-
Catalyst 6500 Series Command Reference, 7.6
-
Quick Links to Catalyst 6500 Series Switch and ROM Monitor Commands
-
Index
-
Preface
-
Command-Line Interfaces
-
alias to boot
-
cd to clear mls exclude protocol
-
clear mls multicast statistics to clear vtp pruneeligible
-
clear vtp statistics to disable
-
disconnect to enable
-
Format to Ping
-
pwd to reset-switch
-
restore counters to set crypto key rsa
-
set default portstatus to set logging timestamp
-
set logout to set port arp-inspection
-
set port auxiliaryvlan to set rcp username
-
set rgmp to set spantree portvlanpri
-
set spantree priority to set trunk
-
set udld to set vtp pruneeligible
-
show accounting to show dot1q-all-tagged
-
show dot1x to show ip alias
-
show ip dns to show ip permit
-
show ip route to show pbf-map
-
show port to show snmp
-
show snmp access to show tech-support
-
show test to show users
-
show version to squeeze
-
stack to write tech-support
-
Acronyms
-
Table Of Contents
set security acl arp-inspection
set security acl capture-ports
set security acl feature ratelimit
set spantree portfast bpdu-filter
set spantree portfast bpdu-guard
22set rgmp
To enable or disable the Router-Ports Group Management Protocol (RGMP) feature on the switch, use the set rgmp command.
set rgmp {enable | disable}
Syntax Description
Defaults
The default is RGMP is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The set rgmp command affects the entire switch. You cannot enable or disable RGMP on a per-VLAN basis.
The RGMP feature is operational only if IGMP snooping is enabled on the switch. (See the set igmp command.)
Examples
This example shows how to enable RGMP on the switch:
Console> (enable) set rgmp enableRGMP is enabled.Console> (enable)This example shows how to disable RGMP on the switch:
Console> (enable) set rgmp disableRGMP is disabled.Console> (enable)Related Commands
clear rgmp statistics
set igmp
show rgmp group
show rgmp statisticsset rspan
To create remote Switched Port Analyzer (SPAN) sessions, use the set rspan command.
set rspan disable source [rspan_vlan | all]
set rpsan disable destination [mod/port | all]
set rspan source {src_mod/src_ports... | vlans... | sc0} {rspan_vlan} [rx | tx | both]
[multicast {enable | disable}] [filter vlans...] [create]set rspan destination mod/port {rspan_vlan} [inpkts {enable | disable}]
[learning {enable | disable}] [create]Syntax Description
Defaults
The defaults are as follows:
•
Remote SPAN is disabled.
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The rspan_vlan variable is optional in the set rspan disable source command and required in the set rspan source and set rspan destination command set.
After you enable SPAN, system defaults are used if no parameters were ever set. If you changed parameters, these are stored in NVRAM, and the new parameters are used.
Use a network analyzer to monitor ports.
Use the inpkts keyword with the enable option to allow the remote SPAN destination port to receive normal incoming traffic in addition to the traffic mirrored from the remote SPAN source. Use the disable option to prevent the remote SPAN destination port from receiving normal incoming traffic.
You can specify an Multilayer Switch Module (MSM) port as the remote SPAN source port. However, you cannot specify an MSM port as the remote SPAN destination port.
When you enable the inpkts option, a warning message notifies you that the destination port does not join STP and may cause loops if this option is enabled.
If you do not specify the keyword create and you have only one session, the session will be overwritten. If a matching rspan_vlan or destination port exists, the particular session will be overwritten (with or without specifying create). If you specify the keyword create and there is no matching rspan_vlan or destination port, the session will be created.
Each switch can source only one remote SPAN session (ingress, egress, or both). When you configure a remote ingress or bidirectional SPAN session in a source switch, the limit for local ingress or bidirectional SPAN session is reduced to one. There are no limits on the number of remote SPAN sessions carried across the network within the remote SPAN session limits.
You can configure any VLAN as a remote SPAN VLAN as long as these conditions are met:
•
•
•
Examples
This example shows how to disable all enabled source sessions:
Console> (enable) set rspan disable source allThis command will disable all remote span source session(s).Do you want to continue (y/n) [n]? yDisabled monitoring of all source(s) on the switch for remote span.Console> (enable)This example shows how to disable one source session to a specific VLAN:
Console> (enable) set rspan disable source 903Disabled monitoring of all source(s) on the switch for rspan_vlan 903.Console> (enable)This example shows how to disable all enabled destination sessions:
Console> (enable) set rspan disable destination allThis command will disable all remote span destination session(s).Do you want to continue (y/n) [n]? yDisabled monitoring of remote span traffic on ports 9/1,9/2,9/3,9/4,9/5,9/6.Console> (enable)This example shows how to disable one destination session to a specific port:
Console> (enable) set rspan disable destination 4/1Disabled monitoring of remote span traffic on port 4/1.Console> (enable)Related Commands
set security acl adjacency
To set an entry for the adjacency table, use the set security acl adjacency command.
set security acl adjacency adjacency_name dest_vlan dest_mac [source_mac [mtu mtu_size] |
mtu mtu_size]Syntax Description
Defaults
The default size for the MTU is 9600 bytes.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The order of ACEs in a policy-based forwarding (PBF) VACL is important. The adjacency table entry has to be defined in the VACL before the redirect ACE because the redirect ACE uses it to redirect traffic. Refer to the Catalyst 6500 Series Switch Software Configuration Guide for detailed information on configuring PBF VACLs.
You can set the MTU when jumbo frames are sent using PBF.
Examples
This example shows how to set an entry for the adjacency table:
Console> (enable) set security acl adjacency ADJ1 11 0-0-0-0-0-B 0-0-0-0-0-AConsole> (enable)This example shows how to set an entry for the adjacency table with a specific MTU size:
Console> (enable) set security acl adjacency a_1 2 0-0a-0a-0a-0a-0a 9000Console> (enable)Related Commands
clear security acl
commit
show security aclset security acl arp-inspection
To configure Address Resolution Protocol (ARP) inspection features, use the set security acl arp-inspection command.
set security acl arp-inspection {match-mac | address-validation}
{enable | [drop [log]] | disable}Syntax Description
Defaults
The MAC address matching feature and the address validation feature are disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When you enter the set security acl arp-inspection match-mac enable command, the system drops packets in which the source Ethernet address in the Ethernet header is not the same as the source MAC address in the ARP header.
When you enter the set security acl arp-inspection address-validation enable command, the system drops packets that have illegal IP or MAC addresses.
The following IP addresses are illegal:
•
•
•
The following MAC addresses are illegal:
•
•
•
Note
Use the set security acl arp-inspection command in conjunction with the set security acl ip arp-inspection command. For more information about configuring ARP inspection features, refer to the "Configuring Access Control" chapter of the Catalyst 6500 Series Switch Software Configuration Guide.
Examples
This example shows how to enable the MAC address matching feature:
Console> (enable) set security acl arp-inspection match-mac enableARP Inspection match-mac feature enabled.Console> (enable)This example shows how to enable the address validation feature:
Console> (enable) set security acl arp-inspection address-validation enableARP Inspection address-validation feature enabled.Console> (enable)Related Commands
set port arp-inspection
set security acl ipset security acl capture-ports
To set the ports (specified with the capture option in the set security acl ip, set security acl ipx, and set security acl mac commands) to show traffic captured on these ports, use the set security acl capture-ports command.
set security acl capture-ports {mod/ports...}
Syntax Description
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved in NVRAM. This command does not require that you enter the commit command.
The module and port specified in this command are added to the current ports configuration list.
This command works with Ethernet ports only; you cannot set ATM ports.
The ACL capture will not work unless the capture port is in the spanning tree forwarding state for the VLAN.
Examples
This example shows how to set a port to capture traffic:
Console> (enable) set security acl capture-ports 3/1Successfully set 3/1 to capture ACL traffic.Console> (enable)This example shows how to set multiple ports to capture traffic:
Console> (enable) set security acl capture-ports 1/1-10Successfully set the following ports to capture ACL traffic: 1/1-2.Console> (enable)Related Commands
clear security acl capture-ports
show security acl capture-portsset security acl feature ratelimit
To specify a rate limit for the number of packets that are sent to the CPU on a global basis, use the set security acl feature ratelimit command.
set security acl feature ratelimit rate
Syntax Description
Defaults
The rate is 500 pps.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The rate limiting option might be shared by multiple features. To display the features sharing rate limiting, enter the show security acl feature ratelimit command.
To specify the rate limit for the number of ARP inspection packets that are sent to the CPU on a per-port basis, use the set port arp-inspection command.
Examples
This example shows how to set the global rate limit to 600
Console> (enable) set security acl feature ratelimit 600ARP Inspection global rate limit set to 600 pps.Console> (enable)Related Commands
set port arp-inspection
show security acl feature ratelimitset security acl ip
To create a new entry in a standard IP VACL and append the new entry at the end of the VACL, use the set security acl ip command.
set security acl ip {acl_name} {permit | deny} {src_ip_spec} [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} [permit | deny] arp
set security acl ip {acl_name} {permit | deny | redirect {adj_name | mod_num/port_num}} {protocol} {src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index | modify editbuffer_index] [log]
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [ip]
{src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [fragment] [capture]
[before editbuffer_index | modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [icmp | 1]
{src_ip_spec} {dest_ip_spec} [icmp_type] [icmp_code] | [icmp_message]
[precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [tcp | 6]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]] [established]
[precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [udp | 17]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]]
[precedence precedence] [tos tos] [fragment] [capture] [before editbuffer_index |
modify editbuffer_index] [log]set security acl ip {acl_name} {permit | deny} arp-inspection {host ip_addr}
{mac_addr | any [log]}set security acl ip {acl_name} {permit | deny} arp-inspection any any [log]
set security acl ip {acl_name} {permit | deny} arp-inspection {host ip_addr} {ip_mask} any [log]
set security acl ip {acl_name} permit dot1x-dhcp [before editbuffer_index | modify editbuffer_index]
set security acl ip {acl_name} permit any
Syntax Description
Defaults
There are no default ACLs and no default ACL-VLAN mappings. By default, ARP is enabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved to NVRAM and hardware only after you enter the commit command. Enter ACEs in batches, and then enter the commit command to save them in NVRAM and in the hardware.
The arp keyword is supported on switches configured with the Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2). The arp keyword is supported on a per-ACL basis only; either ARP is allowed or ARP is denied.
If you use the fragment keyword in an ACE, this ACE applies to nonfragmented traffic and to the fragment with offset equal to zero in a fragmented flow.
A fragmented ACE that permits Layer 4 traffic from host A to host B also permits fragmented traffic from host A to host B regardless of the Layer 4 port.
If you use the capture keyword, the ports that capture the traffic and transmit out are specified by entering the set security acl capture-ports command.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
When you specify the source IP address and the source mask, use the form source_ip_address source_mask and follow these guidelines:
•
•
•
•
When you enter a destination IP address and the destination mask, use the form destination_ip_address destination_mask. The destination mask is required.
•
•
•
The log keyword is an option of deny only. If you want to change an existing VACL configuration to deny with log, you must first clear the VACL and then set it again.
The log keyword is supported on systems configured with Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2) only.
Valid names for precedence are critical, flash, flash-override, immediate, internet, network, priority, and routine.
Valid names for tos are max-reliability, max-throughput, min-delay, min-monetary-cost, and normal.
Valid protocol keywords include icmp (1), ip, ipinip (4), tcp (6), udp (17), igrp (9), eigrp (88), gre (47), nos (94), ospf (89), ahp (51), esp (50), pcp (108), and pim (103). The IP number is displayed in parentheses. Use the keyword ip to match any Internet Protocol.
ICMP packets that are matched by ICMP message type can also be matched by the ICMP message code.
Valid names for icmp_type and icmp_code are administratively-prohibited, alternate-address, conversion-error, dod-host-prohibited, dod-net-prohibited, echo, echo-reply, general-parameter-problem, host-isolated, host-precedence-unreachable, host-redirect, host-tos-redirect, host-tos-unreachable, host-unknown, host-unreachable, information-reply, information-request, mask-reply, mask-request, mobile-redirect, net-redirect, net-tos-redirect, net-tos-unreachable, net-unreachable, network-unknown, no-room-for-option, option-missing, packet-too-big, parameter-problem, port-unreachable, precedence-unreachable, protocol-unreachable, reassembly-timeout, redirect, router-advertisement, router-solicitation, source-quench, source-route-failed, time-exceeded, timestamp-reply, timestamp-request, traceroute, ttl-exceeded, and unreachable.
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number.
TCP port names can be used only when filtering TCP. Valid names for TCP ports are bgp, chargen, daytime, discard, domain, echo, finger, ftp, ftp-data, gopher, hostname, irc, klogin, kshell, lpd, nntp, pop2, pop3, smtp, sunrpc, syslog, tacacs-ds, talk, telnet, time, uucp, whois, and www.
UDP port names can be used only when filtering UDP. Valid names for UDP ports are biff, bootpc, bootps, discard, dns, dnsix, echo, mobile-ip, nameserver, netbios-dgm, netbios-ns, ntp, rip, snmp, snmptrap, sunrpc, syslog, tacacs-ds, talk, tftp, time, who, and xdmcp.
The number listed with the protocol type is the layer protocol number (for example, udp | 17).
If no layer protocol number is entered, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny} {src_ip_spec} [before editbuffer_index |
modify editbuffer_index]If a Layer 4 protocol is specified, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny | redirect mod_num/port_num} {protocol}
{src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [capture]
[before editbuffer_index | modify editbuffer_index]For IP, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [ip]
{src_ip_spec} {dest_ip_spec} [precedence precedence] [tos tos] [capture]
[before editbuffer_index | modify editbuffer_index]For ICMP, you can enter the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [icmp | 1]
{src_ip_spec} {dest_ip_spec} [icmp_type] [icmp_code] | [icmp_message]
[precedence precedence] [tos tos] [capture] [before editbuffer_index |
modify editbuffer_index]For TCP, you can use the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [tcp | 6]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]] [established]
[precedence precedence] [tos tos] [capture] [before editbuffer_index |
modify editbuffer_index]For UDP, you can use the following syntax:
set security acl ip {acl_name} {permit | deny | redirect {mod_num/port_num}} [udp | 17]
{src_ip_spec} [operator port [port]] {dest_ip_spec} [operator port [port]]
[precedence precedence] [tos tos] [capture] [before editbuffer_index |
modify editbuffer_index]Examples
These examples show different ways to use the set security acl ip commands to configure IP security ACL:
Console> (enable) set security acl ip IPACL1 deny 1.2.3.4 0.0.0.0IPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 deny host 171.3.8.2 before 2IPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 permit any anyIPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 redirect 3/1 ip 3.7.1.2 0.0.0.255 host 255.255.255.255 precedence 1 tos min-delayIPACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Console> (enable) set security acl ip IPACL1 permit ip host 60.1.1.1 host 60.1.1.98 captureIPACL1 editbuffer modified. Use 'commit' command to apply changes.Related Commands
clear security acl
clear security acl capture-ports
clear security acl map
commit
set security acl map
set security acl capture-ports
show security acl
show security acl capture-portsset security acl ipx
To create a new entry in a standard IPX VACL and to append the new entry at the end of the VACL, use the set security acl ipx command.
set security acl ipx {acl_name} {permit | deny | redirect mod_num/port_num} {protocol}
{src_net} [dest_net.[dest_node] [[dest_net_mask.]dest_node_mask]] [capture]
[before editbuffer_index | modify editbuffer_index]Syntax Description
Defaults
There are no default ACLs and no default ACL-VLAN mappings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved to NVRAM and hardware only after you enter the commit command. Enter ACEs in batches, and then enter the commit command to save all of them in NVRAM and in the hardware.
If you use the capture keyword, the ports that capture the traffic and transmit out are specified by entering the set security acl capture-ports command.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
Valid protocol keywords include ncp (17), netbios (20), rip (1), sap (4), and spx (5).
The src_net and dest_net variables are eight-digit hexadecimal numbers that uniquely identify network cable segments. When you specify the src_net or dest_net, use the following guidelines:
•
•
The dest_node is a 48-bit value represented by a dotted triplet of 4-digit hexadecimal numbers (xxxx.xxxx.xxxx).
The dest_net_mask. is an eight-digit hexadecimal mask. Place ones in the bit positions you want to mask. The mask must be immediately followed by a period, which must in turn be immediately followed by the destination-node-mask. You can enter this value only when dest_node is specified.
The dest_node_mask is a 48-bit value represented as a dotted triplet of 4-digit hexadecimal numbers (xxxx.xxxx.xxxx). Place ones in the bit positions you want to mask. You can enter this value only when dest_node is specified.
The dest_net_mask. is an eight-digit hexadecimal number that uniquely identifies the network cable segment. It can be a number in the range 0 to FFFFFFFF. A network number of -1 or any matches all networks. You do not need to specify leading zeros in the network number. For example, for the network number 000000AA, you can enter AA. Following are dest_net_mask. examples:
•
•
•
•
Use the show security acl command to display the list.
Examples
This example shows how to block traffic from a specified source IPX address:
Console> (enable) set security acl ipx IPXACL1 deny 1.aIPXACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)This example shows how to deny traffic from hosts in specific subnet (10.1.2.0/8):
Console> (enable) set security acl ipx SERVER deny ip 10.1.2.0 0.0.0.255 host 10.1.1.100IPXACL1 editbuffer modified. Use `commit' command to apply changes.Console> (enable)Related Commands
clear security acl
clear security acl capture-ports
clear security acl map
commit
set security acl map
set security acl capture-ports
show security acl
show security acl capture-ports
set security acl log
To configure the security ACL log table, use the set security acl log command.
set security acl log maxflow max_number
set security acl log ratelimit pps
Syntax Description
Defaults
The default max_number is 500 packets per second and the default ratelimit is 2500 packets per second.
Command Types
Switch command.
Command Modes
Normal.
Usage Guidelines
The command is supported on systems configured with Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2) only.
The set security acl log maxflow command tries to allocate a new log table based on the maximum flow pattern number to store logged packet information. If successful, the new buffer replaces the old one and all flows in the old table are cleared. If either memory is not enough or the maximum number is over the limit, an error message is displayed and the command is dropped.
The set security acl log ratelimit command tries to set the redirect rate in packets per second. If the configuration is over the range, the command is discarded and the range is displayed on the console.
Examples
This example shows how to set the maximum flow:
Console> (enable) set security acl log maxflow 322Log table size set to 322 flow entries.Console> (enable)This example shows how to set the rate limit:
Console> (enable) set security acl log ratelimit 3444Max logging eligible packet rate set to 3444pps.Console> (enable)Related Commands
clear security acl log flow
set security acl log
show security acl logset security acl mac
To create a new entry in a non-IP or non-IPX protocol VACL and to append the new entry at the end of the VACL, use the set security acl mac command.
set security acl mac {acl_name} {permit | deny} {src_mac_addr_spec}
{dest_mac_addr_spec} [ether-type] [capture] [before editbuffer_index |
modify editbuffer_index]Syntax Description
Defaults
There are no default ACLs and no default ACL-VLAN mappings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved to NVRAM and hardware only after you enter the commit command. Enter ACEs in batches, and then enter the commit command to save all of them in NVRAM and in the hardware.
If you use the capture keyword, the ports that capture the traffic and transmit out are specified by entering the set security acl capture-ports command.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
The src_mac_addr_spec is a 48-bit source MAC address and mask and entered in the form of source_mac_address source_mac_address_mask (for example, 08-11-22-33-44-55 ff-ff-ff-ff-ff-ff). Place ones in the bit positions you want to mask. When you specify the src_mac_addr_spec, follow these guidelines:
•
•
•
•
The dest_mac_spec is a 48-bit destination MAC address and mask and entered in the form of dest_mac_address dest_mac_address_mask (for example, 08-00-00-00-02-00/ff-ff-ff-00-00-00). Place ones in the bit positions you want to mask. The destination mask is mandatory. When you specify the dest_mac_spec, use the following guidelines:
•
•
•
Valid names for Ethertypes (and corresponding numbers) are EtherTalk (0x809B), AARP (0x8053), dec-mop-dump (0x6001), dec-mop-remote-console (0x6002), dec-phase-iv (0x6003), dec-lat (0x6004), dec-diagnostic-protocol (0x6005), dec-lavc-sca (0x6007), dec-amber (0x6008), dec-mumps (0x6009), dec-lanbridge (0x8038), dec-dsm (0x8039), dec-netbios (0x8040), dec-msdos (0x8041), banyan-vines-echo (0x0baf), xerox-ns-idp (0x0600), and xerox-address-translation (0x0601).
Use the show security acl command to display the list.
Examples
This example shows how to block traffic to an IP address:
Console> (enable) set security acl mac MACACL1 deny 01-02-02-03-04-05MACACL1 editbuffer modified. User `commit' command to apply changes.Console> (enable)Related Commands
clear security acl
clear security acl capture-ports
clear security acl map
commit
set security acl map
set security acl capture-ports
show security acl
show security acl capture-portsset security acl map
To map an existing VACL to a VLAN, use the set security acl map command.
set security acl map acl_name vlan
Syntax Description
acl_name
Unique name that identifies the list to which the entry belongs.
vlan
Number of the VLAN to be mapped to the VACL; valid values are from 1 to 1005 and from 1025 to 4094.
Defaults
There are no default ACLs and no default ACL-VLAN mappings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Configurations you make by entering this command are saved in NVRAM. This command does not require that you enter the commit command. Each VLAN can be mapped to only one ACL of each type (IP, IPX, and MAC). An ACL can be mapped to a VLAN only after you have committed the ACL.
When you enter the ACL name, follow these naming conventions:
•
•
•
•
•
Caution
Examples
This example shows how to map an existing VACL to a VLAN:
Console> (enable) set security acl map IPACL1 1ACL IPACL1 mapped to vlan 1Console> (enable)This example shows the output if you try to map an ACL that has not been committed:
Console> (enable) set security acl map IPACL1 1Commit ACL IPACL1 before mapping.Console> (enable)This example shows the output if you try to map an ACL that is already mapped to a VLAN for the ACL type (IP, IPX, or MAC):
Console> (enable) set security acl map IPACL2 1Mapping for this type already exists for this VLAN.Console> (enable)Related Commands
clear security acl
clear security acl map
commit
show security aclset snmp
To enable or disable the processing of SNMP requests to the switch and SNMP traps from the switch, use the set snmp command.
set snmp {enable | disable}
Syntax Description
Defaults
By default, SNMP processing is enabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When SNMP processing is enabled, the switch processes SNMP inquiries and sends out SMNP traps if there are no conflicts with other SNMP configurations. When SNMP processing is disabled, the switch ignores SNMP requests and no SNMP traps are sent out regardless of other SNMP configurations.
Whether SNMP processing is enabled or disabled, you can change other SNMP configurations, and RMON-related processes are not affected.
The SNMP ifIndex persistence feature is always enabled. With the ifIndex persistence feature, the ifIndex value of the port and VLAN is always retained and used after the following occurrences:
•
•
•
•
•
For Fast EtherChannel and Gigabit EtherChannel interfaces, the ifIndex value is only retained and used after a high-availability switchover.
Examples
This example shows how to disable SNMP processing:
Console> (enable) set snmp disableSNMP disabledConsole> (enable)Related Commands
set snmp access
To define the access rights of an SNMP group, use the set snmp access command.
set snmp access [-hex] {groupname} {security-model {v1 | v2c}}
[read [-hex] {readview}] [write [-hex] {writeview}] [notify [-hex] {notifyview}]
[volatile | nonvolatile]set snmp access [-hex] {groupname} {security-model v3 {noauthentication |
authentication | privacy}} [read [-hex] {readview}] [write [-hex] {writeview}]
[notify [-hex] {notifyview}] [context [-hex] contextname [exact | prefix]] [volatile | nonvolatile]Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for groupname, readview, writeview, and notifyview (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
readview is assumed to be every object belonging to the Internet (1.3.6.1) OID space; you can use the read option to override this state.
For writeview, you must also configure write access.
For notifyview, if a view is specified, any notifications in that view are sent to all users associated with the group. (An SNMP server host configuration must exist for the user.)
For contextname, the string is treated as either a full context name or the prefix of a context name, depending on whether you enter the exact or prefix keyword. If you enter the prefix keyword, this allows you to enter a simple form of wildcarding. For example, if you enter a contextname of vlan, vlan-1 and vlan-100 will be selected.
If you do not enter a context name, a NULL context string is used.
Examples
This example shows how to set the SNMP access rights for a group:
Console> (enable) set snmp access cisco-group security-model v3 authenticationSNMP access group was set to cisco-group version v3 level authentication, readview internet, nonvolatile.Console> (enable)Related Commands
clear snmp access
show snmp access
show snmp contextset snmp access-list
To specify an access list number for a host or group of hosts, use the set snmp access-list command.
set snmp access-list access_number IP_address [ipmask maskaddr]
Syntax Description
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you specify more than one IP address, separate each IP address with a space.
If you use anaccess list number that is already in use, the new IP addresses are appended to the access list. You can clear one or more IP addresses associated with an access list by entering the clear snmp access-list command.
The maskaddr variable is in the format xxx.xxx.xxx.xxx.
Examples
This example shows how to associate the IP address of a host to access list number 1:
Console> (enable) set snmp access-list 1 172.20.60.100Host 172.20.60.100 is associated with access number 1.Console> (enable)This example shows how to associate the IP addresses of two hosts to access list number 101:
Console> (enable) set snmp access-list 101 172.20.60.10 172.20.60.90Hosts 172.20.60.10, 172.20.60.90 are associated with access number 101.Console> (enable)This example shows how to associate the IP address and subnet mask of a host to access list number 2:
Console> (enable) set snmp access-list 2 172.20.60.100 ipmask 255.0.0.0Access nmber 2 has been created with new IP Address 172.20.60.100 mask 255.0.0.0Console> (enable)Related Commands
clear snmp access-list
show snmp access-listset snmp buffer
To set the size of the SNMP UDP socket receive buffer, use the set snmp buffer command.
set snmp buffer {packets}
Syntax Description
Defaults
95 packets
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You can adjust the SNMP UDP socket receive buffer to contain a maximum of 95 packets.
Examples
This example shows how to set the SNMP UDP socket receive buffer to contain a maximum of 45 packets:
Console> (enable) set snmp buffer 45SNMP socket receive buffer set to 45 packets.Console> (enable)This example shows the error message the displays when you try to set the SNMP UDP socket receive buffer above the valid range:
Console> (enable) set snmp buffer 100Invalid input. Must be an integer between 32 and 95.Console> (enable)Related Commands
set snmp chassis-alias
To set the chassis alias and save it in NVRAM and in the configuration file, use the set snmp chassis-alias command.
set snmp chassis-alias [chassisAlias]
Syntax Description
chassisAlias
(Optional) Chassis entPhysicalAlias. See the "Usage Guidelines" section for more information about setting the chassis alias.
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The chassisAlias value must be from 0 to 32 characters.
To clear the chassisAlias value, enter the set snmp chassis-alias command without entering a chassisAlias value.
Examples
This example shows how to set the chassis alias:
Console> (enable) set snmp chassis-alias my chassisSNMP chassis entPhysicalAlias set to 'my chassis'.Console> (enable)This example shows how to clear the chassis alias:
Console> (enable) set snmp chassis-aliasSNMP chassis entPhysicalAlias cleared.Console> (enable)This example shows the message that appears when you attempt to set a chassis alias that exceeds 32 characters:
Console> (enable) set snmp chassis-alias 123456789123456789123456789123456789Chassis entPhysicalAlias must be less than 33 characters.Console> (enable)Related Commands
set snmp community
To set SNMP communities and associated access types, use the set snmp community command.
set snmp community {read-only | read-write | read-write-all} [community_string]
set snmp community index [-hex] index-name name community_string security [-hex] security-name [context [-hex] context-name] [volatile | nonvolatile]
[transporttag [-hex] tag-value]Syntax Description
Defaults
The default is the following communities and access types are defined:
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
There are three configurable SNMP communities, one for each access type. If you do not specify the community string, the community string configured for that access type is cleared.
The community_string variable cannot contain the @ symbol.
To support the access types, you also need to configure four MIB tables: vacmContextTable, vacmSecurityToGroupTable, vacmAccessTable, and vacmViewTreeFamilyTable. Use the clear config snmp command to reset these tables to the default values.
Examples
This example shows how to set read-write access to the SNMP community called yappledapple:
Console> (enable) set snmp community read-write yappledappleSNMP read-write community string set to yappledapple.Console> (enable)This example shows how to clear the community string defined for read-only access:
Console> (enable) set snmp community read-onlySNMP read-only community string cleared.Console> (enable)Related Commands
clear config
clear snmp community
show snmp
show snmp communityset snmp community-ext
To set additional community strings, use the set snmp community-ext command.
set snmp community-ext community_string {read-only | read-write | read-write-all}
[view view_oid] [access access_number]Syntax Description
Defaults
This command has no default settings.
Command Types
Switch command.
Command Types
Privileged.
Usage Guidelines
Adding a new community string using the set snmp community-ext command creates appropriate entries in the vacmAccessTable (if a view is specified), snmpCommunityTable, and vacmSecurityToGroup tables.
An example of the view_oid variable is 1.3.6.1.2.1.
Examples
This example shows how to set an additional SNMP community string:
Console> (enable) set snmp community-ext public1 read-onlyCommunity string public1 is created with access type as read-onlyConsole> (enable)This example shows how to restrict the community string to an access number:
Console> (enable) set snmp community-ext private1 read-write access 2Community string private1 is created with access type as read-write accessnumber 2Console> (enable)This example shows how to change the access number to the community string:
Console> (enable) set snmp community-ext private1 read-write access 3Community string private1 is updated with access type as read-write accessnumber 3Console> (enable)Related Commands
set snmp extendedrmon netflow
To enable or disable the SNMP extended RMON support for the NAM module, use the set snmp extendedrmon netflow command.
set snmp extendedrmon netflow {enable | disable} {mod}
Syntax Description
enable
Enables the extended RMON support.
disable
Disables the extended RMON support.
mod
Module number of the extended RMON NAM.
Defaults
The default is SNMP-extended RMON NetFlow is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Examples
This example shows how to enable SNMP-extended RMON NetFlow support:
Console> (enable) set snmp extendedrmon netflow enable 2Snmp extended RMON netflow enabledConsole> (enable)This example shows how to disable SNMP-extended RMON NetFlow support:
Console> (enable) set snmp extendedrmon netflow disable 2Snmp extended RMON netflow disabledConsole> (enable)This example shows the response when the SNMP-extended RMON NetFlow feature is not supported:
Console> (enable) set snmp extendedrmon enable 4NAM card is not installed. Console> (enable)Related Commands
set snmp group
To establish the relationship between an SNMP group and a user with a specific security model, use the set snmp group command.
set snmp group [-hex] {groupname} user [-hex] {username}
{security-model {v1 | v2c | v3}} [volatile | nonvolatile]Syntax Description
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for groupname or username (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
Examples
This example shows how to set the SNMP group:
Console> (enable) set snmp group cisco-group user joe security-model v3SNMP group was set to cisco-group user joe and version v3,nonvolatile.Console> (enable)Related Commands
clear snmp group
show snmp groupset snmp ifalias
To set the SNMP interface alias, use the set snmp ifalias command.
set snmp ifalias {ifIndex} [ifAlias]
Syntax Description
ifIndex
Interface index number.
ifAlias
(Optional) Name of the interface alias. See the "Usage Guidelines" section for more information.
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The ifAlias string can contain 0 to 64 characters.
Examples
This example shows how to set the SNMP interface alias:
Console> (enable) set snmp ifalias 1 Inband portifIndex 1 alias setConsole> (enable)Related Commands
clear snmp ifalias
show snmp ifaliasset snmp notify
To set the notifyname entry in the snmpNotifyTable and the notifytag entry in the snmpTargetAddrTable, use the set snmp notify command.
set snmp notify [-hex] {notifyname} tag [-hex] {notifytag}
[trap | inform] [volatile | nonvolatile]Syntax Description
Defaults
The defaults are storage type is volatile and notify type is trap.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for the notifyname and notifytag (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
Examples
This example shows how to set the SNMP notify for a specific notifyname:
Console> (enable) set snmp notify hello tag world informSNMP notify name was set to hello with tag world notifyType inform, and storageType nonvolatile.Console> (enable)Related Commands
clear snmp notify
show snmp notifyset snmp rmon
To enable or disable SNMP RMON support, use the set snmp rmon command.
set snmp rmon {enable | disable}
Syntax Description
Defaults
The default is RMON support is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
RMON statistics are collected on a segment basis.
The RMON feature deinstalls all of the domains for all of the interfaces on an Ethernet module that has been removed from the system.
When you enable RMON, the supported RMON groups for Ethernet ports are Statistics, History, Alarms, and Events as specified in RFC 1757.
Use of this command requires a separate software license.
Examples
This example shows how to enable RMON support:
Console> (enable) set snmp rmon enableSNMP RMON support enabled.Console> (enable)This example shows how to disable RMON support:
Console> (enable) set snmp rmon disableSNMP RMON support disabled.Console> (enable)Related Commands
set snmp rmonmemory
To set the memory usage limit in percentage, use the set snmp rmonmemory command.
set snmp rmonmemory percentage
Syntax Description
Defaults
The default is 85 percent.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When using this command, setting the percentage value to 85 does not mean that RMON can use 85 percent of memory, it means that you cannot create new RMON entries or restore entries from the NVRAM if the memory usage exceeds 85 percent.
If you expect the device to run other sessions such as Telnet, a lower value should be set to the memory limit. Otherwise, the new Telnet sessions may fail because the available memory is not enough.
Examples
This example shows how to set the memory usage limit:
Console> (enable) set snmp rmonmemory 90Console> (enable)Related Commands
set snmp targetaddr
To configure the SNMP target address entries in the snmpTargetAddressTable, use the set snmp targetaddr command.
set snmp targetaddr [-hex] {addrname} param [-hex] {paramsname} {ipaddr}
[udpport {port}] [timeout {value}] [retries {value}] [volatile | nonvolatile]
[taglist {[-hex] tag}] [[-hex] tag tagvalue]Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for the addrname, paramsname, tag, and tagvalue (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
The maximum tagvalue and taglist length is 255 bytes.
Examples
This example shows how to set the target address in the snmpTargetAddressTable:
Console> (enable) set snmp targetaddr foo param bar 10.1.2.4 udp 160 timeout 10 retries 3 taglist tag1 tag2 tag3SNMP targetaddr name was set to foo with param bar ipAddr 10.1.2.4, udpport 160, timeout 10, retries 3, storageType nonvolatile with taglist tag1 tag2 tag3.Console> (enable)Related Commands
clear snmp targetaddr
show snmp targetaddrset snmp targetparams
To configure the SNMP parameters used in the snmpTargetParamsTable when generating a message to a target, use the set snmp targetparams command.
set snmp targetparams [-hex] {paramsname} user [-hex] {username} {security-model {v1 | v2c}} {message-processing {v1 | v2c | v3}} [volatile | nonvolatile]
set snmp targetparams [-hex] {paramsname} user [-hex] {username} {security-model v3} {message-processing v3 {noauthentication | authentication | privacy}} [volatile | nonvolatile]
Syntax Description
Defaults
The default storage type is volatile.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for the paramsname and username (nonprintable delimiters for these parameters), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
Examples
This example shows how to set target parameters in the snmpTargetParamsTable:
Console> (enable) set snmp targetparams bar user joe security-model v3 message-processing v3 authenticationSNMP target params was set to bar v3 authentication, message-processing v3, user joe nonvolatile.Console> (enable)Related Commands
clear snmp targetparams
show snmp targetparamsset snmp trap
To enable or disable the different SNMP traps on the system or to add an entry into the SNMP authentication trap receiver table, use the set snmp trap command.
set snmp trap {enable | disable} [all | auth | bridge | chassis | config | entity | entityfru |
envfan | envpower | envshutdown | flashinsert | flashremove | ippermit | macnotification | module | stpx | syslog | system | vmps | vtp]set snmp trap rcvr_addr rcvr_community [port rcvr_port] [owner rcvr_owner] [index rcvr_index]
Syntax Description
Defaults
The default is SNMP traps are disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
An IP permit trap is sent when unauthorized access based on the IP permit list is attempted.
Use the show snmp command to verify the appropriate traps were configured.
To use this command, you must configure all notification tables: snmpTargetAddrTable, snmpTargetParamsTable, and snmpNotifyTable.
Use the all option to enable or disable all trap types and all port traps.
Use the set port trap command to enable or disable a single port or a range of ports.
The trap configuration is saved in NVRAM and the configuration file.
Examples
This example shows how to enable SNMP chassis traps:
Console> (enable) set snmp trap enable chassisSNMP chassis alarm traps enabled.Console> (enable)This example shows how to enable all traps:
Console> (enable) set snmp trap enableAll SNMP traps enabled.Console> (enable)This example shows how to disable SNMP chassis traps:
Console> (enable) set snmp trap disable chassisSNMP chassis alarm traps disabled.Console> (enable)This example shows how to enable SNMP MAC address notification traps:
Console> (enable) set snmp trap enable macnotificationSNMP MAC notification trap enabled.Console> (enable)This example shows how to add an entry in the SNMP trap receiver table:
Console> (enable) set snmp trap 192.122.173.42 publicSNMP trap receiver added.Console> (enable)Related Commands
clear snmp trap
set port trap
show snmp
test snmp trapset snmp user
To configure a new SNMP user, use the set snmp user command.
set snmp user [-hex] {username} {remote {engineid}} [authentication {md5 | sha | authpassword}] [privacy {privpassword}] [volatile | nonvolatile]
Syntax Description
Defaults
The default storage type is volatile. If you do not specify authentication, the security level default will be noauthentication. If you do not specify privacy, the default will be no privacy.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for username (nonprintable delimiters for this parameter), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
The authpassword and privpassword values must be hexadecimal characters without delimiters in between.
Examples
This example shows how to set a specific username:
Console> (enable) set snmp user joeSnmp user was set to joe authProt no-auth privProt no-priv with engineid 00:00.Console> (enable)This example shows how to set a specific username, authentication, and authpassword:
Console> (enable) set snmp user John authentication md5 arizona2Snmp user was set to John authProt md5 authPasswd arizona2. privProt no-priv wi.Console> (enable)Related Commands
set snmp view
To configure the SNMP MIB view, use the set snmp view command.
set snmp view [-hex]{viewname}{subtree}[mask] [included | excluded] [volatile | nonvolatile]
Syntax Description
Defaults
The defaults are as follows:
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you use special characters for viewname (nonprintable delimiters for this parameter), you must use a hexadecimal keyword, which is one or two hexadecimal digits separated by a colon (:); for example, 00:ab:34.
A MIB subtree with a mask defines a view subtree. The MIB subtree can be in object identifier (OID) format or a text name mapped to a valid OID.
Examples
This example shows how to assign a subtree to the view public:
Console> (enable) set snmp view public 1.3.6.1 includedSnmp view name was set to public with subtree 1.3.6.1 included, nonvolatile.Control> (enable)This example shows the response when the subtree is incorrect:
Console> (enable) set snmp view stats statistics excludedStatistics is not a valid subtree OIDControl> (enable)Related Commands
set span
To enable or disable SPAN and to set up the switch port and VLAN analyzer for multiple SPAN sessions, use the set span command.
set span disable [dest_mod/dest_port | all]
set span {src_mod/src_ports | src_vlans | sc0} {dest_mod/dest_port} [rx | tx | both] [inpkts
{enable | disable}] [learning {enable | disable}] [multicast {enable | disable}]
[filter vlans...] [create]Syntax Description
Defaults
The default is SPAN is disabled, no VLAN filtering is enabled, multicast is enabled, input packets are disabled, and learning is enabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
After you enable SPAN, system defaults are used if no parameters were ever set. If you changed parameters, the old parameters are stored in NVRAM, and the new parameters are used.
Use a network analyzer to monitor ports.
If you specify multiple SPAN source ports, the ports can belong to different VLANs.
A maximum of two rx or both SPAN sessions and four tx SPAN sessions can exist simultaneously. If you use a remote SPAN station, the maximum number of rx or both SPAN sessions is one.
Use the inpkts keyword with the enable option to allow the SPAN destination port to receive normal incoming traffic in addition to the traffic mirrored from the SPAN source. Use the disable option to prevent the SPAN destination port from receiving normal incoming traffic.
You can specify an MSM port as the SPAN source port. However, you cannot specify an MSM port as the SPAN destination port.
When you enable the inpkts option, a warning message notifies you that the destination port does not join STP and may cause loops if this option is enabled.
When you configure multiple SPAN sessions, the destination module number/port number must be known to index the particular SPAN session.
If you do not specify the keyword create and you have only one session, the session will be overwritten. If a matching destination port exists, the particular session will be overwritten (with or without specifying create). If you specify the keyword create and there is no matching destination port, the session will be created.
If any VLANs on SPAN source port(s) are blocked by spanning tree, you may see extra packets transmitted on the destination port that were not actually transmitted out of the source port(s). The extra packets seen at the destination port are packets sent through the switch fabric to the source port and then blocked by spanning tree at the source port.
Examples
This example shows how to configure SPAN so that both transmit and receive traffic from port 1/1 (the SPAN source) is mirrored on port 2/1 (the SPAN destination):
Console> (enable) set span 1/1 2/1Enabled monitoring of Port 1/1 transmit/receive traffic by Port 2/1Console> (enable)This example shows how to set VLAN 522 as the SPAN source and port 2/1 as the SPAN destination:
Console> (enable) set span 522 2/1Enabled monitoring of VLAN 522 transmit/receive traffic by Port 2/1Console> (enable)This example shows how to set VLAN 522 as the SPAN source and port 3/12 as the SPAN destination. Only transmit traffic is monitored. Normal incoming packets on the SPAN destination port are allowed:
Console> (enable) set span 522 2/12 tx inpkts enableSPAN destination port incoming packets enabled.Enabled monitoring of VLAN 522 transmit traffic by Port 2/12Console> (enable)This example shows how to set port 3/2 as the SPAN source and port 2/2 as the SPAN destination:
Console> (enable) set span 3/2 2/2 tx createEnabled monitoring of port 3/2 transmit traffic by Port 2/1Console> (enable)This example shows how to disable SPAN if multiple SPAN sessions are not defined:
Console> (enable) set span disableThis command WILL disable your span session(s).Do you want to continue (y/n) [n]?yDisabled all sessionsConsole> (enable)This example shows what happens if you try to enter the set span disable command (without the destination module number/port number defined) and multiple SPAN sessions are defined:
Console> (enable) set span disableMultiple active span sessions. Please specify span destination to disable.Console> (enable)Related Commands
set spantree backbonefast
To enable or disable the spanning tree BackboneFast Convergence feature, use the set spantree backbonefast command.
set spantree backbonefast {enable | disable}
Syntax Description
Defaults
The default is BackboneFast convergence is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
This command is not available in Multiple Spanning Tree (MST) mode.
For BackboneFast Convergence to work, you must enable it on all switches in the network.
When you try to enable BackboneFast and the switch is in Rapid PVST+ mode, this message is displayed:
Cannot enable backbonefast when the spantree mode is RAPID-PVST+.Examples
This example shows how to enable BackboneFast Convergence:
Console> (enable) set spantree backbonefast enableBackbonefast enabled for all VLANs.Console> (enable)This example shows the message that is displayed when you try to enable BackboneFast in Rapid PVST+ mode:
Console> (enable) set spantree backbonefast enableCannot enable backbonefast when the spantree mode is RAPID-PVST+.Console> (enable)Related Commands
set spantree bpdu-filter
To enable or disable BPDU packet filtering on a port, use the set spantree bpdu-filter command.
set spantree bpdu-filter mod/port {enable | disable | default}
Syntax Description
Defaults
The default is BPDU packet filtering is default.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
BPDU packet filtering turns off BPDU transmission on ports.
If you enter the default keyword, the spanning tree port is set to the global BPDU filtering state.
To enable or disable BPDU filtering for all ports on the switch, enter the set spantree global-default bpdu-filter command.
Examples
This example shows how to enable BPDU filtering on module 3, port 4:
Console> (enable) set spantree bpdu-filter 3/4 enableWarning: Ports enabled with bpdu filter will not send BPDUs and drop allreceived BPDUs. You may cause loops in the bridged network if you misusethis feature.Spantree port 3/4 bpdu filter enabled.Console> (enable)Related Commands
set spantree global-default
show spantree portfastset spantree bpdu-guard
To enable or disable spanning tree BPDU guard on a port, use the set spantree bpdu-guard command.
set spantree bpdu-guard mod/port {enable | disable | default}
Syntax Description
Defaults
The default is BPDU guard is default.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You must enable PortFast mode before you can enable BPDU guard for BPDU guard to work correctly.
When you enable BPDU guard, a port is moved into an errdisable state when a BPDU is received on that port. When you disable a BPDU guard, a PortFast-enabled nontrunking port will stay up when it receives BPDUs, which may cause spanning tree loops.
If you enter the default keyword, the spanning tree port is set to the global BPDU guard state.
To enable or disable BPDU guard for all ports on the switch, enter the set spantree global-default bpdu-guard command.
Examples
This example shows how to enable BPDU guard on module 3, port 1:
Console> (enable) set spantree bpdu-guard 3/1 enableSpantree port 3/1 bpdu guard enabled.Console> (enable)Related Commands
set spantree global-default
show spantree portfastset spantree bpdu-skewing
To enable or disable collection of the spanning tree BPDU skewing detection statistics, use the set spantree bpdu-skewing command.
set spantree bpdu-skewing {enable | disable}
Syntax Description
enable
Enables BPDU skewing detection statistics collection.
disable
Disables BPDU skewing detection statistics collection.
Defaults
The default is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You can use this command to troubleshoot slow network convergence due to skewing. Skewing occurs when spanning tree timers lapse, expected BPDUs are not received, and spanning tree detects topology changes. The difference between the expected result and the BPDUs actually received is a "skew." The skew causes BPDUs to reflood the network to keep the spanning tree topology database up to date.
Examples
This example shows how to enable the BPDU skew detection feature:
Console> (enable) set spantree bpdu-skewing enableSpantree bpdu-skewing enabled on this switch.Console> (enable)This example shows how to disable the BPDU skew detection feature:
Console> (enable) set spantree bpdu-skewing disableSpantree bpdu-skewing disabled on this switch.Console> (enable)Related Commands
set spantree channelcost
To set the channel path cost and to automatically adjust the channel port costs, use the set spantree channelcost command.
set spantree channelcost {channel_id | all} cost
Syntax Description
Defaults
The port cost is updated automatically based on the current port costs of the channeling ports.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You can use this command when your switch is in Link Aggregation Control Protocol (LACP) channel mode or in PAgP channel mode.
For differences between PAgP and LACP, refer to the "Guidelines for Port Configuration" section of the "Configuring EtherChannel" chapter of the Catalyst 6500 Series Switch Software Configuration Guide.
Examples
This example shows how to set the channel 768 path cost to 12.
Console> (enable) set spantree channelcost 768 12Port(s) 1/1-2 port path cost are updated to 19.Channel 768 cost is set to 12.Warning: channel cost may not be applicable if channel is broken.Console> (enable)This example shows how to set all channel path costs to 15:
Console> (enable) set spantree channelcost all 15Port(s) 1/1-2 port path cost are updated to 24.Channel 768 cost is set to 15.Port(s) 4/3-4 cost is set to 15.channel 769 cost is set to 15.Port(s) 4/7-8 cost is set to 15.channel 770 cost is set to 15.Warning: channel cost may not be applicable if channel is broken.Console> (enable)Related Commands
clear lacp-channel statistics
set channelprotocol
set lacp-channel system-priority
set port lacp-channel
set spantree channelvlancost
show lacp-channel
show port lacp-channelset spantree channelvlancost
To set the channel VLAN path cost and adjust the port VLAN costs of the ports that belong to the channel, use the set spantree channelvlancost command.
set spantree channelvlancost channel_id cost
Syntax Description
Defaults
The command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You must set the channel VLAN cost one channel at a time.
You can use this command when your system is in LACP channel mode or PAgP channel mode.
For differences between PAgP and LACP, refer to the "Guidelines for Port Configuration" section of the "Configuring EtherChannel" chapter of the Catalyst 6500 Series Switch Software Configuration Guide.
Examples
This example shows how to set the VLAN cost to 10 for channel 768:
Console> (enable) set spantree channelvlancost 768 10Port(s) 1/1-2 vlan cost are updated to 24.Channel 768 vlancost is set to 10.Console> (enable)Related Commands
clear lacp-channel statistics
set channelprotocol
set lacp-channel system-priority
set port lacp-channel
set spantree channelcost
show lacp-channel
show port lacp-channelset spantree defaultcostmode
To specify the spanning tree default port cost mode, use the set spantree defaultcostmode command.
set spantree defaultcostmode {short | long}
Syntax Description
short
Sets the default port cost for port speeds slower than 10 gigabits.
long
Sets the default port cost mode port speeds of 10 gigabits and faster.
Defaults
The default is short.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The set spantree defaultcostmode long command is available in PVST+ mode only. If you enter this command in MISTP or MISTP-PVST+ mode, this message is displayed:
In MISTP or MISTP-PVST+ mode, default portcost and portinstancecost alwaysuse long format default values.All switches in a network must have the same default. If any switch in the network supports port speeds of 10 gigabits and greater, the default cost mode must be set to long on all the switches in the network.
For port speeds of 1 gigabits and greater, the default port cost should be set to long. For port speeds less than 10 gigabits, the default port cost can be set to short.
The default path cost is based on port speed; see Table 2-21 and Table 2-22 for default settings.
Table 2-21 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Table 2-22 Default Port Cost—Long Mode
100 Kb
200,000,000
1 Mb
20,000,000
10 Mb
2,000,000
100 Mb
200,000
1 Gb
20,000
10 Gb
2,000
100 Gb
200
1 Tb
20
10 Tb
2
Examples
This example shows how to set the spanning tree default port cost mode:
Console> (enable) set spantree defaultcostmode longPortcost and portvlancost set to use long format default values.Console> (enable)Related Commands
set spantree disable
To disable the spanning tree algorithm for all VLANs or a specific VLAN or disable spanning tree instance, use the set spantree disable command.
set spantree disable vlan
set spantree disable all
set spantree disable mistp-instance instance
set spantree disable mistp-instance all
Syntax Description
Defaults
The default is spanning tree is enabled, and all instances are enabled (flooding disabled).
Command Types
Switch command.
Command Modes
Privileged.
If you do not specify a VLAN number or an instance number, 1 is assumed.
When an instance is enabled, the Spanning Tree Protocol starts running on that instance.
When an instance is disabled, the switch stops sending out config type-length values (TLVs) for that instance and starts flooding incoming TLVs for the same instance (but checks the VLAN mapping on the incoming side). All the traffic running on the VLANs mapped to the instance is flooded as well.
This command is not available in MST mode.
Examples
This example shows how to disable the spanning tree for VLAN 1:
Console> (enable) set spantree disable 1VLAN 1 bridge spanning tree disabled.Console> (enable)This example shows how to disable spanning tree for a specific instance:
Console> (enable) set spantree disable mistp-instance 2MI-STP instance 2 disabled.Console> (enable)Related Commands
set spantree enable
show spantreeset spantree enable
To enable the spanning tree algorithm for all VLANs, a specific VLAN, a specific instance, or all instances, use the set spantree enable command.
set spantree enable vlans
set spantree enable all
set spantree enable mistp-instance instance
set spantree enable mistp-instance all
Syntax Description
Defaults
The default is enabled, and all instances are enabled (flooding disabled).
Command Types
Switch command.
Command Modes
Privileged.
MISTP and VTP pruning cannot be enabled at the same time.
If you do not specify a VLAN number or an instance number, 1 is assumed.
This command is not available in MST mode.
Examples
This example shows how to activate spanning tree for VLAN 1:
Console> (enable) set spantree enable 1VLAN 1 bridge spanning tree enabled.Console> (enable)This example shows how to activate spanning tree for an instance:
Console> (enable) set spantree enable mistp-instance 1-STP instance 1 enabled.Console> (enable)Related Commands
set spantree disable
show spantreeset spantree fwddelay
To set the bridge forward delay for a VLAN or an instance, use the set spantree fwddelay command.
set spantree fwddelay delay [vlans]
set spantree fwddelay delay mistp-instance [instances]
set spantree fwddelay delay mst
Syntax Description
Defaults
The default is the bridge forward delay is set to 15 seconds for all VLANs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a VLAN number or an instance number, 1 is assumed.
If you enable MISTP, you cannot set the VLAN bridge forward delay.
If you enable PVST+, you cannot set the instance bridge forward delay.
If you enter the set spantree fwddelay delay mst command, you set the forward delay time for the IST instance and all MST instances. You do not need to set the forward delay time for each MST instance.
Examples
This example shows how to set the bridge forward delay for VLAN 100 to 16 seconds:
Console> (enable) set spantree fwddelay 16 100Spantree 100 forward delay set to 16 seconds.Console> (enable)This example shows how to set the bridge forward delay for an instance to 16 seconds:
Console> (enable) set spantree fwddelay 16 mistp-instance 1Instance 1 forward delay set to 16 seconds.Console> (enable)This example shows how to set the bridge forward delay for the IST and all MST instances to 15 seconds:
Console> (enable) set spantree fwddelay 15 mstMST forward delay set to 15 seconds.Console> (enable)Related Commands
set spantree global-default
To set the global states on the switch, use the set spantree global-default command.
set spantree global-default portfast {enable | disable}
set spantree global-default loop-guard {enable | disable}
set spantree global-default bpdu-guard {enable | disable}
set spantree global-default bpdu-filter {enable | disable}
Syntax Description
Defaults
All ports are in nonedge state.
Loop guard is disabled on all ports.
BPDU guard is disabled on all ports.
BPDU filter is disabled on all ports.
Command Types
Switch command.
Command Modes
Privileged.
Examples
This example shows how to disable the global PortFast state on the switch:
Console> (enable) set spantree global-default portfast disableSpantree global portfast state disabled on this switch.Console> (enable)This example shows how to enable the global loop guard state on the switch:
Console> (enable) set spantree global-default loop-guard enableSpantree global loop-guard state enabled on the switch.Console> (enable)This example shows how to disable the global BPDU guard state on the switch:
Console> (enable) set spantree global-default bpdu-guard disableSpantree global-default bpdu-guard disabled on this switch.Console> (enable)This example shows how to disable the global BPDU filter state on the switch:
Console> (enable) set spantree global-default bpdu-filter disableSpantree global-default bpdu-filter disabled on this switch.Console> (enable)Related Commands
clear spantree mst
set spantree mst config
set spantree portfast bpdu-filter
set spantree portfast bpdu-guard
show spantree mst configset spantree guard
To enable or disable the spanning tree root guard or loop guard feature on a per-port basis, use the set spantree guard command.
set spantree guard {none | root | loop} mod/port
Syntax Description
none
Disables the spanning tree guard feature.
root
Enables the root guard feature.
loop
Enables the loop guard feature.
mod/port
Number of the module and ports on the module.
Defaults
The default is root guard and loop guard are disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you enable loop guard on a channel and the first link becomes unidirectional, loop guard will block the entire channel until the affected port is removed from the channel.
You can use the root guard feature to prevent switches from becoming the root switch. The root guard feature forces a port to become a designated port so that no switch on the other end of the link can become a root switch.
When you enable root guard, it is automatically applied to all of the active instances or VLANs to which that port belongs. When you disable root guard, it is disabled for the specified ports. If a port goes into the root-inconsistent state, it automatically goes into the listening state. Disabling loop guard moves all loop-inconsistent ports to the listening state.
When using the loop guard feature, follow these guidelines:
•
•
•
•
•
•
Examples
This example shows how to enable root guard:
Console> (enable) set spantree guard root 5/1Rootguard on port 5/1 is enabled.Warning!! Enabling rootguard may result in a topolopy change.Console> (enable)This example shows how to enable the loop guard feature:
Console> (enable) set spantree guard loop 5/1Rootguard is enabled on port 5/1, enabling loopguard will disable rootguard onthis port.Do you want to continue (y/n) [n]? yLoopguard on port 5/1 is enabled.Console> (enable)Related Commands
set spantree hello
To set the bridge hello time for a VLAN or an instance, use the set spantree hello command.
set spantree hello interval [vlans]
set spantree hello interval mistp-instance instances
set spantree hello interval mst
Syntax Description
Defaults
The default is the bridge hello time is set to 2 seconds for all VLANs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a VLAN number or an instance number, 1 is assumed.
If you enable MISTP, you cannot set the VLAN hello time.
If you enable PVST+, you cannot set the instance hello time.
If you enter the set spantree hello interval mst command, you set the hello time for the Internal Spanning Tree (IST) instance and all MST instances. You do not need to set the hello time for each MST instance.
Examples
This example shows how to set the spantree hello time for VLAN 100 to 3 seconds:
Console> (enable) set spantree hello 3 100Spantree 100 hello time set to 3 seconds.Console> (enable)This example shows how to set the spantree hello time for an instance to 3 seconds:
Console> (enable) set spantree hello 3 mistp-instance 1Spantree 1 hello time set to 3 seconds.Console> (enable)This example shows how to set the spantree hello time for the IST and all MST instances to 2 seconds:
Console> (enable) set spantree hello 2 mstMST hello time set to 2 seconds.Console> (enable)Related Commands
set spantree link-type
To configure the link type of a port, use the set spantree link-type command.
set spantree link-type mod/port {auto | point-to-point | shared}
Syntax Description
Defaults
The link type is auto.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If the link type is set to auto and the link is a half-duplex link, then the link is a shared link. If the link type is set to auto and the link is a full-duplex link, then the link is a point-to-point link.
The set spantree link-type command is the same as the set spantree mst link-type command.
Examples
This example shows how to connect port 1 on module 3 to a point-to-point link:
Console> (enable) set spantree link-type 3/1 point-to-pointLink type set to point-to-point on port 3/1Console> (enable)Related Commands
set spantree global-default
show spantreeset spantree macreduction
To enable or disable the spanning tree MAC address reduction feature, use the set spantree macreduction command.
set spantree macreduction enable | disable
Syntax Description
Defaults
The default is MAC address reduction is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The MAC address reduction feature is used to enable extended-range VLAN identification and allows the switch to support a large number of spanning tree instances with a very limited number of MAC addresses and still maintain the IEEE 802.1D bridge-ID requirement for each STP instance.
You cannot disable this feature if extended-range VLANs exist.
You cannot disable this feature on chassis with 64 MAC addresses.
Examples
This example shows how to disable the MAC address reduction feature:
Console> (enable) set spantree macreduction disableMAC address reduction disabledConsole> (enable)Related Commands
set spantree maxage
To set the bridge maximum aging time for a VLAN or an instance, use the set spantree maxage command.
set spantree maxage agingtime [vlans]
set spantree maxage agingtime mistp-instance instances
set spantree maxage agingtime mst
Syntax Description
Defaults
The default configuration is 20 seconds for all VLANs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a VLAN number or an instance number, 1 is assumed.
If you enable MISTP, you cannot set the VLAN maximum aging time.
If you enable PVST+, you cannot set the instance maximum aging time.
If you enter the set spantree maxage agingtime mst command, you set the maximum aging time for the IST instance and all MST instances. You do not need to set the maximum aging time for each MST instance.
Examples
This example shows how to set the maximum aging time for VLAN 1000 to 25 seconds:
Console> (enable) set spantree maxage 25 1000Spantree 1000 max aging time set to 25 seconds.Console> (enable)This example shows how to set the maximum aging time for an instance to 25 seconds:
Console> (enable) set spantree maxage 25 mistp-instance 1Instance 1 max aging time set to 25 seconds.Console> (enable)This example shows how to set the maximum aging time for the IST and all MST instances to 20 seconds:
Console> (enable) set spantree maxage 20 mstMST max age set to 20 seconds.Console> (enable)Related Commands
set spantree mode
To configure the type of Spanning Tree Protocol mode to run, use the set spantree mode command.
set spantree mode {mistp | pvst+ | mistp-pvst+ | mst | rapid-pvst+}
Syntax Description
Defaults
The default is PVST+.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When you connect through Telnet into a switch and try to change the spanning tree mode from PVST+ to MISTP or MISTP-PVST+, and no VLANs are mapped to any instance on that switch, this warning message is displayed:
Console> (enable) set spantree mode mistpWarning!! Changing the STP mode from a telnet session will disconnect thesession because there are no VLANs mapped to any MISTP instance.Do you want to continue [n]?When you connect through Telnet into a switch and try to change the spanning tree mode from MISTP or MISTP-PVST+ to PVST+, or when you connect through Telnet into a switch and try to change the spanning tree mode from PVST+ to MISTP or MISTP-PVST+ and additional VLAN-instance mappings are on that switch, this warning message is displayed:
Console> (enable) set spantree mode pvst+Warning!! Changing the STP mode from a telnet session might disconnect thesession.Do you want to continue [n]?When you change from MISTP to Rapid PVST+ and over 8000 VLAN ports are currently configured on the switch, this warning message is displayed:
Console> (enable) set spantree mode rapid-pvst+Warning!! This switch has 12345 VLAN-ports currently configured for STP.Going out of MISTP mode could impact system performance.Do you want to continue [n]?If you change the spanning tree mode from PVST+ to MISTP or MISTP to PVST+, the STP mode previously running stops, all the information collected at runtime is used to build the port database for the new mode, and the new STP mode restarts the computation of the active topology from zero. All the parameters of the previous STP per VLAN or per instance are kept in NVRAM.
If you change the spanning tree mode from PVST+ to MISTP or MISTP to PVST+ and BackboneFast is enabled, this message is displayed:
Console> (enable) set spantree mode mistpCannot change the spantree mode to MISTP when backbonefast is enabled.Examples
This example shows how to set the spanning tree mode to PVST+:
Console> (enable) set spantree mode pvst+Warning!! Changing the STP mode from a telnet session might disconnect the session.Do you want to continue [n]? ySpantree mode set to PVST+.Console> (enable)This example shows what happens if you change the spanning tree mode from PVST+ to MISTP:
Console> (enable) set spantree mode mistpWarning!! Changing the STP mode from a telnet session will disconnect the session because there are no VLANs mapped to any MISTP instance.Do you want to continue [n]? yConsole> (enable)This example shows how to set the spanning tree mode to MST:
Console> (enable) set spantree mode mstWarning!! Changing the STP mode from a telnet session will disconnect the sessin because there are no VLANs mapped to any MISTP instance.Do you want to continue [n]? yConsole> (enable)This example shows how to set the spanning tree mode to rapid PVST+:
Console> (enable) set spantree mode rapid-pvst+Warning!! Changing the STP mode from a telnet session might disconnect the session.Do you want to continue [n]? yConsole> (enable)Related Commands
set spantree mst
To configure the mapping of VLANs to an MST instance, use the set spantree mst command.
set spantree mst instance vlan vlan
Syntax Description
instance
Number of the instance; valid values are from 0 to 15.
vlan vlan
Specifies the VLAN number; valid values are from 1 to 1005 and from 1025 to 4094.
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
All changes made to the region configuration (region information and VLAN mapping) are buffered. Only one user can hold the buffer at a time. This buffer is locked when you first use the set spantree mst instance or set spantree mst config commands.
If the VLAN is already mapped to some other instance, the VLAN is unmapped from that instance and mapped to the new instance.
Each time you map a new VLAN or VLANs, they are added to the existing mapping.
All unmapped VLANs are automatically mapped to MST instance 0 (IST).
Examples
This example shows how to map VLAN 1 to an MST instance 2:
Console> (enable) set spantree mst 2 vlan 1Console> (enable)Related Commands
clear spantree mst
set spantree mst configset spantree mst config
To change the MST region information, use the set spantree mst config command.
set spantree mst config [name name] [revision number]
set spantree mst config commit
set spantree mst config rollback [force]
Syntax Description
Defaults
Unless you specify a region name, no region name will be given.
The default revision number is 1.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The region name can be up to 32 characters long.
The region name and revision number are copied from NVRAM MST region information. You must enter the revision number if the revision number needs to be updated. The revision number is not incremented automatically each time that the MST configuration is committed.
Changes that you make to MST VLAN mapping are buffered, and by entering the set spantree mst config commit command, you put the new MST VLAN mapping into effect. After you enter the set spantree mst config commit command, the lock for the MST edit buffer is released.
If you enter the set spantree mst config rollback command, you discard the changes made to the MST region configuration that are not applied yet (only if you have locked the edit buffer). You can forcefully release the lock set by another user by entering the command set spantreee mst config rollback force.
The set spantree mst config commit and set spantree mst config rollback commands are stored in NVRAM.
Examples
This example shows how to configure an MST region and to give that region a name and revision number:
Console> (enable) set spantree mst config name test-lab revision 10Edit Buffer modified. Use 'set spantree mst config commit' to apply thechangesConsole> (enable)This example shows how to put the new MST VLAN mapping into effect:
Console> (enable) set spantree mst config commitConsole> (enable)This example shows how to discard MST region configuration when you hold the MST edit buffer:
Console> (enable) set spantree mst config rollbackConsole> (enable)This example shows how to unlock the MST edit buffer when it is held by another user:
Console> (enable) set spantree mst config rollback forceConsole> (enable)Related Commands
clear spantree mst
show spantree mst
show spantree mst configset spantree mst link-type
To configure the link type of a port, use the set spantree mst link-type command.
set spantree mst link-type mod/port {auto | point-to-point | shared}
Syntax Description
Defaults
The default link type is auto.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
MST rapid connectivity only works on point-to-point links between two bridges.
If the link type is set to auto and the link is a half-duplex link, then the link is a shared link. If the link type is set to auto and the link is a full-duplex link, then the link is a point-to-point link.
Examples
This example shows how to connect port 1 on module 3 to a point-to-point link:
Console> (enable) set spantree mst link-type 3/1 point-to-pointLink type set to point-to-point on port 3/1Console> (enable)Related Commands
clear spantree mst
set spantree global-default
set spantree mst config
set spantree mst maxhops
To set the spanning tree hop count, use the set spantree mst maxhops command.
set spantree mst maxhops maxhops
Syntax Description
Defaults
The bridge forward delay default is 20 seconds for all instances.
Command Types
Switch command.
Command Modes
Privileged.
Examples
This example shows how to set the maximum number of hops:
Console> (enable) set spantree mst maxhops 20Console> (enable)Related Commands
clear spantree mst
set spantree mst config
set spantree mst link-type
set spantree mst vlan
show spantree mst
show spantree mst configset spantree mst vlan
To configure the mapping of VLANs to an MST instance, use the set spantree mst vlan command.
set spantree mst instance vlan vlan
Syntax Description
instance
Number of the instance; valid values are from 0 to 15.
vlan vlan
Specifies the VLAN number; valid values are from 1 to 1005 and from 1025 to 4094.
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
All changes made to the region configuration (region information and VLAN mapping) are buffered. Only one user can hold the buffer at a time. This buffer is locked when you first enter the set spantree mst instance or set spantree mst config commands.
If the VLAN is already mapped to some other instance, the VLAN is unmapped from that instance and mapped to the new instance.
Each time you map a new VLAN or VLANs, they are added to the existing mapping.
All unmapped VLANs are mapped to MST instance 0 (IST).
Examples
This example shows how to map VLANs 400 through 499 to MST instance 4:
Console> (enable) set spantree mst 4 vlan 400-499Edit Buffer modified. Use 'set spantree mst config commit' to apply thechangesConsole> (enable)Related Commands
clear spantree mst
set spantree mst config
show spantree mst
show spantree mst configset spantree portcost
To set the path cost for a port, use the set spantree portcost command.
set spantree portcost mod/port cost [mst]
Syntax Description
Defaults
The default path cost is based on port speed; see Table 2-23 and Table 2-24 for default settings.
Table 2-23 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The Spanning Tree Protocol uses port path costs to determine which port to select as a forwarding port. You should assign lower numbers to ports attached to faster media (such as full duplex) and higher numbers to ports attached to slower media.
Examples
This example shows how to set the port cost for port 12 on module 2 to 19:
Console> (enable) set spantree portcost 2/12 19Spantree port 2/12 path cost set to 19.Console> (enable)Related Commands
set spantree defaultcostmode
show spantreeset spantree portfast
To allow a port that is connected to a single workstation or PC to start faster when it is connected, use the set spantree portfast command.
set spantree portfast mod/port {enable [trunk] | disable | default}
Syntax Description
Defaults
The default is the PortFast-start feature is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
When a port configured with the spantree portfast enable command is connected, the port immediately enters the spanning tree forwarding state rather than going through the normal spanning tree states, such as listening and learning.
If you enter the trunk keyword, the spanning tree PortFast-start feature is enabled on the specified trunk port.
Examples
This example shows how to enable the spanning tree PortFast-start feature on port 2 on module 1:
Console> (enable) set spantree portfast 1/2 enableWarning: Connecting layer 2 devices to a fast-start port can cause temporary spanning tree loops. Use with caution.Spantree port 1/2 fast start enabled.Console> (enable)This example shows how to enable the spanning tree PortFast-start feature on the trunk port:
Console> (enable) set spantree portfast 3/2 enable trunkWarning: Connecting layer 2 devices to a fast-start port can cause temporary spanning tree loops. Use with caution.Spantree port 1/2 fast start enabled.Console> (enable)Related Commands
set spantree portfast bpdu-filter
To enable or disable spanning tree PortFast BPDU packet filtering on a port, use the set spantree portfast bpdu-filter command.
set spantree portfast bpdu-filter mod/port {enable | disable | default}
Syntax Description
Defaults
The default is BPDU packet filtering is default.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Spanning tree PortFast BPDU packet filtering turns off BPDU transmission on PortFast-enabled ports and nontrunking ports.
If you enter the default keyword, the spanning tree port is set to the global BPDU filtering state.
To enable or disable spanning tree PortFast BPDU filtering for all ports on the switch, enter the set spantree global-default bpdu-filter command.
Examples
This example shows how to enable spanning tree PortFast BPDU filtering on module 3, port 4:
Console> (enable) set spantree portfast bpdu-filter 3/4 enableWarning: Ports enabled with bpdu filter will not send BPDUs and drop allreceived BPDUs. You may cause loops in the bridged network if you misusethis feature.Spantree port 3/4 bpdu filter enabled.Console> (enable)Related Commands
set spantree global-default
show spantree portfastset spantree portfast bpdu-guard
To enable or disable spanning tree PortFast BPDU guard on a port, use the set spantree portfast bpdu-guard command.
set spantree portfast bpdu-guard mod/port {enable | disable | default}
Syntax Description
Defaults
The default is PortFast BPDU guard is default.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You must enable spanning tree PortFast mode before you can enable spanning tree PortFast BPDU guard for BPDU guard to work correctly.
When you enable spanning tree PortFast BPDU guard, a nontrunking PortFast-enabled port is moved into an errdisable state when a BPDU is received on that port. When you disable spanning tree PortFast BPDU guard, a PortFast-enabled nontrunking port will stay up when it receives BPDUs, which may cause spanning tree loops.
If you enter the default keyword, the spanning tree port is set to the global BPDU guard state.
To enable or disable BPDU guard for all ports on the switch, enter the set spantree global-default bpdu-guard command.
Examples
This example shows how to enable spanning tree BPDU guard on module 3, port 1:
Console> (enable) set spantree portfast bpdu-guard 3/1 enableSpantree port 3/1 bpdu guard enabled.Console> (enable)Related Commands
set spantree global-default
show spantree portfastset spantree portinstancecost
To assign the path cost of the port for the specified instances, use the set spantree portinstancecost command.
set spantree portinstancecost mod/port [cost cost] [instances]
set spantree portinstancecost mod/port [cost cost] mst [instances]
Syntax Description
Defaults
The default path cost is based on port speed; see Table 2-25 for default settings.
Table 2-25 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The port instance cost applies to trunk ports only.
The value specified is used as the path cost of the port for the specified instances. The rest of the instances have a path cost equal to the port path cost set through the set spantree instancecost command. (If not set, the value is the default path cost of the port.)
Examples
These examples show how to use the set spantree portinstancecost command and explicitly specify the path cost of a port:
Console> (enable) set spantree portinstancecost 2/10 cost 6 1-10Port 2/10 instances 11-16 have path cost 2000000.Port 2/10 instances 1-10 have path cost 6.This parameter applies to trunking ports only.Console> (enable)These examples show how to use the set spantree portinstancecost command without explicitly specifying the path cost of a port:
Console> (enable) set spantree portinstancecost 1/2Port 1/2 Instances 1-1005 have path cost 3100.Console> (enable)Console> (enable) set spantree portinstancecost 1/2 16Port 1/2 Instances 16,22-1005 have path cost 3100.Console> (enable)This example shows the display if you enter the command when PVST+ is enabled:
Console> (enable) set spantree portinstancecost 3/1This command is only valid when STP is in MISTP or MISTP-PVST+ mode.Console> (enable)This example shows how to set the port cost for a specific MST instance:
Console> (enable) set spantree portinstancecost 2/10 cost 6 1-10 mstPort 2/10 mst instances 1-10 have path cost 6.This parameter applies to trunking ports only.Console> (enable)Related Commands
clear spantree portinstancecost
show spantree mistp-instanceset spantree portinstancepri
To set the port priority for instances in the trunk port, use the set spantree portinstancepri command.
set spantree portinstancepri mod/port priority [instances]
set spantree portinstancepri mod/port priority mst [instances]
Syntax Description
Defaults
The default is the port priority is set to 0, with no instances specified.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Priority values that are not a multiple of 16 (between the values of 0 to 63) are converted to the nearest multiple of 16. Use this command to add instances to a specified port priority level. Subsequent calls to this command do not replace instances that are already set at a specified port priority level.
This feature is not supported for the MSM.
The set spantree portinstancepri command applies to trunk ports only. If you enter this command, you see this message:
Port xx is not a trunk-capable portExamples
This example shows how to set the port priority for module 1, port 2, on specific instances:
Console> (enable) set spantree portinstancepri 1/2 16 1-11Port 1/2 instances 1-11 using portpri 16.This parameter applies to trunking ports only.Console> (enable)This example shows how to set the port priority for module 8, port 1, on MST instance 2:
Console> (enable) set spantree portinstancepri 8/1 31 mst 2Port 8/1 instances 2 using portpri 31.Port 8/1 instances 0-1, 3-15 using portpri 32.Console> (enable)Related Commands
clear spantree portinstancecost
show spantree mistp-instanceset spantree portpri
To set the bridge priority for a spanning tree port, use the set spantree portpri command.
set spantree portpri mod/port priority [mst]
Syntax Description
Defaults
The default is all ports with bridge priority are set to 32.
Command Types
Switch command.
Command Modes
Privileged.
ExamplesA priority value that is not a multiple of 16 (between the values of 0 to 63) is converted to the nearest multiple of 16.
This example shows how to set the priority of port 1 on module 4 to 63:
Console> (enable) set spantree portpri 2/3 48Bridge port 2/3 port priority set to 48.Console> (enable)This example shows the output when you have specified a priority value that is not a multiple of 16:
Console> (enable) set spantree portpri 2/3 2Vlan port priority must be one of these numbers:0, 16, 32, 48, 64, 80,96, 112, 128, 144,160, 176, 192, 208, 224, 240converting 2 to 0 nearest multiple of 16Bridge port 2/3 port priority set to 0.Console> (enable)Related Commands
set spantree portvlancost
To assign a lower path cost to a set of VLANs on a port, use the set spantree portvlancost command.
set spantree portvlancost mod/port [cost cost] [vlan_list]
Syntax Description
Defaults
The default path cost is based on port speed; see Table 2-26 and Table 2-27 for default settings.
Table 2-26 Default Port Cost—Short Mode
4 Mb
250
10 Mb
100
16 Mb
62
100 Mb
19
155 Mb
14
1 Gb
4
10 Gb
2
Table 2-27 Default Port Cost—Long Mode
100 Kb
200,000,000
1 Mb
20,000,000
10 Mb
2,000,000
10 Mb
200,000
1 Gb
20,000
10 Gb
2,000
100 Gb
200
1 Tb
20
10 Tb
2
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Follow these guidelines when you set the path cost for VLANs on a port:
•
•
•
•
This command is not supported in MISTP mode.
Examples
These examples show how to use the set spantree portvlancost command and explicitly specify the path cost of a port:
Console> (enable) set spantree portvlancost 2/10 cost 25 1-20Cannot set portvlancost to a higher value than the port cost, 10, for port 2/10.Console> (enable)Console> (enable) set spantree portvlancost 2/10 cost 1-20Port 2/10 VLANs 1-20 have a path cost of 9.Console> (enable)Console> (enable) set spantree portvlancost 2/10 cost 4 1-20Port 2/10 VLANs 1-20 have path cost 4.Port 2/10 VLANs 21-1000 have path cost 10.Console> (enable)Console> (enable) set spantree portvlancost 2/10 cost 6 21Port 2/10 VLANs 1-21 have path cost 6.Port 2/10 VLANs 22-1000 have path cost 10.Console> (enable)These examples show how to use the set spantree portvlancost command without explicitly specifying the path cost of a port:
Console> (enable) set spantree portvlancost 1/2Port 1/2 VLANs 1-1005 have path cost 3100.Console> (enable)Console> (enable) set spantree portvlancost 1/2 21Port 1/2 VLANs 1-20,22-1005 have path cost 3100.Port 1/2 VLANs 21 have path cost 3099.Console> (enable)Related Commands
clear spantree portvlancost
set channel vlancost
show spantreeset spantree portvlanpri
To set the port priority for a subset of VLANs in the trunk port, use the set spantree portvlanpri command.
set spantree portvlanpri mod/port priority [vlans]
Syntax Description
Defaults
The default is the port VLAN priority is set to 0, with no VLANs specified.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The priority value that is not a multiple of 16 (between the values of 0 to 63) is converted to the nearest multiple of 16.This command is not supported by extended-range VLANs.
Use this command to add VLANs to a specified port priority level. Subsequent calls to this command do not replace VLANs that are already set at a specified port priority level.
This feature is not supported for the MSM.
The set spantree portvlanpri command applies only to trunk ports. If you enter this command, you see this message:
Port xx is not a trunk-capable portExamples
This example shows how to set the port priority for module 1, port 2, on VLANs 21 to 40:
Console> (enable) set spantree portvlanpri 1/2 16 21-40Port 1/2 vlans 3,6-20,41-1000 using portpri 32Port 1/2 vlans 1-2,4-5,21-40 using portpri 16Console> (enable)Related Commands
