Catalyst 3750-X and Catalyst 3560-X Switch Command Reference, Cisco IOS Release 15.0(2)SE and Later

 

Syntax Description

 

Defaults

AAA accounting is disabled.

 

Command History

 

Usage Guidelines

This command requires access to a RADIUS server.

We recommend that you enter the dot1x reauthentication interface configuration command before configuring IEEE 802.1x RADIUS accounting on an interface.

Examples

This example shows how to configure IEEE 802.1x accounting:

Note The RADIUS authentication server must be properly configured to accept and log update or watchdog packets from the AAA client.

 

Related Commands

 

Syntax Description

Note Though other keywords are visible in the command-line help strings, only the default and group radius keywords are supported.

 

Defaults

No authentication is performed.

 

Command History

 

Usage Guidelines

The method argument identifies the method that the authentication algorithm tries in the given sequence to validate the password provided by the client. The only method that is truly IEEE 802.1x-compliant is the group radius method, in which the client data is validated against a RADIUS authentication server.

If you specify group radius, you must configure the RADIUS server by entering the radius-server host global configuration command.

Use the show running-config privileged EXEC command to display the configured lists of authentication methods.

Examples

This example shows how to enable AAA and how to create an IEEE 802.1x-compliant authentication list. This authentication first tries to contact a RADIUS server. If this action returns an error, the user is not allowed access to the network.

You can verify your settings by entering the show running-config privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

Authorization is disabled.

 

Command History

 

Usage Guidelines

Use the aaa authorization network default group radius global configuration command to allow the switch to download IEEE 802.1x authorization parameters from the RADIUS servers in the default authorization list. The authorization parameters are used by features such as per-user ACLs or VLAN assignment to get parameters from the RADIUS servers.

Use the show running-config privileged EXEC command to display the configured lists of authorization methods.

Examples

This example shows how to configure the switch for user RADIUS authorization for all network-related service requests:

You can verify your settings by entering the show running-config privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

ACL smart logging is not enabled.

 

Command History

 

Usage Guidelines

For the complete syntax description of the access-list command without the smartlog keyword, see the Cisco IOS Security Command Reference.

When an ACL is applied to an interface, packets matching the ACL are denied or permitted based on the ACL configuration. When smart logging is enabled on the switch and an ACL includes the smartlog keyword, the contents of the denied or permitted packet are sent to a Flexible NetFlow collector.

You must also enable smart logging globally by entering the logging smartlog global configuration command.

Only port ACLs (ACLs attached to Layer 2 interfaces) support smart logging. Router ACLs or VLAN ACLs do not support smart logging. Port ACLs do not support logging.

When an ACL is applied to an interface, matching packets can be either logged or smart logged, but not both.

To remove disable smart logging of an access list, enter access-list configuration mode and enter the no deny { source [ source-wildcard ] | host source | any } [ smartlog ] command or the no permit { source [ source-wildcard ] | host source | any } [ smartlog ] command.

You can verify that smart logging is enabled in an ACL by entering the show ip access list privileged EXEC command.

Examples

This example shows how to configure smart logging on an extended access list, ACL 101, which allows IP traffic from the host with the IP address 172.20.10.101 to any destination. When smart logging is enabled and the ACL is attached to a Layer 2 interface, copies of packets matching this criteria are sent to the NetFlow collector.

 

Related Commands

 

Syntax Description

 

Defaults

The default action is to forward packets.

 

Command History

 

Usage Guidelines

You enter access-map configuration mode by using the vlan access-map global configuration command.

If the action is drop, you should define the access map, including configuring any access control list (ACL) names in match clauses, before applying the map to a VLAN, or all packets could be dropped.

In access-map configuration mode, use the match access-map configuration command to define the match conditions for a VLAN map. Use the action command to set the action that occurs when a packet matches the conditions.

The drop and forward parameters are not used in the no form of the command.

Examples

This example shows how to identify and apply a VLAN access map vmap4 to VLANs 5 and 6 that causes the VLAN to forward an IP packet if the packet matches the conditions defined in access list al2 :

You can verify your settings by entering the show vlan access-map privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Command History

 

Usage Guidelines

The current software image is not overwritten with the copied image.

Both the software image and HTML files are copied.

The new image is copied to the flash: file system.

The BOOT environment variable is changed to point to the new software image on the flash: file system.

Image names are case sensitive; the image file is provided in tar format.

Note To successfully use the archive copy-sw privileged EXEC command, you must have downloaded from a TFTP server the images for both the stack member switch being added and the stack master. You use the archive download-sw privileged EXEC command to perform the download.

At least one stack member must be running the image that is to be copied to the switch that has incompatible software.

You can copy the image to more than one specific stack member by repeating the /destination -system destination-stack-member-number option in the command for each stack member to be upgraded. If you do not specify the destination-stack-member-number, the default is to copy the running image file to all stack members.

Using the /safe or /leave-old-sw option can cause the new copied image to fail if there is insufficient flash memory. If leaving the software in place would prevent the new image from fitting in flash memory due to space constraints, an error results.

If you used the /leave-old-sw option and did not overwrite the old image when you copied the new one, you can remove the old image by using the delete privileged EXEC command. For more information, see the “delete” section on page 141.

Use the /overwrite option to overwrite the image on the flash device with the copied one.

If you specify the command without the /overwrite option, the algorithm verifies that the new image is not the same as the one on the switch flash device or is not running on any stack members. If the images are the same, the copy does not occur. If the images are different, the old image is deleted, and the new one is copied.

After copying a new image, enter the reload privileged EXEC command to begin using the new image, or specify the /reload or /force-reload option in the archive copy-sw command.

You can enter one or more of these options with the s ource-stack-member-number option:

• /destination-system destination-stack-member-number
• / force-reload
• / leave-old-sw
• / no-set-boot
• / overwrite
• / reload
• /safe

If you enter the s ource-stack-member-number option before one of the previous options, you can enter only the archive copy-sw s ource-stack-member-number command.

These are examples of how you can enter the archive copy-sw command:

• To copy the running image from a stack member to another stack member and to overwrite the software image in the second stack member’s flash memory (if it already exists) with the copied one, enter the archive copy-sw /destination destination-stack-member-number /overwrite s ource-stack-member-number command.
• To copy the running image from a stack member to another stack member, keep the current software image, and reload the system after the image copies, enter the archive copy-sw /destination destination-stack-member-number /safe /reload s ource-stack-member-number command.

Examples

This example shows how to copy the running image from stack member 6 to stack member 8:

This example shows how to copy the running image from stack member 6 to all the other stack members:

This example shows how to copy the running image from stack member 5 to stack member 7. If the image being copied already exists on the second stack member’s flash memory, it can be overwritten with the copied one. The system reloads after the image is copied:

 

Related Commands

 

Syntax Description

 

Defaults

The current software image is not overwritten with the downloaded image.

Both the software image and the HTML files are downloaded.

The new image is downloaded to the flash: file system.

The BOOT environment variable is changed to point to the new software image on the flash: file system.

Image names are case sensitive; the image file is provided in tar format.

Compatibility of the stack protocol version on the image to be downloaded is checked with the version on the switch stack.

 

Command History

 

Usage Guidelines

Use the /allow-feature-upgrade option to allow installation of an image with a different feature set, for example, upgrading from the IP base feature set to the IP services feature.

You can use the archive download-sw /directory command to specify a directory just once, followed by a tar file or list of tar files to be downloaded, instead of specifying complete paths with each tar file. For example, in a mixed hardware stack, you can enter archive download-sw /directory tftp://10.1.1.10/ c3750-ipservices-tar.122-35.SE.tar c3750e-universal-tar.122-35.SE2.tar

The /imageonly option removes the HTML files for the existing image if the existing image is being removed or replaced. Only the Cisco IOS image (without the HTML files) is downloaded.

Using the /safe or /leave-old-sw option can cause the new image download to fail if there is insufficient flash memory. If leaving the software in place prevents the new image from fitting in flash memory due to space constraints, an error results.

If you used the /leave-old-sw option and did not overwrite the old image when you downloaded the new one, you can remove the old image by using the delete privileged EXEC command. For more information, see the “delete” section on page 141.

Use the /no-version-check option if you want to download an image that has a different stack protocol version than the one existing on the switch stack. You must use this option with the /destination-system option to specify the specific stack member to be upgraded with the image.

Note Use the /no-version-check option with care. All stack members, including the stack master, must have the same stack protocol version to be in the same switch stack. This option allows an image to be downloaded without first confirming the compatibility of its stack protocol version with the version of the switch stack.

You can upgrade more than one specific stack member by repeating the /destination-system option in the command for each stack member to be upgraded.

Use the /overwrite option to overwrite the image on the flash device with the downloaded one.

If you specify the command without the /overwrite option, the download algorithm verifies that the new image is not the same as the one on the switch flash device or is not running on any stack members. If the images are the same, the download does not occur. If the images are different, the old image is deleted, and the new one is downloaded.

After downloading a new image, enter the reload privileged EXEC command to begin using the new image, or specify the /reload or /force-reload option in the archive download-sw command.

If you use the archive download-sw command on a Catalyst 3560-X or on a Catalyst 3750-X switch or switch stack (including a mixed stack), after the switch reload and while the links are still shut down, the MCU ucode is upgraded (if necessary). If you use the /force-ucode-reload option, the system performs the ucode upgrade before the reload, which reduces network downtime. When you enter the /force-ucode-reload option, you see a message explaining the behavior, requiring you to enter yes to continue.

Use the /directory option to specify a directory for the images.

Before starting the rolling stack upgrade, configure at least a redundant uplink to the network to ensure that the stack has network connectivity during the upgrade.

Examples

This example shows how to download a new image from a TFTP server at 172.20.129.10 and to overwrite the image on the switch:

This example shows how to download only the software image from a TFTP server at 172.20.129.10 to the switch:

This example shows how to keep the old software version after a successful download:

This example specifies the location of two tar images without having to specify the path each time:

This example specifies the location of three tar images without having to specify the path each time:

This example shows how to upgrade stack members 6 and 8:

This example shows hot to start a rolling stack update:

This is an example of the output when you enter the /force-ucode-reload option:

 

Related Commands

 

Syntax Description

 

Defaults

There is no default setting.

 

Command History

 

Usage Guidelines

Filenames and directory names are case sensitive.

Image names are case sensitive.

Examples

This example shows how to create a tar file. The command writes the contents of the new-configs directory on the local flash device to a file named saved.tar on the TFTP server at 172.20.10.30:

This example shows how to display the contents of an image file that is in flash memory. An example of an image file name is c3750x-universal-tar.12-53.SE2. The contents of the tar file appear on the screen:

This example shows how to display only the html directory and its contents:

This example shows how to extract the contents of a tar file on the TFTP server at 172.20.10.30. This command extracts just the new-configs directory into the root directory on the local flash file system. The remaining files in the saved.tar file are ignored.

 

Related Commands

 

Syntax Description

 

Defaults

Uploads the currently running image from the flash: file system.

 

Command History

 

Usage Guidelines

You must specify that the /source-system-num option uses the /version option. The options together upload the specified image, not the running image, of a specific stack member.

Use the upload feature only if the HTML files associated with the embedded device manager have been installed with the existing image.

The files are uploaded in this sequence: the Cisco IOS image, the HTML files, and info. After these files are uploaded, the software creates the tar file.

Image names are case sensitive.

Examples

This example shows how to upload the currently running image on stack member 6 to a TFTP server at 172.20.140.2:

 

Related Commands

 

Syntax Description

 

Defaults

No ARP access lists are defined.

 

Command History

 

Usage Guidelines

After entering the arp access-list command, you enter ARP access-list configuration mode, and these configuration commands are available:

• default : returns a command to its default setting.
• deny : specifies packets to reject. For more information, see the “deny (ARP access-list configuration)” section on page 144.
• exit : exits ARP access-list configuration mode.
• no : negates a command or returns to default settings.
• permit : specifies packets to forward. For more information, see the “permit (ARP access-list configuration)” section on page 461.

Use the permit and deny access-list configuration commands to forward and to drop ARP packets based on the specified matching criteria.

When the ARP ACL is defined, you can apply it to a VLAN by using the ip arp inspection filter vlan global configuration command. ARP packets containing only IP-to-MAC address bindings are compared to the ACL. All other types of packets are bridged in the ingress VLAN without validation. If the ACL permits a packet, the switch forwards it. If the ACL denies a packet because of an explicit deny statement, the switch drops the packet. If the ACL denies a packet because of an implicit deny statement, the switch compares the packet to the list of DHCP bindings (unless the ACL is static, which means that packets are not compared to the bindings).

Examples

This example shows how to define an ARP access list and to permit both ARP requests and ARP responses from a host with an IP address of 1.1.1.1 and a MAC address of 0000.0000.abcd:

You can verify your settings by entering the show arp access-list privileged EXEC command.

 

Related Commands

 

Syntax Description

This command has no arguments or keywords.

 

Defaults

The switch accepts a RADIUS Change of Authorization (CoA) bounce port command.

 

Command History

 

Usage Guidelines

The CoA bounce port command causes a link flap, which triggers a DHCP renegotiation from the host. This is useful when a VLAN change occurs and the endpoint is a device such as a printer, that has no supplicant to detect the change. Use this command to configure the switch to ignore the bounce port command.

Examples

This example shows how to instruct the switch to ignore a CoA bounce port command:

 

Related Commands

 

Syntax Description

This command has no arguments or keywords.

 

Defaults

The switch accepts a RADIUS Change of Authorization (CoA) disable port command.

 

Command History

 

Usage Guidelines

The CoA disable port command administratively shuts down a port hosting a session, resulting in session termination. Use this command to configure the switch to ignore this command.

Examples

This example shows how to instruct the switch to ignore a CoA disable port command:

 

Related Commands

 

Syntax Description

 

Defaults

The port is in bidirectional mode.

 

Command History

 

Usage Guidelines

Use the both keyword or the no form of this command to return to the default setting (bidirectional mode).

Examples

This example shows how to enable bidirectional mode:

This example shows how to enable unidirectional mode:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Descriptionno authentication event {fail [action[authorize vlan vlan-id | next-method] {| retry {retry count}]} {no-response action authorize vlan vlan-id} {server {alive action reinitialize} | {dead action [authorize | reinitialize vlan vlan-id]}}

 

Defaults

No event responses are configured on the port.

 

Command History

 

Usage Guidelines

Use this command with the fail, no-response, or event keywords to configure the switch response for a specific action.

For authentication-fail events:

• If the supplicant fails authentication, the port is moved to a restricted VLAN, and an EAP success message is sent to the supplicant because it i s not notified of the actual authentication failure.

– If the EAP success message is not sent, the supplicant tries to authenticate every 60 seconds (the default) by sending an EAP-start message.

– Some hosts (for example, devices running Windows XP) cannot implement DHCP until they receive an EAP success message.

The restricted VLAN is supported only in single host mode (the default port mode). When a port is placed in a restricted VLAN, the supplicant's MAC address is added to the MAC address table. Any other MAC address on the port is treated as a security violation.

• You cannot configure an internal VLANs for Layer 3 ports as a restricted VLAN. You cannot specify the same VLAN as a restricted VLAN and as a voice VLAN.

Enable re-authentication with restricted VLANs. If re-authentication is disabled, the ports in the restricted VLANs do not receive re-authentication requests if it is disabled.

To start the re-authentication process, the restricted VLAN must receive a link-down event or an Extensible Authentication Protocol (EAP) logoff event from the port. If a host is connected through a hub:

– The port might not receive a link-down event when the host is disconnected.

– The port might not detect new hosts until the next re-authentication attempt occurs.

When you reconfigure a restricted VLAN as a different type of VLAN, ports in the restricted VLAN are also moved and stay in their currently authorized state.

For no-response events:

• If you enable a guest VLAN on an IEEE 802.1x port, the switch assigns clients to a guest VLAN when it does not receive a response to its Extensible Authentication Protocol over LAN (EAPOL) request/identity frame or when EAPOL packets are not sent by the client.
• The switch maintains the EAPOL packet history. If another EAPOL packet is detected on the port during the lifetime of the link, the guest VLAN feature is disabled. If the port is already in the guest VLAN state, the port returns to the unauthorized state, and authentication restarts. The EAPOL history is cleared.
• If the switch port is moved to the guest VLAN (multi-host mode), multiple non-IEEE 802.1x-capable clients are allowed access. If an IEEE 802.1x-capable client joins the same port on which the guest VLAN is configured, the port is put in the unauthorized state in the RADIUS-configured or user-configured access VLAN, and authentication restarts.

You can configure any active VLAN except a Remote Switched Port Analyzer (RSPAN) VLAN, a primary private VLAN, or a voice VLAN as an IEEE 802.1x guest VLAN. The guest VLAN feature is supported only on access ports. It is not supported on internal VLANs (routed ports) or trunk ports.

• When MAC authentication bypass is enabled on an IEEE 802.1x port, the switch can authorize clients based on the client MAC address if IEEE 802.1x authentication times out while waiting for an EAPOL message exchange. After detecting a client on an IEEE 802.1x port, the switch waits for an Ethernet packet from the client. The switch sends the authentication server a RADIUS-access/request frame with a username and password based on the MAC address.

– If authorization succeeds, the switch grants the client access to the network.

– If authorization fails, the switch assigns the port to the guest VLAN if one is specified.

For more information, see the "Using IEEE 802.1x Authentication with MAC Authentication Bypass" section in the "Configuring IEEE 802.1x Port-Based Authentication" chapter of the software configuration guide.

For server-dead events:

• When the switch moves to the critical-authentication state, new hosts trying to authenticate are moved to the critical-authentication VLAN (or critical VLAN). This applies whether the port is in single-host, multiple-host, multiauth, or MDA mode. Authenticated hosts remain in the authenticated VLAN, and the reauthentication timers are disabled.
• If a client is running Windows XP and the critical port to which the client is connected is in the critical-authentication state, Windows XP might report that the interface is not authenticated.

If the Windows XP client is configured for DHCP and has an IP address from the DHCP server and a critical port receives an EAP-Success message, the DHCP configuration process might not re-initiate.

You can verify your settings by entering the show authentication privileged EXEC command.

Examples

This example shows how to configure the authentication event fail command:

This example shows how to configure a no-response action:

This example shows how to configure a server-response action:

This example shows how to configure a port to send both new and existing hosts to the critical VLAN when the RADIUS server is unavailable. Use this command for ports in multiple authentication (multiauth) mode or if the voice domain of the port is in MDA mode:

This example shows how to configure a port to send both new and existing hosts to the critical VLAN when the RADIUS server is unavailable and if the traffic from the host is tagged with the voice VLAN to put the host in the configured voice VLAN on the port. Use this command for ports in multiple-host or multiauth mode:

 

Related Commands

 

Syntax Description

 

Defaults

The default is to take no action when link-security authentication fails.

 

Command History

 

Usage Guidelines

When link-security authentication fails because of unrecognized user credentials, this command specifies that the switch authorizes a restricted VLAN on the port.

Examples

This example configures the interface so that the port is assigned to a restricted VLAN 40 after a failed authentication attempt:

You can verify your setting by entering the show authentication sessions privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

No fallback is enabled.

 

Command History

 

Usage Guidelines

You must enter the authentication port-control auto interface configuration command before configuring a fallback method.

You can only configure web authentication as a fallback method to 802.1x or MAB, so one or both of these authentication methods should be configured for the fallback to enable.

Examples

This example shows how to specify a fallback profile on a port:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

Single host mode is enabled.

 

Command History

 

Usage Guidelines

Single-host mode should be configured if only one data host is connected. Do not connect a voice device to authenticate on a single-host port. Voice device authorization fails if no voice VLAN is configured on the port.

Multi-domain mode should be configured if data host is connected through an IP Phone to the port. Multi-domain mode should be configured if the voice device needs to be authenticated.

Multi-auth mode should be configured to allow devices behind a hub to obtain secured port access through individual authentication. Only one voice device can be authenticated in this mode if a voice VLAN is configured.

Multi-host mode also offers port access for multiple hosts behind a hub, but multi-host mode gives unrestricted port access to the devices after the first user gets authenticated.

Examples

This example shows how to enable multiauth mode on a port:

This example shows how to enable multi-domain mode on a port:

This example shows how to enable multi-host mode on a port:

This example shows how to enable single-host mode on a port:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

The default is to support a link security policy of should secure.

 

Command History

 

Usage Guidelines

The linksec policy might change after a successful reauthentication started by a local timer or a change of authorization (CoA) reauthenticate command. If the policy changes from must-not-secure to must-secure after a reauthentication, the system attempts to secure the session. If the MACsec key does not renegotiate a MACsec connection after a reauthentication, the session is terminated, and all local states are removed.

A per-user policy received after authentication overrides the interface configuration policy.

Examples

This example configures the interface to always secure MACsec sessions:

You can verify your setting by entering the show authentication sessions privileged EXEC command.

 

Related Commands

 

Syntax Description

This command has no arguments or keywords.

 

Defaults

MAC move is disabled.

 

Command History

 

Usage Guidelines

The command enables authenticated hosts to move between 802.1x-enabled ports on a switch. For example, if there is a device between an authenticated host and port, and that host moves to another port, the authentication session is deleted from the first port, and the host is reauthenticated on the new port.

If MAC move is disabled, and an authenticated host moves to another port, it is not reauthenticated, and a violation error occurs.

MAC move is not supported on port-security enabled 802.1x ports. If MAC move is globally configured on the switch and a port security-enabled host moves to an 802.1x-enabled port, a violation error occurs.

Examples

This example shows how to enable MAC move on a switch:

 

Related Commands

 

Defaults

Open access is disabled.

 

Command History

 

Usage Guidelines

Open authentication must be enabled if a device requires network access before it is authenticated.

A port ACL should be used to restrict host access when open authentication is enabled.

Examples

This example shows how to enable open access on a port:

This example shows how to set the port to disable open access on a port:

 

Related Commands

 

Syntax Description

 

Command Default

The default authentication order is dot1x followed by mab and webauth.

 

Command History

 

Usage Guidelines

Ordering sets the order of methods that the switch attempts when trying to authenticate a new device connected to a port. If one method in the list is unsuccessful, the next method is attempted.

Each method can only be entered once. Flexible ordering is only possible between 802.1x and MAB.

Web authentication can be configured as either a standalone method or as the last method in the order after either 802.1x or MAB. Web authentication should be configured only as fallback to dot1x or mab.

Examples

This example shows how to add 802.1x as the first authentication method, MAB as the second method, and web authentication as the third method:

This example shows how to add MAC authentication Bypass (MAB) as the first authentication method and web authentication as the second authentication method:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Command Default

Reauthentication is disabled.

 

Command History

 

Usage Guidelines

You configure the amount of time between periodic re-authentication attempts by using the authentication timer reauthentication interface configuration command.

Examples

This example shows how to enable periodic reauthentication on a port:

This example shows how to disable periodic reauthentication on a port:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

The default setting is force-authorized.

 

Command History

 

Usage Guidelines

Use the auto keyword only on one of these port types:

• Trunk port—If you try to enable authentication on a trunk port, an error message appears, and is not enabled. If you try to change the mode of an port to trunk, an error message appears, and the port mode is not changed.
• Dynamic ports—A dynamic port can negotiate with its neighbor to become a trunk port. If you try to enable authentication on a dynamic port, an error message appears, and authentication is not enabled. If you try to change the mode of an port to dynamic, an error message appears, and the port mode does not change.
• Dynamic-access ports—If you try to enable authentication on a dynamic-access (VLAN Query Protocol [VQP]) port, an error message appears, and authentication is not enabled. If you try to change an port to dynamic VLAN, an error message appears, and the VLAN configuration does not change.
• EtherChannel port—Do not configure a port that is an active or a not-yet-active member of an EtherChannel as an port. If you try to enable authentication on an EtherChannel port, an error message appears, and authentication is not enabled.
• Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can enable authentication on a port that is a SPAN or RSPAN destination port. However, authentication is disabled until the port is removed as a SPAN or RSPAN destination. You can enable authentication on a SPAN or RSPAN source port.

To globally disable authentication on the switch, use the no dot1x system-auth-control global configuration command. To disable authentication on a specific port or to return to the default setting, use the no authentication port-control interface configuration command.

Examples

This example shows how to set the port state to automatic:

This example shows how to set the port state to the force- authorized state:

This example shows how to set the port state to the force-unauthorized state:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Command Default

The default priority is 802.1x authentication, followed by MAC authentication bypass and web authentication.

 

Command History

 

Usage Guidelines

Ordering sets the order of methods that the switch attempts when trying to authenticate a new device is connected to a port.

When configuring multiple fallback methods on a port, set web authentication (webauth) last.

Assigning priorities to different authentication methods allows a higher-priority method to interrupt an in-progress authentation method with a lower priority.

Note If a client is already authenticated, it might be reauthenticated if an interruption from a higher-priority method occurs.

The default priority of an authentication method is equivalent to its position in execution-list order: 802.1x authentication, MAC authentication bypass, and web authentication. Use the dot1x, mab, and webauth keywords to change this default order.

Examples

This example shows how to set 802.1x as the first authentication method and web authentication as the second authentication method:

This example shows how to set MAC authentication Bypass (MAB) as the first authentication method and web authentication as the second authentication method:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

The inactivity and restart keywords are set to 60 seconds. The reauthenticate keyword is set to one hour.

 

Command History

 

Usage Guidelines

If a timeout value is not configured, an 802.1x session stays authorized indefinitely. No other host can use the port, and the connected host cannot move to another port on the same switch.

Examples

This example shows how to set the authentication inactivity timer to 60 seconds:

This example shows how to set the reauthentication timer to 120 seconds:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

By default authentication violation shutdown mode is enabled.

 

Command History

Examples

This example shows how to configure an IEEE 802.1x-enabled port as error disabled and to shut down when a new device connects it:

This example shows how to configure an 802.1x-enabled port to generate a system error message and to change the port to restricted mode when a new device connects to it:

This example shows how to configure an 802.1x-enabled port to ignore a new device when it connects to the port:

This example shows how to configure an 802.1x-enabled port to remove the current session and initiate authentication with a new device when it connects to the port:

You can verify your settings by entering the show authentication privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

Auto-QoS classify is disabled on the port.

 

Command History

 

Usage Guidelines

Use this command to configure the QoS for trusted interfaces within the QoS domain. The QoS domain includes the switch, the network interior, and edge devices that can classify incoming traffic for QoS.

Auto-QoS configures the switch for connectivity with a trusted interface. The QoS labels of incoming packets are trusted. For nonrouted ports, the CoS value of the incoming packets is trusted. For routed ports, the DSCP value of the incoming packet is trusted.

To take advantage of the auto-QoS defaults, you should enable auto-QoS before you configure other QoS commands. You can fine-tune the auto-QoS configuration after you enable auto-QoS.

This is the policy map when the auto qos classify command is configured:

This is the policy map when the auto qos classify police command is configured:

Note The switch applies the auto-QoS-generated commands as if the commands were entered from the command-line interface (CLI). An existing user configuration can cause the application of the generated commands to fail or to be overridden by the generated commands. These actions occur without warning. If all the generated commands are successfully applied, any user-entered configuration that was not overridden remains in the running configuration. Any user-entered configuration that was overridden can be retrieved by reloading the switch without saving the current configuration to memory. If the generated commands fail to be applied, the previous running configuration is restored.

After auto-QoS is enabled, do not modify a policy map or aggregate policer that includes AutoQoS in its name. If you need to modify the policy map or aggregate policer, make a copy of it, and change the copied policy map or policer. To use the new policy map instead of the generated one, remove the generated policy map from the interface, and apply the new policy map.

To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. Use the debug auto qos privileged EXEC command to enable auto-QoS debugging. For more information, see the debug auto qos command.

To disable auto-QoS on a port, use the no auto qos trust interface configuration command. Only the auto-QoS-generated interface configuration commands for this port are removed. If this is the last port on which auto-QoS is enabled and you enter the no auto qos trust command, auto-QoS is considered disabled even though the auto-QoS-generated global configuration commands remain (to avoid disrupting traffic on other ports affected by the global configuration). You can use the no mls qos global configuration command to disable the auto-QoS-generated global configuration commands. With QoS disabled, there is no concept of trusted or untrusted ports because the packets are not modified. The CoS, DSCP, and IP precedence values in the packet are not changed. Traffic is switched in pass-through mode. Packets are switched without any rewrites and classified as best effort without any policing.

Examples

This example shows how to enable auto-QoS classification of an untrusted device and police traffic:

You can verify your settings by entering the show auto qos interface interface-id privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

Auto-QoS trust is disabled on the port.

When auto-QoS is enabled, it uses the ingress packet label to categorize traffic, to assign packet labels, and to configure the ingress and egress queues.

 

Command History

 

Usage Guidelines

Use this command to configure the QoS for trusted interfaces within the QoS domain. The QoS domain includes the switch, the network interior, and edge devices that can classify incoming traffic for QoS.

Auto-QoS configures the switch for connectivity with a trusted interface. The QoS labels of incoming packets are trusted. For nonrouted ports, the CoS value of the incoming packets is trusted. For routed ports, the DSCP value of the incoming packet is trusted.

To take advantage of the auto-QoS defaults, you should enable auto-QoS before you configure other QoS commands. You can fine-tune the auto-QoS configuration after you enable auto-QoS.

If the port is configured with auto-QoS trust, it trusts all the packets on the port. If the packets are not marked with a DSCP or CoS value, default marking takes affect.

Note The switch applies the auto-QoS-generated commands as if the commands were entered from the command-line interface (CLI). An existing user configuration can cause the application of the generated commands to fail or to be overridden by the generated commands. These actions occur without warning. If all the generated commands are successfully applied, any user-entered configuration that was not overridden remains in the running configuration. Any user-entered configuration that was overridden can be retrieved by reloading the switch without saving the current configuration to memory. If the generated commands fail to be applied, the previous running configuration is restored.

After auto-QoS is enabled, do not modify a policy map or aggregate policer that includes AutoQoS in its name. If you need to modify the policy map or aggregate policer, make a copy of it, and change the copied policy map or policer. To use the new policy map instead of the generated one, remove the generated policy map from the interface, and apply the new policy map.

To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. Use the debug auto qos privileged EXEC command to enable auto-QoS debugging. For more information, see the debug auto qos command.

To disable auto-QoS on a port, use the no auto qos trust interface configuration command. Only the auto-QoS-generated interface configuration commands for this port are removed. If this is the last port on which auto-QoS is enabled and you enter the no auto qos trust command, auto-QoS is considered disabled even though the auto-QoS-generated global configuration commands remain (to avoid disrupting traffic on other ports affected by the global configuration). You can use the no mls qos global configuration command to disable the auto-QoS-generated global configuration commands. With QoS disabled, there is no concept of trusted or untrusted ports because the packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode (packets are switched without any rewrites and classified as best effort without any policing).

Examples

This example shows how to enable auto-QoS for a trusted interface with specific cos classification.

You can verify your settings by entering the show auto qos interface interface-id privileged EXEC command.

 

Related Commands

 

Syntax Description

 

Defaults

Auto-QoS video is disabled on the port.

When auto-QoS is enabled, it uses the ingress packet label to categorize traffic, to assign packet labels, and to configure the ingress and egress queues.

 

Command History

 

Usage Guidelines

Use this command to configure the QoS appropriate for video traffic within the QoS domain. The QoS domain includes the switch, the network interior, and edge devices that can classify incoming traffic for QoS.

Auto-QoS configures the switch for video connectivity to a Cisco TelePresence system, a Cisco IP camera, or a Cisco digital media player.

To take advantage of the auto-QoS defaults, you should enable auto-QoS before you configure other QoS commands. You can fine-tune the auto-QoS configuration after you enable auto-QoS.

Note The switch applies the auto-QoS-generated commands as if the commands were entered from the command-line interface (CLI). An existing user configuration can cause the application of the generated commands to fail or to be overridden by the generated commands. These actions occur without warning. If all the generated commands are successfully applied, any user-entered configuration that was not overridden remains in the running configuration. Any user-entered configuration that was overridden can be retrieved by reloading the switch without saving the current configuration to memory. If the generated commands fail to be applied, the previous running configuration is restored.

If this is the first port on which you have enabled auto-QoS, the auto-QoS-generated global configuration commands are executed followed by the interface configuration commands. If you enable auto-QoS on another port, only the auto-QoS-generated interface configuration commands for that port are executed.

When you enable the auto-QoS feature on the first port, these automatic actions occur:

• QoS is globally enabled ( mls qos global configuration command), and other global configuration commands are added.
• After auto-QoS is enabled, do not modify a policy map or aggregate policer that includes AutoQoS in its name. If you need to modify the policy map or aggregate policer, make a copy of it, and change the copied policy map or policer. To use the new policy map instead of the generated one, remove the generated policy map from the interface, and apply the new policy map.

To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. Use the debug auto qos privileged EXEC command to enable auto-QoS debugging. For more information, see the debug auto qos command.

To disable auto-QoS on a port, use the no auto qos video interface configuration command. Only the auto-QoS-generated interface configuration commands for this port are removed. If this is the last port on which auto-QoS is enabled and you enter the no auto qos video command, auto-QoS is considered disabled even though the auto-QoS-generated global configuration commands remain (to avoid disrupting traffic on other ports affected by the global configuration). You can use the no mls qos global configuration command to disable the auto-QoS-generated global configuration commands. With QoS disabled, there is no concept of trusted or untrusted ports because the packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode (packets are switched without any rewrites and classified as best effort without any policing).

Examples

This example shows how to enable auto-QoS for a Cisco Telepresence interface with conditional trust. The interface is trusted only if a Cisco Telepresence device is detected; otherwise, the port is untrusted.

You can verify your settings by entering the show auto qos video interface interface-id privileged EXEC command.

 

Related Commands