CGS 2520 Switch Command Reference, 12.2(53)EX

Cisco CGS 2520 Cisco IOS Commands

aaa accounting dot1x

Use the aaa accounting dot1x global configuration command to enable authentication, authorization, and accounting (AAA) accounting and to create method lists defining specific accounting methods on a per-line or per-interface basis for IEEE 802.1x sessions. Use the no form of this command to disable IEEE 802.1x accounting.

aaa accounting dot1x {name | default} start-stop {broadcast group {name | radius | tacacs+} [group {name | radius | tacacs+}... ] | group {name | radius | tacacs+} [group {name | radius | tacacs+} ... ]}

no aaa accounting dot1x {name | default}

Syntax Description

Defaults

AAA accounting is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

This command requires access to a RADIUS server.

Note We recommend that you enter the authentication periodic interface configuration command before configuring IEEE 802.1x RADIUS accounting on an interface.

Examples

This example shows how to configure IEEE 802.1x accounting:

Switch(config)# aaa accounting dot1x

Switch(config)# aaa accounting dot1x default start-stop group radius

Switch(config)#

Note The RADIUS authentication server must be properly configured to accept and log update or watchdog packets from the AAA client.

Related Commands

aaa authentication dot1x

Use the aaa authentication dot1x global configuration command to specify the authentication, authorization, and accounting (AAA) method to use on ports complying with IEEE 802.1x. Use the no form of this command to disable authentication.

aaa authentication dot1x {default} method1

no aaa authentication dot1x {default}

Syntax Description

Note Though other keywords are visible in the command-line help strings, only the default and group radius keywords are supported.

Defaults

No authentication is performed.

Command Modes

Global configuration

Command History

Usage Guidelines

The method argument identifies the method that the authentication algorithm tries in the given sequence to validate the password provided by the client. The only method that is truly IEEE 802.1x-compliant is the group radius method, in which the client data is validated against a RADIUS authentication server.

If you specify group radius, you must configure the RADIUS server by entering the radius-server host global configuration command.

Use the show running-config privileged EXEC command to display the configured lists of authentication methods.

Examples

This example shows how to enable AAA and how to create an IEEE 802.1x-compliant authentication list. This authentication first tries to contact a RADIUS server. If this action returns an error, the user is not allowed access to the network.

Switch(config)# aaa new-model

Switch(config)# aaa authentication dot1x default group radius

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

action

Use the action access-map configuration command to set the action for the VLAN access map entry. Use the no form of this command to set the action to the default value, which is to forward.

action {drop | forward}

no action

Syntax Description

Defaults

The default action is to forward packets.

Command Modes

Access-map configuration

Command History

Usage Guidelines

You enter access-map configuration mode by using the vlan access-map global configuration command.

If the action is drop, you should define the access map, including configuring any access control list (ACL) names in match clauses, before applying the map to a VLAN, or all packets could be dropped.

In access-map configuration mode, use the match access-map configuration command to define the match conditions for a VLAN map. Use the action command to set the action that occurs when a packet matches the conditions.

The drop and forward parameters are not used in the no form of the command.

Examples

This example shows how to identify and apply a VLAN access map vmap4 to VLANs 5 and 6 that causes the VLAN to forward an IP packet if the packet matches the conditions defined in access list al2:

Switch(config)# vlan access-map vmap4

Switch(config-access-map)# match ip address al2

Switch(config-access-map)# action forward

Switch(config-access-map)# exit

Switch(config)# vlan filter vmap4 vlan-list 5-6

You can verify your settings by entering the show vlan access-map privileged EXEC command.

Related Commands

alarm contact

Use the alarm contact global configuration command to configure triggers and severity levels for external alarms. Use the no form of this command to remove the configuration.

alarm contact {contact-number {description string | severity {critical | major | minor} | trigger {closed | open}} | all {severity {critical | major | minor} | trigger {closed | open}}

no alarm contact {contact-number {description | severity | trigger} | all {severity | trigger}

Defaults

No alarms are configured.

Command Modes

Global configuration

Command History

Usage Guidelines

The no alarm contact contact-number description sets the description to an empty string.

The no alarm contact {contact-number | all} severity sets the alarm-contact severity to minor.

The no alarm contact {contact-number | all} trigger sets the external alarm-contact trigger to closed.

Examples

This example shows how to configure alarm contact number 1 to report a critical alarm when the contact is open.

Switch(config)# alarm contact 1 description main_lab_door

Switch(config)# alarm contact 1 severity critical 

Switch(config)# alarm contact 1 trigger open

Dec  4 10:34:09.049: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_ASSERT: Alarm asserted: 
main_lab_door

You can verify your settings by entering the show env alarm-contact or the show running-config privileged EXEC command.

Switch# show env alarm-contact

ALARM CONTACT 1

   Status:      asserted

   Description: main_lab_door

   Severity:    critical

   Trigger:     open

This example shows how to configure clear alarm contact number 1 and the show command outputs.

Switch(config)# no alarm contact 1 description

Dec  4 10:39:33.621: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: 
main_lab_door Dec  4 10:39:33.621: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_ASSERT: Alarm 
asserted: external alarm contact 1

Switch(config)# no alarm contact 1 severity

Dec  4 10:39:46.774: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: external 
alarm contact 1 Dec  4 10:39:46.774: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_ASSERT: Alarm 
asserted: external alarm contact 1

Switch(config)# no alarm contact 1 trigger open

Dec  4 10:39:56.547: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: external 
alarm contact 1

Switch(config)# end

Switch# show env alarm-contact

ALARM CONTACT 1

   Status:      not asserted

   Description: external alarm contact 1

   Severity:    minor

   Trigger:     closed

Switch# show hard led

SWITCH: 1

SYSTEM: GREEN

MGMT: GREEN

ALARM 1: BLACK

ALARM 2: BLACK

ALARM 3: BLACK

ALARM 4: BLACK

Related Commands

alarm facility fcs-hysteresis

Use the alarm facility fcs-hysteresis global configuration command to set the frame check sequence (FCS) error hysteresis threshold as a percentage of fluctuation from the FCS bit-error rate. Use the no form of this command to set the FCS error hysteresis threshold to its default value.

alarm facility fcs-hysteresis percentage

no alarm facility fcs-hysteresis percentage

Syntax Description

Defaults

The default threshold-value is 10 percent.

Command Modes

Global configuration

Command History

Usage Guidelines

Set a hysteresis threshold to cause an alarm to trigger when the FCS bit-error rate fluctuates near the configured rate.

You set the FCS hysteresis threshold for all ports on the switch. You set the FCS error rate on a per-port basis by using the

interface configuration command.

If the threshold is not the default, it appears in the output of the show running-config privileged EXEC command.

Examples

This example shows how to set the FCS error hysteresis to 5 percent. The alarm is not triggered unless the bit error rate is more than 5 percent from the configured FCS bit-error rate.

Switch(config)# alarm facility fcs-hysteresis 5

Related Commands

alarm facility power-supply

Use the alarm facility power-supply global configuration command to set the alarm options for a missing or failing power supply when the system is operating in dual power-supply mode. Use the no form of the command to disable the specified setting.

alarm facility power-supply {disable | notifies | relay major | syslog}

no alarm facility power-supply {disable | notifies | relay major | syslog}

Syntax Description

Defaults

A power supply alarm message is stored but not sent to an SNMP server, to a relay, or to a syslog server.

Command Modes

Global configuration

Command History

Usage Guidelines

Power supply alarms are generated only when the system is in dual power-supply mode. When a second power supply is connected, you must use the power-supply dual global configuration command to set dual power-mode operation.

Before you use the notifies keyword to send alarm traps to an SNMP host, you need to set up an SNMP server by using the snmp-server enable traps global configuration command.

Examples

This example shows how to set the power-supply monitoring alarm to go to the minor relay circuitry:

Switch(config)# alarm facility power-supply relay minor 

Related Commands

alarm facility temperature

Use the alarm facility temperature global configuration command to configure a primary temperature monitoring alarm or to configure a secondary temperature alarm threshold with a lower maximum temperature threshold. Use the no form of this command to delete the temperature monitoring alarm configuration or to disable the secondary temperature alarm.

alarm facility temperature {primary {high | low | notifies | relay major | syslog} | secondary {high | low | notifies | relay major | syslog}}

no alarm facility temperature {primary {high | low | notifies | relay major | syslog} | secondary {high | low | notifies | relay major | syslog}}

Syntax Description

Defaults

The primary temperature alarm is enabled for a -4 to 203ºF (-20 to 95oC) range and cannot be disabled. It is associated with a major relay. The secondary temperature alarm is disabled by default.

Command Modes

Global configuration

Command History

Usage Guidelines

The primary temperature alarm is automatically enabled. It cannot be disabled, but you can configure alarm options.

You can modify the primary temperature alarm range by using the high and low keywords.

You can use the secondary temperature alarm to trigger a high temperature alarm when the temperature reaches a threshold that is lower than the maximum primary temperature threshold. You can configure the temperature threshold and alarm options.

Before you use the notifies keyword to sent alarm traps to an SNMP host, you need to set up an SNMP server by using the snmp-server enable traps global configuration command.

Examples

This example shows how to set the secondary temperature with a high threshold value of 113oF (45oC) with alarms and how to send traps to the minor relay circuitry, to the syslog, and to an SNMP server:

Switch(config)# alarm facility temperature secondary high 45

Switch(config)# alarm facility temperature secondary relay minor 

Switch(config)# alarm facility temperature secondary syslog

Switch(config)# alarm facility temperature secondary notifies

This example shows how to disable the secondary temperature alarm:

Switch(config)# no alarm facility temperature secondary 45

This example shows how to set the primary temperature alarm with alarms and traps to go to the syslog and to the major relay circuitry:

Switch(config)# alarm facility temperature primary syslog 

Switch(config)# alarm facility temperature primary relay major

Related Commands

alarm profile (global configuration)

Use the alarm profile global configuration command to create an alarm profile and to enter alarm profile configuration mode. Use the no form of this command to delete an alarm profile.

alarm profile name

no alarm profile name

Syntax Description

Defaults

No alarm profiles are created.

When a profile is created, none of the alarms are enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Available commands in alarm-profile mode:

•alarm alarm-id: enables the specified alarm.

•exit: exits alarm-profile configuration mode.

•help: displays a description of the interactive help system.

•no: negates or sets the default values of a command.

•notifies alarm-id: enables notification for the alarm, which means sending a Simple Network Management Protocol (SNMP) trap to an SNMP server.

•relay-major alarm-id: enables sending the alarm to the major relay circuitry.

•relay-minor alarm-id: enables sending the alarm to the minor relay circuitry.

•syslog alarm-id: enables sending the alarm to a syslog file.

For alarm-id, you can enter one or more alarm IDs separated by a space.

Before you use the notifies keyword to send alarm traps to a SNMP host, you need to set up an SNMP server by using the snmp-server enable traps global configuration command.

There is a default profile for all interfaces. Enter the show alarm profile user EXEC command and see the output for defaultPort.

After you have created an alarm profile, you can attach the profile to an interface by using the alarm-profile interface configuration command.

By default, the defaultPort profile is applied to all interfaces. This profile enables only the Port Not Operating (3) alarm. You can modify this profile by using the alarm profile defaultPort global configuration command to enter alarm profile configuration mode for this profile.

Examples

This example shows how to create the alarm profile fastE for a port with the link-down (alarm 1) and port not forwarding (alarm 2) alarms enabled. The link-down alarm is connected to the minor relay circuitry, and the port not forwarding alarm is connected to the major relay circuitry. These alarms are sent to an SNMP server and written to the system log file (syslog).

Switch(config)# alarm profile fastE

Switch(config-alarm-prof)# alarm 1 2

Switch(config-alarm-prof)# relay major 2

Switch(config-alarm-prof)# relay minor 1

Switch(config-alarm-prof)# notifies 1 2

Switch(config-alarm-prof)# syslog 1 2

This example shows how to delete the alarm relay profile named my-profile:

Switch(config)# no alarm profile my-profile 

Related Commands

alarm profile (interface configuration)

Use the alarm profile interface configuration command to attach an alarm profile to a port. Use the no form of this command to detach the profile from the port.

alarm profile name

no alarm profile

Syntax Description

Defaults

The alarm profile defaultPort is applied to all interfaces. In this profile, only the Port Not Operating alarm is enabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use the alarm profile global configuration command to create the alarm profile, enable one or more alarms and specify the alarm options.

You can attach only one alarm profile to an interface.

When you attach an alarm profile to an interface, it overwrites any previous alarm profile attached to the interface (including the defaultPort profile).

Examples

This example shows how to attach an alarm profile named fastE to a port:

Switch(config)# interface fastethernet1/2

Switch(config-if)# alarm profile fastE 

This example shows how to detach the alarm profile from a port and return it to the defaultPort profile:

Switch(config)# interface fastethernet1/2

Switch(config-if)# no alarm profile

Related Commands

alarm relay-mode

Use the alarm relay-mode global configuration command to set the alarm relay mode for the switch to positive or negative. Use the no form of the command to set the alarm relay mode to the default mode.

alarm relay-mode {negative}

no alarm relay-mode {negative}

Syntax Description

Defaults

By default, the alarm relays are in positive mode when they are open. When there is no power to the switch, all alarm relays are open. The alarm relays close when one or more alarm events are detected.

Command Modes

Global configuration

Command History

Usage Guidelines

Use this command to invert the behavior of the alarm relays. When the alarm relay mode is set to negative, alarm relays are normally closed. When one or more alarm events are detected, the appropriate alarm relay opens.

Examples

This example shows how to set the alarm relays to negative mode:

Switch(config)# alarm relay-mode negative

Related Commands

archive download-sw

Use the archive download-sw privileged EXEC command to download a new image from a TFTP server to the switch and to overwrite or keep the existing image.

archive download-sw {/force-reload | /imageonly | /leave-old-sw | /no-set-boot | /no-version-check | /overwrite | /reload | /safe | /warm} source-url

Syntax Description

Defaults

The current software image is not overwritten with the downloaded image.

Both the software image and HTML files are downloaded.

The new image is downloaded to the flash: file system.

The BOOT environment variable is changed to point to the new software image on the flash: file system.

Image names are case sensitive; the image file is provided in tar format.

Compatibility of the version on the image to be downloaded is checked.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

The /imageonly option removes the HTML files for the existing image if the existing image is being removed or replaced. Only the Cisco IOS image (without the HTML files) is downloaded.

Using the /safe or /leave-old-sw option can cause the new image download to fail if there is insufficient flash memory. If leaving the software in place prevents the new image from fitting in flash memory due to space constraints, an error results.

If you used the /leave-old-sw option and did not overwrite the old image when you downloaded the new one, you can remove the old image by using the delete privileged EXEC command. For more information, see the "delete" section.

Note Use the /no-version-check option with care. This option allows an image to be downloaded without first confirming that it is not incompatible with the switch.

Use the /overwrite option to overwrite the image on the flash device with the downloaded one.

If you specify the command without the /overwrite option, the download algorithm verifies that the new image is not the same as the one on the switch flash device. If the images are the same, the download does not occur. If the images are different, the old image is deleted, and the new one is downloaded.

After downloading a new image, enter the reload privileged EXEC command to begin using the new image, or specify the /reload or /force-reload option in the archive download-sw command.

Examples

This example shows how to download a new image from a TFTP server at 172.20.129.10 and overwrite the image on the switch:

Switch# archive download-sw /overwrite tftp://172.20.129.10/test-image.tar 

This example shows how to download only the software image from a TFTP server at 172.20.129.10 to the switch:

Switch# archive download-sw /imageonly tftp://172.20.129.10/test-image.tar 

This example shows how to keep the old software version after a successful download:

Switch# archive download-sw /leave-old-sw tftp://172.20.129.10/test-image.tar 

Related Commands

archive tar

Use the archive tar privileged EXEC command to create a tar file, list files in a tar file, or extract the files from a tar file.

archive tar {/create destination-url flash:/file-url} | {/table source-url} | {/xtract source-url flash:/file-url [dir/file...]}

Syntax Description

Defaults

None

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Filenames and directory names are case sensitive.

Image names are case sensitive.

Examples

This example shows how to create a tar file. The command writes the contents of the new-configs directory on the local flash device to a file named saved.tar on the TFTP server at 172.20.10.30:

Switch# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs

This example shows how to display the contents of the file that is in flash memory. The contents of the tar file appear on the screen:

Switch# archive tar /table flash:image_name-mz.122-release.tar 

info (219 bytes)

image_name-mz.122-release/(directory)

image_name-mz.122-release(610856 bytes)

image_name-mz.122-release/info (219 bytes)

info.ver (219 bytes)

This example shows how to display only the html directory and its contents:

Switch# archive tar /table flash:image_name-mz.122-release.tar 
image_name-mz.122-release/html

image_name-mz.122-release/html/ (directory)

image_name-mz.122-release/html/const.htm (556 bytes)

image_name-mz.122-release/html/xhome.htm (9373 bytes)

image_name-mz.122-release/html/menu.css (1654 bytes)

<output truncated>

This example shows how to extract the contents of a tar file on the TFTP server at 172.20.10.30. This command extracts just the new-configs directory into the root directory on the local flash file system. The remaining files in the saved.tar file are ignored.

Switch# archive tar /xtract tftp://172.20.10.30/saved.tar flash:/ new-configs

Related Commands

archive upload-sw

Use the archive upload-sw privileged EXEC command to upload an existing switch image to a server.

archive upload-sw [/version version_string] destination-url

Syntax Description

Defaults

Uploads the currently running image from the flash: file system.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Use the upload feature only if the HTML files associated with the embedded device manager have been installed with the existing image.

The files are uploaded in this sequence: the Cisco IOS image, the HTML files, and info. After these files are uploaded, the software creates the tar file.

Image names are case sensitive.

Examples

This example shows how to upload the currently running image to a TFTP server at 172.20.140.2:

Switch# archive upload-sw tftp://172.20.140.2/test-image.tar 

Related Commands

arp access-list

Use the arp access-list global configuration command to define an Address Resolution Protocol (ARP) access control list (ACL) or to add clauses to the end of a previously defined list. Use the no form of this command to delete the specified ARP access list.

arp access-list acl-name

no arp access-list acl-name

Syntax Description

Defaults

No ARP access lists are defined.

Command Modes

Global configuration

Command History

Usage Guidelines

After entering the arp access-list command, you enter ARP access-list configuration mode, and these configuration commands are available:

•default: returns a command to its default setting.

•deny: specifies packets to reject. For more information, see the "deny (ARP access-list configuration)" section.

•exit: exits ARP access-list configuration mode.

•no: negates a command or returns to the default settings.

•permit: specifies packets to forward. For more information, see the "permit (ARP access-list configuration)" section.

Use the permit and deny access-list configuration commands to forward and to drop ARP packets based on the specified matching criteria.

When the ARP ACL is defined, you can apply it to a VLAN by using the ip arp inspection filter vlan global configuration command. ARP packets containing only IP-to-MAC address bindings are compared to the ACL. All other types of packets are bridged in the ingress VLAN without validation. If the ACL permits a packet, the switch forwards it. If the ACL denies a packet because of an explicit deny statement, the switch drops the packet. If the ACL denies a packet because of an implicit deny statement, the switch compares the packet to the list of DHCP bindings (unless the ACL is static, which means that packets are not compared to the bindings).

Examples

This example shows how to define an ARP access list and to permit both ARP requests and ARP responses from a host with an IP address of 1.1.1.1 and a MAC address of 0000.0000.abcd:

Switch(config)# arp access-list static-hosts

Switch(config-arp-nacl)# permit ip host 1.1.1.1 mac host 00001.0000.abcd

Switch(config-arp-nacl)# end

You can verify your settings by entering the show arp access-list privileged EXEC command.

Related Commands

authentication control-direction

Use the authentication control-direction interface configuration command to configure the port mode as unidirectional or bidirectional. Use the no form of this command to return to the default setting.

authentication control-direction {both | in}

no authentication control-direction

Syntax Description

Defaults

The port is in bidirectional mode.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use the both keyword or the no form of this command to return to the default setting (bidirectional mode).

Examples

This example shows how to enable bidirectional mode:

Switch(config-if)# authentication control-direction both

This example shows how to enable unidirectional mode:

Switch(config-if)# authentication control-direction in

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication critical recovery delay

To configure the Auth Manager critical recovery delay, use the authentication critical recovery delay command in global configuration mode. To remove a previously configured recovery delay, us the no form of this command.

authentication critical recovery delay milliseconds

no authentication critical recovery delay

Syntax Description

Command Default

The default delay is 1000 milliseconds.

Command Modes

Global configuration

Command History

Examples

The following example shows how to configure the critical recovery delay period to 1500 milliseconds:

Switch(config)# authentication critical recovery delay 1500

authentication event

Use the authentication event interface configuration command to set the actions for specific authentication events on the port.

authentication event {fail [action [authorize vlan vlan-id | next-method] {| retry {retry count}]} { no-response action authorize vlan vlan-id} {server {alive action reinitialize} | {dead action [authorize | reinitialize vlan vlan-id]}}

no authentication event {fail [action [authorize vlan vlan-id | next-method] {| retry {retry count}]} { no-response action authorize vlan vlan-id} {server {alive action reinitialize} | {dead action [authorize | reinitialize vlan vlan-id]}}

Syntax Descriptionno authentication event {fail [action[authorize vlan vlan-id | next-method] {| retry {retry count}]} {no-response action authorize vlan vlan-id} {server {alive action reinitialize} | {dead action [authorize | reinitialize vlan vlan-id]}}

Defaults

No event responses are configured on the port.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use this command with the fail, no-response, or event keywords to configure the switch response for a specific action.

For server-dead events:

•When the switch moves to the critical-authentication state, new hosts trying to authenticate are moved to the critical-authentication VLAN (or critical VLAN). This applies whether the port is in single-host, multiple-host, multiauth, or MDA mode. Authenticated hosts remain in the authenticated VLAN, and the reauthentication timers are disabled.

•If a client is running Windows XP and the critical port to which the client is connected is in the critical-authentication state, Windows XP might report that the interface is not authenticated.

If the Windows XP client is configured for DHCP and has an IP address from the DHCP server and a critical port receives an EAP-Success message, the DHCP configuration process might not re-initiate.

For no-response events:

•If you enable a guest VLAN on an IEEE 802.1x port, the switch assigns clients to a guest VLAN when it does not receive a response to its Extensible Authentication Protocol over LAN (EAPOL) request/identity frame or when EAPOL packets are not sent by the client.

•The switch maintains the EAPOL packet history. If another EAPOL packet is detected on the port during the lifetime of the link, the guest VLAN feature is disabled. If the port is already in the guest VLAN state, the port returns to the unauthorized state, and authentication restarts. The EAPOL history is cleared.

•If the switch port is moved to the guest VLAN (multi-host mode), multiple non-IEEE 802.1x-capable clients are allowed access . If an IEEE 802.1x-capable client joins the same port on which the guest VLAN is configured, the port is put in the unauthorized state in the RADIUS-configured or user-configured access VLAN, and authentication restarts.

You can configure any active VLAN except a Remote Switched Port Analyzer (RSPAN) VLAN, a primary private VLAN, or a voice VLAN as an IEEE 802.1x guest VLAN. The guest VLAN feature is supported only on access ports. It is not supported on internal VLANs (routed ports) or trunk ports.

•When MAC authentication bypass is enabled on an IEEE 802.1x port, the switch can authorize clients based on the client MAC address if IEEE 802.1x authentication times out while waiting for an EAPOL message exchange. After detecting a client on an IEEE 802.1x port, the switch waits for an Ethernet packet from the client. The switch sends the authentication server a RADIUS-access/request frame with a username and password based on the MAC address.

–If authorization succeeds, the switch grants the client access to the network.

–If authorization fails, the switch assigns the port to the guest VLAN if one is specified.

For more information, see the "Using IEEE 802.1x Authentication with MAC Authentication Bypass" section in the "Configuring IEEE 802.1x Port-Based Authentication" chapter of the software configuration guide.

For authentication-fail events:

•If the supplicant fails authentication, the port is moved to a restricted VLAN, and an EAP success message is sent to the supplicant because it i s not notified of the actual authentication failure.

–If the EAP success message is not sent, the supplicant tries to authenticate every 60 seconds (the default) by sending an EAP-start message.

–Some hosts (for example, devices running Windows XP) cannot implement DHCP until they receive an EAP success message.

The restricted VLAN is supported only in single host mode (the default port mode). When a port is placed in a restricted VLAN, the supplicant's MAC address is added to the MAC address table. Any other MAC address on the port is treated as a security violation.

•You cannot configure an internal VLANs for Layer 3 ports as a restricted VLAN. You cannot specify the same VLAN as a restricted VLAN and as a voice VLAN.

Enable re-authentication with restricted VLANs. If re-authentication is disabled, the ports in the restricted VLANs do not receive re-authentication requests if it is disabled.

To start the re-authentication process, the restricted VLAN must receive a link-down event or an Extensible Authentication Protocol (EAP) logoff event from the port. If a host is connected through a hub:

–The port might not receive a link-down event when the host is disconnected.

–The port might not detect new hosts until the next re-authentication attempt occurs.

When you reconfigure a restricted VLAN as a different type of VLAN, ports in the restricted VLAN are also moved and stay in their currently authorized state.

Examples

This example shows how to configure the authentication event fail command:

Switch(config-if)# authentication event fail action authorize vlan 20

This example shows how to configure a no-response action:

Switch(config-if)# authentication event no-response action authorize vlan 10

This example shows how to configure a server-response action:

Switch(config-if)# authentication event server alive action reinitialize

This example shows how to configure a port to send both new and existing hosts to the critical VLAN when the RADIUS server is unavailable.

Switch(config-if)# authentication event server dead action authorize vlan 10

This example shows how to configure a port to send both new and existing hosts to the critical VLAN when the RADIUS server is unavailable. Use this command for ports in multiple-host or multiauth mode:

Switch(config-if)# authentication event server dead action reinitialize vlan 10

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication fallback

Use the authentication fallback interface configuration command to configure a port to use web authentication as a fallback method for clients that do not support IEEE 802.1x authentication. To return to the default setting, use the no form of this command.

authentication fallback name

no authentication fallback name

Syntax Description

Defaults

No fallback is enabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

You must enter the authentication port-control auto interface configuration command before configuring a fallback method.

You can only configure web authentication as a fallback method to 802.1x or MAB, so one or both of these authentication methods should be configured for the fallback to enable.

Examples

This example shows how to specify a fallback profile on a port:

Switch(config-if)# authentication fallback profile1

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication host-mode

Use the authentication host-mode interface configuration command to set the authorization manager mode on a port.

authentication host-mode [multi-auth | multi-host | single-host]

no authentication host-mode [multi-auth | multi-host | single-host]

Syntax Description

Defaults

Single host mode is enabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Single-host mode should be configured if only one data host is connected. Do not connect a voice device to authenticate on a single-host port. Voice device authorization fails if no voice VLAN is configured on the port.

Multi-auth mode should be configured to allow up to eight devices behind a hub to obtain secured port access through individual authentication. Only one voice device can be authenticated in this mode if a voice VLAN is configured.

Multi-host mode also offers port access for multiple hosts behind a hub, but multi-host mode gives unrestricted port access to the devices after the first user gets authenticated.

Examples

This example shows how to enable multiauth mode on a port:

Switch(config-if)# authentication host-mode multi-auth

This example shows how to enable multi-host mode on a port:

Switch(config-if)# authentication host-mode multi-host

This example shows how to enable single-host mode on a port:

Switch(config-if)# authentication host-mode single-host

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication mac-move permit

Use the authentication mac-move permit global configuration command to enable MAC move on a switch. Use the no form of this command to return to the default setting.

authentication mac-move permit

no authentication mac-move permit

Syntax Description

This command has no arguments or keywords.

Defaults

MAC move is enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

The command enables authenticated hosts to move between 802.1x-enabled ports on a switch. For example, if there is a device between an authenticated host and port, and that host moves to another port, the authentication session is deleted from the first port, and the host is reauthenticated on the new port.

If MAC move is disabled, and an authenticated host moves to another port, it is not reauthenticated, and a violation error occurs.

MAC move is not supported on port-security enabled 802.1x ports. If MAC move is globally configured on the switch and a port security-enabled host moves to an 802.1x-enabled port, a violation error occurs.

Examples

This example shows how to enable MAC move on a switch:

Switch(config)# authentication mac-move permit

Related Commands

authentication open

Use the authentication open interface configuration command to enable or disable open access on a port. Use the no form of this command to disable open access.

authentication open

no authentication open

Defaults

Open access is disabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Open authentication must be enabled if a device requires network access before it is authenticated.

A port ACL should be used to restrict host access when open authentication is enabled.

Examples

This example shows how to enable open access on a port:

Switch(config-if)# authentication open

This example shows how to set the port to disable open access on a port:

Switch(config-if)# no authentication open

Related Commands

authentication order

Use the authentication order interface configuration command to set the order of authentication methods used on a port.

authentication order [dot1x | mab] {webauth}

no authentication order

Syntax Description

Command Default

The default authentication order is dot1x followed by mab and webauth.

Command Modes

Interface configuration

Command History

Usage Guidelines

Ordering sets the order of methods that the switch attempts when trying to authenticate a new device connected to a port. If one method in the list is unsuccessful, the next method is attempted.

Each method can only be entered once. Flexible ordering is only possible between 802.1x and MAB.

Web authentication can be configured as either a standalone method or as the last method in the order after either 802.1x or MAB. Web authentication should be configured only as fallback to dot1x or mab.

Examples

This example shows how to add 802.1x as the first authentication method, MAB as the second method, and web authentication as the third method:

Switch(config-if)# authentication order dotx mab webauth

This example shows how to add MAC authentication Bypass (MAB) as the first authentication method and web authentication as the second authentication method:

Switch(config-if)# authentication order mab webauth

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication periodic

Use the authentication periodic interface configuration command to enable or disable reauthentication on a port. Enter the no form of this command to disable reauthentication.

authentication periodic

no authentication periodic

Command Default

Reauthentication is disabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

You configure the amount of time between periodic re-authentication attempts by using the authentication timer reauthentication interface configuration command.

Examples

This example shows how to enable periodic reauthentication on a port:

Switch(config-if)# authentication periodic

This example shows how to disable periodic reauthentication on a port:

Switch(config-if)# no authentication periodic

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication port-control

Use the authentication port-control interface configuration command to enable manual control of the port authorization state. Use the no form of this command to return to the default setting.

authentication port-control {auto | force-authorized | force-un authorized}

no authentication port-control {auto | force-authorized | force-un authorized}

Syntax Description

Defaults

The default setting is force-authorized.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use the auto keyword only on one of these port types:

•Trunk port—If you try to enable IEEE 802.1x authentication on a trunk port, an error message appears, and IEEE 802.1x is not enabled. If you try to change the mode of an IEEE 802.1x-enabled port to trunk, an error message appears, and the port mode is not changed.

•Dynamic ports—A dynamic port can negotiate with its neighbor to become a trunk port. If you try to enable IEEE 802.1x authentication on a dynamic port, an error message appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an IEEE 802.1x-enabled port to dynamic, an error message appears, and the port mode does not change.

•Dynamic-access ports—If you try to enable IEEE 802.1x authentication on a dynamic-access (VLAN Query Protocol [VQP]) port, an error message appears, and IEEE 802.1x authentication is not enabled. If you try to change an IEEE 802.1x-enabled port to dynamic VLAN, an error message appears, and the VLAN configuration does not change.

•EtherChannel port—Do not configure a port that is an active or a not-yet-active member of an EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x authentication on an EtherChannel port, an error message appears, and IEEE 802.1x authentication is not enabled.

•Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port. However, IEEE 802.1x authentication is disabled until the port is removed as a SPAN or RSPAN destination. You can enable IEEE 802.1x authentication on a SPAN or RSPAN source port.

To globally disable IEEE 802.1x authentication on the switch, use the no dot1x system-auth-control global configuration command. To disable IEEE 802.1x authentication on a specific port or to return to the default setting, use the no authentication port-control interface configuration command.

Examples

This example shows how to set the port state to automatic:

Switch(config-if)# authentication port-control auto

This example shows how to set the port state to the force- authorized state:

Switch(config-if)# authentication port-control force-authorized

This example shows how to set the port state to the force-unauthorized state:

Switch(config-if)# authentication port-control force-unauthorized

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication priority

Use the authentication priority interface configuration command to add an authentication method to the port-priority list.

auth priority [dot1x | mab] {webauth}

no auth priority [dot1x | mab] {webauth}

Syntax Description

Command Default

The default priority is 802.1x authentication, followed by MAC authentication bypass and web authentication.

Command Modes

Interface configuration

Command History

Usage Guidelines

Ordering sets the order of methods that the switch attempts when trying to authenticate a new device is connected to a port.

When configuring multiple fallback methods on a port, set web authentication (webauth) last.

Assigning priorities to different authentication methods allows a higher-priority method to interrupt an in-progress authentation method with a lower priority.

Note If a client is already authenticated, it might be reauthenticated if an interruption from a higher-priority method occurs.

The default priority of an authentication method is equivalent to its position in execution-list order: 802.1x authentication, MAC authentication bypass, and web authentication. Use the dot1x, mab, and webauth keywords to change this default order.

Examples

This example shows how to set 802.1x as the first authentication method and web authentication as the second authentication method:

Switch(config-if)# authentication priority dotx webauth

This example shows how to set MAC authentication Bypass (MAB) as the first authentication method and web authentication as the second authentication method:

Switch(config-if)# authentication priority mab webauth

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication timer

Use the authentication timer interface configuration command to configure the timeout and reauthentication parameters for an 802.1x-enabled port.

authentication timer {{[inactivity | reauthenticate]} {restart value}}

no authentication timer {{[inactivity | reauthenticate]} {restart value}}

Syntax Description

Defaults

The inactivity and restart keywords are set to off. The reauthenticate keyword is set to one hour.

Command Modes

Interface configuration

Command History

Usage Guidelines

If a timeout value is not configured, an 802.1x session stays authorized indefinitely. No other host can use the port, and the connected host cannot move to another port on the same switch.

Examples

This example shows how to set the authentication inactivity timer to 60 seconds:

Switch(config-if)# authentication timer inactivity 60

This example shows how to set the reauthentication timer to 120 seconds:

Switch(config-if)# authentication timer restart 120

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

authentication violation

Use the authentication violation interface configuration command to configure the violation modes that occur when a new device connects to a port or when a new device connects to a port after the maximum number of devices are connected to that port.

authentication violation {protect | restrict | shutdown | replace}

no authentication violation {protect | restrict | shutdown | replace}

Syntax Description

Defaults

By default authentication violation shutdown mode is enabled.

Command Modes

Interface configuration

Command History

Examples

This example shows how to configure an IEEE 802.1x-enabled port as error disabled and to shut down when a new device connects it:

Switch(config-if)# authentication violation shutdown

This example shows how to configure an IEEE 802.1x-enabled port to generate a system error message and to change the port to restricted mode when a new device connects to it:

Switch(config-if)# authentication violation restrict

This example shows how to configure an IEEE 802.1x-enabled port to ignore a new device when it connects to the port:

Switch(config-if)# authentication violation protect

This example shows how to configure an IEEE 802.1x-enabled port that is in single-host mode to tear down the old session and authenticate a new device when it connects to the port:

Switch(config-if)# authentication violation replace

You can verify your settings by entering the show authentication privileged EXEC command.

Related Commands

bandwidth

Use the bandwidth policy-map class configuration command to configure class-based weighted fair queuing (CBWFQ) by setting the output bandwidth for a policy-map class. Use the no form of this command to remove the bandwidth setting for the class.

bandwidth {rate | percent value | remaining percent value}

no bandwidth [rate | percent value | remaining percent value]

Syntax Description

Defaults

No bandwidth is defined.

Command Modes

Policy-map class configuration

Command History

Usage Guidelines

You use the bandwidth policy-map class command to control output traffic. The bandwidth command specifies the bandwidth for traffic in that class. CBWFQ derives the weight for packets belonging to the class from the bandwidth allocated to the class and uses the weight to ensure that the queue for that class is serviced fairly. Bandwidth settings are not supported in input policy maps.

When you configure bandwidth for a class of traffic as an absolute rate (kb/s) or a percentage of bandwidth (percent value), it represents the minimum bandwidth guarantee or committed information rate (CIR) for that traffic class. This means that the traffic class gets at least the bandwidth specified in the command, but is not limited to that bandwidth. Any excess bandwidth on the port is allocated to each class in the same ratio as the configured CIR rates.

When you enter the bandwidth remaining percent command, hard bandwidths are not guaranteed, and only relative bandwidths are assured. Class bandwidths are always proportional to the specified bandwidth percentages configured for the port.

When you configure bandwidth in an output policy, you must specify the same units in each bandwidth configuration; that is, all absolute values (rates) or percentages.

The total rate of the minimum bandwidth guarantees for each queue of the policy cannot exceed the total speed for the interface. If the percent keyword is used, the sum of the class bandwidth percentages cannot exceed 100 percent.

Using the queue-limit command to modify the default queue limit is especially important on higher-speed interfaces so that they meet the minimum bandwidth guarantees required by the interface.

You cannot use the bandwidth policy-map class configuration command to configure CBWFQ and the shape average command to configure class-based shaping for the same class in a policy map.

You cannot configure bandwidth in a class that includes priority queuing (configured with the priority policy-map class configuration command).

Examples

This example shows how to set the precedence of output queues by setting bandwidth in kilobits per second. The classes outclass1, outclass2, and outclass3 get a minimum of 50000, 20000, and 10000 kb/s. The class class-default at a minimum gets the remaining bandwidth.

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# bandwidth 50000

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

Switch(config-pmap-c)# bandwidth 20000

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth 10000

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

This example shows how to set the precedence of output queues by allocating percentages of the total available bandwidth to each traffic class.The classes outclass1, outclass2, and outclass3 get a minimum of 50, 20, and 10 percent. The class class-default at a minimum gets 20 percent.

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# bandwidth percent 50

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

Switch(config-pmap-c)# bandwidth percent 20

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth percent 10

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

This example shows how to set outclass1 as a priority queue, with outclass2, and outclass3 getting 50 and 20 percent, respectively, of the bandwidth remaining after the priority queue is serviced. The class class-default gets the remaining 30 percent with no guarantees.

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

Switch(config-pmap-c)# bandwidth remaining percent 50

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth remaining percent 20

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

boot config-file

Use the boot config-file global configuration command to specify the filename that Cisco IOS uses to read and write a nonvolatile copy of the system configuration. Use the no form of this command to return to the default setting.

boot config-file flash:/file-url

no boot config-file

Syntax Description

Defaults

The default configuration file is flash:config.text.

Command Modes

Global configuration

Command History

Usage Guidelines

Filenames and directory names are case sensitive.

This command changes the setting of the CONFIG_FILE environment variable. For more information, see Appendix A, "Cisco CGS 2520 Switch Boot Loader Commands."

Related Commands

boot enable-break

Use the boot enable-break global configuration command to enable interrupting the automatic boot process. Use the no form of this command to return to the default setting.

boot enable-break

no boot enable-break

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled. The automatic boot process cannot be interrupted by pressing the break key on the console.

Command Modes

Global configuration

Command History

Usage Guidelines

When you enter this command, you can interrupt the automatic boot process by pressing the break key on the console after the flash file system is initialized. The break key is different for each operating system:

•On a SUN work station running UNIX, Ctrl-C is the break key.

•On a PC running Windows 2000, Ctrl-Break is the break key.

This command changes the setting of the ENABLE_BREAK environment variable. For more information, see Appendix A, "Cisco CGS 2520 Switch Boot Loader Commands."

Related Commands

boot helper

Use the boot helper global configuration command to dynamically load files during boot loader initialization to extend or patch the functionality of the boot loader. Use the no form of this command to return to the default.

boot helper filesystem:/file-url ...

no boot helper

Syntax Description

Defaults

No helper files are loaded.

Command Modes

Global configuration

Command History

Usage Guidelines

This variable is used only for internal development and testing.

Filenames and directory names are case sensitive.

This command changes the setting of the HELPER environment variable. For more information, see Appendix A, "Cisco CGS 2520 Switch Boot Loader Commands."

Related Commands

boot helper-config-file

Use the boot helper-config-file global configuration command to specify the name of the configuration file to be used by the Cisco IOS helper image. If this is not set, the file specified by the CONFIG_FILE environment variable is used by all versions of Cisco IOS that are loaded. Use the no form of this command to return to the default setting.

boot helper-config-file filesystem:/file-url

no boot helper-config file

Syntax Description

Defaults

No helper configuration file is specified.

Command Modes

Global configuration

Command History

Usage Guidelines

This variable is used only for internal development and testing.

Filenames and directory names are case sensitive.

This command changes the setting of the HELPER_CONFIG_FILE environment variable. For more information, see Appendix A, "Cisco CGS 2520 Switch Boot Loader Commands."

Related Commands

boot manual

Use the boot manual global configuration command to enable manually booting the switch during the next boot cycle. Use the no form of this command to return to the default setting.

boot manual

no boot manual

Syntax Description

This command has no arguments or keywords.

Defaults

Manual booting is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

The next time you reboot the system, the switch is in boot loader mode, which is shown by the switch: prompt. To boot the system, use the boot boot loader command, and specify the name of the bootable image.

This command changes the setting of the MANUAL_BOOT environment variable. For more information, see Appendix A, "Cisco CGS 2520 Switch Boot Loader Commands."

Related Commands

boot private-config-file

Use the boot private-config-file global configuration command to specify the filename that Cisco IOS uses to read and write a nonvolatile copy of the private configuration. Use the no form of this command to return to the default setting.

boot private-config-file filename

no boot private-config-file

Syntax Description

Defaults

The default configuration file is private-config.

Command Modes

Global configuration

Command History

Usage Guidelines

Filenames are case sensitive.

Examples

This example shows how to specify the name of the private configuration file to be pconfig:

Switch(config)# boot private-config-file pconfig

Related Commands

boot system

Use the boot system global configuration command to specify the Cisco IOS image to load during the next boot cycle. Use the no form of this command to return to the default setting.

boot system filesystem:/file-url ...

no boot system

Syntax Description

Defaults

The switch attempts to automatically boot the system by using information in the BOOT environment variable. If this variable is not set, the switch attempts to load and execute the first executable image it can by performing a recursive, depth-first search throughout the flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory.

Command Modes

Global configuration

Command History

Usage Guidelines

Filenames and directory names are case sensitive.

If you are using the archive download-sw privileged EXEC command to maintain system images, you never need to use the boot system command. The boot system command is automatically manipulated to load the downloaded image.

This command changes the setting of the BOOT environment variable. For more information, see Appendix A, "Cisco CGS 2520 Switch Boot Loader Commands."

Related Commands

channel-group

Use the channel-group interface configuration command to assign an Ethernet port to an EtherChannel group. Use the no form of this command to remove an Ethernet port from an EtherChannel group.

channel-group channel-group-number mode {active | {auto [non-silent] | desirable [non-silent] | on} | passive}

no channel-group

PAgP modes:
channel-group channel-group-number mode {auto [non-silent] | {desirable [non-silent]}

LACP modes:
channel-group channel-group-number mode {active | passive}

On mode:
channel-group channel-group-number mode on

Note Link Aggregation Control Protocol (LACP.) and Port Aggregation Protocol (PAgP) are available only on network node interfaces (NNIs) or enhanced network interfaces (ENIs). The active, auto, desirable, and passive keywords are not visible on user network interfaces (UNIs).

Syntax Description

Defaults

No channel groups are assigned.

No mode is configured.

Command Modes

Interface configuration

Command History

Usage Guidelines

For Layer 2 EtherChannels, you do not have to create a port-channel interface first by using the interface port-channel global configuration command before assigning a physical port to a channel group. Instead, you can use the channel-group interface configuration command. It automatically creates the port-channel interface when the channel group gets its first physical port if the logical interface is not already created. If you create the port-channel interface first, the channel-group-number can be the same as the port-channel-number, or you can use a new number. If you use a new number, the channel-group command dynamically creates a new port channel.

If the port is a UNI or an ENI, you must use the no shutdown interface configuration command to enable it before using the channel-group command. UNIs and ENIs are disabled by default. NNIs are enabled by default.

You do not have to disable the IP address that is assigned to a physical port that is part of a channel group, but we strongly recommend that you do so.

You create Layer 3 port channels by using the interface port-channel command followed by the no switchport interface configuration command. You should manually configure the port-channel logical interface before putting the interface into the channel group.

After you configure an EtherChannel, configuration changes that you make on the port-channel interface apply to all the physical ports assigned to the port-channel interface. Configuration changes applied to the physical port affect only the port where you apply the configuration. To change the parameters of all ports in an EtherChannel, apply configuration commands to the port-channel interface, for example, spanning-tree commands or commands to configure a Layer 2 EtherChannel as a trunk.

If you do not specify non-silent with the auto or desirable mode, silent is assumed. The silent mode is used when the switch is connected to a device that is not PAgP-capable and seldom, if ever, sends packets. A example of a silent partner is a file server or a packet analyzer that is not generating traffic. In this case, running PAgP on a physical port prevents that port from ever becoming operational. However, it allows PAgP to operate, to attach the port to a channel group, and to use the port for transmission. Both ends of the link cannot be set to silent.

In the on mode, an EtherChannel exists only when a port group in the on mode is connected to another port group in the on mode.

Caution You should exercise care when setting the mode to on (manual configuration). All ports configured in the on mode are bundled in the same group and are forced to have similar characteristics. If the group is misconfigured, packet loss or spanning-tree loops might occur.

Do not configure an EtherChannel in both the PAgP and LACP modes. EtherChannel groups running PAgP and LACP can coexist on the same switch. Individual EtherChannel groups can run either PAgP or LACP, but they cannot interoperate.

Note PAgP and LACP are available only on NNIs and ENIs.

If you set the protocol by using the channel-protocol interface configuration command, the setting is not overridden by the channel-group interface configuration command.

Do not configure a port that is an active or a not-yet-active member of an EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x on an EtherChannel port, an error message appears, and IEEE 802.1x is not enabled.

Do not configure a secure port as part of an EtherChannel or an EtherChannel port as a secure port.