-
Catalyst 4500 Series Switch Cisco IOS Command Reference, 12.2(50)SG
-
Quick Links to Catalyst 4500 Series Switch Cisco IOS Commands
-
Index
-
Preface
-
Command-Line Interface
-
aaa accounting dot1x default start-stop group radius through instance
-
interface port-channel through shape
-
show access-group mode interface through show vtp
-
snmp ifindex clear through vtp v2-mode
-
Acronyms and Abbreviations
-
Table Of Contents
snmp-server ifindex persist compress
snmp trap mac-notification change
spanning-tree etherchannel guard misconfig
spanning-tree extend system-id
spanning-tree loopguard default
spanning-tree mst configuration
spanning-tree mst forward-time
spanning-tree portfast (interface configuration mode)
spanning-tree portfast bpdufilter default
spanning-tree portfast bpduguard default
spanning-tree portfast default
storm-control broadcast include multicast
switchport private-vlan association trunk
switchport private-vlan host-association
switchport private-vlan mapping
switchport private-vlan trunk allowed vlan
switchport private-vlan trunk native vlan tag
udld (global configuration mode)
udld (interface configuration mode)
vlan internal allocation policy
vmps reconfirm (global configuration)
vmps reconfirm (privileged EXEC)
vtp (global configuration mode)
snmp ifindex clear
To clear any previously configured snmp ifindex commands that were entered for a specific interface, use the snmp ifindex clear command.
snmp ifindex clear
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Interface configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
Interface index persistence occurs when ifIndex values in the interface MIB (IF-MIB) persist across reboots and allow for consistent identification of specific interfaces using SNMP.
Use the snmp ifindex clear command on a specific interface when you want that interface to use the global configuration setting for ifIndex persistence. This command clears any ifIndex configuration commands previously entered for that specific interface.
Examples
This example shows how to enable ifIndex persistence for all interfaces:
Router(config)# snmp-server ifindex persistThis example shows how to disable IfIndex persistence for FastEthernet 1/1 only:
Router(config)# interface fastethernet 1/1Router(config-if)# no snmp ifindex persistRouter(config-if)# exitThis example shows how to clear the ifIndex configuration from the FastEthernet 1/1 configuration:
Router(config)# interface fastethernet 1/1Router(config-if)# snmp ifindex clearRouter(config-if)# exitAs a result of this sequence of commands, ifIndex persistence is enabled for all interfaces that are specified by the snmp-server ifindex persist global configuration command.
Related Commands
snmp ifindex persist
To enable ifIndex values in the Interfaces MIB (IF-MIB) that persist across reboots (ifIndex persistence) on a specific interface, use the snmp ifindex persist command. To disable ifIndex persistence only on a specific interface, use the no form of this command.
snmp ifindex persist
no snmp ifindex persist
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled.
Command Modes
Interface configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
Interface index persistence occurs when ifIndex values in the IF-MIB persist across reboots and allow for consistent identification of specific interfaces using SNMP.
The snmp ifindex persist interface configuration command enables and disables ifIndex persistence for individual entries (that correspond to individual interfaces) in the ifIndex table of the IF-MIB.
The snmp-server ifindex persist global configuration command enables and disables ifIndex persistence for all interfaces on the routing device. This action applies only to interfaces that have ifDescr and ifIndex entries in the ifIndex table of the IF-MIB.
Examples
This example shows how to enable ifIndex persistence for interface FastEthernet 1/1 only:
Router(config)# interface fastethernet 1/1Router(config-if)# snmp ifindex persistRouter(config-if)# exitThis example shows how to enable ifIndex persistence for all interfaces, and then disable ifIndex persistence for interface FastEthernet 1/1 only:
Router(config)# snmp-server ifindex persistRouter(config)# interface fastethernet 1/1Router(config-if)# no snmp ifindex persistRouter(config-if)# exitRelated Commands
snmp-server enable traps
To enable SNMP notifications (traps or informs), use the snmp-server enable traps command. To disable all SNMP notifications, use the no form of this command.
snmp-server enable traps [flash [insertion | removal] | fru-ctrl | port-security [trap-rate trap-rate] | removal | stpx | vlancreate | vlandelete | vtp] [mac-notification [change | move | threshold]
no snmp-server enable traps [flash [insertion | removal] | fru-ctrl | port-security [trap-rate trap-rate] | removal | stpx | vlancreate | vlandelete | vtp] [mac-notification]
Syntax Description
Defaults
SNMP notifications are disabled.
Command Modes
Global configuration mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.2(31)SG
Support for MAC notification was added.
Usage Guidelines
If you enter this command without an option, all notification types controlled by this command are enabled.
SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests for the specified notification types. To specify whether the notifications should be sent as traps or informs, use the snmp-server host [traps | informs] command.
The snmp-server enable traps command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send notifications, you must configure at least one snmp-server host command.
This list of the MIBs is used for the traps:
•
flash—Controls SNMP FLASH traps from the CISCO-FLASH-MIB.
–
–
•
•
•
•
•
•
Examples
This example shows how to send all traps to the host is specified by the name myhost.cisco.com using the community string defined as public:
Switch(config)# snmp-server enable trapsSwitch(config)# snmp-server host myhost.cisco.com publicSwitch(config)#This example shows how to enable the MAC address change MIB notification:
Switch(config)# snmp-server enable traps mac-notification changeSwitch(config)#SNMP traps can be enabled with a rate-limit to detect port-security violations due to restrict mode. The following example shows how to enable traps for port-security with a rate of 5 traps per second:
Switch(config)# snmp-server enable traps port-security trap-rate 5Switch(config)#Related Commands
snmp-server ifindex persist
To globally enable ifIndex values that will remain constant across reboots for use by SNMP, use the snmp-server ifindex persist command. To globally disable inIndex persistence, use the no form of this command.
snmp-server ifindex persist
no snmp-server ifindex persist
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled.
Command Modes
Global configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
Interface index persistence occurs when ifIndex values in the IF-MIB persist across reboots and allow for consistent identification of specific interfaces using SNMP.
The snmp-server ifindex persist global configuration command does not override the interface-specific configuration. To override the interface-specific configuration of ifIndex persistence, enter the no snmp ifindex persist and snmp ifindex clear interface configuration commands.
Entering the no snmp-server ifindex persist global configuration command enables and disables ifIndex persistence for all interfaces on the routing device using ifDescr and ifIndex entries in the ifIndex table of the IF-MIB.
Examples
This example shows how to enable ifIndex persistence for all interfaces:
Router(config)# snmp-server ifindex persistRelated Commands
snmp-server ifindex persist compress
To configure the format of the ifIndex table in a compressed format, use the snmp-server ifindex persist compress command. To place the table in a decompressed format, use the no form of this command.
snmp-server ifindex persist compress
no snmp-server ifindex persist compress
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled
Command Modes
Global configuration mode.
Command History
12.2(46)SG
Support for this command was introduced on the Catalyst 4500 series switches.
Usage Guidelines
This command is hidden on Supervisor Engine V and later supervisor engines because the ifIndex table is always in a compressed format on those supervisor engines.
At bootup, if the nvram:ifIndex-table.gz file (the ifIndex table ina compressed format) is present on a Supervisor Engine II+, Supervisor Engine III, or Supervisor Engine IV, the snmp-server ifindex persist compress command is automatically run even if the startup-config file does not have this configuration.
Examples
This example shows how to enable compression of the ifIndex table:
Router(config)# snmp-server ifindex persist compressThis example shows how to disable compression of the ifIndex table:
Router(config)# no snmp-server ifindex persist compressRelated Commands
snmp trap mac-notification change
To enable SNMP MAC address notifications, use the snmp trap mac-notification command. To return to the default setting, use the no form of this command.
snmp trap mac-notification change {added | removed}
no snmp trap mac-notification change {added | removed}
Syntax Description
Defaults
MAC address addition and removal are disabled.
Command Modes
Interface configuration mode
Command History
12.2(31)SG
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
Even though you enable the change notification trap for a specific interface by using the
snmp trap mac-notification change command, the trap is generated only when you enable the
snmp-server enable traps mac-notification change and the mac address-table notification change global configuration commands.Examples
This example shows how to enable the MAC notification trap when a MAC address is added to a port:
Switch(config)# interface gigabitethernet1/1Switch(config-if)# snmp trap mac-notification change addedYou can verify your settings by entering the show mac address-table notification change interface privileged EXEC command.
Related Commands
spanning-tree backbonefast
To enable BackboneFast on a spanning-tree VLAN, use the spanning-tree backbonefast command. To disable BackboneFast, use the no form of this command.
spanning-tree backbonefast
no spanning-tree backbonefast
Syntax Description
This command has no arguments or keywords.
Defaults
BackboneFast is disabled.
Command Modes
Global configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
BackboneFast should be enabled on all Catalyst 4506 series switches to allow the detection of indirect link failures. Enabling BackboneFast starts the spanning-tree reconfiguration more quickly.
Examples
This example shows how to enable BackboneFast on all VLANs:
Switch(config)# spanning-tree backbonefastSwitch(config)#Related Commands
spanning-tree bpdufilter
To enable BPDU filtering on an interface, use the spanning-tree bpdufilter command. To return to the default settings, use the no form of this command.
spanning-tree bpdufilter {enable | disable}
no spanning-tree bpdufilter
Syntax Description
Defaults
Disabled
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
Caution
When configuring Layer 2 protocol tunneling on all the service provider edge switches, you must enable spanning-tree BPDU filtering on the 802.1Q tunnel ports by entering the spanning-tree bpdufilter enable command.
BPDU filtering allows you to prevent a port from sending and receiving BPDUs. The configuration is applicable to the whole interface, whether it is trunking or not. This command has three states:
•
•
•
Examples
This example shows how to enable the BPDU filter feature on this interface:
Switch(config-if)# spanning-tree bpdufilter enableSwitch(config-if)#Related Commands
Displays spanning-tree information.
Enables the BPDU filtering by default on all PortFast ports.
spanning-tree bpduguard
To enable BPDU guard on an interface, use the spanning-tree bpduguard command. To return to the default settings, use the no form of this command.
spanning-tree bpduguard {enable | disable}
no spanning-tree bpduguard
Syntax Description
Defaults
BPDU guard is disabled.
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
BPDU guard is a feature that prevents a port from receiving BPDUs. This feature is typically used in a service provider environment where the administrator wants to prevent an access port from participating in the spanning tree. If the port still receives a BPDU, it is put in the ErrDisable state as a protective measure. This command has three states:
•
•
•
Examples
This example shows how to enable BPDU guard on this interface:
Switch(config-if)# spanning-tree bpduguard enableSwitch(config-if)#Related Commands
Displays spanning-tree information.
Enables the BPDU filtering by default on all PortFast ports.
spanning-tree cost
To calculate the path cost of STP on an interface, use the spanning-tree cost command. To revert to the default, use the no form of this command.
spanning-tree cost cost
no spanning-tree cost cost
Syntax Description
Defaults
The default settings are as follows:
•
•
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
When you configure the cost, the higher values indicate higher costs. The range applies regardless of the protocol type that is specified. The path cost is calculated, based on the interface bandwidth.
Examples
This example shows how to access an interface and set a path cost value of 250 for the spanning-tree VLAN that is associated with that interface:
Switch(config)# interface fastethernet 2/1Switch(config-if)# spanning-tree cost 250Switch(config-if)#Related Commands
spanning-tree etherchannel guard misconfig
To display an error message when a loop due to a channel misconfiguration is detected, use the spanning-tree etherchannel guard misconfig command. To disable the feature, use the no form of this command.
spanning-tree etherchannel guard misconfig
no spanning-tree etherchannel guard misconfig
Syntax Description
This command has no arguments or keywords.
Defaults
Spanning-tree EtherChannel guard is enabled.
Command Modes
Global configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
When an EtherChannel guard misconfiguration is detected, this message is displayed:
%SPANTREE-2-CHNL_MISCFG:Detected loop due to etherchannel misconfig of interface Port-Channel1To determine which local ports are involved in the misconfiguration, enter the show interfaces status err-disabled command. To verify the EtherChannel configuration on the remote device, enter the show etherchannel summary command on the remote device.
After you correct the configuration, enter the shutdown and the no shutdown commands on the associated port-channel interface.
Examples
This example shows how to enable the EtherChannel guard misconfiguration feature:
Switch(config)# spanning-tree etherchannel guard misconfigSwitch(config)#Related Commands
spanning-tree extend system-id
To enable the extended system ID feature on a chassis that supports 1024 MAC addresses, use the spanning-tree extend system-id command. To disable the feature, use the no form of this command.
spanning-tree extend system-id
no spanning-tree extend system-id
Syntax Description
This command has no arguments or keywords.
Defaults
Enabled on systems that do not provide 1024 MAC addresses.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
Releases 12.1(13)E and later support chassis with 64 or 1024 MAC addresses. For chassis with 64 MAC addresses, STP uses the extended system ID plus a MAC address to make the bridge ID unique for each VLAN.
You cannot disable the extended system ID on chassis that support 64 MAC addresses.
Enabling or disabling the extended system ID updates the bridge IDs of all active STP instances, which might change the spanning-tree topology.
Examples
This example shows how to enable the extended system ID:
Switch(config)# spanning-tree extend system-idSwitch(config)#Related Commands
spanning-tree guard
To enable root guard, use the spanning-tree guard command. To disable root guard, use the no form of this command.
spanning-tree guard {loop | root | none}
no spanning-tree guard
Syntax Description
loop
Enables the loop guard mode on the interface.
root
Enables root guard mode on the interface.
none
Sets the guard mode to none.
Defaults
Root guard is disabled.
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(12c)EW
Loop guard support was added.
Examples
This example shows how to enable root guard:
Switch(config-if)# spanning-tree guard rootSwitch(config-if)#Related Commands
spanning-tree link-type
To configure a link type for a port, use the spanning-tree link-type command. To return to the default settings, use the no form of this command.
spanning-tree link-type {point-to-point | shared}
no spanning-tree link-type
Syntax Description
point-to-point
Specifies that the interface is a point-to-point link.
shared
Specifies that the interface is a shared medium.
Defaults
Link type is derived from the duplex mode.
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
RSTP+ fast transition works only on point-to-point links between two bridges.
By default, the switch derives the link type of a port from the duplex mode. A full-duplex port is considered as a point-to-point link while a half-duplex configuration is assumed to be on a shared link.
If you designate a port as a shared link, RSTP+ fast transition is forbidden, regardless of the duplex setting.
Examples
This example shows how to configure the port as a shared link:
Switch(config-if)# spanning-tree link-type sharedSwitch(config-if)#Related Commands
spanning-tree loopguard default
To enable loop guard as the default on all ports of a specific bridge, use the spanning-tree loopguard default command. To disable loop guard, use the no form of this command.
spanning-tree loopguard default
no spanning-tree loopguard default
Syntax Description
This command has no keywords or arguments.
Defaults
Loop guard is disabled.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
Loop guard provides an additional security in the bridge network. Loop guard prevents alternate or root ports from becoming the designated port because of a failure leading to a unidirectional link.
Loop guard operates only on ports that are considered point-to-point by the spanning tree.
Individual loop-guard port configuration overrides this global default.
Examples
This example shows how to enable loop guard:
Switch(config)# spanning-tree loopguard defaultSwitch(config)#Related Commands
spanning-tree mode
To switch between PVST+ and MST modes, use the spanning-tree mode command. To return to the default settings, use the no form of this command.
spanning-tree mode {pvst | mst | rapid-pvst}
no spanning-tree mode {pvst | mst | rapid-pvst}
Syntax Description
Defaults
PVST+ mode
Command Modes
Configuration
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(19)EW
Support for the rapid-pvst keyword.
Usage Guidelines
Caution
Examples
This example shows how to switch to MST mode:
Switch(config)# spanning-tree mode mstSwitch(config)#This example shows how to return to the default mode (PVST):
Switch(config)# no spanning-tree modeSwitch(config)#Related Commands
spanning-tree mst
To set the path cost and port-priority parameters for any MST instance (including the CIST with instance ID 0), use the spanning-tree mst command. To return to the default settings, use the no form of this command.
spanning-tree mst instance-id [cost cost] | [port-priority prio]
no spanning-tree mst instance-id {cost | port-priority}
Syntax Description
Defaults
Port priority is 128.
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
The higher cost cost values indicate higher costs. When entering the cost value, do not include a comma in the entry; for example, enter 1000, not 1,000.
The higher port-priority prio values indicate smaller priorities.
By default, the cost depends on the port speed; faster interface speeds indicate smaller costs. MST always uses long path costs.
Examples
This example shows how to set the interface path cost:
Switch(config-if)# spanning-tree mst 0 cost 17031970Switch(config-if)#This example shows how to set the interface priority:
Switch(config-if)# spanning-tree mst 0 port-priority 64Switch(config-if)#Related Commands
Displays MST protocol information.
Enables an interface when two bridges compete for position as the root bridge.
spanning-tree mst configuration
To enter the MST configuration submode, use the spanning-tree mst configuration command. To return to the default MST configuration, use the no form of this command.
spanning-tree mst configuration
no spanning-tree mst configuration
Syntax Description
This command has no arguments or keywords.
Defaults
The default settings are as follows:
•
•
•
•
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
The MST configuration consists of three main parameters:
•
•
•
By default, the value for the MST configuration is the default value for all its parameters.
The abort and exit commands allow you to exit the MST configuration submode. The difference between the two commands depends on whether you want to save your changes or not.
The exit command commits all the changes before leaving MST configuration submode. If you do not map the secondary VLANs to the same instance as the associated primary VLAN, when you exit the MST configuration submode, a message displays and lists the secondary VLANs that are not mapped to the same instance as the associated primary VLAN. The message is as follows:
These secondary vlans are not mapped to the same instance as their primary:->3The abort command leaves the MST configuration submode without committing any changes.
Whenever you change an MST configuration submode parameter, it can cause a loss of connectivity. To reduce the number of service disruptions, when you enter the MST configuration submode, you are changing a copy of the current MST configuration. When you are done editing the configuration, you can apply all the changes at once by using the exit keyword, or you can exit the submode without committing any change to the configuration by using the abort keyword.
In the unlikely event that two users enter a new configuration at exactly at the same time, this message is displayed:
Switch(config-mst)# exit% MST CFG:Configuration change lost because of concurrent accessSwitch(config-mst)#Examples
This example shows how to enter the MST configuration submode:
Switch(config)# spanning-tree mst configurationSwitch(config-mst)#This example shows how to reset the MST configuration to the default settings:
Switch(config)# no spanning-tree mst configurationSwitch(config)#Related Commands
Maps a VLAN or a set of VLANs to an MST instance.
Sets the MST region name.
Sets the MST configuration revision number.
Displays MST protocol information.
spanning-tree mst forward-time
To set the forward delay timer for all the instances, use the spanning-tree mst forward-time command. To return to the default settings, use the no form of this command.
spanning-tree mst forward-time seconds
no spanning-tree mst forward-time
Syntax Description
seconds
Number of seconds to set the forward delay timer for all the instances on the Catalyst 4500 series switch; valid values are from 4 to 30 seconds.
Defaults
The forward delay timer is set for 15 seconds.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Examples
This example shows how to set the forward-delay timer:
Switch(config)# spanning-tree mst forward-time 20Switch(config)#Related Commands
spanning-tree mst hello-time
To set the hello-time delay timer for all the instances, use the spanning-tree mst hello-time command. To return to the default settings, use the no form of this command.
spanning-tree mst hello-time seconds
no spanning-tree mst hello-time
Syntax Description
seconds
Number of seconds to set the hello-time delay timer for all the instances on the Catalyst 4500 series switch; valid values are from 1 to 10 seconds.
Defaults
The hello-time delay timer is set for 2 seconds.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
If you do not specify the hello-time value, the value is calculated from the network diameter.
Examples
This example shows how to set the hello-time delay timer:
Switch(config)# spanning-tree mst hello-time 3Switch(config)#Related Commands
spanning-tree mst max-age
To set the max-age timer for all the instances, use the spanning-tree mst max-age command. To return to the default settings, use the no form of this command.
spanning-tree mst max-age seconds
no spanning-tree mst max-age
Syntax Description
seconds
Number of seconds to set the max-age timer for all the instances on the Catalyst 4500 series switch; valid values are from 6 to 40 seconds.
Defaults
The max-age timer is set for 20 seconds.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Examples
This example shows how to set the max-age timer:
Switch(config)# spanning-tree mst max-age 40Switch(config)#Related Commands
spanning-tree mst max-hops
To specify the number of possible hops in the region before a BPDU is discarded, use the spanning-tree mst max-hops command. To return to the default settings, use the no form of this command.
spanning-tree mst max-hops hopnumber
no spanning-tree mst max-hops
Syntax Description
hopnumber
Number of possible hops in the region before a BPDU is discarded; valid values are from 1 to 40 hops.
Defaults
Number of hops is 20.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Examples
This example shows how to set the number of possible hops in the region before a BPDU is discarded to 25:
Switch(config)# spanning-tree mst max-hops 25Switch(config)#Related Commands
spanning-tree mst root
To designate the primary root, secondary root, bridge priority, and timer value for an instance, use the spanning-tree mst root command. To return to the default settings, use the no form of this command.
spanning-tree mst instance-id root {primary | secondary} | {priority prio} [diameter dia [hello-time hello]]
no spanning-tree mst root
Syntax Description
Defaults
Bridge priority is 32768.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
The bridge priority can be set in increments of 4096 only. When you set the priority, valid values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440.
You can set the priority to 0 to make the switch root.
The spanning-tree root secondary bridge priority value is 16384.
The diameter dia and hello-time hello options are available for instance 0 only.
If you do not specify the hello_time value, the value is calculated from the network diameter.
Examples
This example shows how to set the priority and timer values for the bridge:
Switch(config)# spanning-tree mst 0 root primary diameter 7 hello-time 2Switch(config)# spanning-tree mst 5 root primarySwitch(config)#Related Commands
spanning-tree pathcost method
To set the path cost calculation method, use the spanning-tree pathcost method command. To revert to the default setting, use the no form of this command.
spanning-tree pathcost method {long | short}
no spanning-tree pathcost method
Syntax Description
long
Specifies 32-bit-based values for port path costs.
short
Specifies 16-bit-based values for port path costs.
Defaults
Port path cost has 32-bit-based values.
Command Modes
Global configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
This command applies to all the spanning-tree instances on the switch.
The long path cost calculation method uses all the 32 bits for path cost calculation and yields values in the range of 1 through 200,000,000.
The short path cost calculation method (16 bits) yields values in the range of 1 through 65,535.
Examples
This example shows how to set the path cost calculation method to long:
Switch(config) spanning-tree pathcost method longSwitch(config)This example shows how to set the path cost calculation method to short:
Switch(config) spanning-tree pathcost method shortSwitch(config)Related Commands
spanning-tree portfast (interface configuration mode)
To enable PortFast mode, where the interface is immediately put into the forwarding state upon linkup without waiting for the timer to expire, use the spanning-tree portfast command. To return to the default setting, use the no form of this command.
spanning-tree portfast {disable | trunk}
no spanning-tree portfast
Syntax Description
disable
Disables PortFast on the interface.
trunk
Enables PortFast on the interface even while in the trunk mode.
Defaults
PortFast mode is disabled.
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(12c)EW
The disable and trunk options were added.
Usage Guidelines
You should use this feature only with interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.
An interface with PortFast mode enabled is moved directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-time delay.
Be careful when using the no spanning-tree portfast command. This command does not disable PortFast if the spanning-tree portfast default command is enabled.
This command has four states:
•
•
•
Note
•
Examples
This example shows how to enable PortFast mode:
Switch(config-if)# spanning-tree portfastSwitch(config-if)Related Commands
spanning-tree portfast bpdufilter default
To enable the BPDU filtering by default on all PortFast ports, use the spanning-tree portfast bpdufilter default command. To return to the default settings, use the no form of this command.
spanning-tree portfast bpdufilter default
no spanning-tree portfast bpdufilter default
Syntax Description
This command has no keywords or arguments.
Defaults
BPDU filtering is disabled.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
The spanning-tree portfast bpdufilter default command enables BPDU filtering globally on the Catalyst 4500 series switch. BPDU filtering prevents a port from sending or receiving any BPDUs.
You can override the effects of the spanning-tree portfast bpdufilter default command by configuring BPDU filtering at the interface level.
Note
When enabled locally on a port, BPDU filtering prevents the Catalyst 4500 series switch from receiving or sending BPDUs on this port.
Caution
Examples
This example shows how to enable BPDU filtering by default:
Switch(config)# spanning-tree portfast bpdufilter defaultSwitch(config)#Related Commands
spanning-tree portfast bpduguard default
To enable BPDU guard by default on all the PortFast ports, use the spanning-tree portfast bpduguard default command. To return to the default settings, use the no form of this command.
spanning-tree portfast bpduguard default
no spanning-tree portfast bpduguard default
Syntax Description
This command has no keywords or arguments.
Defaults
BPDU guard is disabled.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
Caution
BPDU guard disables a port if it receives a BPDU. BPDU guard is applied only on ports that are PortFast enabled and are in an operational PortFast state.
Examples
This example shows how to enable BPDU guard by default:
Switch(config)# spanning-tree portfast bpduguard defaultSwitch(config)#Related Commands
spanning-tree portfast default
To globally enable PortFast by default on all access ports, use the spanning-tree portfast default command. To disable PortFast as default on all access ports, use the no form of this command.
spanning-tree portfast default
no spanning-tree portfast default
Syntax Description
This command has no arguments or keywords.
Defaults
PortFast is disabled.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
Caution
An interface with PortFast mode enabled is moved directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-time delay.
You can enable PortFast mode on individual interfaces using the spanning-tree portfast (interface configuration mode) command.
Examples
This example shows how to globally enable PortFast by default on all access ports:
Switch(config)# spanning-tree portfast defaultSwitch(config)#Related Commands
spanning-tree port-priority
To prioritize an interface when two bridges compete for position as the root bridge, use the spanning-tree port-priority command. The priority you set breaks the tie. To revert to the default setting, use the no form of this command.
spanning-tree port-priority port_priority
no spanning-tree port-priority
Syntax Description
Defaults
Port priority value is set to 128.
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Examples
This example shows how to increase the possibility that the spanning-tree instance 20 will be chosen as the root-bridge on interface FastEthernet 2/1:
Switch(config-if)# spanning-tree port-priority 0Switch(config-if)#Related Commands
spanning-tree uplinkfast
To enable the UplinkFast feature, use the spanning-tree uplinkfast command. To disable UplinkFast, use the no form of this command.
spanning-tree uplinkfast [max-update-rate packets-per-second]
no spanning-tree uplinkfast [max-update-rate]
Syntax Description
max-update-rate packets_per_second
(Optional) Specifies the maximum rate (in packets per second) at which update packets are sent; valid values are from 0 to 65535.
Defaults
The default settings are as follows:
•
•
Command Modes
Global configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
This command should be used only on access switches.
When UplinkFast is configured, the bridge priority is changed to 49,152 so that this switch will not be selected as root. All interface path costs of all spanning-tree interfaces belonging to the specified spanning-tree instances are also increased by 3000.
When spanning tree detects that the root interface has failed, the UplinkFast feature causes an immediate switchover to an alternate root interface, transitioning the new root interface directly to the forwarding state. During this time, a topology change notification is sent. To minimize the disruption caused by the topology change, a multicast packet is sent to 01-00-0C-CD-CD-CD for each station address in the forwarding bridge except for those associated with the old root interface.
Use the spanning-tree uplinkfast max-update-rate command to enable UplinkFast (if not already enabled) and change the rate at which the update packets are sent. Use the no form of this command to return the default rate of 150 packets per second.
Examples
This example shows how to enable UplinkFast and set the maximum rate to 200 packets per second:
Switch(config)# spanning-tree uplinkfastSwitch(config)# spanning-tree uplinkfast max-update-rate 200Related Commands
spanning-tree vlan
To configure STP on a per-VLAN basis, use the spanning-tree vlan command. To return to the default value, use the no form of this command.
spanning-tree vlan vlan_id [forward-time seconds | hello-time seconds | max-age seconds | priority priority | protocol protocol | root {primary | secondary} [diameter net-diameter [hello-time seconds]]]
no spanning-tree vlan vlan_id [forward-time | hello-time | max-age | priority | root]
Syntax Description
Defaults
The default settings are as follows:
•
•
•
•
•
Command Modes
Global configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(12c)EW
Support for extended addressing was added.
Usage Guidelines
When you are setting the max-age seconds value, if a bridge does not hear BPDUs from the root bridge within the specified interval, it assumes that the network has changed and recomputes the spanning-tree topology.
The spanning-tree root primary command alters the switch bridge priority to 8192. If you enter the spanning-tree root primary command and the switch does not become root, then the bridge priority is changed to 100 less than the bridge priority of the current bridge. If the switch does not become root, an error will result.
The spanning-tree root secondary command alters the switch bridge priority to 16384. If the root switch fails, this switch becomes the next root switch.
Use the spanning-tree root commands on backbone switches only.
Examples
This example shows how to enable spanning tree on VLAN 200:
Switch(config)# spanning-tree vlan 200Switch(config)#This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4:
Switch(config)# spanning-tree vlan 10 root primary diameter 4Switch(config)#This example shows how to configure the switch as the secondary root switch for VLAN 10 with a network diameter of 4:
Switch(config)# spanning-tree vlan 10 root secondary diameter 4Switch(config)#Related Commands
speed
To configure the interface speed, use the speed command. To disable a speed setting, use the no form of this command.
speed {10 | 100 | 1000 | auto [10 | 100 | 1000] | nonegotiate}
no speed
Syntax Description
Defaults
The default values are shown in the following table:
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.2(20)EWA
Support for auto negotiating specific speeds added.
Usage Guidelines
Table 2-33 lists the supported command options by interface.
If you configure the interface speed and duplex commands manually and enter a value other than
speed auto (for example, 10 or 100 Mbps), make sure that you configure the connecting interface speed command to a matching speed but do not use the auto parameter.When manually configuring the interface speed to either 10 or 100 Mbps, the switch prompts you to also configure duplex mode on the interface.
Note
Caution
Table 2-34 describes the system's performance for different combinations of the duplex and speed modes. The specified duplex command that is configured with the specified speed command produces the resulting system action.
Examples
This example shows how to set the interface speed to 100 Mbps on the Fast Ethernet interface 5/4:
Switch(config)# interface fastethernet 5/4Switch(config-if)# speed 100This example shows how to allow Fast Ethernet interface 5/4 to autonegotiate the speed and duplex mode:
Switch(config)# interface fastethernet 5/4Switch(config-if)# speed auto
Note
This example shows how to limit the interface speed to 10 and 100 Mbps on the Gigabit Ethernet interface 1/1 in auto-negotiation mode:
Switch(config)# interface gigabitethernet 1/1Switch(config-if)# speed auto 10 100This example shows how to limit the speed negotiation to 100 Mbps on the Gigabit Ethernet interface 1/1:
Switch(config)# interface gigabitethernet 1/1Switch(config-if)# speed auto 100Related Commands
storm-control
To enable broadcast storm control on a port and to specify what to do when a storm occurs on a port, use the storm-control interface configuration command. To disable storm control for the broadcast traffic and to disable a specified storm-control action, use the no form of this command.
storm-control {broadcast level high level [lower level]} | action {shutdown | trap}}
no storm-control {broadcast level level [lower level]} | action {shutdown | trap}}
Syntax Description
Defaults
Broadcast storm control is disabled.
Command Modes
Interface configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.2(40)SG
Support for the Supervisor Engine 6-E and Catalyst 4900M chassis is introduced.
Usage Guidelines
Enter the storm-control broadcast level command to enable traffic storm control on the interface, configure the traffic storm control level, and apply the traffic storm control level to the broadcast traffic on the interface.
The Catalyst 4500 series switch supports broadcast traffic storm control on all LAN ports.
The period is required when you enter the fractional suppression level.
The suppression level is entered as a percentage of the total bandwidth. A threshold value of 100 percent indicates that no limit is placed on traffic. A value of 0.0 means that all specified traffic on that port is blocked.
Enter the show interfaces counters storm-control command to display the discard count.
Enter the show running-config command to display the enabled suppression mode and level setting.
To turn off suppression for the specified traffic type, you can do one of the following:
•
•
The lower level is ignored for the interfaces that perform storm control in the hardware.
Note
Examples
This example shows how to enable broadcast storm control on a port with a 75.67 percent rising suppression level:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet 3/1Switch(config-if)# storm-control broadcast level 75.67Switch(config-if)# endThis example shows how to disable the port during a storm:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet 3/1Switch(config-if)# storm-control action shutdownSwitch(config-if)# endThis example shows how to disable storm control on a port:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet 3/1Switch(config-if)# no storm-control broadcast levelSwitch(config-if)# endThis example shows how to disable storm control by setting the high level to 100 percent:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet 3/1Switch(config-if)# storm-control broadcast level 100Switch(config-if)# endRelated Commands
Displays the traffic on the physical interface.
Displays the running configuration of a switch.
storm-control broadcast include multicast
To enable multicast storm control on a port, use the storm-control broadcast include multicast command. To disable multicast storm control, use the no form of this command.
storm-control broadcast include multicast
no storm-control broadcast include multicast
Syntax Description
This command has no arguments or keywords.
Defaults
Multicast storm control is disabled.
Command Modes
Global configuration mode
Interface configuration mode on a Supervisor Engine 6-E and Catlyst 4900M chassisCommand History
12.2(18)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.2(40)SG
Support for the Supervisor Engine 6-E and Catalyst 4900M chassis is introduced.
Usage Guidelines
This command prompts the hardware to filter multicast packets if it is already filtering broadcast packets.
The Supervisor Engine 6-E and Catalyst 4900M chassis supports per-interface multicast suppression. When you enable multicast suppression on an interface you subject incoming multicast and broadcast traffic on that interface to suppression.
Examples
This example shows how to enable multicast storm control globally:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# storm-control broadcast include multicastSwitch(config)# endThis example shows how to enable per-port Multicast storm control on a Supervisor Engine 6-E:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet2/4Switch(config-if)# storm-control broadcast include multicastSwitch(config)# endRelated Commands
Enables broadcast storm control on a port and and specifies what to do when a storm occurs on a port.
switchport
To modify the switching characteristics of a Layer 2 switch interface, use the switchport command. To return the interface to the routed-interface status and cause all further Layer 2 configuration to be erased, use the no form of this command without parameters.
switchport [access vlan vlan_num] | [nonegotiate] | [voice vlan {vlan_id | dot1p | none | untagged}]
no switchport [access | nonegotiate | voice vlan]
Syntax Description
Defaults
The default settings are as follows:
•
•
•
•
•
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(11)EW
Support for voice VLAN was added.
Usage Guidelines
The no switchport command shuts the port down and then reenables it, which may generate messages on the device to which the port is connected.
The no form of the switchport access command resets the access mode VLAN to the appropriate default VLAN for the device. The no form of the switchport nonegotiate command removes the nonegotiate status.
When you are using the nonegotiate keyword, DISL/DTP negotiation packets will not be sent on the interface. The device will trunk or not trunk according to the mode parameter given: access or trunk. This command will return an error if you attempt to execute it in dynamic (auto or desirable) mode.
The voice VLAN is automatically set to VLAN 1 unless you use one of the optional keywords.
If you use the switch port voice vlan command for an interface, the interface cannot join a port channel.
When you use the switchport voice vlan command, the output for the show running-config command changes to show the voice VLAN set.
Examples
This example shows how to cause the port interface to stop operating as a Cisco-routed port and convert to a Layer 2-switched interface:
Switch(config-if)# switchportSwitch(config-if)#This example shows how to cause a port interface in access mode, which is configured as a switched interface, to operate in VLAN 2:
Switch(config-if)# switchport access vlan 2Switch(config-if)#This example shows how to cause a port interface, which is configured as a switched interface, to refrain from negotiating in trunking mode and act as a trunk or access port (depending on the mode set):
Switch(config-if)# switchport nonegotiateSwitch(config-if)#This example shows how to set the voice VLAN for the interface to VLAN 2:
Switch(config-if)# switchport voice vlan 2switchport voice vlan 2Switch(config-if)#Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
switchport access vlan
To set the VLAN when an interface is in access mode, use the switchport access vlan command. To reset the access mode VLAN to the appropriate default VLAN for the device, use the no form of this command.
switchport access [vlan {vlan-id | dynamic}]
no switchport access vlan
Syntax Description
vlan-id
(Optional) Number of the VLAN on the interface in access mode; valid values are from 1 to 4094.
dynamic
(Optional) Enables VMPS control of the VLAN.
Defaults
The default settings are as follows:
•
•
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(13)EW
Support for VPMS was added.
Usage Guidelines
You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport access vlan command. This action is required only if you have not already entered the switchport command for the interface.
Entering the no switchport command shuts the port down and then reenables it, which could generate messages on the device to which the port is connected.
The no form of the switchport access vlan command resets the access mode VLAN to the appropriate default VLAN for the device.
If your system is configured with a Supervisor Engine I, valid values for vlan-id are from 1 to 1005. If your system is configured with a Supervisor Engine II, valid values for vlan-id are from 1 to 4094. Extended-range VLANs are not supported on systems configured with a Supervisor Engine I.
Examples
This example shows how to cause the port interface to stop operating as a Cisco-routed port and convert to a Layer 2-switched interface:
Switch(config-if)# switchportSwitch(config-if)#
Note
This example shows how to cause a port interface that has already been configured as a switched interface to operate in VLAN 2 instead of the platform's default VLAN when in access mode:
Switch(config-if)# switchport access vlan 2Switch(config-if)#Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
switchport autostate exclude
To exclude a port from the VLAN interface link-up calculation, use the switchport autostate exclude command. To return to the default settings, use the no form of this command.
switchport autostate exclude
no switchport autostate exclude
Syntax Description
This command has no keywords or arguments.
Defaults
All ports are included in the VLAN interface link-up calculation.
Command Modes
Interface configuration mode
Command History
12.2(37)SG
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport autostate exclude command. This action is required only if you have not entered the switchport command for the interface.
Note
The switchport autostate exclude command marks the port to be excluded from the interface VLAN up calculation when there are multiple ports in the VLAN.
The show interface interface switchport command displays the autostate mode if the mode has been set. If the mode has not been set, the autostate mode is not displayed.
Examples
This example shows how to exclude a port from the VLAN interface link-up calculation:
Switch(config-if)# switchport autostate excludeSwitch(config-if)#This example shows how to include a port in the VLAN interface link-up calculation:
Switch(config-if)# no switchport autostate excludeSwitch(config-if)#You can verify your settings by entering the show interfaces switchport privileged EXEC command.
Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
switchport block
To prevent the unknown multicast or unicast packets from being forwarded, use the switchport block interface configuration command. To allow the unknown multicast or unicast packets to be forwarded, use the no form of this command.
switchport block {multicast | unicast}
no switchport block {multicast | unicast}
Syntax Description
multicast
Specifies that the unknown multicast traffic should be blocked.
unicast
Specifies that the unknown unicast traffic should be blocked.
Defaults
Unknown multicast and unicast traffic are not blocked.
All traffic with unknown MAC addresses is sent to all ports.
Command Modes
Interface configuration mode
Command History
12.1(19)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
You can block the unknown multicast or unicast traffic on the switch ports.
Blocking the unknown multicast or unicast traffic is not automatically enabled on the switch ports; you must explicitly configure it.
Note
Examples
This example shows how to block the unknown multicast traffic on an interface:
Switch(config-if)# switchport block multicastYou can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command.
Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
switchport mode
To set the interface type, use the switchport mode command. To reset the mode to the appropriate default mode for the device, use the no form of this command.
switchport mode {access | dot1q-tunnel | trunk | dynamic {auto | desirable}}
switchport mode private-vlan {host | promiscuous | trunk promiscuous | trunk [secondary]}
no switchport mode dot1q-tunnel
no switchport mode private-vlan
Syntax Description
Defaults
Link converts to a trunk link.
dot1q tunnel ports are disabled.
Command Modes
Interface configuration mode
Command History
Usage Guidelines
If you enter access mode, the interface goes into permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not approve the change.
If you enter trunk mode, the interface goes into permanent trunking mode and negotiates to convert the link into a trunk link even if the neighboring interface does not approve the change.
If you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode.
If you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.
If you specify the dot1q-tunnel keyword, the port is set unconditionally as an 802.1Q tunnel port.
The port becomes inactive if you configure it as a private VLAN trunk port and one of the following applies:
•
•
If a private port PVLAN association or mapping is deleted, or if a private port is configured as a SPAN destination, it becomes inactive.
Examples
This example shows how to set the interface to dynamic desirable mode:
Switch(config-if)# switchport mode dynamic desirableSwitch(config-if)#This example shows how to set a port to PVLAN host mode:
Switch(config-if)# switchport mode private-vlan hostSwitch(config-if)#This example shows how to set a port to private VLAN trunk:
Switch(config-if)# switchport mode private-vlan trunkSwitch(config-if)#This example shows how to configure a port for an 802.1Q tunnel port:
Switch(config-if)# switchport mode dot1q-tunnelSwitch(config-if)#This example shows how to configure a promiscuous trunk port:
Switch(config-if)# switchport mode private-vlan trunk promiscuousSwitch(config-if)#This example shows how to configure an isolated trunk port:
Switch(config-if)# switchport mode private-vlan trunkORSwitch(config-if)# switchport mode private-vlan trunk secondarySwitch(config-if)#You can verify your settings by entering the show interfaces switchport command and examining information in the Administrative Mode and Operational Mode rows.
This example shows how to configure interface FastEthernet 5/2 as a PVLAN promiscuous port, map it to a PVLAN, and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan promiscuousSwitch(config-if)# switchport private-vlan mapping 200 2Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName:Fa5/2Switchport:EnabledAdministrative Mode:private-vlan promiscuousOperational Mode:private-vlan promiscuousAdministrative Trunking Encapsulation:negotiateOperational Trunking Encapsulation:nativeNegotiation of Trunking:OffAccess Mode VLAN:1 (default)Trunking Native Mode VLAN:1 (default)Voice VLAN:noneAdministrative Private VLAN Host Association:noneAdministrative Private VLAN Promiscuous Mapping:200 (VLAN0200) 2 (VLAN0002)Private VLAN Trunk Native VLAN:noneAdministrative Private VLAN Trunk Encapsulation:dot1qAdministrative Private VLAN Trunk Normal VLANs:noneAdministrative Private VLAN Trunk Private VLANs:noneOperational Private VLANs:200 (VLAN0200) 2 (VLAN0002)Trunking VLANs Enabled:ALLPruning VLANs Enabled:2-1001Capture Mode DisabledCapture VLANs Allowed:ALLThis example shows how to configure interface FastEthernet 5/1 as a PVLAN host port and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/1Switch(config-if)# switchport mode private-vlan hostSwitch(config-if)# switchport private-vlan host-association 202 440Switch(config-if)# end
Switch# show interfaces fastethernet 5/1 switchportName: Fa5/1Switchport: EnabledAdministrative Mode: private-vlan hostOperational Mode: private-vlan hostAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: nativeNegotiation of Trunking: OffAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Voice VLAN: noneAppliance trust: noneAdministrative Private VlanHost Association: 202 (VLAN0202) 440 (VLAN0440)Promiscuous Mapping: noneTrunk encapsulation : dot1qTrunk vlans:Operational private-vlan(s):202 (VLAN0202) 440 (VLAN0440)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode DisabledCapture VLANs Allowed: ALLThis example shows how to configure interface FastEthernet 5/2 as a secondary trunk port, and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan trunk secondarySwitch(config-if)# switchport private-vlan trunk native vlan 10Switch(config-if)# switchport private-vlan trunk allowed vlan 10. 3-4Switch(config-if)# switchport private-vlan association trunk 3 301Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName: Fa5/2Switchport: EnabledAdministrative Mode: private-vlan trunk secondaryOperational Mode: private-vlan trunk secondaryAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: none Administrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: 10Administrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: noneAdministrative private-vlan trunk associations:3 (VLAN0003) 301 (VLAN0301)Administrative private-vlan trunk mappings: noneOperational private-vlan: noneOperational Normal VLANs: noneTrunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode Disabled Capture VLANs Allowed: ALLUnknown unicast blocked: disabledUnknown multicast blocked: disabledAppliance trust: noneSwitch(config-if)#This example shows how to configure interface FastEthernet 5/2 as a promiscuous trunk port and to verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan trunk promiscuousSwitch(config-if)# switchport private-vlan trunk native vlan 10Switch(config-if)# switchport private-vlan trunk allowed vlan 10, 3-4Switch(config-if)# switchport private-vlan mapping trunk 3 301, 302Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName: Fa5/2Switchport: EnabledAdministrative Mode: private-vlan trunk promiscuousOperational Mode: private-vlan trunk promiscuousAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: noneAdministrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: 10Administrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: 3-4,10Administrative private-vlan trunk associations: noneAdministrative private-vlan trunk mappings:3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302)Operational private-vlan:3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode DisabledCapture VLANs Allowed: ALLUnknown unicast blocked: disabledUnknown multicast blocked: disabledAppliance trust: noneSwitch(config-if)#Related Commands
switchport port-security
To enable port security on an interface, use the switchport port-security command. To disable port security and set parameters to their default states, use the no form of this command.
switchport port-security [aging {static | time time | type {absolute | inactivity}} |
limit rate invalid-source-mac [N | none] | mac-address mac-address [vlan {access | voice} | mac-address sticky [mac-address] [vlan access | voice] | maximum value [vlan {access | voice} | violation {restrict | shutdown}]no switchport port-security [aging {static | time time | type {absolute | inactivity}} |
limit rate invalid-source-mac [N | none] | mac-address mac-address [vlan {access | voice} | mac-address sticky [mac-address] [vlan access | voice] | maximum value [vlan {access | voice} | violation {restrict | shutdown}]Syntax Description
Defaults
The default settings are as follows:
•
•
•
•
•
Command Modes
Interface configuration mode
Command History
Usage Guidelines
After you set the maximum number of secure MAC addresses that are allowed on a port, you can add secure addresses to the address table by manually configuring them, by allowing the port to dynamically configure them, or by configuring some MAC addresses and allowing the rest to be dynamically configured.
The packets are dropped into the hardware when the maximum number of secure MAC addresses are in the address table and a station that does not have a MAC address in the address table attempts to access the interface.
If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you set the maximum allowed secure addresses on the port to more than 1.
You cannot configure static secure MAC addresses in the voice VLAN.
A secure port has the following limitations:
•
•
•
•
•
•
•
When a secure port is in the error-disabled state, you can remove it from this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually reenable it by entering the shutdown and no shut down interface configuration commands.
To enable secure address aging for a particular port, set the aging time to a value other than 0 for that port.
To allow limited time access to particular secure addresses, set the aging type as absolute. When the aging time lapses, the secure addresses are deleted.
To allow continuous access to a limited number of secure addresses, set the aging type as inactivity. This action removes the secure address when it becomes inactive, and other addresses can become secure.
To allow unlimited access to a secure address, configure it as a secure address, and disable aging for the statically configured secure address by using the no switchport port-security aging static interface configuration command.
If the sticky command is executed without a MAC address specified, all MAC addresses that are learned on that port will be made sticky. You can also specify a specific MAC address to be a sticky address by entering the sticky keyword next to it.
You can configure the sticky feature even when port security is not enabled on the interface. The feature becomes operational when you enable port security on the interface.
You can use the no form of the sticky command only if the sticky feature is already enabled on the interface.
Examples
This example shows how to set the aging time to 2 hours (120 minutes) for the secure addresses on the Fast Ethernet port 12:
Switch(config)# interface fastethernet 0/12Switch(config-if)# switchport port-security aging time 120Switch(config-if)#This example shows how to set the aging timer type to Inactivity for the secure addresses on the Fast Ethernet port 12:
Switch(config)# interface fastethernet 0/12Switch(config-if)# switch port-security aging type inactivitySwitch(config-if)#The following example shows how to configure rate limit for invalid source packets on Fast Ethernet port 12:
Switch(config)# interface fastethernet 0/12Switch(config-if)# switchport port-security limit rate invalid-source-mac 100Switch(config-if)#The following example shows how to configure rate limit for invalid source packets on Fast Ethernet port 12:
Switch(config)# interface fastethernet 0/12Switch(config-if)# switchport port-security limit rate invalid-source-mac noneSwitch(config-if)#You can verify the settings for all secure ports or the specified port by using the show port-security privileged EXEC command.
This example shows how to remove all sticky and static addresses that are configured on the interface:
Switch(config)# interface fastethernet 2/12Switch(config-if)# no switchport port-security mac-addressSwitch(config-if)This example shows how to configure a secure MAC address on Fast Ethernet port 12:
Switch(config)# interface fastethernet 0/12Switch(config-if)# switchport mode accessSwitch(config-if)# switchport port-securitySwitch(config-if)# switchport port-security mac-address 1000.2000.3000Switch(config-if)This example shows how to make all MAC addresses learned on Fast Ethernet port 12 sticky:
Switch(config)# interface fastethernet 2/12SSwitch(config-if)# switchport port-security mac-address stickySwitch(config-if)This example shows how to make MAC address 1000.2000.3000 sticky on Fast Ethernet port 12:
Switch(config)# interface fastethernet 2/12Switch(config-if)# switchport port-security mac-address sticky 1000.2000.3000Switch(config-if)This example shows how to disable the sticky feature on Fast Ethernet port 12:
Switch(config)# interface fastethernet 2/12Switch(config-if)# no switchport port-security mac-address stickySwitch(config-if)
Note
Note
vlan [access | voice] keywords are not supported.This example shows how to configure sticky MAC addresses for voice and data VLANs on Fast Ethernet interface 5/1 and to verify the configuration:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fa5/1Switch(config-if)# switchport mode accessSwitch(config-if)# switchport port-securitySwitch(config-if)# switchport port-security mac-address sticky 0000.0000.obob vlan voiceSwitch(config-if)# switchport port-security mac-address sticky 0000.0000.0005 vlan accessSwitch(config-if)# endThis example shows how to designate a maximum of one MAC address for a voice VLAN (for a Cisco IP Phone, let's say) and one MAC address for the data VLAN (for a PC, let's say) on Fast Ethernet interface 5/1 and to verify the configuration:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fa5/1Switch(config-if)# switchport mode accessSwitch(config-if)# switchport port-securitySwitch(config-if)# switchport port-security mac-address stickySwitch(config-if)# switchport port-security maximum 1 vlan voiceSwitch(config-if)# switchport port-security maximum 1 vlan accessSwitch(config-if)# end
Note
You can verify your settings by using the show port-security address privileged EXEC command.
Related Commands
switchport private-vlan association trunk
To configure the association between a secondary VLAN and a VLAN on a private VLAN trunk port, use the switchport private-vlan association trunk command. To remove the private VLAN mapping from the port, use the no form of this command.
switchport private-vlan association trunk {primary-vlan-id} {secondary-vlan-id}
no switchport private-vlan association trunk {primary-vlan-id}
Syntax Description
primary-vlan-id
Number of the primary VLAN of the private VLAN relationship.
secondary-vlan-id
Number of the secondary VLAN of the private VLAN relationship.
Defaults
Private VLAN mapping is disabled.
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.2(20)EW
Support for community VLAN was added.
Usage Guidelines
Multiple private VLAN pairs can be specified so that a private VLAN trunk port can carry multiple secondary VLANs. If an association is specified for the existing primary VLAN, the existing association is replaced.
Only isolated secondary VLANs can be carried over a private VLAN trunk.
Note
If there is no trunk association, any packets received on the secondary VLANs are dropped.
Examples
This example shows how to configure a port with a primary VLAN (VLAN 18) and secondary VLAN (VLAN 20):
Switch(config-if)# switchport private-vlan association trunk 18 20Switch(config-if)#This example shows how to remove the private VLAN association from the port:
Switch(config-if)# no switchport private-vlan association trunk 18Switch(config-if)#This example shows how to configure interface FastEthernet 5/2 as a secondary trunk port, and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan trunk secondarySwitch(config-if)# switchport private-vlan trunk native vlan 10Switch(config-if)# switchport private-vlan trunk allowed vlan 10. 3-4Switch(config-if)# switchport private-vlan association trunk 3 301Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName: Fa5/2Switchport: EnabledAdministrative Mode: private-vlan trunk secondaryOperational Mode: private-vlan trunk secondaryAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: none Administrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: 10Administrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: noneAdministrative private-vlan trunk associations:3 (VLAN0003) 301 (VLAN0301)Administrative private-vlan trunk mappings: noneOperational private-vlan: noneOperational Normal VLANs: noneTrunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode Disabled Capture VLANs Allowed: ALLUnknown unicast blocked: disabledUnknown multicast blocked: disabledAppliance trust: noneSwitch(config-if)#Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
Enables the interface type.
switchport private-vlan host-association
To define a PVLAN association for an isolated or community port, use the switchport private-vlan host-association command. To remove the PVLAN mapping from the port, use the no form of this command.
switchport private-vlan host-association {primary-vlan-id} {secondary-vlan-id}
no switchport private-vlan host-association
Syntax Description
Defaults
Private VLAN mapping is disabled.
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.1(12c)EW
Support for extended addressing was added.
Usage Guidelines
There is no runtime effect on the port unless it is in PVLAN host mode. If the port is in PVLAN host mode but all VLANs do not exist, the command is allowed, but the port is made inactive.
The secondary VLAN may be an isolated or community VLAN.
Examples
This example shows how to configure a port with a primary VLAN (VLAN 18) and secondary VLAN (VLAN 20):
Switch(config-if)# switchport private-vlan host-association 18 20Switch(config-if)#This example shows how to remove the PVLAN association from the port:
Switch(config-if)# no switchport private-vlan host-associationSwitch(config-if)#This example shows how to configure interface FastEthernet 5/1 as a PVLAN host port and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/1Switch(config-if)# switchport mode private-vlan hostSwitch(config-if)# switchport private-vlan host-association 202 440Switch(config-if)# endSwitch# show interfaces fastethernet 5/1 switchportName: Fa5/1Switchport: EnabledAdministrative Mode: private-vlan hostOperational Mode: private-vlan hostAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: nativeNegotiation of Trunking: OffAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Voice VLAN: noneAppliance trust: noneAdministrative Private VlanHost Association: 202 (VLAN0202) 440 (VLAN0440)Promiscuous Mapping: noneTrunk encapsulation : dot1qTrunk vlans:Operational private-vlan(s):202 (VLAN0202) 440 (VLAN0440)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode DisabledCapture VLANs Allowed: ALLRelated Commands
Displays the administrative and operational status of a switching (nonrouting) port.
Enables the interface type.
switchport private-vlan mapping
To define private VLAN mapping for a promiscuous port, use the switchport private-vlan mapping command. To clear all mapping from the primary VLAN, use the no form of this command.
switchport private-vlan mapping {primary-vlan-id} {secondary-vlan-list} | {add secondary-vlan-list} | {remove secondary-vlan-list}
switchport private-vlan mapping trunk {primary-vlan-id} [add | remove] secondary-vlan-list
no switchport private-vlan mapping [trunk]
Syntax Description
Defaults
Private VLAN mapping is disabled.
Command Modes
Interface configuration mode
Command History
Usage Guidelines
There is no run-time effect on the port unless it is in private VLAN promiscuous mode. If the port is in private VLAN promiscuous mode but the VLANs do not exist, the command is allowed, but the port is made inactive.
The secondary VLAN may be an isolated or community VLAN.
Note
Examples
This example shows how to configure the mapping of primary VLAN 18 to the secondary isolated VLAN 20 on a port:
Switch(config-if)# switchport private-vlan mapping 18 20Switch(config-if)#This example shows how to add a VLAN to the mapping:
Switch(config-if)# switchport private-vlan mapping 18 add 21Switch(config-if)#This example shows how to add a range of secondary VLANs to the mapping:
Switch(config-if)# switchport private-vlan mapping 18 add 22-24Switch(config-if)#This example shows how to add a range of secondary VLANs to the trunk mapping:
Switch(config-if)# switchport private-vlan mapping trunk 18 add 22-24Switch(config-if)#This example shows how to configure interface FastEthernet 5/2 as a PVLAN promiscuous port, map it to a PVLAN, and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan promiscuousSwitch(config-if)# switchport private-vlan mapping 200 2Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName:Fa5/2Switchport:EnabledAdministrative Mode:private-vlan promiscuousOperational Mode:private-vlan promiscuousAdministrative Trunking Encapsulation:negotiateOperational Trunking Encapsulation:nativeNegotiation of Trunking:OffAccess Mode VLAN:1 (default)Trunking Native Mode VLAN:1 (default)Voice VLAN:noneAdministrative Private VLAN Host Association:noneAdministrative Private VLAN Promiscuous Mapping:200 (VLAN0200) 2 (VLAN0002)Private VLAN Trunk Native VLAN:noneAdministrative Private VLAN Trunk Encapsulation:dot1qAdministrative Private VLAN Trunk Normal VLANs:noneAdministrative Private VLAN Trunk Private VLANs:noneOperational Private VLANs:200 (VLAN0200) 2 (VLAN0002)Trunking VLANs Enabled:ALLPruning VLANs Enabled:2-1001Capture Mode DisabledCapture VLANs Allowed:ALLThis example shows how to configure interface FastEthernet 5/2 as a promiscuous trunk port and to verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan trunk promiscuousSwitch(config-if)# switchport private-vlan trunk native vlan 10Switch(config-if)# switchport private-vlan trunk allowed vlan 10, 3-4Switch(config-if)# switchport private-vlan mapping trunk 3 301, 302Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName: Fa5/2Switchport: EnabledAdministrative Mode: private-vlan trunk promiscuousOperational Mode: private-vlan trunk promiscuousAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: noneAdministrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: 10Administrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: 3-4,10Administrative private-vlan trunk associations: noneAdministrative private-vlan trunk mappings:3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302)Operational private-vlan:3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode DisabledCapture VLANs Allowed: ALLUnknown unicast blocked: disabledUnknown multicast blocked: disabledAppliance trust: noneSwitch(config-if)#Related Commands
switchport private-vlan trunk allowed vlan
To configure a list of the allowed normal VLANs on a private VLAN trunk port, use the switchport private-vlan trunk allowed vlan command. To remove all the allowed normal VLANs from a private VLAN trunk port, use the no form of this command.
switchport private-vlan trunk allowed vlan {vlan-list} all | none | [add | remove | except] vlan_atom [,vlan_atom...]
no switchport private-vlan trunk allowed vlan
Syntax Description
Defaults
All allowed normal VLANs are removed from a private VLAN trunk port.
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
By default, no normal VLANs are allowed unless you explicitly configure the VLANs to be allowed.
Use this command only for normal VLANs on a private VLAN trunk port.
Use the switchport private-vlan association trunk command to configure a port that can carry private VLANs on a private VLAN trunk port.
Examples
This example shows how to configure the private VLAN trunk port that carries normal VLANs 1 to10:
Switch(config-if)# switchport private-vlan trunk allowed vlan 1-10Switch(config-if)#This example shows how to remove all the allowed normal VLANs from a private VLAN trunk port:
Switch(config-if)# no switchport private-vlan trunk allowed vlanSwitch(config-if)#This example shows how to configure interface FastEthernet 5/2 as a secondary trunk port, and verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan trunk secondarySwitch(config-if)# switchport private-vlan trunk native vlan 10Switch(config-if)# switchport private-vlan trunk allowed vlan 10. 3-4Switch(config-if)# switchport private-vlan association trunk 3 301Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName: Fa5/2Switchport: EnabledAdministrative Mode: private-vlan trunk secondaryOperational Mode: private-vlan trunk secondaryAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: none Administrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: 10Administrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: noneAdministrative private-vlan trunk associations:3 (VLAN0003) 301 (VLAN0301)Administrative private-vlan trunk mappings: noneOperational private-vlan: noneOperational Normal VLANs: noneTrunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode Disabled Capture VLANs Allowed: ALLUnknown unicast blocked: disabledUnknown multicast blocked: disabledAppliance trust: noneSwitch(config-if)#This example shows how to configure interface FastEthernet 5/2 as a promiscuous trunk port and to verify the configuration:
Switch# configure terminalSwitch(config)# interface fastethernet 5/2Switch(config-if)# switchport mode private-vlan trunk promiscuousSwitch(config-if)# switchport private-vlan trunk native vlan 10Switch(config-if)# switchport private-vlan trunk allowed vlan 10, 3-4Switch(config-if)# switchport private-vlan mapping trunk 3 301, 302Switch(config-if)# endSwitch# show interfaces fastethernet 5/2 switchportName: Fa5/2Switchport: EnabledAdministrative Mode: private-vlan trunk promiscuousOperational Mode: private-vlan trunk promiscuousAdministrative Trunking Encapsulation: negotiateOperational Trunking Encapsulation: dot1qNegotiation of Trunking: OnAccess Mode VLAN: 1 (default)Trunking Native Mode VLAN: 1 (default)Administrative Native VLAN tagging: enabledVoice VLAN: noneAdministrative private-vlan host-association: noneAdministrative private-vlan mapping: noneAdministrative private-vlan trunk native VLAN: 10Administrative private-vlan trunk Native VLAN tagging: enabledAdministrative private-vlan trunk encapsulation: dot1qAdministrative private-vlan trunk normal VLANs: 3-4,10Administrative private-vlan trunk associations: noneAdministrative private-vlan trunk mappings:3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302)Operational private-vlan:3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302)Trunking VLANs Enabled: ALLPruning VLANs Enabled: 2-1001Capture Mode DisabledCapture VLANs Allowed: ALLUnknown unicast blocked: disabledUnknown multicast blocked: disabledAppliance trust: noneSwitch(config-if)#Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
Enables the interface type.
switchport private-vlan trunk native vlan tag
To control the tagging of the native VLAN traffic on 802.1Q private VLAN trunks, use the switchport private-vlan trunk native vlan tag command. To remove the control of tagging (and default to the global setting), use the no form of this command.
switchport private-vlan trunk native vlan tag
no switchport private-vlan trunk native vlan tag
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting is global; the settings on the port are determined by the global setting.
Command Modes
Interface configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
12.2(18)EW
Removed vlan-id keyword.
Usage Guidelines
The configuration created with this command only applies to ports that are configured as private VLAN trunks.
Examples
This example shows how to enable 802.1Q native VLAN tagging on a PVLAN trunk:
Switch(config-if)# switchport private-vlan trunk native vlan tagSwitch(config-if)#Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
Enables the interface type.
switchport trunk
To set the trunk characteristics when an interface is in trunking mode, use the switchport trunk command. To reset all of the trunking characteristics back to the original defaults, use the no form of this command.
switchport trunk encapsulation {isl | dot1q | negotiate}
no switchport trunk encapsulation
switchport trunk native vlan {tag | vlan_id}
no switchport trunk native vlan {tag | vlan_id}
switchport trunk allowed vlan vlan_list
no switchport trunk allowed vlan vlan_list
switchport trunk pruning vlan vlan_list
no switchport trunk pruning vlan vlan_list
Syntax Description
Defaults
The default settings are as follows:
•
•
•
•
Command Modes
Interface configuration mode
Command History
Usage Guidelines
The vlan_list format is all | none | [add | remove | except] vlan_atom[,vlan_atom...], where:
•
•
•
•
•
•
The switchport trunk encapsulation command is supported only for platforms and interface hardware that can support both ISL and 802.1Q formats.
If you enter the negotiate keywords, and DISL and DTP negotiation do not resolve the encapsulation format, ISL is the selected format. The no form of this command resets the trunk encapsulation format back to the default.
The no form of the native vlan command resets the native mode VLAN to the appropriate default VLAN for the device.
The no form of the allowed vlan command resets the list to the default list, which allows all VLANs.
The no form of the pruning vlan command resets the list to the default list, which enables all VLANs for VTP pruning.
These configuration guidelines and restrictions apply when using 802.1Q trunks and impose some limitations on the trunking strategy for a network:
•
•
•
•
•
•
•
Follow these guidelines for native VLAN tagging:
•
•
•
•
Examples
This example shows how to cause a port interface that is configured as a switched interface to encapsulate in 802.1Q trunking format regardless of its default trunking format in trunking mode:
Switch(config-if)# switchport trunk encapsulation dot1qSwitch(config-if)#This example shows how to enable 802.1Q tagging on a port:
Switch(config-if)# switchport trunk native vlan tagSwitch(config-if)#This example shows how to configure a secure MAC-address and a maximum limit of secure MAC addresses on Gigabit Ethernet port 1 for all VLANs:
Switch(config)# interface gigabitethernet1/1Switch(config-if)# switchport trunk encapsulation dot1qSwitch(config-if)# switchport mode trunkSwitch(config-if)# switchport port-securitySwitch(config-if)# switchport port-security maximum 3This example shows how to configure a secure MAC-address on Gigabit Ethernet port 1 in a specific VLAN or range of VLANs:
Switch(config)# interface gigabitethernet1/1Switch(config-if)# switchport trunk encapsulation dot1qSwitch(config-if)# switchport mode trunkSwitch(config-if)# switchport port-securitySwitch(config-if)# vlan-range 2-6Switch(config-if-vlan-range)# port-security maximum 3This example shows how to configure a secure MAC-address in a VLAN on Gigabit Ethernet port 1:
Switch(config)# interface gigabitethernet1/1Switch(config-if)# switchport trunk encapsulation dot1qSwitch(config-if)# switchport mode trunkSwitch(config-if)# switchport port-securitySwitch(config-if)# switchport port-security mac-address stickySwitch(config-if)# vlan-range 2-6Switch(config-if-vlan-range)# port-security mac-address 1.1.1Switch(config-if-vlan-range)# port-security mac-address sticky 1.1.2Switch(config-if-vlan-range)# port-security mac-address sticky 1.1.3You can verify your settings by using the show port-security interface vlan privileged EXEC command.
Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
system mtu
To set the maximum Layer 2 or Layer 3 payload size, use the system mtu command. To revert to the default MTU setting, use the no form of this command.
system mtu datagram-size
no system mtu
Syntax Description
Defaults
The default MTU setting is 1500 bytes.
Command Modes
Global configuration mode
Command History
12.1(12c)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
The datagram-size parameter specifies the Ethernet payload size, not the total Ethernet frame size, and the Layer 3 MTU is changed as a result of changing the system mtu command.
For ports from 3 to18 on model WS-X4418-GB and ports from 1 to 12 on model WS-X4412-2GB-TX, only the standard IEEE Ethernet payload size of 1500 bytes is supported.
For other modules, an Ethernet payload size of up to 1552 bytes is supported with a total Ethernet frame size of up to 1600 bytes.
Examples
This example shows how to set the MTU size to 1550 bytes:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# system mtu 1550Switch(config)# endSwitch#This example shows how to revert to the default MTU setting:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# no system mtuSwitch(config)# endSwitch#Related Commands
test cable-diagnostics tdr
To test the condition of copper cables on 48-port 10/100/1000 BASE-T modules, use the
test cable-diagnostics tdr command.test cable-diagnostics tdr {interface {interface interface-number}
Note
Syntax Description
interface interface
Interface type; valid values are fastethernet and gigabitethernet.
interface-number
Module and port number.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
Usage Guidelines
The TDR test is supported on Catalyst 4500 series switches running Cisco IOS Release 12.2(25)SG for the following line cards only:
•
•
•
•
•
•
The valid values for interface interface are fastethernet and gigabitethernet.
Do not start the test at the same time on both ends of the cable. Starting the test at both ends of the cable at the same time can lead to false test results.
Do not change the port configuration during any cable diagnostics test. This action may result in incorrect test results.
The interface must be operating before starting the TDR test. If the port is down, the results of the test will be invalid. Issue the no shutdown command on the port.
Examples
This example shows how to start the TDR test on port 1 on module 2:
Switch# test cable-diagnostics tdr int gi2/1Switch#This example shows the message that displays when the TDR test is not supported on a module:
Switch# test cable-diagnostics tdr int gi2/100:03:15:%C4K_IOSDIAGMAN-4-TESTNOTSUPPORTEDONMODULE: Online cablediag tdr test is not supported on this moduleSwitch#
Note
show cable-diagnostic tdr command within 1 minute of the test starting, you may see a "TDR test is in progress on interface..." message.Related Commands
traceroute mac
To display the Layer 2 path taken by the packets from the specified source MAC address to the specified destination MAC address, use the traceroute mac command.
traceroute mac [interface interface-id] {source-mac-address} [interface interface-id] {destination-mac-address} [vlan vlan-id] [detail]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(15)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
Do not use leading zeros when entering a VLAN ID.
The Layer 2 traceroute feature is available on these switches:
•
•
•
•
•
•
For Layer 2 traceroute to functional properly, Cisco Discovery Protocol (CDP) must be enabled on all of the switches in the network. Do not disable CDP.
When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.
The maximum number of hops identified in the path is ten.
Layer 2 traceroute supports only unicast traffic. If you specify a multicast source or destination MAC address, the physical path is not identified, and a message appears.
The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and a message appears.
If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and a message appears.
Layer 2 traceroute is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and a message appears.
This feature is not supported in Token Ring VLANs.
Examples
This example shows how to display the Layer 2 path by specifying the source and destination MAC addresses:
Switch# traceroute mac 0000.0201.0601 0000.0201.0201Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)con6 (2.2.6.6) :Fa0/1 =>Fa0/3con5 (2.2.5.5 ) : Fa0/3 =>Gi0/1con1 (2.2.1.1 ) : Gi0/1 =>Gi0/2con2 (2.2.2.2 ) : Gi0/2 =>Fa0/1Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)Layer 2 trace completedSwitch#This example shows how to display the detailed Layer 2 path:
Switch# traceroute mac 0000.0201.0601 0000.0201.0201 detailSource 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)con6 / WS-C2950G-24-EI / 2.2.6.6 :Fa0/1 [auto, auto] =>Fa0/3 [auto, auto]con5 / WS-C2950G-24-EI / 2.2.5.5 :Fa0/3 [auto, auto] =>Gi0/1 [auto, auto]con1 / WS-C3550-12G / 2.2.1.1 :Gi0/1 [auto, auto] =>Gi0/2 [auto, auto]con2 / WS-C3550-24 / 2.2.2.2 :Gi0/2 [auto, auto] =>Fa0/1 [auto, auto]Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)Layer 2 trace completed.Switch#This example shows the Layer 2 path when the switch is not connected to the source switch:
Switch# traceroute mac 0000.0201.0501 0000.0201.0201 detailSource not directly connected, tracing source .....Source 0000.0201.0501 found on con5[WS-C2950G-24-EI] (2.2.5.5)con5 / WS-C2950G-24-EI / 2.2.5.5 :Fa0/1 [auto, auto] =>Gi0/1 [auto, auto]con1 / WS-C3550-12G / 2.2.1.1 :Gi0/1 [auto, auto] =>Gi0/2 [auto, auto]con2 / WS-C3550-24 / 2.2.2.2 :Gi0/2 [auto, auto] =>Fa0/1 [auto, auto]Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)Layer 2 trace completed.Switch#This example shows the Layer 2 path when the switch cannot find the destination port for the source MAC address:
Switch# traceroute mac 0000.0011.1111 0000.0201.0201Error:Source Mac address not found.Layer2 trace aborted.Switch#This example shows the Layer 2 path when the source and destination devices are in different VLANs:
Switch# traceroute mac 0000.0201.0601 0000.0301.0201Error:Source and destination macs are on different vlans.Layer2 trace aborted.Switch#This example shows the Layer 2 path when the destination MAC address is a multicast address:
Switch# traceroute mac 0000.0201.0601 0100.0201.0201Invalid destination mac addressSwitch#This example shows the Layer 2 path when the source and destination switches belong to multiple VLANs:
Switch# traceroute mac 0000.0201.0601 0000.0201.0201Error:Mac found on multiple vlans.Layer2 trace aborted.Switch#This example shows how to display the Layer 2 path by specifying the interfaces on the source and destination switches:
Switch# traceroute mac interface fastethernet0/1 0000.0201.0601 interface fastethernet0/3 0000.0201.0201Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)con6 (2.2.6.6) :Fa0/1 =>Fa0/3con5 (2.2.5.5 ) : Fa0/3 =>Gi0/1con1 (2.2.1.1 ) : Gi0/1 =>Gi0/2con2 (2.2.2.2 ) : Gi0/2 =>Fa0/1Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)Layer 2 trace completedSwitch#Related Commands
Displays the Layer 2 path that is taken by the packets from the specified source IP address or hostname to the specified destination IP address or hostname.
traceroute mac ip
To display the Layer 2 path that is taken by the packets from the specified source IP address or hostname to the specified destination IP address or hostname, use the traceroute mac command.
traceroute mac ip {source-ip-address | source-hostname} {destination-ip-address | destination-hostname} [detail]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
The Layer 2 traceroute feature is available on these switches:
•
•
•
•
•
•
For Layer 2 traceroute to functional properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.
When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.
The maximum number of hops identified in the path is ten.
The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs.
•
•
Layer 2 traceroute is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears.
This feature is not supported in Token Ring VLANs.
Examples
This example shows how to display the Layer 2 path by specifying the source and destination IP addresses and by using the detail keyword:
Switch# traceroute mac ip 2.2.66.66 2.2.22.22 detailTranslating IP to mac.....2.2.66.66 =>0000.0201.06012.2.22.22 =>0000.0201.0201Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)con6 / WS-C2950G-24-EI / 2.2.6.6 :Fa0/1 [auto, auto] =>Fa0/3 [auto, auto]con5 / WS-C2950G-24-EI / 2.2.5.5 :Fa0/3 [auto, auto] =>Gi0/1 [auto, auto]con1 / WS-C3550-12G / 2.2.1.1 :Gi0/1 [auto, auto] =>Gi0/2 [auto, auto]con2 / WS-C3550-24 / 2.2.2.2 :Gi0/2 [auto, auto] =>Fa0/1 [auto, auto]Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)Layer 2 trace completed.Switch#This example shows how to display the Layer 2 path by specifying the source and destination hostnames:
Switch# traceroute mac ip con6 con2Translating IP to mac .....2.2.66.66 =>0000.0201.06012.2.22.22 =>0000.0201.0201Source 0000.0201.0601 found on con6con6 (2.2.6.6) :Fa0/1 =>Fa0/3con5 (2.2.5.5 ) : Fa0/3 =>Gi0/1con1 (2.2.1.1 ) : Gi0/1 =>Gi0/2con2 (2.2.2.2 ) : Gi0/2 =>Fa0/1Destination 0000.0201.0201 found on con2Layer 2 trace completedSwitch#This example shows the Layer 2 path when Address Resolution Protocol (ARP) cannot associate the source IP address with the corresponding MAC address:
Switch# traceroute mac ip 2.2.66.66 2.2.77.77Arp failed for destination 2.2.77.77.Layer2 trace aborted.Switch#Related Commands
Displays the Layer 2 path taken by the packets from the specified source MAC address to the specified destination MAC address.
trust
To define a trust state for traffic classified through the class policy-map configuration command, use the trust policy-map class configuration command. To return to the default setting, use the no form of this command.
trust [cos | dscp]
no trust [cos | dscp]
Syntax Description
Defaults
The action is not trusted.
Command Modes
Policy-map class configuration
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch.
Usage Guidelines
This command is not supported on the Supervisor Engine 6-E and Catalyst 4900M chassis.
Use this command to distinguish the quality of service (QoS) trust behavior for certain traffic from other traffic. For example, inbound traffic with certain DSCP values can be trusted. You can configure a class map to match and trust the DSCP values in the inbound traffic.
Trust values set with this command supersede trust values set with the qos trust interface configuration command.
If you specify trust cos, QoS uses the received or default port CoS value and the CoS-to-DSCP map to generate a DSCP value for the packet.
If you specify trust dscp, QoS uses the DSCP value from the ingress packet. For non-IP packets that are tagged, QoS uses the received CoS value; for non-IP packets that are untagged, QoS uses the default port CoS value. In either case, the DSCP value for the packet is derived from the CoS-to-DSCP map.
To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.
Examples
This example shows how to define a port trust state to trust inbound DSCP values for traffic classified with "class1":
Switch# configure terminalSwitch(config)# policy-map policy1Switch(config-pmap)# class class1Switch(config-pmap-c)# trust dscpSwitch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmitSwitch(config-pmap-c)# exitSwitch#You can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands
tx-queue
To configure the transmit queue parameters for an interface, use the tx-queue command. To return to the default value, use the no form of this command.
tx-queue [queue-id] {bandwidth bandwidth-rate | priority high | shape shape-rate}
no tx-queue
Syntax Description
Defaults
The default settings are as follows:
•
•
•
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
This command is not supported on the Supervisor Engine 6-E and Catalyst 4900M chassis.
The bandwidth and shape rates cannot exceed the maximum speed of the interface.
The bandwidth can be configured only on the following:
•
•
•
•
•
Only transmit queue 3 can be configured to be a high-priority transmit queue.
Examples
This example shows how to allocate bandwidth on queue 1 to 100 Mbps:
Switch(config-if)# tx-queue 1Switch(config-if-tx-queue)# bandwidth 1000000000Switch(config-if-tx-queue)#This example shows how to configure transmit queue 3 to the high priority:
Switch(config-if)# tx-queue 3Switch(config-if-tx-queue)# priority highSwitch(config-if-tx-queue)#This example shows how to configure the traffic shaping rate of 64 kbps to transmit queue 1:
Switch(config-if)# tx-queue 1Switch(config-if-tx-queue)# shape 64000Switch(config-if-tx-queue)#Related Commands
udld (global configuration mode)
To enable aggressive or normal mode in the UDLD protocol and to set the configurable message timer time, use the udld command. Use the no form of this command to do the following:
•
•
•
udld enable | aggressive
no udld enable | aggressive
udld message time message-timer-time
no udld message time
Syntax Description
Defaults
All fiber interfaces are disabled and the message timer time equals 15 seconds.
Command Modes
Global configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
If you enable aggressive mode, once all the neighbors of a port have aged out either in the advertisement or in the detection phase, UDLD restarts the linkup sequence to try to resynchronize with any potentially out-of-sync neighbor and shuts down the port if the message train from the link is still undetermined.
This command affects the fiber interfaces only. Use the udld (interface configuration mode) command to enable UDLD on the other interface types.
Examples
This example shows how to enable UDLD on all the fiber interfaces:
Switch (config)# udld enableSwitch (config)#Related Commands
Displays the administrative and operational UDLD status.
Enables UDLD on an individual interface or prevents a fiber interface from being enabled by the udld (global configuration mode) command.
udld (interface configuration mode)
To enable UDLD on an individual interface or to prevent a fiber interface from being enabled by the udld (global configuration mode) command, use the udld command. To return to the udld (global configuration mode) command setting, or if the port is a nonfiber port to disable UDLD, use the no form of this command.
udld {enable | aggressive | disable}
no udld {enable | aggressive | disable}
Syntax Description
enable
Enables UDLD on this interface.
aggressive
Enables UDLD in aggressive mode on this interface.
disable
Disables UDLD on this interface.
Defaults
The fiber interfaces are enabled per the state of the global udld (enable or aggressive) command, and the nonfiber interfaces are enabled with UDLD disabled.
Command Modes
Interface configuration mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
If you enable aggressive mode, once all the neighbors of a port have aged out either in the advertisement or in the detection phase, UDLD restarts the linkup sequence to try to resynchronize with any potentially out-of-sync neighbor and shuts down the port if the message train from the link is still undetermined.
Use the no udld enable command on the fiber ports to return control of UDLD to the global udld enable command or to disable UDLD on the nonfiber ports.
Use the udld aggressive command on the fiber ports to override the setting of the global udld (enable or aggressive) command. Use the no form on the fiber ports to remove this setting, return control of UDLD enabling back to the global udld command or to disable UDLD on the nonfiber ports.
The disable keyword is supported on the fiber ports only. Use the no form of this command to remove this setting and return control of UDLD to the udld (global configuration mode) command.
If the port changes from fiber to nonfiber or vice versa, all configurations will be maintained because of a change of module or a GBIC change detected by the platform software.
Examples
This example shows how to cause any port interface to enable UDLD, despite the current global udld (global configuration mode) setting:
Switch (config-if)# udld enableSwitch (config-if)#This example shows how to cause any port interface to enable UDLD in aggressive mode, despite the current global udld (enable or aggressive) setting:
Switch (config-if)# udld aggressiveSwitch (config-if)#This example shows how to cause a fiber port interface to disable UDLD, despite the current global udld (global configuration mode) setting:
Switch (config-if)# udld disableSwitch (config-if)#Related Commands
Displays the administrative and operational UDLD status.
Enables aggressive or normal mode in the UDLD protocol and sets the configurable message timer time.
udld reset
To reset all the UDLD ports in the shutdown state, use the udld reset command.
udld reset
Syntax Description
This command has no keywords or variables.
Defaults
This command has no default settings.
Command Modes
Privileged EXEC mode
Command History
12.1(8a)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
If the interface configuration is still enabled for UDLD, these ports will begin to run UDLD again and may shut down if the reason for the shutdown has not been corrected.
The udld reset command permits the traffic to flow on the ports again; other features, such as spanning tree, PAgP, and DTP, operate normally if enabled.
Examples
This example shows how to reset all the ports that are shut down by UDLD:
Switch# udld resetSwitch#Related Commands
unidirectional
To configure the nonblocking Gigabit Ethernet ports to unidirectionally send or receive traffic on an interface, use the unidirectional command. To disable unidirectional communication, use the no form of this command.
unidirectional {receive-only | send-only}
no unidirectional {receive-only | send-only}
Syntax Description
receive-only
Specifies the unidirectional reception.
send-only
Specifies the unidirectional transmission.
Defaults
Disabled
Command Modes
Interface configuration mode
Command History
12.1(13)EW
Support for this command was introduced on the Catalyst 4500 series switch..
Usage Guidelines
Enabling port unidirectional mode automatically disables port UDLD. You must manually ensure that the unidirectional link does not create a spanning-tree loop in the network.
Examples
This example shows how to set Gigabit Ethernet interface 1/1 to receive traffic unidirectionally:
Switch# config terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet 1/1Switch(config-if)# unidirectional receive-onlySwitch(config-if)# endSwitch#Related Commands
Displays the administrative and operational status of a switching (nonrouting) port.
username
To establish a username-based authentication system, use the username command.
username name secret {0 | 5} password
Syntax Description
