-
Catalyst 6500 Series Command Reference, 8.7
-
Quick Links to Catalyst 6500 Series Switch and ROM Monitor Commands
-
Preface
-
Command-Line Interfaces
-
alias to boot
-
cd to clear mls exclude protocol
-
clear mls multicast statistics to clear vtp pruneeligible
-
clear vtp statistics to disable
-
disconnect to enable
-
format to ping ethernet
-
pwd to reset-switch
-
set default portstatus to set logging timestamp
-
restore counters to set crypto key rsa
-
set default portstatus to set logging timestamp
-
set logout to set port auto-mdix
-
set port auxiliaryvlan to set rcp username
-
set rgmp to set spantree portvlanpri
-
set spantree priority to set trunk
-
set udld to set web-auth session-timeout
-
show accounting to show dot1q-all-tagged
-
show dot1x to show ip alias
-
show ip dns to show ip permit
-
show ip route to show poll
-
show port to show snmp
-
show snmp access to show tech-support
-
show test to show users
-
show version to squeeze
-
Acronyms
-
Acknowledgments for Open-Source Software
-
Table Of Contents
set port ethernet-oam link-monitor
set port ethernet-oam remote-loopback
set qos bridged-microflow-policing
set qos dscp-mutation-table-map
set qos statistics export aggregate
set qos statistics export destination
set qos statistics export interval
set qos statistics export port
2set port auxiliaryvlan
To configure the auxiliary VLAN ports, use the set port auxiliaryvlan command.
set port auxiliaryvlan mod[/port] {vlan | untagged | dot1p | none} [cdpverify {enable | disable}]
Syntax Description
Defaults
The default setting is none.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you do not specify a port, all ports are selected.The vlan option specifies that the connected device sends packets that are tagged with a specific VLAN.
If you enter the none option, voice information will not be sent or received.
Dynamic VLAN support for voice VLAN identifier (VVID) includes these restrictions to the following multiple VLAN access port (MVAP) configuration on the switch port:
•
You can configure any VVID on a dynamic port including dot1p and untagged, except when the VVID is equal to dot1p or untagged. If this is the case, you must configure VMPS with the MAC address of the IP phone. When you configure the VVID as dot1p or untagged on a dynamic port, this warning message is displayed:
VMPS should be configured with the IP phone mac's.•
•
The presence of an IP phone is determined through CDP packet exchange between the switch and the phone. This detection method is used for both inline-powered IP phones and wall-powered IP phones.
If the auxiliary VLAN ID equals the port-VLAN ID or when the auxiliary VLAN ID is configured as none, dot1p, or untagged, this feature cannot be applied to the port. If any command entry results in the auxiliary VLAN ID equaling the port-VLAN ID, the feature is disabled and the following warning message is displayed:
cdpverify feature on port mod/port is disabled.Examples
This example shows how to set the auxiliary VLAN port to untagged:
Console> (enable) set port auxiliaryvlan 5/7 untaggedPort 5/7 allows the connected device send and receive untagged packets andwithout 802.1p priority.Console> (enable)This example shows how to set the auxiliary VLAN port to dot1p:
Console> (enable) set port auxiliaryvlan 5/9 dot1pPort 5/9 allows the connected device send and receive packets with 802.1p priority.Console> (enable)This example shows how to set the auxiliary VLAN port to none:
Console> (enable) set port auxiliaryvlan 5/12 nonePort 5/12 will not allow sending CDP packets with AuxiliaryVLAN information.Console> (enable)This example shows how to set the auxiliary VLAN port to a specific module, port, and VLAN:
Console> (enable) set port auxiliaryvlan 2/1-3 222Auxiliaryvlan 222 configuration successful.AuxiliaryVlan AuxVlanStatus Mod/Ports------------- ------------- -------------------------222 active 1/2,2/1-3Console> (enable)Related Commands
set port broadcast
To set broadcast, multicast, or unicast suppression for one or more ports, use the set port broadcast command. The threshold limits the backplane traffic received from the module.
set port broadcast mod/port threshold% [violation {drop-packets | errdisable}]
[multicast {enable | disable}] [unicast {enable | disable}]Syntax Description
Defaults
The default is 100% (no broadcast limit).
The default action is drop-packets if a broadcast violation occurs.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
This command is not supported by the NAM.
You can enter the threshold value in two ways:
•
•
The percent sign (%) is required when entering the threshold value.
The multicast and unicast keywords are supported on Gigabit Ethernet modules only.
If you enter the command without using the multicast or unicast keyword, only broadcast traffic is suppressed. If you enter the multicast or unicast keyword, both broadcast and the selected traffic type are suppressed.
Examples
This example shows how to limit broadcast traffic to 20 percent:
Console> (enable) set port broadcast 4/3 20%Port 4/3 broadcast traffic limited to 20.00%.Console> (enable)This example shows how to limit broadcast traffic to 90 percent and to errdisable when suppression occurs:
Console> (enable) set port broadcast 4/6 90% violation errdisablePort 4/6 broadcast traffic limited to 90.00%.On broadcast suppression port 4/6 is configured to move to errdisabled state.Console> (enable)This example shows how to allow a specific amount of multicast traffic to a range of ports:
Console> (enable) set port broadcast 4/1-24 80% multicast enablePort 4/1-24 multicast traffic limited to 80%.Console> (enable)This example shows how to limit broadcast and multicast traffic to 91 percent, to disable unicast traffic, and to errdisable when suppression occurs:
Console> (enable) set port broadcast 4/2 91% violation errdisable multicast enable unicast disablePort 4/2 broadcast and multicast traffic limited to 91.00%.On broadcast suppression port 4/2 is configured to move to errdisabled state.Console> (enable)This example shows how to limit broadcast, multicast, and unicast traffic to 91 percent:
Console> (enable) set port broadcast 4/2 91% multicast enable unicast enablePort 4/2 broadcast, multicast and unicast traffic limited to 91.00%.Console> (enable)Related Commands
clear port broadcast
show port broadcastset port channel
To configure EtherChannel on Ethernet module ports, use the set port channel command.
set port channel mod/port [admin_group]
set port channel mod/port mode {on | off | desirable | auto} [silent | non-silent]
set port channel all mode off
set port channel all distribution {ip | mac} [source | destination | both]
set port channel all distribution {session} [source | destination | both]
set port channel all distribution {ip-vlan-session} [source | destination | both]
Syntax Description
Defaults
The default is EtherChannel is set to auto and silent on all module ports. The defaults for frame distribution are ip and both.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
This command is not supported by the NAM.
This command is not supported by non-EtherChannel-capable modules.
The set port channel all distribution session command is supported on systems configured with the Supervisor Engine 2 with Layer 3 Switching Engine II (PFC2) and the Supervisor Engine 720.
Make sure that all ports in the channel are configured with the same port speed, duplex mode, and so forth. For more information on EtherChannel, refer to the Catalyst 6500 Series Software Configuration Guide.
With the on mode, a usable EtherChannel exists only when a port group in on mode is connected to another port group in on mode.
If you are running QoS, make sure that bundled ports are all of the same trust types and have similar queueing and drop capabilities.
Disable the port security feature on the channeled ports (see the set port security command). If you enable port security for a channeled port, the port shuts down when it receives packets with source addresses that do not match the secure address of the port.
You can configure up to eight ports on the same switch in each administrative group.
When you assign ports to an existing administrative group, the original ports associated with the administrative group will move to a new automatically picked administrative group. You cannot add ports to the same administrative group.
If you do not enter an admin_group value, a new administrative group is created with the admin_group value selected automatically. The next available administrative group is automatically selected.
If you do not enter the channel mode, the channel mode of the ports addressed are not modified.
The silent | non-silent parameters only apply if desirable or auto modes are entered.
If you do not specify silent or non-silent, the current setting is not affected.
The ip-vlan-session keyword is supported only on the Supervisor Engine 720.
Note
With software releases 6.2(2) and later, due to the port ID handling by the spanning tree feature, the maximum supported number of EtherChannels is 126 for a 6- or 9-slot chassis and 63 for a 13-slot chassis. Note that the 13-slot chassis was first supported in software release 6.2(2).Examples
This example shows how to set the channel mode to desirable:
Console> (enable) set port channel 2/2-8 mode desirablePorts 2/2-8 channel mode set to desirable.Console> (enable)This example shows how to set the channel mode to auto:
Console> (enable) set port channel 2/7-8,3/1 mode autoPorts 2/7-8,3/1 channel mode set to auto.Console> (enable)This example shows how to group ports 4/1 through 4 in an administrative group:
Console> (enable) set port channel 4/1-4 96Port(s) 4/1-4 are assigned to admin group 96.Console> (enable)This example shows the display when the port list is exceeded:
Console> (enable) set port channel 2/1-9 1No more than 8 ports can be assigned to an admin group.Console> (enable)This example shows how to disable EtherChannel on module 4, ports 4 through 6:
Console> (enable) set port channel 4/4-6 mode offPort(s) 4/4-6 channel mode set to off.Console> (enable)This example shows the display output when you assign ports to an existing administrative group. This example moves ports in admin group 96 to another admin group and assigns ports 4/4 through 6 to admin group 96:
Console> (enable) set port channel 4/4-6 96Port(s) 4/1-3 are moved to admin group 97.Port(s) 4/4-6 are assigned to admin group 96.Console> (enable)This example shows how to set the channel mode to off for ports 4/4 through 6 and assign ports 4/4 through 6 to an automatically selected administrative group:
Console> (enable) set port channel 4/4-6 offPort(s) 4/4-6 channel mode set to off.Port(s) 4/4-6 are assigned to admin group 23.Console> (enable)This example shows how to configure the EtherChannel load-balancing feature:
Console> (enable) set port channel all distribution ip destinationChannel distribution is set to ip destination.Console> (enable)Related Commands
show channel
show channel group
show port channelset port cops
To create port roles, use the set port cops command.
set port cops mod/port roles role1 [role2]...
Syntax Description
Defaults
The default is all ports have a default role of null string, for example, the string of length 0.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
This command is not supported by the NAM.
A port may have multiple roles. You can configure a maximum of 64 total roles per switch. You can specify multiple roles in a single command.
Examples
This example shows how to create roles on a port:
Console> (enable) set port cops 3/1 roles backbone_port main_portNew role `backbone_port' created.New role `main_port' created.Roles added for port 3/1-4.Console> (enable)This example shows the display if you attempt to create a roll and exceed the maximum allowable number of roles:
Console> (enable) set port cops 3/1 roles access_portUnable to add new role. Maximum number of roles is 64.Console> (enable)Related Commands
set port critical
To enable or disable the Inaccessible Authentication Bypass (IAB) feature on a port that is configured to use 802.1X, LPIP, MAC authentication bypass, or Web Authentication, use the set port critical command.
set port critical mod/port {enable | disable}
Syntax Description
mod/port
Number of the module and the port on the module.
enable
Enables IAB on the specified port.
disable
Disables IAB on the specified port.
Defaults
IAB is disabled.
Command Types
Switch.
Command Modes
Privileged.
Usage Guidelines
Use the set port critical command in place of the set port dot1x mod/port critical command.
Examples
This example show how to enable IAB on port 1, module 5:
Console> (enable) set port critical 5/1 enablePort, 5/1 Critical feature enabled.Console> (enable)Related Commands
show port critical
show port mac-auth-bypass
show port web-authset port debounce
To enable or disable the debounce timer or configure the timer setting on a per-port basis, use the set port debounce command.
set port debounce mod/port {enable | disable}
set port debounce mod/port delay time
Syntax Description
Defaults
By default, the debounce timer is disabled on all ports.
When the debounce timer is disabled, the default debounce timer values are as follows:
•
•
•
•
•
•
•
When the debounce timer is enabled, the default debounce timer values are as follows:
•
•
•
•
•
•
•
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The debounce timer is the time the firmware waits before notifying the supervisor engine of a link change at the physical layer.
Setting the debounce timer value to 200 milliseconds or from 300 to 5000 milliseconds is possible only for gigabit fiber ports. You do not need to enable the debounce timer on a gigabit fiber port before adjusting the timer. Any timer value that is greater than the default value in disabled state is considered a value that enables the timer.
For 10/100 ports and 100BASE-FX ports in the disabled state, the firmware may take up to 600 milliseconds to notify the supervisor engine of a link change because the firmware polling time is every 300 milliseconds.
For 10/100 ports and 100BASE-FX ports in the enabled state, the firmware may take up to 3400 milliseconds to notify the supervisor engine of a link change because the firmware polling time is every 300 milliseconds.
Examples
This example shows how to enable the debounce timer for a specific port on a specific module:
Console> (enable) set port debounce 1/1 enableDebounce is enabled on port 1/1.Warning:Enabling port debounce causes Link Up/Down detections to be delayed.It results in loss of data traffic during debouncing period, which mightaffect the convergence/reconvergence of various Layer 2 and Layer 3protocols.Use with caution.Console> (enable)Related Commands
set port description
To include a description that identifies a port, use the set port description command.
set port description mod/port [port_description]
Syntax Description
mod/port
Number of the module and the port on the module.
port_description
(Optional) Description that identifies the specified port. See the "Usage Guidelines" section for more information.
Defaults
This command has no default settings.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
The set port description command adds another 43 characters to the existing limit of 21 characters that can be set when you enter the set port name command.
The set port description command is only supported in text configuration mode.
If you do not enter a port_description argument, the port description is cleared.
Examples
This example shows how to include a port description:
Console> (enable) set port description 7/1 sarahtom 172.30.8.35 00-0a-5e-44-8b-8 2/2Port 7/1 description set.Console> (enable)This example shows how to clear a port description:
Console> (enable) set port description 7/1Port 7/1 description cleared.Console> (enable)Related Commands
set port name
show config mode
show port descriptionset port dhcp-snooping
To configure DHCP snooping on a port, use the set port dhcp-snooping command.
set port dhcp-snooping mod/port {trust | source-guard} {enable | disable}
set port dhcp-snooping mod/port binding-limit count
set port dhcp-snooping mod/port add-binding ip-addr mac-addr [vlan]
Syntax Description
Defaults
Trust and Source Guard are disabled.
The binding limit on a port is 32.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you enter the set port dhcp-snooping mod/ports trust disable command, the DHCP snooping feature performs checks on packets coming from the ports that you specify. If you enter the enable keyword, the feature trusts the packets from those ports and does not perform checks.
If you enter the set port dhcp-snooping mod/ports source-guard enable command, the IP addresses learned through DHCP snooping are the only source IP addresses allowed on incoming traffic. All packets that contain other IP addresses are dropped. If a new binding is added, the IP address associated with that binding is added to the port. If a binding is deleted, the IP address associated with that binding is removed from the port.
If DHCP snooping is disabled on a VLAN, the bindings for that VLAN are deleted.
If you enable IP Source Guard on a port, that port should be untrusted. Also, the security ACL mode should be port-based or merge-mode, and no PACLs should be on the port.
Note the following when configuring DHCP-related features:
•
•
•
•
•
•
•
Examples
This example shows how to enable DHCP trust on port 2 of module 2:
Console> (enable) set port dhcp-snooping 2/2 trust enablePort(s) 2/2 state set to trusted for DHCP Snooping.Console> (enable)This example shows how to enable IP Source Guard on port 2 of module 2:
Console> (enable) set port dhcp-snooping 2/2 source-guard enableEnabling IP Source Guard on port(s) 2/2.Console> (enable)This example shows how to limit the number of bindings to 48 on port 4 and port 5 of module 3:
Console> (enable) set port dhcp-snooping 3/4-5 binding-limit 48Ports 3/4-5 DHCP snooping binding limit is set to 48Console> (enable)This example show how to add a binding to a specified port:
Console> (enable) set port dhcp-snooping 5/1 add-binding 172.20.52.18 00-50-f0-ac-30-54 1DHCP Snooping Binding addition successful for Port 5/1, Vlan 1IP addr 172.20.52.18, Mac Addr 00-50-f0-ac-30-54.Console> (enable)Related Commands
clear dhcp-snooping bindings
show port dhcp-snoopingset port disable
To disable a port or a range of ports, use the set port disable command.
set port disable mod/port
Syntax Description
Defaults
The default system configuration has all ports enabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
This command is not supported by the NAM.
It takes approximately 30 seconds for this command to take effect.
Examples
This example shows how to disable a port using the set port disable command:
Console> (enable) set port disable 5/10Port 5/10 disabled.Console> (enable)Related Commands
set port dot1q-all-tagged
To enable the 802.1Q tagging feature on specific ports, use the set port dot1q-all-tagged command.
set port dot1q-all-tagged {mod/port} {enable | disable}
Syntax Description
mod/port
Number of the module and the port on the module.
enable
Enables the dot1q-all-tagged feature.
disable
Disables the dot1q-all-tagged feature.
Defaults
The 802.1Q tagging feature is enabled on a per-port basis. See the "Usage Guidelines" section for more information.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
Although 802.1Q tagging is enabled by default on a per-port basis, tagging only takes effect when you enable the feature globally by entering the set dot1q-all-tagged enable command. When the global command is enabled, if you do not want tagging on a specific port, you must disable the feature on that port.
Examples
This example shows how to enable the dot1q tagging feature on specific ports:
Console> (enable) set port dot1q-all-tagged 1/1-2 enablePackets on native vlan will be tagged on port(s) 1/1-2.Console> (enable)This example shows how to enable the dot1q tagging feature on all ports:
Console> (enable) set port dot1q-all-tagged all enablePackets on native vlan will be tagged on all applicable ports.Console> (enable)This example shows how to disable the dot1q tagging feature on specific ports:
Console> (enable) set port dot1q-all-tagged 1/1-2 disablePackets on native vlan will not be tagged for port(s) 1/1-2.Console> (enable)This example shows how to disable the dot1q tagging feature on all ports:
Console> (enable) set port dot1q-all-tagged all disablePackets on native vlan will not be tagged on all applicable ports.Console> (enable)Related Commands
set dot1q-all-tagged
show dot1q-all-tagged
show port dot1q-all-taggedset port dot1q-ethertype
To set the EtherType field in the IEEE 802.1Q tag to a custom value, use the set port dot1q-ethertype command.
set port dot1q-ethertype mod/port {value | default}
Syntax Description
mod/port
Number of the module and the port on the module.
value
Hexadecimal number of the two-byte EtherType field.
default
Specifies the default value of 0x8100 for the two-byte EtherType field.
Defaults
The EtherType field is set to default.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
If you specify a custom EtherType field, your network can support Cisco and non-Cisco switches that do not use the standard 0x8100 EtherType to identify 802.1Q-tagged frames. When you specify a custom EtherType field, you can identify 802.1Q tagged frames and switch the frames to a specified VLAN. The two bytes immediately following the EtherType are interpreted as a standard 802.1Q tag. Specify the value of the two-byte EtherType field as a hexadecimal number.
To return the custom EtherType field to the default value (0x8100), use the set port dot1q-ethertype mod/port default command.
Note
Note
Note
Note
Examples
This example shows how to set the 802.1Q EtherType to 0x1234 on module 2, port 1:
Console> (enable) set port dot1q-ethertype 2/1 1234All the group ports 2/1-2 associated with port 2/1 will be modified.Do you want to continue (y/n) [n]?yDot1q Ethertype value set to 0x1234 on ports 2/1-2.Console> (enable)This example shows how to return the 802.1Q EtherType field to the standard EtherType field (0x8100) on module 2, port 1:
Console> (enable) set port dot1q-ethertype 2/1 defaultAll the group ports 2/1-2 associated with port 2/1 will be modified.Do you want to continue (y/n) [n]?yDot1q Ethertype value set to 0x8100 on ports 2/1-2.Console> (enable)
Related Commands
set port dot1qtunnel
To configure the dot1q tunnel mode for the port, use the set port dot1qtunnel command.
set port dot1qtunnel mod/port {access | disable}
Syntax Description
mod/port
Number of the module and the port on the module.
access
Turns off the port trunking mode.
disable
Disables dot1q tunneling.
Defaults
Dot1q tunnel mode is disabled.
Command Types
Switch command.
Command Modes
Privileged.
Usage Guidelines
You cannot enable the dot1q tunneling feature on a port until dot1q-tagged-only mode is enabled.
You cannot disable dot1q-tagged-only mode on the switch until dot1q tunneling is disabled on all the ports on the switch.
You cannot set the dot1q tunnel mode to access if port security is enabled.
You cannot set the dot1q tunnel mode to access on a port with an auxiliary VLAN configured.
An interconnected network can have redundant paths to the same edge switch of ISP, but it cannot have redundant paths to two different edge switches of ISP.
Note
If you enable dot1q-tagged globally, the dot1q-tagged per-port setting controls whether or not the frames are tagged. If you disable dot-1q-tagged globally, the default group is never tagged and the per-port setting has no effect.
Examples
This example shows how to set dot1q tunneling on the port to access:
Console> (enable) set port dot1qtunnel 4/1 accessDot1q tunnel feature set to access mode on port 4/1.Port 4/2 trunk mode set to off.Console> (enable)This example shows the output if you try to turn on trunking on a port that has dot1q tunneling mode set:
Console> (enable) set trunk 4/1 onFailed to set port 4/1 to trunk mode on.The dot1q tunnel mode for the port is currently set to access.Console> (enable)Related Commands
set port dot1x
To configure 802.1X on a port, use the set port dot1x command.
set port dot1x mod/port multiple-host {enable | disable}
set port dot1x mod/port port-control port_control_value
set port dot1x mod/port initialize
set port dot1x mod/port re-authenticate
set port dot1x mod/port re-authentication {enable | disable}
set port dot1x mod/port multiple-authentication {enable | disable}
set port dot1x mod/port guest-vlan {vlan | none}
set port dot1x mod/port shutdown-timeout {enable | disable}
set port dot1x mod/port port-control-direction {both | in}
set port dot1x mod/port auth-fail-vlan {vlan | none}
set port dot1x mod/port critical {enable | disable}
set port dot1x mod/port re-authperiod server {enable | disable}
set port dot1x mod/port ip-device-tracking {enable | disable}
Syntax Description
Defaults
The default settings are as follows:
•
•
•
•
•
•
•
