-
Catalyst 6500 Series Command Reference, 6.3 and 6.4
-
Quick Links to Catalyst 6500 Series Switch and ROM Monitor Commands
-
Index
-
Preface
-
Command-Line Interfaces
-
alias to boot
-
cd to clear mls entry cef adjacency
-
clear mls exclude protocol to clear vtp pruneeligible
-
clear vtp statistics to disable
-
disconnect to enable
-
format to ping
-
pwd to reset-switch
-
restore counters to set crypto key rsa
-
set default portstatus to set logging timestamp
-
set logout to set pbf
-
set port auxiliaryvlan to set rcp username
-
set rgmp to set spantree portvlanpri
-
set spantree priority to set trunk
-
set udld to set vtp pruneeligible
-
show accounting to show default
-
show dot1q-all-tagged to show interface
-
show ip alias to show ip permit
-
show ip route to show pbf
-
show port to show snmp
-
show snmp access to show tech-support
-
show test to show udld
-
show users to squeeze
-
stack to write tech-support
-
Acronyms
-
Table Of Contents
set security acl capture-ports
set spantree portfast bpdu-filter
set spantree portfast bpdu-guard
set rgmp
Use the set rgmp command to enable or disable the RGMP feature on the switch.
set rgmp {enable | disable}
Syntax Description
Defaults
The default is RGMP is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The set rgmp command affects the entire switch. You cannot enable or disable RGMP on a per-VLAN basis.
The RGMP feature is operational only if IGMP snooping is enabled on the switch (see the set igmp command).
Examples
This example shows how to enable RGMP on the switch:
Console> (enable) set rgmp enableRGMP is enabled.Console> (enable)This example shows how to disable RGMP on the switch:
Console> (enable) set rgmp disableRGMP is disabled.Console> (enable)Related Commands
show rgmp group
show rgmp statistics
clear rgmp statistics
set igmpset rspan
Use the set rspan command set to create remote SPAN sessions.
set rspan disable source [rspan_vlan | all]
set rpsan disable destination [mod/port | all]
set rspan source {src_mod/src_ports... | vlans... | sc0} {rspan_vlan} [rx | tx | both]
[multicast {enable | disable}] [filter vlans...] [create]set rspan destination mod/port {rspan_vlan} [inpkts {enable | disable}]
[learning {enable | disable}] [create]Syntax Description
Defaults
The defaults are as follows:
•
Remote SPAN is disabled.
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The rspan_vlan variable is optional in the set rspan disable source command and required in the set rspan source and set rspan destination command set.
After you enable SPAN, system defaults are used if no parameters were ever set. If you changed parameters, these are stored in NVRAM, and the new parameters are used.
Use a network analyzer to monitor ports.
Use the inpkts keyword with the enable option to allow the remote SPAN destination port to receive normal incoming traffic in addition to the traffic mirrored from the remote SPAN source. Use the disable option to prevent the remote SPAN destination port from receiving normal incoming traffic.
You can specify an MSM port as the remote SPAN source port. However, you cannot specify an MSM port as the remote SPAN destination port.
When you enable the inpkts option, a warning message notifies you that the destination port does not join STP and may cause loops if this option is enabled.
If you do not specify the keyword create and you have only one session, the session will be overwritten. If a matching rspan_vlan or destination port exists, the particular session will be overwritten (with or without specifying create). If you specify the keyword create and there is no matching rspan_vlan or destination port, the session will be created.
Each switch can source only one remote SPAN session (ingress, egress, or both). When you configure a remote ingress or bidirectional SPAN session in a source switch, the limit for local ingress or bidirectional SPAN session is reduced to one. There are no limits on the number of remote SPAN sessions carried across the network within the remote SPAN session limits.
You can configure any VLAN as a remote SPAN VLAN as long as these conditions are met:
•
•
•
Examples
This example shows how to disable all enabled source sessions:
Console> (enable) set rspan disable source allThis command will disable all remote span source session(s).Do you want to continue (y/n) [n]? yDisabled monitoring of all source(s) on the switch for remote span.Console> (enable)This example shows how to disable one source session to a specific VLAN:
Console> (enable) set rspan disable source 903Disabled monitoring of all source(s) on the switch for rspan_vlan 903.Console> (enable)This example shows how to disable all enabled destination sessions:
Console> (enable) set rspan disable destination allThis command will disable all remote span destination session(s).Do you want to continue (y/n) [n]? yDisabled monitoring of remote span traffic on ports 9/1,9/2,9/3,9/4,9/5,9/6.Console> (enable)This example shows how to disable one destination session to a specific port:
Console> (enable) set rspan disable destination 4/1Disabled monitoring of remote span traffic on port 4/1.Console> (enable)Related Commands
set security acl adjacency
Use the set security acl adjacency command to set an entry for the adjacency table.
set security acl adjacency adjacency_name dest_vlan dest_mac [[source_mac] |
[source_mac mtu mtu_size] | [mtu mtu_size]]Syntax Description
Defaults
The default size for the MTU is 9600 bytes.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The order of ACEs in a PBF VACL is important. The adjacency table entry has to be defined in the VACL before the redirect ACE because the redirect ACE uses it to redirect traffic. Refer to the Catalyst 6000 Family Software Configuration Guide for detailed information on configuring PBF VACLs.
You can set the MTU for cases in which jumbo frames are sent using PBF.
Examples
This example shows how to set an entry for the adjacency table:
Console> (enable) set security acl adjacency ADJ1 11 0-0-0-0-0-B 0-0-0-0-0-AConsole> (enable)This example shows how to set an entry for the adjacency table with a specific MTU size:
Console> (enable) set security acl adjacency a_1 2 0-0a-0a-0a-0a-0a 9000Console> (enable)Related Commands
clear security acl
commit
show security acloset security acl capture-ports
Use the set security acl capture-ports command to set the ports (specified with the capture option in the set security acl ip, set security acl ipx, and set security acl mac commands) to show traffic captured on these ports.
set security acl capture-ports {mod/ports...}
Syntax Description
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved in NVRAM. This command does not require that you enter the commit command.
The module and port specified in this command are added to the current ports configuration list.
This command works with Ethernet ports only; you cannot set ATM ports.
The ACL capture will not work unless the capture port is in the spanning tree forwarding state for the VLAN.
Examples
This example shows how to set a port to capture traffic:
Console> (enable) set security acl capture-ports 3/1Successfully set 3/1 to capture ACL traffic.Console> (enable)This example shows how to set multiple ports to capture traffic:
Console> (enable) set security acl capture-ports 1/1-10Successfully set the following ports to capture ACL traffic: 1/1-2.Console> (enable)Related Commands
clear security acl capture-ports
show security acl capture-portsset security acl ip
Use the set security acl ip command set to create a new entry in a standard IP VACL and append the new entry at the end of the VACL.
set security acl ip {acl_name} {permit | deny} {src_ip_spec} [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} [permit | deny] arp
set security acl ip {acl_name} {permit | deny | redirect {adj_name | mod_num/port_num}} {protocol} {src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index | modify editbuffer_index] [log]
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [ip]
{src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [fragment] [capture]
[before editbuffer_index | modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [icmp | 1]
{src_ip_spec} {dest_ip_spec} [icmp_type] [icmp_code] | [icmp_message]
[precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [tcp | 6]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]] [established]
[precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [udp | 17]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]]
[precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index |
modify editbuffer_index] [log]Syntax Description
Defaults
There are no default ACLs and no default ACL-VLAN mappings. By default, ARP is enabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved to NVRAM and hardware only after you enter the commit command. Enter ACEs in batches and then enter the commit command to save them in NVRAM and in the hardware.
The arp keyword is supported on switches configured with the Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2). If you use the arp keyword, this is supported on a per-ACL basis only; either ARP is allowed or ARP is denied.
If you use the fragment keyword in an ACE, this ACE applies to nonfragmented traffic and to the fragment with offset equal to zero in a fragmented flow.
A fragmented ACE that permits Layer 4 traffic from host A to host B also permits fragmented traffic from host A to host B regardless of the Layer 4 port.
If you use the capture keyword, the ports that capture the traffic and transmit out are specified by entering the set security acl capture-ports command.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
When you specify the source IP address and the source mask, use the form source_ip_address source_mask and follow these guidelines:
•
•
•
•
When you enter a destination IP address and the destination mask, use the form destination_ip_address destination_mask. The destination mask is required.
•
•
•
The log keyword is an option of deny only. If you want to change an existing VACL configuration to deny with log, you must first clear the VACL and then set it again.
The log keyword is supported on systems configured with Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2) only.
Valid names for precedence are critical, flash, flash-override, immediate, internet, network, priority, and routine.
Valid names for tos are max-reliability, max-throughput, min-delay, min-monetary-cost, and normal.
Valid protocol keywords include icmp (1), ip, ipinip (4), tcp (6), udp (17), igrp (9), eigrp (88), gre (47), nos (94), ospf (89), ahp (51), esp (50), pcp (108), and pim (103). The IP number is displayed in parentheses. Use the keyword ip to match any Internet Protocol.
ICMP packets that are matched by ICMP message type can also be matched by the ICMP message code.
Valid names for icmp_type and icmp_code are administratively-prohibited, alternate-address, conversion-error, dod-host-prohibited, dod-net-prohibited, echo, echo-reply, general-parameter-problem, host-isolated, host-precedence-unreachable, host-redirect, host-tos-redirect, host-tos-unreachable, host-unknown, host-unreachable, information-reply, information-request, mask-reply, mask-request, mobile-redirect, net-redirect, net-tos-redirect, net-tos-unreachable, net-unreachable, network-unknown, no-room-for-option, option-missing, packet-too-big, parameter-problem, port-unreachable, precedence-unreachable, protocol-unreachable, reassembly-timeout, redirect, router-advertisement, router-solicitation, source-quench, source-route-failed, time-exceeded, timestamp-reply, timestamp-request, traceroute, ttl-exceeded, and unreachable.
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number.
TCP port names can be used only when filtering TCP. Valid names for TCP ports are bgp, chargen, daytime, discard, domain, echo, finger, ftp, ftp-data, gopher, hostname, irc, klogin, kshell, lpd, nntp, pop2, pop3, smtp, sunrpc, syslog, tacacs-ds, talk, telnet, time, uucp, whois, and www.
UDP port names can be used only when filtering UDP. Valid names for UDP ports are biff, bootpc, bootps, discard, dns, dnsix, echo, mobile-ip, nameserver, netbios-dgm, netbios-ns, ntp, rip, snmp, snmptrap, sunrpc, syslog, tacacs-ds, talk, tftp, time, who, and xdmcp.
The number listed with the protocol type is the layer protocol number (for example, udp | 17).
If no layer protocol number is entered, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny} {src_ip_spec} [before editbuffer_index |
modify editbuffer_index]If a Layer 4 protocol is specified, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny | redirect mod_num/port_num} {protocol}
{src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [capture]
[before editbuffer_index | modify editbuffer_index]For IP, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [ip]
{src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [capture]
[before editbuffer_index | modify editbuffer_index]For ICMP, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [icmp | 1]
{src_ip_spec} {dest_ip_spec} [icmp_type] [icmp_code] | [icmp_message]
[precedence precedence] [tos tos] [capture] [before editbuffer_index |
modify editbuffer_index]For TCP, you can use the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [tcp | 6]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]] [established]
[precedence precedence] [tos tos] [capture] [before editbuffer_index |
modify editbuffer_index]For UDP, you can use the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [udp | 17]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]]
[precedence precedence] [tos tos] [capture] [before editbuffer_index |
modify editbuffer_index]Examples
These examples show different ways to use the set security acl ip commands to configure IP security ACL:
Console> (enable) set security acl ip IPACL1 deny 1.2.3.4 0.0.0.0IPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 deny host 171.3.8.2 before 2IPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 permit any anyIPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 redirect 3/1 ip 3.7.1.2 0.0.0.255 host 255.255.255.255 precedence 1 tos min-delayIPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 permit ip host 60.1.1.1 host 60.1.1.98 captureIPACL1 editbuffer modified. Use 'commit' command to apply changes.Related Commands
clear security acl
clear security acl capture-ports
clear security acl map
commit
show security acl
show security acl capture-ports
set security acl map
set security acl capture-portsset security acl ipx
Use the set security acl ipx command to create a new entry in a standard IPX VACL and to append the new entry at the end of the VACL.
set security acl ipx {acl_name} {permit | deny | redirect mod_num/port_num} {protocol}
{src_net} [dest_net.[dest_node] [[dest_net_mask.]dest_node_mask]] [capture]
[before editbuffer_index | modify editbuffer_index]Syntax Description
Defaults
There are no default ACLs and no default ACL-VLAN mappings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved to NVRAM and hardware only after you enter the commit command. Enter ACEs in batches and then enter the commit command to save all of them in NVRAM and in the hardware.
If you use the capture keyword, the ports that capture the traffic and transmit out are specified by entering the set security acl capture-ports command.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
Valid protocol keywords include ncp (17), netbios (20), rip (1), sap (4), and spx (5).
The src_net and dest_net variables are eight-digit hexadecimal numbers that uniquely identify network cable segments. When you specify the src_net or dest_net, use the following guidelines:
•
•
The .dest_node is a 48-bit value represented by a dotted triplet of 4-digit hexadecimal numbers (xxxx.xxxx.xxxx).
The dest_net_mask is an eight-digit hexadecimal mask. Place ones in the bit positions you want to mask. The mask must be immediately followed by a period, which must in turn be immediately followed by the destination-node-mask. You can enter this value only when dest_node is specified.
The dest_node_mask is a 48-bit value represented as a dotted triplet of 4-digit hexadecimal numbers (xxxx.xxxx.xxxx). Place ones in the bit positions you want to mask. You can enter this value only when dest_node is specified.
The dest_net_mask is an eight-digit hexadecimal number that uniquely identifies the network cable segment. It can be a number in the range 0 to FFFFFFFF. A network number of -1 or any matches all networks. You do not need to specify leading zeros in the network number. For example, for the network number 000000AA, you can enter AA. Following are dest_net_mask examples:
•
•
•
•
Use the show security acl command to display the list.
Examples
This example shows how to block traffic from a specified source IPX address:
Console> (enable) set security acl ipx IPXACL1 deny 1.aIPXACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)This example shows how to deny traffic from hosts in specific subnet (10.1.2.0/8):
Console> (enable) set security acl ipx SERVER deny ip 10.1.2.0 0.0.0.255 host 10.1.1.100IPXACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Related Commands
clear security acl
clear security acl capture-ports
clear security acl map
commit
show security acl
show security acl capture-ports
set security acl map
set security acl capture-portsset security acl log
Use the set security acl log command set to configure the security ACL log table.
set security acl log maxflow max_number
set security acl log ratelimit pps
Syntax Description
Defaults
The default max_number is 500 pps and the default ratelimit is 2500 pps.
Command Types
Switch command.
Command Modes
Normal.
Usage Guidelines
The command is supported on systems configured with Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2) only.
The set security acl log maxflow command tries to allocate a new log table based on the maximum flow pattern number to store logged packet information. If successful, the new buffer replaces the old one and all flows in the old table are cleared. If either memory is not enough or the maximum number is over the limit, an error message is displayed and the command is dropped.
The set security acl log ratelimit command tries to set the redirect rate in packets per second. If the configuration is over the range, the command is discarded and the range is displayed on the console.
Examples
This example shows how to set the maximum flow:
Console> (enable) set security acl log maxflow 322Log table size set to 322 flow entries.Console> (enable)This example shows how to set the rate limit:
Console> (enable) set security acl log ratelimit 3444Max logging eligible packet rate set to 3444pps.Console> (enable)Related Commands
clear security acl log flow
set security acl log
show security acl logset security acl mac
Use the set security acl mac command to create a new entry in a non-IP or non-IPX protocol VACL and to append the new entry at the end of the VACL.
set security acl mac {acl_name} {permit | deny} {src_mac_addr_spec}
{dest_mac_addr_spec} [ether-type] [capture] [before editbuffer_index |
modify editbuffer_index]Syntax Description
Defaults
There are no default ACLs and no default ACL-VLAN mappings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved to NVRAM and hardware only after you enter the commit command. Enter ACEs in batches and then enter the commit command to save all of them in NVRAM and in the hardware.
If you use the capture keyword, the ports that capture the traffic and transmit out are specified by entering the set security acl capture-ports command.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
The src_mac_addr_spec is a 48-bit source MAC address and mask and entered in the form of source_mac_address source_mac_address_mask (for example, 08-11-22-33-44-55 ff-ff-ff-ff-ff-ff). Place ones in the bit positions you want to mask. When you specify the src_mac_addr_spec, follow these guidelines:
•
•
•
•
The dest_mac_spec is a 48-bit destination MAC address and mask and entered in the form of dest_mac_address dest_mac_address_mask (for example, 08-00-00-00-02-00/ff-ff-ff-00-00-00). Place ones in the bit positions you want to mask. The destination mask is mandatory. When you specify the dest_mac_spec, use the following guidelines:
•
•
•
Valid names for ethertypes (and corresponding numbers) are Ethertalk (0x809B), AARP (0x8053), dec-mop-dump (0x6001), dec-mop-remote-console (0x6002), dec-phase-iv (0x6003), dec-lat (0x6004), dec-diagnostic-protocol (0x6005), dec-lavc-sca (0x6007), dec-amber (0x6008), dec-mumps (0x6009), dec-lanbridge (0x8038), dec-dsm (0x8039), dec-netbios (0x8040), dec-msdos (0x8041), banyan-vines-echo (0x0baf), xerox-ns-idp (0x0600), and xerox-address-translation (0x0601).
Use the show security acl command to display the list.
Examples
This example shows how to block traffic to an IP address:
Console> (enable) set security acl mac MACACL1 deny 01-02-02-03-04-05MACACL1 editbuffer modified. User `commit' command to apply changes.Console> (enable)Related Commands
clear security acl
clear security acl capture-ports
clear security acl map
commit
show security acl
show security acl capture-ports
set security acl map
set security acl capture-portsset security acl map
Use the set security acl map command to map an existing VACL to a VLAN.
set security acl map acl_name vlan
Syntax Description
acl_name
Unique name that identifies the list to which the entry belongs.
vlan
Number of the VLAN to be mapped to the VACL; valid values are from 1 to 1005 and from 1025 to 4094.
Defaults
There are no default ACLs and no default ACL-VLAN mappings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved in NVRAM. This command does not require that you enter the commit command. Each VLAN can be mapped to only one ACL of each type (IP, IPX, and MAC). An ACL can be mapped to a VLAN only after you have committed the ACL.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
Caution
Examples
This example shows how to map an existing VACL to a VLAN:
Console> (enable) set security acl map IPACL1 1ACL IPACL1 mapped to vlan 1Console> (enable)This example shows the output if you try to map an ACL that has not been committed:
Console> (enable) set security acl map IPACL1 1Commit ACL IPACL1 before mapping.Console> (enable)This example shows the output if you try to map an ACL that is already mapped to a VLAN for the ACL type (IP, IPX, or MAC):
Console> (enable) set security acl map IPACL2 1Mapping for this type already exists for this VLAN.Console> (enable)Related Commands
clear security acl
clear security acl map
commit
show security aclset snmp access
Use the set snmp access command set to define the access rights of an SNMP group.
set snmp access [-hex] {groupname} {security-model {v1 | v2c}}
[read [-hex] {readview}] [write [-hex] {writeview}] [notify [-hex] {notifyview}]
[volatile | nonvolatile]set snmp access [-hex] {groupname} {security-model v3 {noauthentication |
authentication | privacy}} [read [-hex] {readview}] [write [-hex] {writeview}]
[notify [-hex] {notifyview}] [context [-hex] contextname [exact | prefix]] [volatile | nonvolatile]Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for groupname, readview, writeview, and notifyview (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
readview is assumed to be every object belonging to the Internet (1.3.6.1) OID space; you can use the read option to override this state.
For writeview, you must also configure write access.
For notifyview, if a view is specified, any notifications in that view are sent to all users associated with the group (an SNMP server host configuration must exist for the user).
For contextname, the string is treated as either a full context name or the prefix of a context name, depending on whether you enter the exact or prefix keyword. If you enter the prefix keyword, this allows you to enter a simple form of wildcarding. For example, if you enter a contextname of vlan, vlan-1 and vlan-100 will be selected.
If you do not enter a context name, a NULL context string is used.
Examples
This example shows how to set the SNMP access rights for a group:
Console> (enable) set snmp access cisco-group security-model v3 authenticationSNMP access group was set to cisco-group version v3 level authentication, readview internet, nonvolatile.Console> (enable)Related Commands
clear snmp access
show snmp access
show snmp contextset snmp community
Use the set snmp community command to set SNMP communities and associated access types.
set snmp community {read-only | read-write | read-write-all} [community_string]
Syntax Description
Defaults
The default is the following communities and access types are defined:
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
There are three configurable SNMP communities, one for each access type. If you do not specify the community string, the community string configured for that access type is cleared.
To support the access types, you also need to configure four MIB tables: vacmContextTable, vacmSecurityToGroupTable, vacmAccessTable, and vacmViewTreeFamilyTable. Use the clear config snmp command to reset these tables to the default values.
Examples
This example shows how to set read-write access to the SNMP community called yappledapple:
Console> (enable) set snmp community read-write yappledappleSNMP read-write community string set to yappledapple.Console> (enable)This example shows how to clear the community string defined for read-only access:
Console> (enable) set snmp community read-onlySNMP read-only community string cleared.Console> (enable)Related Commands
clear config
clear snmp community
show snmp
show snmp communityset snmp extendedrmon netflow
Use the set snmp extendedrmon netflow command to enable or disable the SNMP extended RMON support for the NAM module.
set snmp extendedrmon netflow {enable | disable} {mod}
Syntax Description
enable
Keyword to enable the extended RMON support.
disable
Keyword to disable the extended RMON support.
mod
Module number of the extended RMON NAM.
Defaults
The default is SNMP-extended RMON NetFlow is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Examples
This example shows how to enable SNMP-extended RMON NetFlow support:
Console> (enable) set snmp extendedrmon netflow enable 2Snmp extended RMON netflow enabledConsole> (enable)This example shows how to disable SNMP-extended RMON NetFlow support:
Console> (enable) set snmp extendedrmon netflow disable 2Snmp extended RMON netflow disabledConsole> (enable)This example shows the response when the SNMP-extended RMON NetFlow feature is not supported:
Console> (enable) set snmp extendedrmon enable 4NAM card is not installed. Console> (enable)Related Commands
set snmp group
Use the set snmp group command to establish the relationship between an SNMP group and a user with a specific security model.
set snmp group [-hex] {groupname} user [-hex] {username}
{security-model {v1 | v2c | v3}} [volatile | nonvolatile]Syntax Description
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for groupname or username (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
Examples
This example shows how to set the SNMP group:
Console> (enable) set snmp group cisco-group user joe security-model v3SNMP group was set to cisco-group user joe and version v3,nonvolatile.Console> (enable)Related Commands
clear snmp group
show snmp groupset snmp notify
Use the set snmp notify command to set the notifyname entry in the snmpNotifyTable and the notifytag entry in the snmpTargetAddrTable.
set snmp notify [-hex] {notifyname} tag [-hex] {notifytag}
[trap | inform] [volatile | nonvolatile]Syntax Description
Defaults
The defaults are storage type is volatile and notify type is trap.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for the notifyname and notifytag (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
Examples
This example shows how to set the SNMP notify for a specific notifyname:
Console> (enable) set snmp notify hello tag world informSNMP notify name was set to hello with tag world notifyType inform, and storageType nonvolatile.Console> (enable)Related Commands
clear snmp notify
show snmp notifyset snmp rmon
Use the set snmp rmon command to enable or disable SNMP RMON support.
set snmp rmon {enable | disable}
Syntax Description
Defaults
The default is RMON support is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
RMON statistics are collected on a segment basis.
The RMON feature deinstalls all of the domains for all of the interfaces on an Ethernet module that has been removed from the system.
When you enable RMON, the supported RMON groups for Ethernet ports are Statistics, History, Alarms, and Events as specified in RFC 1757.
Use of this command requires a separate software license.
Examples
This example shows how to enable RMON support:
Console> (enable) set snmp rmon enableSNMP RMON support enabled.Console> (enable)This example shows how to disable RMON support:
Console> (enable) set snmp rmon disableSNMP RMON support disabled.Console> (enable)Related Commands
set snmp rmonmemory
Use the set snmp rmonmemory command to set the memory usage limit in percentage.
set snmp rmonmemory percentage
Syntax Description
Defaults
The default is 85 percent.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When using this command, setting the percentage value to 85 does not mean that RMON can use 85 percent of memory, it means that you cannot create new RMON entries or restore entries from the NVRAM if the memory usage exceeds 85 percent.
If you expect the device to run other sessions such as Telnet, a lower value should be set to the memory limit. Otherwise, the new Telnet sessions may fail because the available memory is not enough.
Examples
This example shows how to set the memory usage limit:
Console> (enable) set snmp rmonmemory 90Console> (enable)Related Commands
set snmp targetaddr
Use the set snmp targetaddr command to configure the SNMP target address entries in the snmpTargetAddressTable.
set snmp targetaddr [-hex] {addrname} param [-hex] {paramsname}{ipaddr}
[udpport {port}] [timeout {value}] [retries {value}] [volatile | nonvolatile]
[taglist {[-hex] tag}] [[-hex] tag tagvalue]Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for the addrname, paramsname, tag, and tagvalue (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
The maximum tagvalue and taglist length is 255 bytes.
Examples
This example shows how to set the target address in the snmpTargetAddressTable:
Console> (enable) set snmp targetaddr foo param bar 10.1.2.4 udp 160 timeout 10 retries 3 taglist tag1 tag2 tag3SNMP targetaddr name was set to foo with param bar ipAddr 10.1.2.4, udpport 160, timeout 10, retries 3, storageType nonvolatile with taglist tag1 tag2 tag3.Console> (enable)Related Commands
clear snmp targetaddr
show snmp targetaddrset snmp targetparams
Use the set snmp targetparams command set to configure the SNMP parameters used in the snmpTargetParamsTable when generating a message to a target.
set snmp targetparams [-hex] {paramsname} user [-hex] {username} {security-model {v1 | v2c}} {message-processing {v1 | v2c | v3}} [volatile | nonvolatile]
set snmp targetparams [-hex] {paramsname} user [-hex] {username} {security-model v3} {message-processing v3 {noauthentication | authentication | privacy}} [volatile | nonvolatile]
Syntax Description
Defaults
The default storage type is volatile.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for the paramsname and username (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
Examples
This example shows how to set target parameters in the snmpTargetParamsTable:
Console> (enable) set snmp targetparams bar user joe security-model v3 message-processing v3 authenticationSNMP target params was set to bar v3 authentication, message-processing v3, user joe nonvolatile.Console> (enable)Related Commands
clear snmp targetparams
show snmp targetparamsset snmp trap
Use the set snmp trap command set to enable or disable the different SNMP traps on the system or to add an entry into the SNMP authentication trap receiver table.
set snmp trap {enable | disable} [all | auth | bridge | chassis | config | entity | entityfru |
envfan | envpower | envshutdown | ippermit | module | stpx | syslog | system |
vmps | vtp]set snmp trap rcvr_addr rcvr_community [port rcvr_port] [owner rcvr_owner] [index rcvr_index]
Syntax Description
Defaults
The default is SNMP traps are disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
An IP permit trap is sent when unauthorized access based on the IP permit list is attempted.
Use the show snmp command to verify the appropriate traps were configured.
To use this command, you must configure all notification tables: snmpTargetAddrTable, snmpTargetParamsTable, and snmpNotifyTable.
Use the all option to enable or disable all trap types and port traps.
Use the set port trap command to enable or disable a single port or a range of ports.
The rcvr_index is required only when you want to enter another entry with the same rcvr_addr.
Examples
This example shows how to enable SNMP chassis traps:
Console> (enable) set snmp trap enable chassisSNMP chassis alarm traps enabled.Console> (enable)This example shows how to enable all traps:
Console> (enable) set snmp trap enableAll SNMP traps enabled.Console> (enable)This example shows how to disable SNMP chassis traps:
Console> (enable) set snmp trap disable chassisSNMP chassis alarm traps disabled.Console> (enable)This example shows how to add an entry in the SNMP trap receiver table:
Console> (enable) set snmp trap 192.122.173.42 publicSNMP trap receiver added.Console> (enable)Related Commands
show snmp
test snmp trap
clear snmp trap
set port trapset snmp user
Use the set snmp user command to configure a new SNMP user.
set snmp user [-hex] {username} {remote {engineid}} [authentication {md5 | sha | authpassword}] [privacy {privpassword}] [volatile | nonvolatile]
Syntax Description
Defaults
The default storage type is volatile. If you do not specify authentication, the security level default will be noauthentication. If you do not specify privacy, the default will be no privacy.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for username (nonprintable delimiters for this parameter), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
authpassword and privpassword must be hexadecimal characters without delimiters in between.
Examples
This example shows how to set a specific username:
Console> (enable) set snmp user joeSnmp user was set to joe authProt no-auth privProt no-priv with engineid 00:00.Console> (enable)This example shows how to set a specific username, authentication, and authpassword:
Console> (enable) set snmp user John authentication md5 arizona2Snmp user was set to John authProt md5 authPasswd arizona2. privProt no-priv wi.Console> (enable)Related Commands
set snmp view
Use the set snmp view command to configure the SNMP MIB view.
set snmp view [-hex]{viewname}{subtree}[mask] [included | excluded] [volatile | nonvolatile]
Syntax Description
Defaults
The defaults are as follows:
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for viewname (nonprintable delimiters for this parameter), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
A MIB subtree with a mask defines a view subtree. The MIB subtree can be in OID format or a text name mapped to a valid OID.
Examples
This example shows how to assign a subtree to the view public:
Console> (enable) set snmp view public 1.3.6.1 includedSnmp view name was set to public with subtree 1.3.6.1 included, nonvolatile.Control> (enable)This example shows the response when the subtree is incorrect:
Console> (enable) set snmp view stats statistics excludedStatistics is not a valid subtree OIDControl> (enable)Related Commands
set span
Use the set span command set to enable or disable SPAN and to set up the switch port and VLAN analyzer for multiple SPAN sessions.
set span disable [dest_mod/dest_port | all]
set span {src_mod/src_ports | src_vlans | sc0} {dest_mod/dest_port} [rx | tx | both] [inpkts
{enable | disable}] [learning {enable | disable}] [multicast {enable | disable}]
[filter vlans...] [create]Syntax Description
Defaults
The default is SPAN is disabled, no VLAN filtering is enabled, multicast is enabled, input packets are disabled, and learning is enabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
After you enable SPAN, system defaults are used if no parameters were ever set. If you changed parameters, the old parameters are stored in NVRAM, and the new parameters are used.
Use a network analyzer to monitor ports.
If you specify multiple SPAN source ports, the ports can belong to different VLANs.
A maximum of two rx or both SPAN sessions and four tx SPAN sessions can exist simultaneously. If you use a remote SPAN station, the maximum number of rx or both SPAN sessions is one.
Use the inpkts keyword with the enable option to allow the SPAN destination port to receive normal incoming traffic in addition to the traffic mirrored from the SPAN source. Use the disable option to prevent the SPAN destination port from receiving normal incoming traffic.
You can specify an MSM port as the SPAN source port. However, you cannot specify an MSM port as the SPAN destination port.
When you enable the inpkts option, a warning message notifies you that the destination port does not join STP and may cause loops if this option is enabled.
When you configure multiple SPAN sessions, the destination module number/port number must be known to index the particular SPAN session.
If you do not specify the keyword create and you have only one session, the session will be overwritten. If a matching destination port exists, the particular session will be overwritten (with or without specifying create). If you specify the keyword create and there is no matching destination port, the session will be created.
Examples
This example shows how to configure SPAN so that both transmit and receive traffic from port 1/1 (the SPAN source) is mirrored on port 2/1 (the SPAN destination):
Console> (enable) set span 1/1 2/1Enabled monitoring of Port 1/1 transmit/receive traffic by Port 2/1Console> (enable)This example shows how to set VLAN 522 as the SPAN source and port 2/1 as the SPAN destination:
Console> (enable) set span 522 2/1Enabled monitoring of VLAN 522 transmit/receive traffic by Port 2/1Console> (enable)This example shows how to set VLAN 522 as the SPAN source and port 3/12 as the SPAN destination. Only transmit traffic is monitored. Normal incoming packets on the SPAN destination port are allowed:
Console> (enable) set span 522 2/12 tx inpkts enableSPAN destination port incoming packets enabled.Enabled monitoring of VLAN 522 transmit traffic by Port 2/12Console> (enable)This example shows how to set port 3/2 as the SPAN source and port 2/2 as the SPAN destination:
Console> (enable) set span 3/2 2/2 tx createEnabled monitoring of port 3/2 transmit traffic by Port 2/1Console> (enable)This example shows how to disable SPAN if multiple SPAN sessions are not defined:
Console> (enable) set span disableThis command WILL disable your span session(s).Do you want to continue (y/n) [n]?yDisabled all sessionsConsole> (enable)This example shows what happens if you try to enter the set span disable command (without the destination module number/port number defined) and multiple SPAN sessions are defined:
Console> (enable) set span disableMultiple active span sessions. Please specify span destination to disable.Console> (enable)Related Commands
set spantree backbonefast
Use the set spantree backbonefast command to enable or disable the spanning tree BackboneFast Convergence feature.
set spantree backbonefast {enable | disable}
Syntax Description
enable
Keyword to enable BackboneFast Convergence.
disable
Keyword to disable BackboneFast Convergence.
Defaults
The default is BackboneFast convergence is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
For BackboneFast Convergence to work, you must enable it on all switches in the network.
When you try to enable BackboneFast and the switch is in MISTP or MISTP-PVST+ mode, this message displays:
Cannot enable backbonefast when the spantree mode is MISTP-PVST+.Examples
This example shows how to enable BackboneFast Convergence:
Console> (enable) set spantree backbonefast enableBackbonefast enabled for all VLANs.Console> (enable)Related Commands
set spantree bpdu-skewing
Use the set spantree bpdu-skewing command to enable or disable collection of the spanning tree BPDU skewing detection statistics.
set spantree bpdu-skewing {enable | disable}
Syntax Description
enable
Keyword to enable BPDU skewing detection statistics collection.
disable
Keyword to disable BPDU skewing detection statistics collection.
Defaults
The default is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You can use this command to troubleshoot slow network convergence due to skewing. Skewing occurs when spanning tree timers lapse, expected BPDUs are not received, and spanning tree detects topology changes. The difference between the expected result and the BPDUs actually received is a "skew." The skew causes BPDUs to reflood the network to keep the spanning tree topology database up to date.
Examples
This example shows how to enable the BPDU skew detection feature:
Console> (enable) set spantree bpdu-skewing enableSpantree bpdu-skewing enabled on this switch.Console> (enable)This example shows how to disable the BPDU skew detection feature:
Console> (enable) set spantree bpdu-skewing disableSpantree bpdu-skewing disabled on this switch.Console> (enable)Related Commands
set spantree defaultcostmode
Use the set spantree defaultcostmode command to specify the spanning tree default port cost mode.
set spantree defaultcostmode {short | long}
Syntax Description
short
Keyword to set the default port cost for port speeds slower than 10 Gb.
long
Keyword to set the default port cost mode port speeds of 10 Gb and faster.
Defaults
The default is short.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The set spantree defaultcostmode long command is available in PVST+ mode only. If you enter this command in MISTP or MISTP-PVST+ mode, this message displays:
In MISTP or MISTP-PVST+ mode, default portcost and portinstancecost alwaysuse long format default values.All switches in a network must have the same default. If any switch in the network supports port speeds of 10 Gb and greater, the default cost mode must be set to long on all the switches in the network.
For port speeds of 1 Gb and greater, the default port cost should be set to long. For port speeds less than 10 Gb, the default port cost can be set to short.
The default path cost is based on port speed; see Table 2-21 and Table 2-22 for default settings.
Table 2-21 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Table 2-22 Default Port Cost—Long Mode
100 Kb
200,000,000
1 Mb
20,000,000
10 Mb
2,000,000
100 Mb
200,000
1 Gb
20,000
10 Gb
2,000
100 Gb
200
1 Tb
20
10 Tb
2
Examples
This example shows how to set the spanning tree default port cost mode:
Console> (enable) set spantree defaultcostmode longPortcost and portvlancost set to use long format default values.Console> (enable)Related Commands
set spantree disable
Use the set spantree disable command set to disable the spanning tree algorithm for all VLANs or a specific VLAN or disable spanning tree instance.
set spantree disable vlan
set spantree disable all
set spantree disable mistp-instance instance
set spantree disable mistp-instance all
Syntax Description
Defaults
The default is spanning tree is enabled, and all instances are enabled (flooding disabled).
Command Types
Switch command.
Command Modes
Privileged.
If you do not specify a VLAN number or an instance number, 1 is assumed.
When an instance is enabled, the Spanning Tree Protocol starts running on that instance.
When an instance is disabled, the switch stops sending out config TLVs for that instance and starts flooding incoming TLVs for the same instance (but checks the VLAN mapping on the incoming side). All the traffic running on the VLANs mapped to the instance is flooded as well.
Examples
This example shows how to disable the spanning tree for VLAN 1:
Console> (enable) set spantree disable 1VLAN 1 bridge spanning tree disabled.Console> (enable)This example shows how to disable spanning tree for a specific instance:
Console> (enable) set spantree disable mistp-instance 2MI-STP instance 2 disabled.Console> (enable)Related Commands
set spantree enable
show spantreeset spantree enable
Use the set spantree enable command set to enable the spanning tree algorithm for all VLANs, a specific VLAN, a specific instance, or all instances.
set spantree enable vlans
set spantree enable all
set spantree enable mistp-instance instance
set spantree enable mistp-instance all
Syntax Description
Defaults
The default is enabled, and all instances are enabled (flooding disabled).
Command Types
Switch command.
Command Modes
Privileged.
MISTP and VTP pruning cannot be enabled at the same time.
If you do not specify a VLAN number or an instance number, 1 is assumed.
Examples
This example shows how to activate spanning tree for VLAN 1:
Console> (enable) set spantree enable 1VLAN 1 bridge spanning tree enabled.Console> (enable)This example shows how to activate spanning tree for an instance:
Console> (enable) set spantree enable mistp-instance 1-STP instance 1 enabled.Console> (enable)Related Commands
set spantree disable
show spantreeset spantree fwddelay
Use the set spantree fwddelay command to set the bridge forward delay for a VLAN or an instance.
set spantree fwddelay delay [vlans]
set spantree fwddelay delay mistp-instance [instances]
Syntax Description
Defaults
The default is the bridge forward delay is set to 15 seconds for all VLANs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a VLAN number or an instance number, 1 is assumed.
If you enable MISTP, you cannot set the VLAN bridge forward delay.
If you enable PVST+, you cannot set the instance bridge forward delay.
Examples
This example shows how to set the bridge forward delay for VLAN 100 to 16 seconds:
Console> (enable) set spantree fwddelay 16 100Spantree 100 forward delay set to 16 seconds.Console> (enable)This example shows how to set the bridge forward delay for an instance to 16 seconds:
Console> (enable) set spantree fwddelay 16 mistp-instance 1Instance 1 forward delay set to 16 seconds.Console> (enable)Related Commands
set spantree guard
Use the set spantree guard command to enable or disable the spanning tree root guard or loop guard feature on a per-port basis.
set spantree guard {none | root | loop} mod/port
Syntax Description
Defaults
The default is root guard and loop guard are disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you enable loop guard on a channel and the first link becomes unidirectional, loop guard will block the entire channel until the affected port is removed from the channel.
You may want to prevent switches from becoming the root switch. The root guard feature forces a port to become a designated port so that no switch on the other end of the link can become a root switch.
When you enable root guard, it is automatically applied to all of the active instances or VLANs to which that port belongs. When you disable root guard, it is disabled for the specified port(s). If a port goes into the root-inconsistent state, it automatically goes into the listening state.
Use care when enabling loop guard. Loop guard is useful only in those topologies where there are blocked ports. Topologies where there are no blocked ports are loop free by definition and do not need this feature to be enabled.
Loop guard should be enabled only on root and alternate root ports.
Loop guard should be used mainly on access switches.
When you enable loop guard, it is automatically applied to all of the active instances or VLANs to which that port belongs. When you disable loop guard, it is disabled for the specified port(s). Disabling loop guard moves all loop-inconsistent ports to the listening state.
You cannot enable loop guard on PortFast-enabled or dynamic VLAN ports.
You cannot enable PortFast on loop guard-enabled ports.
You cannot enable loop guard if root guard is enabled.
Examples
This example shows how to enable root guard:
Console> (enable) set spantree guard root 5/1Rootguard on port 5/1 is enabled.Warning!! Enabling rootguard may result in a topolopy change.Console> (enable)This example shows how to enable the loop guard feature:
Console> (enable) set spantree guard loop 5/1Rootguard is enabled on port 5/1, enabling loopguard will disable rootguard onthis port.Do you want to continue (y/n) [n]? yLoopguard on port 5/1 is enabled.Console> (enable)Related Commands
set spantree hello
Use the set spantree hello command set to set the bridge hello time for a VLAN or an instance.
set spantree hello interval [vlans]
set spantree hello interval mistp-instance instances
Syntax Description
Defaults
The default is the bridge hello time is set to 2 seconds for all VLANs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a VLAN number or an instance number, 1 is assumed.
If you enable MISTP, you cannot set the VLAN hello time.
If you enable PVST+, you cannot set the instance hello time.
Examples
This example shows how to set the spantree hello time for VLAN 100 to 3 seconds:
Console> (enable) set spantree hello 3 100Spantree 100 hello time set to 3 seconds.Console> (enable)This example shows how to set the spantree hello time for an instance to 3 seconds:
Console> (enable) set spantree hello 3 mistp-instance 1Spantree 1 hello time set to 3 seconds.Console> (enable)Related Commands
set spantree macreduction
Use the set spantree macreduction command to enable or disable the spanning tree MAC address reduction feature.
set spantree macreduction enable | disable
Syntax Description
Defaults
The default is MAC address reduction is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The MAC address reduction feature is used to enable extended-range VLAN identification and allows the switch to support a large number of spanning tree instances with a very limited number of MAC addresses and still maintain the IEEE 802.1D bridge-ID requirement for each STP instance.
You cannot disable this feature if extended-range VLANs exist.
You cannot disable this feature on chassis with 64 MAC addresses.
Examples
This example shows how to disable the MAC address reduction feature:
Console> (enable) set spantree macreduction disableMAC address reduction disabledConsole> (enable)Related Commands
set spantree maxage
Use the set spantree maxage command set to set the bridge maximum aging time for a VLAN or an instance.
set spantree maxage agingtime [vlans]
set spantree maxage agingtime mistp-instance instances
Syntax Description
Defaults
The default configuration is 20 seconds for all VLANs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a VLAN number or an instance number, 1 is assumed.
If you enable MISTP, you cannot set the VLAN maximum aging time.
If you enable PVST+, you cannot set the instance maximum aging time.
Examples
This example shows how to set the maximum aging time for VLAN 1000 to 25 seconds:
Console> (enable) set spantree maxage 25 1000Spantree 1000 max aging time set to 25 seconds.Console> (enable)This example shows how to set the maximum aging time for an instance to 25 seconds:
Console> (enable) set spantree maxage 25 mistp-instance 1Instance 1 max aging time set to 25 seconds.Console> (enable)Related Commands
set spantree mode
Use the set spantree mode command to configure the type of Spanning Tree Protocol mode to run.
set spantree mode {mistp | pvst+ | mistp-pvst+}
Syntax Description
mistp
Keyword to specify MISTP mode.
pvst+
Keyword to specify PVST+ mode.
mistp-pvst+
Keywords to allow the switch running MISTP to tunnel BPDUs with remote switches running PVST+.
Defaults
The default is PVST+.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When you connect through Telnet into a switch and try to change the spanning tree mode from PVST+ to MISTP or MISTP-PVST+, and no VLANs are mapped to any instance on that switch, this warning message displays:
Console> (enable) set spantree mode mistpWarning!! Changing the STP mode from a telnet session will disconnect thesession because there are no VLANs mapped to any MISTP instance.Do you want to continue [n]?When you connect through Telnet into a switch and try to change the spanning tree mode from MISTP or MISTP-PVST+ to PVST+, or when you connect through Telnet into a switch and try to change the spanning tree mode from PVST+ to MISTP or MISTP-PVST+ and additional VLAN-instance mappings are on that switch, this warning message displays:
Console> (enable) set spantree mode pvst+Warning!! Changing the STP mode from a telnet session might disconnect thesession.Do you want to continue [n]?When you change from MISTP to PVST+ and over 8000 VLAN ports are currently configured on the switch, this warning message displays:
Console> (enable) set spantree mode pvst+Warning!! This switch has 12345 VLAN-ports currently configured for STP.Going out of MISTP mode could impact system performance.Do you want to continue [n]?If you change the spanning tree mode from PVST+ to MISTP or MISTP to PVST+, the STP mode previously running stops, all the information collected at runtime is used to build the port database for the new mode, and the new STP mode restarts the computation of the active topology from zero. All the parameters of the previous STP per VLAN or per instance are kept in NVRAM.
If you change the spanning tree mode from PVST+ to MISTP or MISTP to PVST+ and BackboneFast is enabled, this message displays:
Console> (enable) set spantree mode mistpCannot change the spantree mode to MISTP when backbonefast is enabled.Examples
This example shows how to set the spanning tree mode to PVST+:
Console> (enable) set spantree mode pvst+Warning!! Changing the STP mode from a telnet session might disconnect the session.Do you want to continue [n]? ySpantree mode set to PVST+.Console> (enable)This example shows what happens if you change the spanning tree mode from PVST+ to MISTP:
Console> (enable) set spantree mode mistpWarning!! Changing the STP mode from a telnet session will disconnect the session because there are no VLANs mapped to any MISTP instance.Do you want to continue [n]? yConsole> (enable)Related Commands
set spantree portcost
Use the set spantree portcost command to set the path cost for a port.
set spantree portcost mod/port cost
Syntax Description
mod/port
Number of the module and the port on the module.
cost
Number of the path cost; see the "Usage Guidelines" section for additional information.
Defaults
The default path cost is based on port speed; see Table 2-23 and Table 2-24 for default settings.
Table 2-23 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Table 2-24 Default Port Cost—Long Mode
100 Kb
200,000,000
1 Mb
20,000,000
10 Mb
2,000,000
10 Mb
200,000
1 Gb
20,000
10 Gb
2,000
100 Gb
200
1 Tb
20
10 Tb
2
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The Spanning Tree Protocol uses port path costs to determine which port to select as a forwarding port. You should assign lower numbers to ports attached to faster media (such as full duplex) and higher numbers to ports attached to slower media.
Examples
This example shows how to set the port cost for port 12 on module 2 to 19:
Console> (enable) set spantree portcost 2/12 19Spantree port 2/12 path cost set to 19.Console> (enable)Related Commands
set spantree defaultcostmode
show spantreeset spantree portfast
Use the set spantree portfast command to allow a port that is connected to a single workstation or PC to start faster when it is connected.
set spantree portfast mod/port {enable | disable}
Syntax Description
Defaults
The default is the PortFast-start feature is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When a port configured with the spantree portfast enable command is connected, the port immediately enters the spanning tree forwarding state rather than going through the normal spanning tree states such as listening and learning. Use this command on ports that are connected to a single workstation or PC only; do not use it on ports that are connected to networking devices such as hubs, routers, switches, bridges, or concentrators.
Examples
This example shows how to enable the spanning tree PortFast-start feature on port 2 on module 1:
Console> (enable) set spantree portfast 1/2 enableWarning: Spantree port fast start should only be enabled on ports connected to a single host. Connecting hubs, concentrators, switches, bridges, etc. to a fast start port can cause temporary spanning tree loops. Use with caution.Spantree port 1/2 fast start enabled.Console> (enable)Related Commands
set spantree portfast bpdu-filter
Use the set spantree portfast bpdu-filter command to enable or disable BPDU packet filtering on the switch.
set spantree portfast bpdu-filter {enable | disable}
Syntax Description
Defaults
The default is BPDU packet filtering is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
BPDU packet filtering turns off BPDU transmission on PortFast-enabled ports and nontrunking ports.
Examples
This example shows how to enable the BPDU packet filtering:
Console> (enable) set spantree portfast bpdu-filter enableSpantree portfast bpdu-filter enabled on this switch.Console> (enable)This example shows how to disable the BPDU packet filtering:
Console> (enable) set spantree portfast bpdu-filter disableSpantree portfast bpdu-filter disabled on this switch.Console> (enable)Related Commands
set spantree portfast bpdu-guard
Use the set spantree portfast bpdu-guard command to enable or disable spanning tree PortFast BPDU guard on the switch.
set spantree portfast bpdu-guard {enable | disable}
Syntax Description
enable
Keyword to enable the spanning tree PortFast BPDU guard.
disable
Keyword to disable the spanning tree PortFast BPDU guard.
Defaults
The default is PortFast BPDU guard is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You must enable PortFast mode before you can enable PortFast BPDU guard for BPDU guard to work correctly.
When you enable PortFast BPDU guard, a nontrunking PortFast-enabled port is moved into an errdisable state when a BPDU is received on that port. When you disable a PortFast BPDU guard, a PortFast-enabled nontrunking port will stay up when it receives BPDUs, which may cause spanning tree loops.
Examples
This example shows how to enable the spanning tree PortFast BPDU guard:
Console> (enable) set spantree portfast bpdu-guard enableSpantree portfast bpdu-guard enabled on this switch.Console> (enable)This example shows how to disable the spanning tree PortFast BPDU guard:
Console> (enable) set spantree portfast bpdu-guard disableSpantree portfast bpdu-guard disabled on this switch.Console> (enable)Related Commands
set spantree portinstancecost
Use the set spantree portinstancecost command to assign the path cost of the port for the specified instances.
set spantree portinstancecost mod/port [cost cost] [instances]
Syntax Description
Defaults
The default path cost is based on port speed; see Table 2-25 for default settings.
Table 2-25 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The portinstancecost applies to trunk ports only.
The value specified is used as the path cost of the port for the specified instances. The rest of the instances have a path cost equal to the port path cost set through the set spantree instancecost command (if not set, the value is the default path cost of the port).
Examples
These examples show how to use the set spantree portinstancecost command and explicitly specify the path cost of a port:
Console> (enable) set spantree portinstancecost 2/10 cost 6 1-10Port 2/10 instances 11-16 have path cost 2000000.Port 2/10 instances 1-10 have path cost 6.This parameter applies to trunking ports only.Console> (enable)These examples show how to use the set spantree portinstancecost command without explicitly specifying the path cost of a port:
Console> (enable) set spantree portinstancecost 1/2Port 1/2 Instances 1-1005 have path cost 3100.Console> (enable)Console> (enable) set spantree portinstancecost 1/2 16Port 1/2 Instances 16,22-1005 have path cost 3100.Console> (enable)This example shows the display if you enter the command when PVST+ is enabled:
Console> (enable) set spantree portinstancecost 3/1This command is only valid when STP is in MISTP or MISTP-PVST+ mode.Console> (enable)Related Commands
clear spantree portinstancecost
show spantree mistp-instanceset spantree portinstancepri
Use the set spantree portinstancepri command to set the port priority for instances in the trunk port.
set spantree portinstancepri mod/port priority [instances]
Syntax Description
Defaults
The default is the port priority is set to 0, with no instances specified.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Use this command to add instances to a specified port priority level. Subsequent calls to this command do not replace instances that are already set at a specified port priority level.
This feature is not supported for the MSM.
The set spantree portinstancepri command applies to trunk ports only. If you enter this command, you see this message:
Port xx is not a trunk-capable portExamples
This example shows how to set the port priority for module 1, port 2, on specific instances:
Console> (enable) set spantree portinstancepri 1/2 16 1-11Port 1/2 instances 1-11 using portpri 16.This parameter applies to trunking ports only.Console> (enable)Related Commands
clear spantree portinstancecost
show spantree mistp-instanceset spantree portpri
Use the set spantree portpri command to set the bridge priority for a spanning tree port.
set spantree portpri mod/port priority
Syntax Description
Defaults
The default is all ports with bridge priority are set to 32.
Command Types
Switch command.
Command Modes
Privileged.
Examples
This example shows how to set the priority of port 1 on module 4 to 63:
Console> (enable) set spantree portpri 4/1 63Bridge port 4/1 priority set to 63.Console> (enable)Related Commands
set spantree portvlancost
Use the set spantree portvlancost command to assign a lower path cost to a set of VLANs on a port.
set spantree portvlancost mod/port [cost cost] [vlan_list]
Syntax Description
Defaults
The default path cost is based on port speed; see Table 2-26 and Table 2-27 for default settings.
Table 2-26 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Table 2-27 Default Port Cost—Long Mode
100 Kb
200,000,000
1 Mb
20,000,000
10 Mb
2,000,000
10 Mb
200,000
1 Gb
20,000
10 Gb
2,000
100 Gb
200
1 Tb
20
10 Tb
2
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Follow these guidelines when you set the path cost for VLANs on a port:
•
•
•
•
This command is not supported in MISTP mode.
Examples
These examples show how to use the set spantree portvlancost command and explicitly specify the path cost of a port:
Console> (enable) set spantree portvlancost 2/10 cost 25 1-20Cannot set portvlancost to a higher value than the port cost, 10, for port 2/10.Console> (enable)Console> (enable) set spantree portvlancost 2/10 cost 1-20Port 2/10 VLANs 1-20 have a path cost of 9.Console> (enable)Console> (enable) set spantree portvlancost 2/10 cost 4 1-20Port 2/10 VLANs 1-20 have path cost 4.Port 2/10 VLANs 21-1000 have path cost 10.Console> (enable)Console> (enable) set spantree portvlancost 2/10 cost 6 21Port 2/10 VLANs 1-21 have path cost 6.Port 2/10 VLANs 22-1000 have path cost 10.Console> (enable)These examples show how to use the set spantree portvlancost command without explicitly specifying the path cost of a port:
Console> (enable) set spantree portvlancost 1/2Port 1/2 VLANs 1-1005 have path cost 3100.Console> (enable)Console> (enable) set spantree portvlancost 1/2 21Port 1/2 VLANs 1-20,22-1005 have path cost 3100.Port 1/2 VLANs 21 have path cost 3099.Console> (enable)Related Commands
clear spantree portvlancost
set channel vlancost
show spantreeset spantree portvlanpri
Use the set spantree portvlanpri command to set the port priority for a subset of VLANs in the trunk port.
set spantree portvlanpri mod/port priority [vlans]
Syntax Description
Defaults
The default is the port VLAN priority is set to 0, with no VLANs specified.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
This command is not supported by extended-range VLANs.
Use this command to add VLANs to a specified port priority level. Subsequent calls to this command do not replace VLANs that are already set at a specified port priority level.
This feature is not supported for the MSM.
The set spantree portvlanpri command applies only to trunk ports. If you enter this command, you see this message:
Port xx is not a trunk-capable portExamples
This example shows how to set the port priority for module 1, port 2, on VLANs 21 to 40:
Console> (enable) set spantree portvlanpri 1/2 16 21-40Port 1/2 vlans 3,6-20,41-1000 using portpri 32Port 1/2 vlans 1-2,4-5,21-40 using portpri 16Console> (enable)Related Commands
clear spantree portvlanpri
show spantree
