared.
If you enter this command for a channel group that contains members in PAgP mode, the command is ignored.
Examples
This example shows how to clear the statistics for a specific group:
Switch# clear lacp 1 countersSwitch#Related Commands
clear mac-address-table
To clear the global counter entries from the Layer 2 MAC address table, use the clear mac-address-table command.
clear mac-address-table {dynamic [{address mac_addr} | {interface interface}] [vlan vlan_id] | notification}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
Usage Guidelines
Enter the clear mac-address-table dynamic command with no arguments to remove all dynamic entries from the table.
The clear mac-address-table notification command only clears the global counters which are displayed with show mac-address-table notification command. It does not clear the global counters and the history table of the CISCO-MAC-NATIFICATION-MIB.
Examples
This example shows how to clear all the dynamic Layer 2 entries for a specific interface (gi1/1):
Switch# clear mac-address-table dynamic interface gi1/1Switch#This example shows how to clear the MAC address notification counters:
Switch# clear mac-address-table notificationSwitch#Related Commands
clear mac-address-table dynamic
To clear the dynamic address entries from the Layer 2 MAC address table, use the clear mac-address-table dynamic command.
clear mac-address-table dynamic [{address mac_addr} | {interface interface}] [vlan vlan_id]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses added.
Usage Guidelines
Enter the clear mac-address-table dynamic command with no arguments to remove all dynamic entries from the table.
Examples
This example shows how to clear all the dynamic Layer 2 entries for a specific interface (gi1/1):
Switch# clear mac-address-table dynamic interface gi1/1Switch#Related Commands
clear pagp
To clear the port-channel information, use the clear pagp command.
clear pagp {group-number | counters}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear the port-channel information for a specific group:
Switch# clear pagp 32Switch#This example shows how to clear all the port-channel traffic filters:
Switch# clear pagp countersSwitch#Related Commands
clear port-security
To delete all configured secure addresses or a specific dynamic or sticky secure address on an interface from the MAC address table, use the clear port-security command.
clear port-security dynamic [address mac-addr [vlan vlan-id]] | [interface interface-id] [vlan access | voice]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Usage Guidelines
If you enter the clear port-security all command, the switch removes all the dynamic secure MAC addresses from the MAC address table.
Note
no switchport port-security mac-address command.If you enter the clear port-security dynamic interface interface-id command, the switch removes all the dynamic secure MAC addresses on an interface from the MAC address table.
Command History
12.2(18)EW
This command was first introduced on the Catalyst 4500 series switch.
12.2(31)SG
Add support for sticky port security.
Examples
This example shows how to remove all the dynamic secure addresses from the MAC address table:
Switch# clear port-security dynamicThis example shows how to remove a dynamic secure address from the MAC address table:
Switch# clear port-security dynamic address 0008.0070.0007This example shows how to remove all the dynamic secure addresses learned on a specific interface:
Switch# clear port-security dynamic interface gigabitethernet0/1You can verify that the information was deleted by entering the show port-security command.
Related Commands
Displays information about the port-security setting.
Enables port security on an interface.
clear pppoe intermediate-agent statistics
To clear PPPoE Intermediate Agent statistics (packet counters), use the
clear pppoe intermediate-agent statistics command.clear ppoe intermediate-agent statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.2(50)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to clear PPPoE Intermediate Agent statistics:.
Switch# clear pppoe intermediate-agent statisticsSwitch#Related Commands
show pppoe intermediate-agent statistics (refer to the Cisco IOS Release 12.2 Command Reference)
Displays PPPoE Intermediate Agent statistics (packet counters).
clear qos
To clear the global and per-interface aggregate QoS counters, use the clear qos command.
clear qos [aggregate-policer [name] | interface {{fastethernet | GigabitEthernet} {mod/interface}} | vlan {vlan_num} | port-channel {number}]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
This command is not supported on the Supervisor Engine 6-E and Catalyst 4900M chassis.
Note
The clear qos command resets the interface QoS policy counters. If no interface is specified, the clear qos command resets the QoS policy counters for all interfaces.
Examples
This example shows how to clear the global and per-interface aggregate QoS counters for all the protocols:
Switch# clear qosSwitch#This example shows how to clear the specific protocol aggregate QoS counters for all the interfaces:
Switch# clear qos aggregate-policerSwitch#Related Commands
clear vlan counters
To clear the software-cached counter values to start from zero again for a specified VLAN or all existing VLANs, use the clear vlan counters command.
clear vlan [vlan-id] counters
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
If you do not specify a vlan-id value; the software-cached counter values for all the existing VLANs are cleared.
Examples
Switch# clear vlan 10 countersClear "show vlan" counters on this vlan [confirm]ySwitch#Related Commands
clear vmps statistics
To clear the VMPS statistics, use the clear vmps statistics command.
clear vmps statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Examples
Switch# clear vmps statisticsSwitch#Related Commands
Displays VMPS information.
Changes the reconfirmation interval for the VLAN Query Protocol (VQP) client.
control-plane
To enter control-plane configuration mode, which allows users to associate or modify attributes or parameters (such as a service policy) that are associated with the control plane of the device, use the control-plane command.
control-plane
Syntax Description
This command has no arguments or keywords.
Defaults
Default service police named "system-cpp-policy" is attached.
Command Modes
Global configuration mode
Command History
Usage Guidelines
This command is not supported on the Supervisor Engine 6-E and Catalyst 4900M chassis.
After you enter the control-plane command, you can define control plane services for your route processor. For example, you can associate a service policy with the control plane to police all traffic that is destined to the control plane.
Examples
These examples show how to configure trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets to be policed at the specified rate:
Switch(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow 10.1.1.2 trusted host traffic.Switch(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Switch(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Switch(config)# class-map telnet-classSwitch(config-cmap)# match access-group 140Switch(config-cmap)# exitSwitch(config)# policy-map control-planeSwitch(config-pmap)# class telnet-classSwitch(config-pmap-c)# police 32000 1000 conform transmit exceed dropSwitch(config-pmap-c)# exitSwitch(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Switch(config)# macro global apply system-cppSwitch(config)# control-planeSwitch(config-cp)# service-police input system-cpp-policySwitch(config-cp)# exitRelated Commands
counter
To assign a counter set to a switch port, use the counter command. To remove a counter assignment, use the no form of this command.
counter
no counter
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default setting.
Command Modes
Interface configuration mode
Command History
Usage Guidelines
This command is supported on the Supervisor Engine 6-E and Catalyst 4900M chassis.
The total number of switch ports that can have transmit and receive counters is 4096.
When a Layer 3 port with counter assigned is changed to a Layer 2 port or removed, the hardware counters are freed. This action is similar to issuing the no counter command.
Examples
This example shows how to assign a counter set to a switch port:
Switch#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)#interface vlan 20Switch(config-if)#counterSwitch(config-if)#endSwitch#dbl
To enable active queue management on a transmit queue used by a class of traffic, use the dbl command. Use the no form of this command to return to the default setting.
dbl
no dbl
Syntax Description
This command has no keywords or arguments.
Defaults
Active queue management is disabled.
Command Modes
Policy-map class configuration
Command History
12.1(8a)EW
This command was introduced on the Catalyst 4500 series switch.
12.2(40)SG
Added support for the Supervisor Engine 6E.
Usage Guidelines
The semantics of the DBL configuration is similar to (W)RED algorithm. That means `dbl' is allowed standalone on "class-default", but otherwise requires that bandwidth or shape command also be configured on the class.
Examples
This example shows how to enable dbl action in a class:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# dblSwitch(config-pmap-c)# exitSwitch(config-pmap)# exitSwitch(config)# interface gigabitethernet 1/1Switch(config-if)# service-policy output policy1Switch(config-if)# endRelated Commands
debug adjacency
To display information about the adjacency debugging, use the debug adjacency command. To disable debugging output, use the no form of this command.
debug adjacency [ipc]
no debug adjacency
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to display the information in the adjacency database:
Switch# debug adjacency4d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:004d02h: ADJ: add 172.20.52.36 (GigabitEthernet1/1) via ARP will expire: 04:00:00<... output truncated...>Switch#Related Commands
debug backup
To debug the backup events, use the debug backup command. To disable the debugging output, use the no form of this command.
debug backup
no debug backup
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to debug the backup events:
Switch# debug backupBackup events debugging is onSwitch#Related Commands
debug condition interface
To limit the debugging output of interface-related activities, use the debug condition interface command. To disable the debugging output, use the no form of this command.
debug condition interface {fastethernet mod/port | GigabitEthernet mod/port |
null interface_num | port-channel interface-num | vlan vlan_id}no debug condition interface {fastethernet mod/port | GigabitEthernet mod/port | null interface_num | port-channel interface-num | vlan vlan_id}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses added.
Examples
This example shows how to limit the debugging output to VLAN interface 1:
Switch# debug condition interface vlan 1Condition 2 setSwitch#Related Commands
Abbreviates the entry of the debug condition interface command.
undebug condition interface (same as no debug condition interface)
Disables interface related activities.
debug condition standby
To limit the debugging output for the standby state changes, use the debug condition standby command. To disable the debugging output, use the no form of this command.
debug condition standby {fastethernet mod/port | GigabitEthernet mod/port |
port-channel interface-num | vlan vlan_id group-number}no debug condition standby {fastethernet mod/port | GigabitEthernet mod/port |
port-channel interface-num | vlan vlan_id group-number}Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses added.
Usage Guidelines
If you attempt to remove the only condition set, you will be prompted with a message asking if you want to abort the removal operation. You can enter n to abort the removal or y to proceed with the removal. If you remove the only condition set, an excessive number of debugging messages might occur.
Examples
This example shows how to limit the debugging output to group 0 in VLAN 1:
Switch# debug condition standby vlan 1 0Condition 3 setSwitch#This example shows the display if you try to turn off the last standby debug condition:
Switch# no debug condition standby vlan 1 0This condition is the last standby condition set.Removing all conditions may cause a flood of debuggingmessages to result, unless specific debugging flagsare first removed.Proceed with removal? [yes/no]: n% Operation abortedSwitch#Related Commands
undebug condition standby (same as no debug condition standby)
Disables debugging output.
debug condition vlan
To limit the VLAN debugging output for a specific VLAN, use the debug condition vlan command. To disable the debugging output, use the no form of this command.
debug condition vlan {vlan_id}
no debug condition vlan {vlan_id}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses added.
Usage Guidelines
If you attempt to remove the only VLAN condition set, you will be prompted with a message asking if you want to abort the removal operation. You can enter n to abort the removal or y to proceed with the removal. If you remove the only condition set, it could result in the display of an excessive number of messages.
Examples
This example shows how to limit the debugging output to VLAN 1:
Switch# debug condition vlan 1Condition 4 setSwitch#This example shows the message that is displayed when you attempt to disable the last VLAN debug condition:
Switch# no debug condition vlan 1This condition is the last vlan condition set.Removing all conditions may cause a flood of debuggingmessages to result, unless specific debugging flagsare first removed.Proceed with removal? [yes/no]: n% Operation abortedSwitch#Related Commands
undebug condition vlan (same as no debug condition vlan)
Disables debugging output.
debug dot1x
To enable the debugging for the 802.1X feature, use the debug dot1x command. To disable the debugging output, use the no form of this command.
debug dot1x {all | errors | events | packets | registry | state-machine}
no debug dot1x {all | errors | events | packets | registry | state-machine}
Syntax Description
Defaults
Debugging is disabled.
Command Modes
Privileged EXEC mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable the 802.1X debugging for all conditions:
Switch# debug dot1x allSwitch#Related Commands
Displays dot1x information.
undebug dot1x (same as no debug dot1x)
Disables debugging output.
debug etherchnl
To debug EtherChannel, use the debug etherchnl command. To disable the debugging output, use the no form of this command.
debug etherchnl [all | detail | error | event | idb | linecard]
no debug etherchnl
Syntax Description
Defaults
The default settings are as follows:
•
•
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
If you do not specify a keyword, all debug messages are displayed.
Examples
This example shows how to display all the EtherChannel debug messages:
Switch# debug etherchnlPAgP Shim/FEC debugging is on22:46:30:FEC:returning agport Po15 for port (Fa2/1)22:46:31:FEC:returning agport Po15 for port (Fa4/14)22:46:33:FEC:comparing GC values of Fa2/25 Fa2/15 flag = 1 122:46:33:FEC:port_attrib:Fa2/25 Fa2/15 same22:46:33:FEC:EC - attrib incompatable for Fa2/25; duplex of Fa2/25 is half, Fa2/15 is full22:46:33:FEC:pagp_switch_choose_unique:Fa2/25, port Fa2/15 in agport Po3 is incompatableSwitch#This example shows how to display the EtherChannel IDB debug messages:
Switch# debug etherchnl idbAgport idb related debugging is onSwitch#This example shows how to disable the debugging:
Switch# no debug etherchnlSwitch#Related Commands
debug interface
To abbreviate the entry of the debug condition interface command, use the debug interface command. To disable debugging output, use the no form of this command.
debug interface {FastEthernet mod/port | GigabitEthernet mod/port | null |
port-channel interface-num | vlan vlan_id}no debug interface {FastEthernet mod/port | GigabitEthernet mod/port | null |
port-channel interface-num | vlan vlan_id}Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
12.1(12c)EW
Support for extended VLAN addresses added.
Examples
This example shows how to limit the debugging to interface VLAN 1:
Switch# debug interface vlan 1Condition 1 setSwitch#Related Commands
Limits the debugging output of interface-related activities.
undebug etherchnl (same as no debug etherchnl)
Disables debugging output.
debug ipc
To debug the IPC activity, use the debug ipc command. To disable the debugging output, use the no form of this command.
debug ipc {all | errors | events | headers | packets | ports | seats}
no debug ipc {all | errors | events | headers | packets | ports | seats}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable the debugging of the IPC events:
Switch# debug ipc eventsSpecial Events debugging is onSwitch#Related Commands
debug ip dhcp snooping event
To debug the DHCP snooping events, use the debug ip dhcp snooping event command. To disable debugging output, use the no form of this command.
debug ip dhcp snooping event
no debug ip dhcp snooping event
Syntax Description
This command has no arguments or keywords.
Defaults
Debugging of snooping event is disabled.
Command Modes
Privileged EXEC mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable the debugging for the DHCP snooping events:
Switch# debug ip dhcp snooping eventSwitch#This example shows how to disable the debugging for the DHCP snooping events:
Switch# no debug ip dhcp snooping eventSwitch#Related Commands
debug ip dhcp snooping packet
To debug the DHCP snooping messages, use the debug ip dhcp snooping packet command. To disable the debugging output, use the no form of this command.
debug ip dhcp snooping packet
no debug ip dhcp snooping packet
Syntax Description
This command has no arguments or keywords.
Defaults
Debugging of snooping packet is disabled.
Command Modes
Privileged EXEC mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable the debugging for the DHCP snooping packets:
Switch# debug ip dhcp snooping packetSwitch#This example shows how to disable the debugging for the DHCP snooping packets:
Switch# no debug ip dhcp snooping packetSwitch#Related Commands
debug ip verify source packet
To debug the IP source guard messages, use the debug ip verify source packet command. To disable the debugging output, use the no form of this command.
debug ip verify source packet
no debug ip verify source packet
Syntax Description
This command has no arguments or keywords.
Defaults
Debugging of snooping security packets is disabled.
Command Modes
Privileged EXEC mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable debugging for the IP source guard:
Switch# debug ip verify source packetSwitch#This example shows how to disable debugging for the IP source guard:
Switch# no debug ip verify source packetSwitch#Related Commands
debug lacp
To debug the LACP activity, use the debug lacp command. To disable the debugging output, use the no form of this command.
debug lacp [all | event | fsm | misc | packet]
no debug lacp
Syntax Description
Defaults
Debugging of LACP activity is disabled.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
This command is supported only by the supervisor engine and can be entered only from the Catalyst 4500 series switch console.
Examples
This example shows how to enable the LACP miscellaneous debugging:
Switch# debug lacpPort Aggregation Protocol Miscellaneous debugging is onSwitch#Related Commands
debug monitor
To display the monitoring activity, use the debug monitor command. To disable the debugging output, use the no form of this command.
debug monitor {all | errors | idb-update | list | notifications | platform | requests}
no debug monitor {all | errors | idb-update | list | notifications | platform | requests}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to debug the monitoring errors:
Switch# debug monitor errorsSPAN error detail debugging is onSwitch#Related Commands
debug nvram
To debug the NVRAM activity, use the debug nvram command. To disable the debugging output, use the no form of this command.
debug nvram
no debug nvram
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to debug NVRAM:
Switch# debug nvramNVRAM behavior debugging is onSwitch#Related Commands
debug pagp
To debug the PAgP activity, use the debug pagp command. To disable the debugging output, use the no form of this command.
debug pagp [all | dual-active | event | fsm | misc | packet]
no debug pagp
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
This command is supported only by the supervisor engine and can be entered only from the Catalyst 4500 series switch console.
Examples
This example shows how to enable the PAgP miscellaneous debugging:
Switch# debug pagp miscPort Aggregation Protocol Miscellaneous debugging is onSwitch#*Sep 30 10:13:03: SP: PAgP: pagp_h(Fa5/6) expired*Sep 30 10:13:03: SP: PAgP: 135 bytes out Fa5/6*Sep 30 10:13:03: SP: PAgP: Fa5/6 Transmitting information packet*Sep 30 10:13:03: SP: PAgP: timer pagp_h(Fa5/6) started with interval 30000<... output truncated...>Switch#Related Commands
debug platform packet protocol lacp
To debug the LACP protocol packets, use the debug platform packet protocol lacp command. To disable the debugging output, use the no form of this command.
debug platform packet protocol lacp [receive | transmit | vlan]
no debug platform packet protocol lacp [receive | transmit | vlan]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable all PM debugging:
Switch# debug platform packet protocol lacpSwitch#Related Commands
undebug platform packet protocol lacp (same as no debug platform packet protocol lacp)
Disables debugging output.
debug platform packet protocol pagp
To debug the PAgP protocol packets, use the debug platform packet protocol pagp command. To disable the debugging output, use the no form of this command.
debug platform packet protocol pagp [receive | transmit | vlan]
no debug platform packet protocol pagp [receive | transmit | vlan]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable all PM debugging:
Switch# debug platform packet protocol pagpSwitch#Related Commands
undebug platform packet protocol pagp (same as no debug platform packet protocol pagp)
Disables debugging output.
debug pm
To debug the port manager (PM) activity, use the debug pm command. To disable the debugging output, use the no form of this command.
debug pm {all | card | cookies | etherchnl | messages | port | registry | scp | sm | span | split |
vlan | vp}no debug pm {all | card | cookies | etherchnl | messages | port | registry | scp | sm | span | split |
vlan | vp}Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable all PM debugging:
Switch# debug pm allSwitch#Related Commands
debug port-security
To debug port security, use the debug port-security command. To disable the debugging output, use the no form of this command.
debug port-security
no debug port-security
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to enable all PM debugging:
Switch# debug port-securitySwitch#Related Commands
debug pppoe intermediate-agent
To turn on debugging of the PPPoE Intermediate Agent feature, use the
debug pppoe intermediate-agent command. To turn off debugging, use the no form of this command.[no] debug ppoe intermediate-agent {event | packet | all}
Syntax Description
event
Turn on event debugging.
packet
Turn on packet debugging.
all
Turn on both event and packet debugging.
Defaults
All debugging turned off.
Command Modes
Privileged EXEC mode
Command History
12.2(50)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to turn on packet debugging:
Switch# debug pppoe intermediate-agent packetPPPOE IA Packet debugging is on*Sep 2 06:12:56.133: PPPOE_IA: Process new PPPoE packet, Message type: PADI, input interface: Gi3/7, vlan : 2 MAC da: ffff.ffff.ffff, MAC sa: aabb.cc00.0000*Sep 2 06:12:56.137: PPPOE_IA: received new PPPOE packet from inputinterface (GigabitEthernet3/4)*Sep 2 06:12:56.137: PPPOE_IA: received new PPPOE packet from inputinterface (GigabitEthernet3/8)*Sep 2 06:12:56.137: PPPOE_IA: Process new PPPoE packet, Message type: PADO, input interface: Gi3/4, vlan : 2 MAC da: aabb.cc00.0000, MAC sa: 001d.e64c.6512*Sep 2 06:12:56.137: PPPOE_IA: Process new PPPoE packet, Message type: PADO, input interface: Gi3/8, vlan : 2 MAC da: aabb.cc00.0000, MAC sa: aabb.cc80.0000*Sep 2 06:12:56.137: PPPOE_IA: received new PPPOE packet from inputinterface (GigabitEthernet3/7)*Sep 2 06:12:56.137: PPPOE_IA: Process new PPPoE packet, Message type: PADR, input interface: Gi3/7, vlan : 2 MAC da: 001d.e64c.6512, MAC sa: aabb.cc00.0000*Sep 2 06:12:56.145: PPPOE_IA: received new PPPOE packet from inputinterface (GigabitEthernet3/4)*Sep 2 06:12:56.145: PPPOE_IA: Process new PPPoE packet, Message type: PADS, input interface: Gi3/4, vlan : 2 MAC da: aabb.cc00.0000, MAC sa: 001d.e64c.6512Switch#This example shows how to turn off packet debugging.
Switch# debug pppoe intermediate-agent packetPPPOE IA Packet debugging is offSwitch#Related Commands
