interface

To select an interface to configure and to enter interface configuration mode, use the interface command.

interface type number

 
Syntax Description

type

Type of interface to be configured; see Valid type Values for valid values.

number

Module and port number.

 
Defaults

No interface types are configured.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(25)EW

Extended to include the 10-Gigabit Ethernet interface.

 
Usage Guidelines

Table 1-1 lists the valid values for type .

 

Table 1-1 Valid type Values

Keyword
Definition

ethernet

Ethernet IEEE 802.3 interface.

fastethernet

100-Mbps Ethernet interface.

gigabitethernet

Gigabit Ethernet IEEE 802.3z interface.

tengigabitethernet

10-Gigabit Ethernet IEEE 802.3ae interface.

ge-wan

Gigabit Ethernet WAN IEEE 802.3z interface; supported on Catalyst 4500 series switches that are configured with a Supervisor Engine 2 only.

pos

Packet OC-3 interface on the Packet over SONET Interface Processor; supported on Catalyst 4500 series switches that are configured with a Supervisor Engine 2 only.

atm

ATM interface; supported on Catalyst 4500 series switches that are configured with a Supervisor Engine 2 only.

vlan

VLAN interface; see the interface vlan command.

port-channel

Port channel interface; see the interface port-channel command.

null

Null interface; the valid value is 0.

Examples

This example shows how to enter the interface configuration mode on the Fast Ethernet interface 2/4:

Switch(config)# interface fastethernet2/4
Switch(config-if)#

 
Related Commands

Command
Description

show interfaces

Displays interface information.

interface (virtual switch)

To select an interface to configure and enter interface configuration mode, use the interface global configuration mode command.

interface [interface switch-num/slot/port.subinterface }

 
Syntax Description

interface

Specifies the interface to be configured; see Valid type Values for valid values.

switch-num

Specifies a switch ID.

slot

Specifies a slot number.

port

Specifies a port number.

.subinterface

Specifies the port subinterface number.

 
Defaults

No interface types are configured.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

Cisco IOS XE 3.4.0SG and 15.1(2)SG

Support introduced on the Catalyt 4500 Series Switch.

 
Usage Guidelines

Table 1-2 lists the valid values for type .

 

Table 1-2 Valid type Values

Keyword
Definition

fastethernet

Fast Ethernet 802.3

gigabitethernet

Gigabit Ethernet IEEE 802.3z interface.

tengigabitethernet

10-Gigabit Ethernet IEEE 802.3ae interface.

vlan

VLAN interface; see the interface vlan command.

port-channel

Port channel interface; see the interface port-channel command.

null

Null interface; the valid value is 0.

tunnel

Tunnel interface

Examples

The following example shows how to enter the interface configuration mode on the GigabitEthernet interface for switch 1, module 2, port 4:

Router(config)# interface gigabitethernet 1/2/4
Router(config)#

 
Related Commands

Command
Description

show interfaces (virtual switch)

Displays the traffic that is seen by a specific interface.

interface port-channel

To access or create a port-channel interface, use the interface port-channel command.

interface port-channel channel-group

 
Syntax Description

channel-group

Port-channel group number; valid values are from 1 to 64.

 
Defaults

This command has no default settings.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You do not have to create a port-channel interface before assigning a physical interface to a channel group. A port-channel interface is created automatically when the channel group gets its first physical interface, if it is not already created.

You can also create the port channels by entering the interface port-channel command. This will create a Layer 3 port channel. To change the Layer 3 port channel into a Layer 2 port channel, use the switchport command before you assign the physical interfaces to the channel group. A port channel cannot be changed from Layer 3 to Layer 2 or vice versa when it contains member ports.

Only one port channel in a channel group is allowed.


Caution The Layer 3 port-channel interface is the routed interface. Do not enable Layer 3 addresses on the physical Fast Ethernet interfaces.

If you want to use CDP, you must configure it only on the physical Fast Ethernet interface and not on the port-channel interface.

Examples

This example creates a port-channel interface with a channel-group number of 64:

Switch(config)# interface port-channel 64
Switch(config)#

 
Related Commands

Command
Description

channel-group

Assigns and configures an EtherChannel interface to an EtherChannel group.

show etherchannel

Displays EtherChannel information for a channel.

interface range

To run a command on multiple ports at the same time, use the interface range command.

interface range { vlan vlan_id - vlan_id } { port-range | macro name }

 
Syntax Description

vlan vlan_id - vlan_id

Specifies a VLAN range; valid values are from 1 to 4094.

port-range

Port range; for a list of valid values for port-range, see the “Usage Guidelines” section.

macro name

Specifies the name of a macro.

 
Defaults

This command has no default settings.

 
Command Modes

Global configuration mode

Interface configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended VLAN addresses added.

 
Usage Guidelines

You can use the interface range command on the existing VLAN SVIs only. To display the VLAN SVIs, enter the show running config command. The VLANs that are not displayed cannot be used in the interface range command.

The values that are entered with the interface range command are applied to all the existing VLAN SVIs.

Before you can use a macro, you must define a range using the define interface-range command.

All configuration changes that are made to a port range are saved to NVRAM, but the port ranges that are created with the interface range command do not get saved to NVRAM.

You can enter the port range in two ways:

  • Specifying up to five port ranges
  • Specifying a previously defined macro

You can either specify the ports or the name of a port-range macro. A port range must consist of the same port type, and the ports within a range cannot span the modules.

You can define up to five port ranges on a single command; separate each range with a comma.

When you define a range, you must enter a space between the first port and the hyphen (-):

interface range gigabitethernet 5/1 -20, gigabitethernet4/5 -20.
 

Use these formats when entering the port-range :

  • interface-type { mod }/{ first-port } - { last-port }
  • interface-type { mod }/{ first-port } - { last-port }

Valid values for interface-type are as follows:

  • FastEthernet
  • GigabitEthernet
  • Vlan vlan_id

You cannot specify both a macro and an interface range in the same command. After creating a macro, you can enter additional ranges. If you have already entered an interface range, the CLI does not allow you to enter a macro.

You can specify a single interface in the port-range value. This makes the command similar to the interface interface-number command.

Examples

This example shows how to use the interface range command to interface to FE 5/18 - 20:

Switch(config)# interface range fastethernet 5/18 - 20
Switch(config-if)#
 

This command shows how to run a port-range macro:

Switch(config)# interface range macro macro1
Switch(config-if)#

 
Related Commands

Command
Description

define interface-range

Creates a macro of interfaces.

show running config (refer to Cisco IOS documentation)

Displays the running configuration for a switch.

interface vlan

To create or access a Layer 3 switch virtual interface (SVI), use the interface vlan command. To delete an SVI, use the no form of this command.

interface vlan vlan_id

no interface vlan vlan_id

 
Syntax Description

vlan_id

Number of the VLAN; valid values are from 1 to 4094.

 
Defaults

Fast EtherChannel is not specified.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

 
Usage Guidelines

The SVIs are created the first time that you enter the interface vlan vlan_id command for a particular VLAN. The vlan_id value corresponds to the VLAN tag that is associated with the data frames on an ISL or 802.1Q-encapsulated trunk or the VLAN ID that is configured for an access port. A message is displayed whenever a VLAN interface is newly created, so you can check that you entered the correct VLAN number.

If you delete an SVI by entering the no interface vlan vlan_id command, the associated interface is forced into an administrative down state and marked as deleted. The deleted interface will no longer be visible in a show interface command.

You can reinstate a deleted SVI by entering the interface vlan vlan_id command for the deleted interface. The interface comes back up, but much of the previous configuration will be gone.

Examples

This example shows the output when you enter the interface vlan vlan_id command for a new VLAN number:

Switch(config)# interface vlan 23
% Creating new VLAN interface.
Switch(config)#
 

ip admission proxy http refresh-all

To ensure that you see a customized WebAuth login page with the same name in the switch system directory as a same-named prior login page, use the ip admission proxy http refresh-all command.

ip admission proxy http [success | failure | refresh-all | login [expired | page]]

 
Syntax Description

success

Successful authentication proxy.

failure

Failed authentication proxy.

refresh-all

Refresh all custom html pages.

login expired

Specify expired webpage

login page

Specify customized login webpage

 
Defaults

If you do not enter this command, if any of the customized web-based authentication page files with the file of same name have been changed, you see the old login page rather than the new file.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

15.0(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You should enter this command whenever the customized web-based authentication page has been changed in the system directory.

Examples

This example shows how to enter this command:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip admission proxy http [success | failure | refresh-all | login]
Switch(config)# end
Switch#
 

<The new html page is observed.>

ip arp inspection filter vlan

To permit ARPs from hosts that are configured for static IP when DAI is enabled and to define an ARP access list and apply it to a VLAN, use the ip arp inspection filter vlan command. To disable this application, use the no form of this command.

ip arp inspection filter arp-acl-name vlan vlan-range [ static ]

no ip arp inspection filter arp-acl-name vlan vlan-range [ static ]

 
Syntax Description

arp-acl-name

Access control list name.

vlan-range

VLAN number or range; valid values are from 1 to 4094.

static

(Optional) Specifies that the access control list should be applied statically.

 
Defaults

No defined ARP ACLs are applied to any VLAN.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

When an ARP access control list is applied to a VLAN for dynamic ARP inspection, the ARP packets containing only the IP-to-Ethernet MAC bindings are compared against the ACLs. All other packet types are bridged in the incoming VLAN without validation.

This command specifies that the incoming ARP packets are compared against the ARP access control list, and the packets are permitted only if the access control list permits them.

If the access control lists deny the packets because of explicit denies, the packets are dropped. If the packets are denied because of an implicit deny, they are then matched against the list of DHCP bindings if the ACL is not applied statically.

Examples

This example shows how to apply the ARP ACL static hosts to VLAN 1 for DAI:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip arp inspection filter static-hosts vlan 1
Switch(config)# end
Switch#
Switch# show ip arp inspection vlan 1
Source Mac Validation : Enabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
 
 
 
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
1 Enabled Active static-hosts No
 
Vlan ACL Logging DHCP Logging
---- ----------- ------------
1 Acl-Match Deny
Switch#

 
Related Commands

Command
Description

arp access-list

Defines an ARP access list or adds clauses at the end of a predefined list.

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.

ip arp inspection limit (interface)

To limit the rate of incoming ARP requests and responses on an interface and prevent DAI from consuming all of the system’s resources in the event of a DoS attack, use the ip arp inspection limit command. To release the limit, use the no form of this command.

ip arp inspection limit { rate pps | none } [ burst interval seconds ]

no ip arp inspection limit

 
Syntax Description

rate pps

Specifies an upper limit on the number of incoming packets processed per second. The rate can range from 1 to 10000.

none

Specifies no upper limit on the rate of the incoming ARP packets that can be processed.

burst interval seconds

(Optional) Specifies the consecutive interval in seconds over which the interface is monitored for the high rate of the ARP packets. The interval is configurable from 1 to 15 seconds.

 
Defaults

The rate is set to 15 packets per second on the untrusted interfaces, assuming that the network is a switched network with a host connecting to as many as 15 new hosts per second.

The rate is unlimited on all the trusted interfaces.

The burst interval is set to 1 second by default.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(20)EW

Added support for interface monitoring.

 
Usage Guidelines

The trunk ports should be configured with higher rates to reflect their aggregation. When the rate of the incoming packets exceeds the user-configured rate, the interface is placed into an error-disabled state. The error-disable timeout feature can be used to remove the port from the error-disabled state. The rate applies to both the trusted and nontrusted interfaces. Configure appropriate rates on trunks to handle the packets across multiple DAI-enabled VLANs or use the none keyword to make the rate unlimited.

The rate of the incoming ARP packets onthe channel ports is equal to the sum of the incoming rate of packets from all the channel members. Configure the rate limit for the channel ports only after examining the rate of the incoming ARP packets on the channel members.

After a switch receives more than the configured rate of packets every second consecutively over a period of burst seconds, the interface is placed into an error-disabled state.

Examples

This example shows how to limit the rate of the incoming ARP requests to 25 packets per second:

Switch# config terminal
Switch(config)# interface fa6/3
Switch(config-if)# ip arp inspection limit rate 25
Switch(config-if)# end
Switch# show ip arp inspection interfaces fastEthernet 6/3
Interface Trust State Rate (pps)
--------------- ----------- ----------
Fa6/3 Trusted 25
Switch#
 

This example shows how to limit the rate of the incoming ARP requests to 20 packets per second and to set the interface monitoring interval to 5 consecutive seconds:

Switch# config terminal
Switch(config)# interface fa6/1
Switch(config-if)# ip arp inspection limit rate 20 burst interval 5
Switch(config-if)# end

 
Related Commands

Command
Description

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.

ip arp inspection log-buffer

To configure the parameters that are associated with the logging buffer, use the ip arp inspection log-buffer command. To disable the parameters, use the no form of this command.

ip arp inspection log-buffer { entries number | logs number interval seconds }

no ip arp inspection log-buffer { entries | logs }

 
Syntax Description

entries number

Number of entries from the logging buffer; the range is from 0 to 1024.

logs number

Number of entries to be logged in an interval; the range is from 0 to 1024. A 0 value indicates that entries should not be logged out of this buffer.

interval seconds

Logging rate; the range is from 0 to 86400 (1 day). A 0 value indicates an immediate log.

 
Defaults

When dynamic ARP inspection is enabled, denied, or dropped, the ARP packets are logged.

The number of entries is set to 32.

The number of logging entries is limited to 5 per second.

The interval is set to 1.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The first dropped packet of a given flow is logged immediately. The subsequent packets for the same flow are registered but are not logged immediately. Registering these packets is done in a log buffer that is shared by all the VLANs. Entries from this buffer are logged on a rate-controlled basis.

Examples

This example shows how to configure the logging buffer to hold up to 45 entries:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip arp inspection log-buffer entries 45
Switch(config)# end
Switch# show ip arp inspection log
Total Log Buffer Size : 45
Syslog rate : 5 entries per 1 seconds.
No entries in log buffer.
Switch#
 

This example shows how to configure the logging rate to 10 logs per 3 seconds:

Switch(config)# ip arp inspection log-buffer logs 10 interval 3
Switch(config)# end
Switch# show ip arp inspection log
Total Log Buffer Size : 45
Syslog rate : 10 entries per 3 seconds.
No entries in log buffer.
Switch#

 
Related Commands

Command
Description

arp access-list

Defines an ARP access list or adds clauses at the end of a predefined list.

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.

ip arp inspection trust

To set a per-port configurable trust state that determines the set of interfaces where incoming ARP packets are inspected, use the ip arp inspection trust command. To make the interfaces untrusted, use the no form of this command.

ip arp inspection trust

no ip arp inspection trust

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

This command has no default settings.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to configure an interface to be trusted:

Switch# config terminal
Switch(config)# interface fastEthernet 6/3
Switch(config-if)# ip arp inspection trust
Switch(config-if)# end
 

To verify the configuration, use the show form of this command:

Switch# show ip arp inspection interfaces fastEthernet 6/3
 
Interface Trust State Rate (pps) Burst Interval
--------------- ----------- ---------- --------------
Fa6/3 Trusted None 1
Switch#

 
Related Commands

Command
Description

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.

ip arp inspection validate

To perform specific checks for ARP inspection, use the ip arp inspection validate command. To disable checks, use the no form of this command.

ip arp inspection validate [ src-mac ] [ dst-mac ] [ ip ]

no ip arp inspection validate [ src-mac ] [ dst-mac ] [ ip ]

 
Syntax Description

src-mac

(Optional) Checks the source MAC address in the Ethernet header against the sender’s MAC address in the ARP body. This checking is done against both ARP requests and responses.

Note When src-mac is enabled, packets with different MAC addresses are classified as invalid and are dropped.

dst-mac

(Optional) Checks the destination MAC address in the Ethernet header against the target MAC address in ARP body. This checking is done for ARP responses.

Note When dst-mac is enabled, the packets with different MAC addresses are classified as invalid and are dropped.

ip

(Optional) Checks the ARP body for invalid and unexpected IP addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.

The sender IP addresses are checked in all ARP requests and responses and target IP addresses are checked only in ARP responses.

 
Defaults

Checks are disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

When enabling the checks, specify at least one of the keywords (src-mac, dst-mac, and ip) on the command line. Each command overrides the configuration of the previous command. If a command enables src and dst mac validations, and a second command enables IP validation only, the src and dst mac validations are disabled as a result of the second command.

The no form of this command disables only the specified checks. If none of the check options are enabled, all the checks are disabled.

Examples

This example show how to enable the source MAC validation:

Switch(config)# ip arp inspection validate src-mac
Switch(config)# end
Switch# show ip arp inspection vlan 1
Source Mac Validation : Enabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
 
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
1 Enabled Active
 
Vlan ACL Logging DHCP Logging
---- ----------- ------------
1 Deny Deny
Switch#

 
Related Commands

Command
Description

arp access-list

Defines an ARP access list or adds clauses at the end of a predefined list.

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.


 

ip arp inspection vlan

To enable dynamic ARP inspection (DAI) on a per-VLAN basis, use the ip arp inspection vlan command. To disable DAI, use the no form of this command.

ip arp inspection vlan vlan-range

no ip arp inspection vlan vlan-range

 
Syntax Description

vlan-range

VLAN number or range; valid values are from 1 to 4094.

 
Defaults

ARP inspection is disabled on all VLANs.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You must specify on which VLANs to enable DAI. DAI may not function on the configured VLANs if they have not been created or if they are private.

Examples

This example shows how to enable DAI on VLAN 1:

Switch# configure terminal
Switch(config)# ip arp inspection vlan 1
Switch(config)# end
Switch# show ip arp inspection vlan 1
 
Source Mac Validation : Disabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
1 Enabled Active
Vlan ACL Logging DHCP Logging
---- ----------- ------------
1 Deny Deny
Switch#
 

This example shows how to disable DAI on VLAN 1:

Switch# configure terminal
Switch(config)# no ip arp inspection vlan 1
Switch(config)#

 
Related Commands

Command
Description

arp access-list

Defines an ARP access list or adds clauses at the end of a predefined list.

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.

ip arp inspection vlan logging

To control the type of packets that are logged, use the ip arp inspection vlan logging command. To disable this logging control, use the no form of this command.

ip arp inspection vlan vlan-range logging { acl-match { matchlog | none } | dhcp-bindings { permit | all | none }}

no ip arp inspection vlan vlan-range logging { acl-match | dhcp-bindings }

 
Syntax Description

vlan-range

Number of the VLANs to be mapped to the specified instance. The number is entered as a single value or a range; valid values are from 1 to 4094.

acl-match

Specifies the logging criteria for packets that are dropped or permitted based on ACL matches.

matchlog

Specifies that logging of packets matched against ACLs is controlled by the matchlog keyword in the permit and deny access control entries of the ACL.

Note By default, the matchlog keyword is not available on the ACEs. When the keyword is used, denied packets are not logged. Packets are logged only when they match against an ACE that has the matchlog keyword.

none

Specifies that ACL-matched packets are not logged.

dhcp-bindings

Specifies the logging criteria for packets dropped or permitted based on matches against the DHCP bindings.

permit

Specifies logging when permitted by DHCP bindings.

all

Specifies logging when permitted or denied by DHCP bindings.

none

Prevents all logging of packets permitted or denied by DHCP bindings.

 
Defaults

All denied or dropped packets are logged.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The acl-match and dhcp-bindings keywords merge with each other. When you set an ACL match configuration, the DHCP bindings configuration is not disabled. You can use the no form of this command to reset some of the logging criteria to their defaults. If you do not specify either option, all the logging types are reset to log on when the ARP packets are denied. The two options that are available to you are as follows:

  • acl-match—Logging on ACL matches is reset to log on deny
  • dhcp-bindings—Logging on DHCP binding compared is reset to log on deny

Examples

This example shows how to configure an ARP inspection on VLAN 1 to add packets to a log on matching against the ACLs with the logging keyword:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip arp inspection vlan 1 logging acl-match matchlog
Switch(config)# end
Switch# show ip arp inspection vlan 1
 
Source Mac Validation : Enabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
 
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
1 Enabled Active
 
Vlan ACL Logging DHCP Logging
---- ----------- ------------
1 Acl-Match Deny
Switch#

 
Related Commands

Command
Description

arp access-list

Defines an ARP access list or adds clauses at the end of a predefined list.

show ip arp inspection

Displays the status of dynamic ARP inspection for a specific range of VLANs.


 

ip cef load-sharing algorithm

To configure the load-sharing hash function so that the source TCP/UDP port, the destination TCP/UDP port, or both ports can be included in the hash in addition to the source and destination IP addresses, use the ip cef load-sharing algorithm command. To revert back to the default, which does not include the ports, use the no form of this command.

ip cef load-sharing algorithm { include-ports { source source | destination dest } | original | tunnel | universal }

no ip cef load-sharing algorithm { include-ports { source source | destination dest } | original | tunnel | universal }

 
Syntax Description

include-ports

Specifies the algorithm that includes the Layer 4 ports.

source source

Specifies the source port in the load-balancing hash functions.

destination dest

Specifies the destination port in the load-balancing hash. Uses the source and destination in hash functions.

original

Specifies the original algorithm; not recommended.

tunnel

Specifies the algorithm for use in tunnel-only environments.

universal

Specifies the default Cisco IOS load-sharing algorithm.

 
Defaults

Default load-sharing algorithm is disabled.


Note This option does not include the source or destination port in the load-balancing hash.


 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The original algorithm, tunnel algorithm, and universal algorithm are routed through the hardware. For software-routed packets, the algorithms are handled by the software. The include-ports option does not apply to the software-switched traffic.

Examples

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 ports:

Switch(config)# ip cef load-sharing algorithm include-ports
Switch(config)#
 

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 tunneling ports:

Switch(config)# ip cef load-sharing algorithm include-ports tunnel
Switch(config)#

 
Related Commands

Command
Description

show ip cef vlan

Displays the IP CEF VLAN interface status and configuration information.

ip device tracking maximum

To enable IP port security binding tracking on a Layer 2 port, use the ip device tracking maximum command. To disable IP port security on untrusted Layer 2 interfaces, use the no form of this command.

ip device tracking maximum { number }

no ip device tracking maximum { number }

 
Syntax Description

number

Specifies the number of bindings created in the IP device tracking table for a port, valid values are from 0 to 2048.

 
Defaults

This command has no default settings.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(37)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to enable IP port security with IP-MAC filters on a Layer 2 access port:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip device tracking
Switch(config)# interface fastethernet 4/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 1
Switch(config-if)# ip device tracking maximum 5
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 5
Switch(config-if)# ip verify source tracking port-security
Switch(config-if)# end
 

You can verify your settings by entering the show ip verify source privileged EXEC command.

 
Related Commands

Command
Description

ip verify source

Enables IP source guard on untrusted Layer 2 interfaces.

show ip verify source

Displays the IP source guard configuration and filters on a particular interface.


 

ip dhcp snooping

To enable DHCP snooping globally, use the ip dhcp snooping command. To disable DHCP snooping, use the no form of this command.

ip dhcp snooping

no ip dhcp snooping

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

DHCP snooping is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You must enable DHCP snooping globally before you can use DHCP snooping on a VLAN.

Examples

This example shows how to enable DHCP snooping:

Switch(config)# ip dhcp snooping
Switch(config)#
 

This example shows how to disable DHCP snooping:

Switch(config)# no ip dhcp snooping
Switch(config)#

 
Related Commands

Command
Description

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping binding

To set up and generate a DHCP binding configuration to restore bindings across reboots, use the ip dhcp snooping binding command. To disable the binding configuration, use the no form of this command.

ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface expiry seconds

no ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface

 
Syntax Description

mac-address

Specifies a MAC address.

vlan vlan-#

Specifies a valid VLAN number.

ip-address

Specifies an IP address.

interface interface

Specifies an interface type and number.

expiry seconds

Specifies the interval (in seconds) after which binding is no longer valid.

 
Defaults

This command has no default settings.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(25)EW

Support for the 10-Gigabit Ethernet interface was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Whenever a binding is added or removed using this command, the binding database is marked as changed and a write is initiated.

Examples

This example shows how to generate a DHCP binding configuration on interface gigabitethernet1/1 in VLAN 1 with an expiration time of 1000 seconds:

Switch# ip dhcp snooping binding 0001.1234.1234 vlan 1 172.20.50.5 interface gi1/1 expiry 1000
Switch#

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping database

To store the bindings that are generated by DHCP snooping, use the ip dhcp snooping database command. To either reset the timeout, reset the write-delay, or delete the agent specified by the URL, use the no form of this command.

ip dhcp snooping database { url | timeout seconds | write-delay seconds }

no ip dhcp snooping database {timeout | write-delay}

 
Syntax Description

url

Specifies the URL in one of the following forms:

  • tftp://<host>/<filename>
  • ftp://<user>:<password>@<host>/<filename>
  • rcp://<user>@<host>/<filename>
  • nvram:/<filename>
  • bootflash:/<filename>

timeout seconds

Specifies when to abort the database transfer process after a change to the binding database.

The minimum value of the delay is 15 seconds. 0 is defined as an infinite duration.

write-delay seconds

Specifies the duration for which the transfer should be delayed after a change to the binding database.

 
Defaults

The timeout value is set to 300 seconds (5 minutes).

The write-delay value is set to 300 seconds.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You need to create an empty file at the configured URL on network-based URLs (such as TFTP and FTP) before the switch can write the set of bindings for the first time at the URL.


Note Because both NVRAM and bootflash have limited storage capacity, using TFTP or network-based files is recommended. If you use flash to store the database file, new updates (by the agent) result in the creation of new files (flash fills quickly). In addition, due to the nature of the file system used on the flash, a large number of files causes access to be considerably slowed. When a file is stored in a remote location accessible through TFTP, an RPR/SSO standby supervisor engine can take over the binding list when a switchover occurs.


Examples

This example shows how to store a database file with the IP address 10.1.1.1 within a directory called directory. A file named file must be present on the TFTP server.

Switch# config terminal
Switch(config)# ip dhcp snooping database tftp://10.1.1.1/directory/file
Switch(config)# end
Switch# show ip dhcp snooping database
Agent URL : tftp://10.1.1.1/directory/file
Write delay Timer : 300 seconds
Abort Timer : 300 seconds
 
Agent Running : Yes
Delay Timer Expiry : Not Running
Abort Timer Expiry : Not Running
 
Last Succeded Time : None
Last Failed Time : None
Last Failed Reason : No failure recorded.
 
Total Attempts : 1 Startup Failures : 0
Successful Transfers : 0 Failed Transfers : 0
Successful Reads : 0 Failed Reads : 0
Successful Writes : 0 Failed Writes : 0
Media Failures : 0
 
Switch#

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping binding

Sets up and generates a DHCP binding configuration to restore bindings across reboots.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping information option

To enable DHCP option 82 data insertion, use the ip dhcp snooping information option command. To disable DHCP option 82 data insertion, use the no form of this command.

ip dhcp snooping information option format remote-id { hostname | string { word }}

no ip dhcp snooping information option format remote-id { hostname | string { word }}

 
Syntax Description

format

Specifies the option 82 information format.

remote-id

Specifies the remote ID for option 82.

hostname

Specifies the user-configured hostname for the remote ID.

string word

Specifies the user-defined string for the remote ID. The word string can be from 1 to 63 characters long with no spaces.

 
Defaults

DHCP option 82 data insertion is e nabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(40)SG

Added remote-id keyword to support option 82 enhancement.

 
Usage Guidelines

If the hostname is longer than 63 characters it is truncated to 63 characters in the remote ID.

Examples

This example shows how to enable DHCP option 82 data insertion:

Switch(config)# ip dhcp snooping information option
Switch(config)#
 

This example shows how to disable DHCP option 82 data insertion:

Switch(config)# no ip dhcp snooping information option
Switch(config)#
 

This example shows how to configure the hostname as the remote ID:

Switch(config)# ip dhcp snooping information option format remote-id hostname
Switch(config)#
 

The following example shows how to enable DHCP Snooping on VLAN 500 through 555 and option 82 remote ID:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 500 555
Switch(config)# ip dhcp snooping information option format remote-id string switch123
Switch(config)# interface GigabitEthernet 5/1
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# ip dhcp snooping limit rate 100
Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id string customer-555
Switch(config-if)# interface FastEthernet 2/1
Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id string customer-500
Switch(config)# end

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping binding

Sets up and generates a DHCP binding configuration to restore bindings across reboots.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

ip dhcp snooping vlan information option format-type circuit-id string

Enables circuit-id (a sub-option of DHCP snooping option-82) on a VLAN.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping information option allow-untrusted

To allow DHCP packets with option 82 data inserted to be received from a snooping untrusted port, use the ip dhcp snooping information option allow-untrusted command. To disallow receipt of these DHCP packets, use the no form of this command.

ip dhcp snooping information option allow-untrusted

no ip dhcp snooping information option allow-untrusted

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

DHCP packets with option 82 are not allowed on snooping untrusted ports.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(25)EWA

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to allow DHCP packets with option 82 data inserted to be received from a snooping untrusted port:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip dhcp snooping information option allow-untrusted
Switch(config)# end
Switch#

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping limit rate

To configure the number of the DHCP messages that an interface can receive per second, use the ip dhcp snooping limit rate command. To disable the DHCP snooping rate limiting, use the no form of this command.

ip dhcp snooping limit rate rate

no ip dhcp snooping limit rate

 
Syntax Description

rate

Number of DHCP messages a switch can receive per second.

 
Defaults

DHCP snooping rate limiting is disabled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Typically, the rate limit applies to the untrusted interfaces. If you want to set up rate limiting for the trusted interfaces, note that the trusted interfaces aggregate all DHCP traffic in the switch, and you will need to adjust the rate limit of the interfaces to a higher value.

Examples

This example shows how to enable the DHCP message rate limiting:

Switch(config-if)# ip dhcp snooping limit rate 150
Switch(config)#
 

This example shows how to disable the DHCP message rate limiting:

Switch(config-if)# no ip dhcp snooping limit rate
Switch(config)#

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping trust

To configure an interface as trusted for DHCP snooping purposes, use the ip dhcp snooping trust command. To configure an interface as untrusted, use the no form of this command.

ip dhcp snooping trust

no ip dhcp snooping trust

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

DHCP snooping trust is disabled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to enable DHCP snooping trust on an interface:

Switch(config-if)# ip dhcp snooping trust
Switch(config)#
 

This example shows how to disable DHCP snooping trust on an interface:

Switch(config-if)# no ip dhcp snooping trust
Switch(config)#

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping vlan

Use the ip dhcp snooping vlan command to enable DHCP snooping on a VLAN. To disable DHCP snooping on a VLAN, use the no form of this command.

ip dhcp snooping [ vlan number ]

no ip dhcp snooping [ vlan number ]

 
Syntax Description

vlan number

(Optional) Single VLAN number or a range of VLANs; valid values are from 1 to 4094.

 
Defaults

DHCP snooping is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

DHCP snooping is enabled on a VLAN only if both global snooping and the VLAN snooping are enabled.

Examples

This example shows how to enable DHCP snooping on a VLAN:

Switch(config)# ip dhcp snooping vlan 10
Switch(config)#
 

This example shows how to disable DHCP snooping on a VLAN:

Switch(config)# no ip dhcp snooping vlan 10
Switch(config)#
 

This example shows how to enable DHCP snooping on a group of VLANs:

Switch(config)# ip dhcp snooping vlan 10 55
Switch(config)#
 

This example shows how to disable DHCP snooping on a group of VLANs:

Switch(config)# no ip dhcp snooping vlan 10 55
Switch(config)#

 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan information option format-type circuit-id string

Enables circuit-id (a suboption of DHCP snooping option-82) on a VLAN.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip dhcp snooping vlan information option format-type circuit-id string

To enable circuit-id (a suboption of DHCP snooping option 82) on a VLAN, use the ip dhcp snooping vlan information option format-type circuit-id string command. To disable circuit-id on a VLAN, use the no form of this command.

ip dhcp snooping vlan number information option format-type circuit-id [override] string string

no ip dhcp snooping vlan number information option format-type circuit-id [override] string

 
Syntax Description

number

Specifies single or range of VLANs; valid values are from 1 to 4094.

override

(Optional) Specifies an override string.

string string

Specifies a user-defined string for the circuit ID; range of 3 to 63 ASCII characters with no spaces.

 
Defaults

VLAN-mod-port, if DHCP snooping option-82 is disabled.

 
Command Modes

Interface configuration

 
Command History

Release
Modification

12.2(40)SG

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(54)SG

Added the override option

 
Usage Guidelines

The circuit-id suboption of DHCP option 82 is supported only when DHCP snooping is globally enabled and on VLANs using DHCP option 82.

This command allows you to configure a string of ASCII characters to be the circuit ID. When you want to override the vlan-mod-port format type and instead use the circuit-ID to define subscriber information, use the override keyword.

Examples

The following example shows how to enable DHCP snooping on VLAN 500 through 555 and option 82 circuit-id:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 500 555
Switch(config)# ip dhcp snooping information option format remote-id string switch123
Switch(config)# interface GigabitEthernet 5/1
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# ip dhcp snooping limit rate 100
Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id string customer-555
Switch(config-if)# interface FastEthernet 2/1
Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id string customer-500
Switch(config)# end
 

This example shows how to configure the option-82 circuit-ID override suboption:

Switch(config-if)# ip dhcp snooping vlan 250 information option format-type circuit-id
override string testcustomer
 

You can verify your settings by entering the show ip dhcp snooping user EXEC command.


Note The show ip dhcp snooping user EXEC command only displays the global command output, including a remote-ID configuration. It does not display any per-interface, per-VLAN string that you have configured for the circuit ID.


 
Related Commands

Command
Description

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip dhcp snooping vlan

Enables DHCP snooping on a VLAN or a group of VLANs.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

ip igmp filter

To control whether all hosts on a Layer 2 interface can join one or more IP multicast groups by applying an IGMP profile to the interface, use the ip igmp filter command. To remove a profile from the interface, use the no form of this command.

ip igmp filter profile number

no ip igmp filter

 
Syntax Description

profile number

IGMP profile number to be applied; valid values are from 1 to 429496795.

 
Defaults

Profiles are not applied.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(11b)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You can apply IGMP filters only to Layer 2 physical interfaces; you cannot apply IGMP filters to routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group.

An IGMP profile can be applied to one or more switch port interfaces, but one port can have only one profile applied to it.

Examples

This example shows how to apply IGMP profile 22 to an interface:

Switch(config)# interface gigabitethernet1/1
Switch(config-if)# ip igmp filter 22
Switch(config-if)#

 
Related Commands

Command
Description

ip igmp profile

Creates an IGMP profile.

show ip igmp profile

Displays all configured IGMP profiles or a specified IGMP profile.

ip igmp max-groups

To set the maximum number of IGMP groups that a Layer 2 interface can join, use the ip igmp max-groups command. To set the maximum back to the default, use the no form of this command.

ip igmp max-groups number

no ip igmp max-groups

 
Syntax Description

number

Maximum number of IGMP groups that an interface can join; valid values are from 0 to 4294967294.

 
Defaults

No maximum limit.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(11b)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You can use the ip igmp max-groups command only on Layer 2 physical interfaces; you cannot set the IGMP maximum groups for the routed ports, the switch virtual interfaces (SVIs), or the ports that belong to an EtherChannel group.

Examples

This example shows how to limit the number of IGMP groups that an interface can join to 25:

Switch(config)# interface gigabitethernet1/1
Switch(config-if)# ip igmp max-groups 25
Switch(config-if)

ip igmp profile

To create an IGMP profile, use the ip igmp profile command. To delete the IGMP profile, use the no form of this command.

ip igmp profile profile number

no ip igmp profile profile number

 
Syntax Description

profile number

IGMP profile number being configured; valid values are from 1 to 4294967295.

 
Defaults

No profile created.

 
Command Modes

Global configuration mode

IGMP profile configuration

 
Command History

Release
Modification

12.1(11b)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

When entering a range, enter the low IP multicast address, a space, and the high IP multicast address.

You can apply an IGMP profile to one or more Layer 2 interfaces, but each interface can have only one profile applied to it.

Examples

This example shows how to configure IGMP profile 40 that permits the specified range of IP multicast addresses:

Switch # config terminal
Switch(config)# ip igmp profile 40
Switch(config-igmp-profile)# permit
Switch(config-igmp-profile)# range 233.1.1.1 233.255.255.255
Switch(config-igmp-profile)#

 
Related Commands

Command
Description

ip igmp filter

Controls whether all hosts on a Layer 2 interface can join one or more IP multicast groups by applying an IGMP profile to the interface.

show ip igmp profile

Displays all configured IGMP profiles or a specified IGMP profile.


 

ip igmp query-interval

To configure the frequency that the switch sends the IGMP host-query messages, use the ip igmp query-interval command. To return to the default frequency, use the no form of this command.

ip igmp query-interval seconds

no ip igmp query-interval

 
Syntax Description

seconds

Frequency, in seconds, at which the IGMP host-query messages are transmitted; valid values depend on the IGMP snooping mode. See the “Usage Guidelines” section for more information.

 
Defaults

The query interval is set to 60 seconds.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

If you use the default IGMP snooping configuration, the valid query interval values are from 1 to 65535 seconds. If you have changed the default configuration to support CGMP as the IGMP snooping learning method, the valid query interval values are from 1 to 300 seconds.

The designated switch for a LAN is the only switch that sends the IGMP host-query messages. For IGMP version 1, the designated switch is elected according to the multicast routing protocol that runs on the LAN. For IGMP version 2, the designated querier is the lowest IP-addressed multicast switch on the subnet.

If no queries are heard for the timeout period (controlled by the ip igmp query-timeout command), the switch becomes the querier.


Note Changing the timeout period may severely impact multicast forwarding.


Examples

This example shows how to change the frequency at which the designated switch sends the IGMP host-query messages:

Switch(config-if)# ip igmp query-interval 120
Switch(config-if)#

 
Related Commands

Command
Description

ip igmp querier-timeout (refer to Cisco IOS documentation)

Configures the timeout period before the router takes over as the querier for the interface after the previous querier has stopped querying.

ip pim query-interval (refer to Cisco IOS documentation)

Configures the frequency of Protocol Independent Multicast (PIM) router query messages.

show ip igmp groups (refer to Cisco IOS documentation)

Displays the multicast groups with receivers that are directly connected to the router and that were learned through Internet Group Management Protocol (IGMP), use the show ip igmp groups command in EXEC mode.

ip igmp snooping

To enable IGMP snooping, use the ip igmp snooping command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping [ tcn { flood query count count | query solicit }]

no ip igmp snooping [ tcn { flood query count count | query solicit }]

 
Syntax Description

tcn

(Optional) Specifies the topology change configurations.

flood

(Optional) Specifies to flood the spanning tree table to the network when a topology change occurs.

query

(Optional) Specifies the TCN query configurations.

count count

(Optional) Specifies how often the spanning tree table is flooded; valid values are from 1 to 10.

solicit

(Optional) Specifies an IGMP general query.

 
Defaults

IGMP snooping is e nabled.

 
Command Modes

Global configuration mode

Interface configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(11)EW

Support for flooding the spanning tree table was added.

 
Usage Guidelines

The tcn flood option applies only to Layer 2 switch ports and EtherChannels; it does not apply to routed ports, VLAN interfaces, or Layer 3 channels.

The ip igmp snooping command is disabled by default on multicast routers.


Note You can use the tcn flood option in interface configuration mode.


Examples

This example shows how to enable IGMP snooping:

Switch(config)# ip igmp snooping
Switch(config)#
 

This example shows how to disable IGMP snooping:

Switch(config)# no ip igmp snooping
Switch(config)#
 

This example shows how to enable the flooding of the spanning tree table to the network after nine topology changes have occurred:

Switch(config)# ip igmp snooping tcn flood query count 9
Switch(config)#
 

This example shows how to disable the flooding of the spanning tree table to the network:

Switch(config)# no ip igmp snooping tcn flood
Switch(config)#
 

This example shows how to enable an IGMP general query:

Switch(config)# ip igmp snooping tcn query solicit
Switch(config)#
 

This example shows how to disable an IGMP general query:

Switch(config)# no ip igmp snooping tcn query solicit
Switch(config)#

 
Related Commands

Command
Description

ip igmp snooping vlan immediate-leave

Enable IGMP immediate-leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 interface as a multicast router interface for a VLAN.

ip igmp snooping vlan static

Configures a Layer 2 interface as a member of a group.

ip igmp snooping report-suppression

To enable report suppression, use the ip igmp snooping report-suppression command. To disable report suppression and forward the reports to the multicast devices, use the no form of this command.

ip igmp snooping report-suppression

no igmp snooping report-suppression

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

IGMP snooping report-suppression is enabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

If the ip igmp snooping report-suppression command is disabled, all the IGMP reports are forwarded to the multicast devices.

If the command is enabled, report suppression is done by IGMP snooping.

Examples

This example shows how to enable report suppression:

Switch(config)# ip igmp snooping report-suppression
Switch(config)#
 

This example shows how to disable report suppression:

Switch(config)# no ip igmp snooping report-suppression
Switch(config)#
 

This example shows how to display the system status for report suppression:

Switch# show ip igmp snoop
vlan 1
----------
IGMP snooping is globally enabled
IGMP snooping TCN solicit query is globally disabled
IGMP snooping global TCN flood query count is 2
IGMP snooping is enabled on this Vlan
IGMP snooping immediate-leave is disabled on this Vlan
IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan
IGMP snooping is running in IGMP_ONLY mode on this Vlan
IGMP snooping report suppression is enabled on this Vlan
Switch#

 
Related Commands

Command
Description

ip igmp snooping vlan immediate-leave

Enable IGMP immediate-leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 interface as a multicast router interface for a VLAN.

ip igmp snooping vlan static

Configures a Layer 2 interface as a member of a group.

ip igmp snooping vlan

To enable IGMP snooping for a VLAN, use the ip igmp snooping vlan command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping vlan vlan-id

no ip igmp snooping vlan vlan-id

 
Syntax Description

vlan-id

Number of the VLAN; valid values are from 1 to 1001 and from 1006 to 4094.

 
Defaults

IGMP snooping is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

 
Usage Guidelines

This command is entered in VLAN interface configuration mode only.

The ip igmp snooping vlan command is disabled by default on multicast routers.

Examples

This example shows how to enable IGMP snooping on a VLAN:

Switch(config)# ip igmp snooping vlan 200
Switch(config)#
 

This example shows how to disable IGMP snooping on a VLAN:

Switch(config)# no ip igmp snooping vlan 200
Switch(config)#

 
Related Commands

Command
Description

ip igmp snooping vlan immediate-leave

Enable IGMP immediate-leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 interface as a multicast router interface for a VLAN.

ip igmp snooping vlan static

Configures a Layer 2 interface as a member of a group.

ip igmp snooping vlan explicit-tracking

To enable per-VLAN explicit host tracking, use the ip igmp snooping vlan explicit-tracking command. To disable explicit host tracking, use the no form of this command.

ip igmp snooping vlan vlan-id explicit-tracking

no ip igmp snooping vlan vlan-id explicit-tracking

 
Syntax Description

vlan_id

(Optional) Specifies a VLAN; valid values are from 1 to 1001 and from 1006 to 4094.

 
Defaults

Explicit host tracking is enabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(20)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to disable IGMP explicit host tracking on interface VLAN 200 and how to verify the configuration:

Switch(config)# no ip igmp snooping vlan 200 explicit-tracking
Switch(config)# end
Switch# show ip igmp snooping vlan 200 | include explicit tracking
Global IGMP Snooping configuration:
-----------------------------------
IGMP snooping : Enabled
IGMPv3 snooping : Enabled
Report suppression : Enabled
TCN solicit query : Disabled
TCN flood query count : 2
 
Vlan 2:
--------
IGMP snooping : Enabled
IGMPv2 immediate leave : Disabled
Explicit host tracking : Disabled
Multicast router learning mode : pim-dvmrp
CGMP interoperability mode : IGMP_ONLY
Explicit host tracking : Disabled
Switch#

 
Related Commands

Command
Description

ip igmp snooping vlan immediate-leave

Enables IGMP immediate-leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 interface as a multicast router interface for a VLAN.

ip igmp snooping vlan static

Configures a Layer 2 interface as a member of a group.

show ip igmp snooping membership

Displays host membership information.

ip igmp snooping vlan immediate-leave

To enable IGMP immediate-leave processing, use the ip igmp snooping vlan immediate-leave command. To disable immediate-leave processing, use the no form of this command.

ip igmp snooping vlan vlan_num immediate-leave

no ip igmp snooping vlan vlan_num immediate-leave

 
Syntax Description

vlan_num

Number of the VLAN; valid values are from 1 to 4094.

immediate-leave

Enables immediate leave processing.

 
Defaults

Immediate leave processing is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

 
Usage Guidelines

You enter this command in global configuration mode only.

Use the immediate-leave feature only when there is a single receiver for the MAC group for a specific VLAN.

The immediate-leave feature is supported only with IGMP version 2 hosts.

Examples

This example shows how to enable IGMP immediate-leave processing on VLAN 4:

Switch(config)# ip igmp snooping vlan 4 immediate-leave
Switch(config)#
 

This example shows how to disable IGMP immediate-leave processing on VLAN 4:

Switch(config)# no ip igmp snooping vlan 4 immediate-leave
Switch(config)#

 
Related Commands

Command
Description

ip igmp snooping

Enables IGMP snooping.

ip igmp snooping vlan mrouter

Configures a Layer 2 interface as a multicast router interface for a VLAN.

ip igmp snooping vlan static

Configures a Layer 2 interface as a member of a group.

show ip igmp interface

Displays the information about the IGMP-interface status and configuration.

show mac-address-table multicast

Displays information about the multicast MAC address table.

ip igmp snooping vlan mrouter

To statically configure an Layer 2 interface as a multicast router interface for a VLAN, use the
ip igmp snooping vlan mrouter command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan-id mrouter { interface {{ fastethernet slot/port } | { gigabitethernet slot/port } | { tengigabitethernet slot/port } | { port-channel number }} |
{
learn { cgmp | pim-dvmrp }}

no ip igmp snooping vlan vlan-id mrouter { interface {{ fastethernet slot/port } | { gigabitethernet slot/port } | { tengigabitethernet slot/port } | { port-channel number }} |
{
learn { cgmp | pim-dvmrp }}

 
Syntax Description

vlan vlan-id

Specifies the VLAN ID number to use in the command; valid values are from 1 to 4094.

interface

Specifies the next-hop interface to a multicast switch.

fastethernet slot/port

Specifies the Fast Ethernet interface; number of the slot and port.

gigabitethernet slot/port

Specifies the Gigabit Ethernet interface; number of the slot and port.

tengigabitethernet slot/port

Specifies the 10-Gigabit Ethernet interface; number of the slot and port.

port-channel number

Port-channel number; valid values are from 1 to 64.

learn

Specifies the multicast switch learning method.

cgmp

Specifies the multicast switch snooping CGMP packets.

pim-dvmrp

Specifies the multicast switch snooping PIM-DVMRP packets.

 
Defaults

Multicast switch snooping PIM-DVMRP packets are specified.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

12.2(25)EW

Support for the 10-Gigabit Ethernet interface was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You enter this command in VLAN interface configuration mode only.

The interface to the switch must be in the VLAN where you are entering the command. It must be both administratively up and line protocol up.

The CGMP learning method can decrease control traffic.

The learning method that you configure is saved in NVRAM.

The static connections to multicast interfaces are supported only on switch interfaces.

Examples

This example shows how to specify the next-hop interface to a multicast switch:

Switch(config-if)# ip igmp snooping 400 mrouter interface fastethernet 5/6
Switch(config-if)#
 

This example shows how to specify the multicast switch learning method:

Switch(config-if)# ip igmp snooping 400 mrouter learn cgmp
Switch(config-if)#

 
Related Commands

Command
Description

ip igmp snooping

Enable IGMP snooping.

ip igmp snooping vlan immediate-leave

Enable IGMP immediate-leave processing.

ip igmp snooping vlan static

Configures a Layer 2 interface as a member of a group.

show ip igmp snooping

Displays information on dynamically learned and manually configured VLAN switch interfaces.

show ip igmp snooping mrouter

Displays information on the dynamically learned and manually configured multicast switch interfaces.

ip igmp snooping vlan static

To configure a Layer 2 interface as a member of a group, use the ip igmp snooping vlan static command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan_num static mac-address { interface { fastethernet slot/port } | { gigabitethernet slot/port } | { tengigabitethernet slot/port } | { port-channel number }}

no ip igmp snooping vlan vlan_num static mac-address { interface { fastethernet slot/port } | { gigabitethernet slot/port } | { tengigabitethernet mod/interface-number } | { port-channel number }}

 
Syntax Description

vlan_num

Number of the VLAN.

mac-address

Group MAC address.

interface

Specifies the next-hop interface to multicast switch.

fastethernet slot/port

Specifies the Fast Ethernet interface; number of the slot and port.

gigabitethernet slot/port

Specifies the Gigabit Ethernet interface; number of the slot and port.

tengigabitethernet slot/port

Specifies the 10-Gigabit Ethernet interface; number of the slot and port.

port-channel number

Port-channel number; valid values are from 1 through 64.

 
Defaults

This command has no default settings.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(25)EW

Support for the 10-Gigabit Ethernet interface was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to configure a host statically on an interface:

Switch(config)# ip igmp snooping vlan 4 static 0100.5e02.0203 interface fastethernet 5/11
Configuring port FastEthernet5/11 on group 0100.5e02.0203 vlan 4
Switch(config)#

 
Related Commands

Command
Description

ip igmp snooping

Enable IGMP snooping.

ip igmp snooping vlan immediate-leave

Enable IGMP immediate-leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 interface as a multicast router interface for a VLAN.

show mac-address-table multicast

Displays information about the multicast MAC address table.

ip local-proxy-arp

To enable the l ocal proxy ARP feature, use the ip local-proxy-arp command. To disable the l ocal proxy ARP feature, use the no form of this command.

ip local-proxy-arp

no ip local-proxy-arp

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

Local proxy ARP is disabled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Use this feature only on subnets where hosts are intentionally prevented from communicating directly to the switch on which they are connected.

ICMP redirect is disabled on interfaces where the local proxy ARP feature is enabled.

Examples

This example shows how to enable the local proxy ARP feature:

Switch(config-if)# ip local-proxy-arp
Switch(config-if)#

ip mfib fastdrop

To enable MFIB fast drop, use the ip mfib fastdrop command. To disable MFIB fast drop, use the no form of this command.

ip mfib fastdrop

no ip mfib fastdrop

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

MFIB fast drop is enabled.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to enable MFIB fast drops:

Switch# ip mfib fastdrop
Switch#

 
Related Commands

Command
Description

clear ip mfib fastdrop

Clears all the MFIB fast-drop entries.

show ip mfib fastdrop

Displays all currently active fast-drop entries and shows whether fast drop is enabled.

ip multicast multipath

To enable load splitting of IP multicast traffic over Equal Cost Multipath (ECMP), use the
ip multicast multipath command in global configuration mode. To disable this functionality, use the no form of this command.

ip multicast [ vrf vrf-name ] multipath [ s-g-hash { basic | next-hop-based }]

no ip multicast [ vrf vrf-name ] multipath [ s-g-hash { basic | next-hop-based }]

 
Syntax Description

vrf vrf-name

(Optional) Enables ECMP multicast load splitting for IP multicast traffic associated with the Multicast Virtual Private Network (MVPN) routing and forwarding (MVRF) instance specified for the vrf-name argument.

s-g-hash basic | next-hop-based

(Optional) Enables ECMP multicast load splitting based on source and group address or on source, group, and next-hop address.

The basic keyword e nables a simple hash based on source and group address. This algorithm is referred to as the basic S-G-hash algorithm.

The next-hop-based keyword enables a more complex hash based on source, group, and next-hop address. This algorithm is referred to as the next-hop-based S-G-hash algorithm.

 
Command Default

If multiple equal-cost paths exist, multicast traffic will not be load-split across those paths.

 
Command Modes

Global configuration (config)

 
Command History

Release
Modification

12.2(53)SG

The s-g-hash keyword was introduced on the Catalyst 4500 switch.

 
Usage Guidelines

The ip multicast multipath command does not work with bidirectional Protocol Independent Multicast (PIM).

Use the ip multicast multipath command to enable load splitting of IP multicast traffic across multiple equal-cost paths.

If two or more equal-cost paths from a source are available, unicast traffic will be load-split across those paths. However, by default, multicast traffic is not load-split across multiple equal-cost paths. In general, multicast traffic flows down from the reverse path forwarding (RPF) neighbor. According to the PIM specifications, this neighbor must have the highest IP address if more than one neighbor has the same metric.

When you configue load splitting with the ip multicast multipath command, the system splits multicast traffic across multiple equal-cost paths based on source address using the S-hash algorithm. When the ip multicast multipath command is configured and multiple equal-cost paths exist, the path in which multicast traffic will travel is selected based on the source IP address. Multicast traffic from different sources will be load-split across the different equal-cost paths. Load splitting will not occur across equal-cost paths for multicast traffic from the same source sent to different multicast groups.


Note The ip multicast multipath command load splits the traffic but does not load balance the traffic. Traffic from a source will use only one path, even if the traffic greatly exceeds traffic from other sources.


If the ip multicast multipath command is configured with the s-g-hash keyword and multiple equal-cost paths exist, load splitting will occur across equal-cost paths based on source and group address or on source, group, and next-hop address. If you specify the optional s-g-hash keyword for load splitting IP multicast traffic, you must select the algorithm used to calculate the equal-cost paths by specifying one of the following keywords:

  • basic —The basic S-G-hash algorithm is predictable because no randomization is used in calculating the hash value. The basic S-G-hash algorithm, however, is subject to polarization because for a given source and group the same hash is always chosen irrespective of the router that the hash is being calculated on.
  • next-hop-based —The next-hop-based S-G-hash algorithm is predictable because no randomization is used to determine the hash value. Unlike the S-hash and basic S-G-hash algorithms, the next-hop-based hash mechanism is not subject to polarization.

Examples

The following example shows how to enable ECMP multicast load splitting on a router based on source address using the S-hash algorithm:

Switch(config)# ip multicast multipath
 

The following example shows how to enable ECMP multicast load splitting on a router based on source and group address using the basic S-G-hash algorithm:

Switch(config)# ip multicast multipath s-g-hash basic
 

The following example shows how to enable ECMP multicast load splitting on a router based on source, group, and next-hop address using the next-hop-based S-G-hash algorithm:

Switch(config)# ip multicast multipath s-g-hash next-hop-based

ip route-cache flow

To enable NetFlow statistics for IP routing, use the ip route-cache flow command. To disable NetFlow statistics, use the no form of this command.

ip route-cache flow [ infer-fields ]

no ip route-cache flow [ infer-fields ]

 
Syntax Description

infer-fields

(Optional) Includes the NetFlow fields as inferred by the software: Input identifier, Output identifier, and Routing information.

 
Defaults

NetFlow statistics is disabled.

Inferred information is excluded.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switches.

12.1(19)EW

Command enhanced to support infer fields.

 
Usage Guidelines

To use these commands, you need to install the Supervisor Engine IV and the NetFlow Service Card.

The NetFlow statistics feature captures a set of traffic statistics. These traffic statistics include the source IP address, destination IP address, Layer 4 port information, protocol, input and output identifiers, and other routing information that can be used for network analysis, planning, accounting, billing and identifying DoS attacks.

NetFlow switching is supported on IP and IP-encapsulated traffic over all interface types.

If you enter the ip route-cache flow infer-fields command after the ip route-cache flow command, you will purge the existing cache, and vice versa. This action is done to avoid having flows with and without inferred fields in the cache simultaneously.

For additional information on NetFlow switching, refer to the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.


Note NetFlow consumes additional memory and CPU resources compared to other switching modes. You need to know the resources required on your switch before enabling NetFlow.


Examples

This example shows how to enable NetFlow switching on the switch:

Switch# config terminal
Switch(config)# ip route-cache flow
Switch(config)# exit
Switch#

Note This command does not work on individual interfaces.


ip source binding

To add or delete a static IP source binding entry, use the ip source binding command. To delete the corresponding IP source binding entry, use the no form of this command.

ip source binding ip-address mac-address vlan vlan-id interface interface-name

no ip source binding ip-address mac-address vlan vlan-id interface interface-name

 
Syntax Description

ip-address

Binding IP address.

mac-address

Binding MAC address.

vlan vlan-id

VLAN number.

interface interface-name

Binding interface.

 
Defaults

This command has no default settings.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The ip source binding command is used to add a static IP source binding entry only.

The no form of this command deletes the corresponding IP source binding entry. For the deletion to succeed, all required parameters must match.

Each static IP binding entry is keyed by a MAC address and VLAN number. If the CLI contains an existing MAC and VLAN, the existing binding entry will be updated with the new parameters; a separate binding entry will not be created.

Examples

This example shows how to configure the static IP source binding:

Switch# config terminal
Switch(config)# ip source binding 11.0.0.1 0000.000A.000B vlan 10 interface fastethernet6/10
Switch(config)#

 
Related Commands

Command
Description

show ip source binding

Displays IP source bindings that are configured on the system.

ip sticky-arp

To enable sticky ARP, use the ip sticky-arp command. Use the no form of this command to disable sticky ARP.

ip sticky-arp

no ip sticky-arp

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

Enabled

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command is supported on PVLANs only.

ARP entries that are learned on Layer 3 PVLAN interfaces are sticky ARP entries. (You should display and verify ARP entries on the PVLAN interface using the show arp command).

For security reasons, sticky ARP entries on the PVLAN interface do not age out. Connecting new equipment with the same IP address generates a message and the ARP entry is not created.

Because the ARP entries on the PVLAN interface do not age out, you must manually remove ARP entries on the PVLAN interface if a MAC address changes.

Unlike static entries, sticky-ARP entries are not stored and restored when you enter the reboot and restart commands.

Examples

This example shows how to enable sticky ARP:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config) ip sticky-arp
Switch(config)# end
Switch#
 

This example shows how to disable sticky ARP:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config) no ip sticky-arp
Switch(config)# end
Switch#

 
Related Commands

Command
Description

arp (refer to Cisco IOS documentation)

Enables Address Resolution Protocol (ARP) entries for static routing over the Switched Multimegabit Data Service (SMDS) network.

show arp (refer to Cisco IOS documentation)

Displays ARP information.

ip verify header vlan all

To enable IP header validation for Layer 2-switched IPv4 packets, use the ip verify header vlan all command. To disable the IP header validation, use the no form of this command.

ip verify header vlan all

no ip verify header vlan all

 
Syntax Description

This command has no default settings.

 
Defaults

The IP header is validated for bridged and routed IPv4 packets.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(20)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command does not apply to Layer 3-switched (routed) packets.

The Catalyst 4500 series switch checks the validity of the following fields in the IPv4 header for all switched IPv4 packets:

  • The version must be 4.
  • The header length must be greater than or equal to 20 bytes.
  • The total length must be greater than or equal to four times the header length and greater than the Layer 2 packet size minus the Layer 2 encapsulation size.

If an IPv4 packet fails the IP header validation, the packet is dropped. If you disable the header validation, the packets with the invalid IP headers are bridged but are not routed even if routing was intended. The IPv4 access lists also are not applied to the IP headers.

Examples

This example shows how to disable the IP header validation for the Layer 2-switched IPv4 packets:

Switch# config terminal
Switch(config)# no ip verify header vlan all
Switch(config)# end
Switch#

ip verify source

To enable IP source guard on untrusted Layer 2 interfaces, use the ip verify source command. To disable IP source guard on untrusted Layer 2 interfaces, use the no form of this command.

ip verify source { vlan dhcp-snooping | tracking } [port-security]

no ip verify source { vlan dhcp-snooping | tracking } [port-security]

 
Syntax Description

vlan dhcp-snooping

Enables IP source guard on untrusted Layer 2 DHCP snooping interfaces.

tracking

Enables IP port security to learn static IP address learning on a port.

port-security

(Optional) Filters both source IP and MAC addresses using the port security feature.

 
Defaults

IP source guard is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(37)SG

Added support for IP port security and tracking.

Examples

This example shows how to enable IP source guard on VLANs 10 through 20 on a per-port basis:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10 20
Switch(config)# interface fastethernet6/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 10
Switch(config-if)# switchport trunk allowed vlan 11-20
Switch(config-if)# no ip dhcp snooping trust
Switch(config-if)# ip verify source vlan dhcp-snooping
Switch(config)# end
Switch# show ip verify source interface f6/1
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----------
Fa6/1 ip-mac active 10.0.0.1 10
Fa6/1 ip-mac active deny-all 11-20
Switch#
 

This example shows how to enable IP port security with IP-MAC filters on a Layer 2 access port:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip device tracking
Switch(config)# interface fastEthernet 4/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 1
Switch(config-if)# ip device tracking maximum 5
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 5
Switch(config-if)# ip verify source tracking port-security
Switch(config-if)# end
 

You can verify your settings by entering the show ip verify source privileged EXEC command.

 
Related Commands

Command
Description

ip device tracking maximum

Enables IP port security binding tracking on a Layer 2 port.

ip dhcp snooping

Globally enables DHCP snooping.

ip dhcp snooping information option

Enables DHCP option 82 data insertion.

ip dhcp snooping limit rate

Configures the number of the DHCP messages that an interface can receive per second.

ip dhcp snooping trust

Enables DHCP snooping on a trusted VLAN.

ip source binding

Adds or delete a static IP source binding entry.

show ip dhcp snooping

Displays the DHCP snooping configuration.

show ip dhcp snooping binding

Displays the DHCP snooping binding entries.

show ip source binding

Displays IP source bindings that are configured on the system.

show ip verify source

Displays the IP source guard configuration and filters on a particular interface.

ip verify unicast source reachable-via

To enable and configure unicast RPF checks on a IPv4 interface, use the ip verify unicast source reachable-via command. To disable unicast RPF, use the no form of this command.

ip verify unicast source reachable-via rx allow-default

no ip verify unicast source reachable-via

 
Syntax Description

rx

Verifies that the source address is reachable on the interface where the packet was received.

allow-default

Verifies that the default route matches the source address.

 
Defaults

Disabled

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(40)SG

Support introduced on Catalyst 4900M chassis and a Catalyst 4500 with a Supervisor Engine 6-E.

 
Usage Guidelines

  1. In basic RX mode, unicast RPF ensures a source address must be reachable on the arrived interface. For example, the source must be reachable without load balancing.

Note Unicast RPF is an input function and is applied only on the input interface of a router at the upstream end of a connection.


Do not use unicast RPF on internal network interfaces. Internal interfaces might have routing asymmetry, which means that there are multiple routes to the source of a packet. Apply unicast RPF only where there is natural or configured symmetry.

Examples

This example shows how to enable unicast RPF exist-only checking mode:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gigabitethernet1/1
Switch(config-if)# ip verify unicast source reachable-via rx allow-default
Switch(config-if)# end
Switch#

 
Related Commands

Command
Description

ip cef (refer to Cisco IOS documentation)

Enables Cisco Express Forwarding (CEF) on the switch.

show running-config

Displays the current running configuration for a switch.

ip wccp

To enable support of the specified Web Cache Communication Protocol (WCCP) service for participation in a service group, use the ip wccp command in global configuration mode. To disable the service group, use the no form of this command.

ip wccp { web-cache | service-number } [ accelerated ] [ group-address multicast-address ] [ redirect-list access-list ] [ group-list access-list ] [ password [ 0 | 7 ] password ]

no ip wccp { web-cache | service-number }[ accelerated ] [ group-address multicast-address ] [ redirect-list access-list ] [ group-list access-list ] [ password [ 0 | 7 ] password ]

 
Syntax Description

web-cache

Specifies the web-cache service.

Note Web cache counts as one service. The maximum number of services, including those assigned with the service-number argument, are 8.

service-number

Dynamic service identifier, which means the service definition is dictated by the cache. The dynamic service number can be from 0 to 254. The maximum number of services is 8, which includes the web-cache service specified with the web-cache keyword.

Note If Cisco cache engines are being used in your service group, the reverse-proxy service is indicated by a value of 99.

accelerated

(Optional) This option applies only to hardware-accelerated routers. This keyword configures the service group to prevent a connection being formed with a cache engine unless the cache engine is configured in a way that allows redirection on the router to benefit from hardware acceleration.

group-address multicast-address

(Optional) Multicast IP address that communicates with the WCCP service group. The multicast address is used by the router to determine which cache engine should receive redirected messages.

redirect-list access-list

(Optional) Access list that controls traffic redirected to this service group. The access-list argument should consist of a string of no more than 64 characters (name or number) that specifies the access list.

group-list access-list

(Optional) Access list that determines which cache engines are allowed to participate in the service group. The access-list argument specifies either the number or the name of a standard or extended access list.

password [ 0 | 7 ] password

(Optional) Message digest algorithm 5 (MD5) authentication for messages received from the service group. Messages that are not accepted by the authentication are discarded. The encryption type can be 0 or 7, with 0 specifying not yet encrypted and 7 for proprietary. The password argument can be up to eight characters in length.

 
Command Default

WCCP services are not enabled on the router.

 
Command Modes

Global configuration (config)

 
Command History

Release
Modification

12.2(31)SG

Support introduced on the Catalyst 4500 series switch.

15.0(2)SG/3.2(0)SG

Supported extended to Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E.

15.0(2)SG1

Support for redirect-list keyword.

IOS XE 3.3.0 SG (15.1(1)SG)

Supported extended to Supervisor Engine 7-E and Supervisor Engine 7L-E.

 
Usage Guidelines

This command instructs a router to enable or disable the support for the specified service number or the web-cache service name. A service number can be from 0 to 254. Once the service number or name is enabled, the router can participate in the establishment of a service group.

When the no ip wccp command is entered, the router terminates participation in the service group, deallocates space if none of the interfaces still has the service configured, and terminates the WCCP task if no other services are configured.

The keywords following the web-cache keyword and the service-number argument are optional and may be specified in any order, but only may be specified once. The following sections outline the specific usage of each of the optional forms of this command.

ip wccp { web-cache | service-number } group-address multicast-address

A WCCP group address can be configured to set up a multicast address that cooperating routers and web caches can use to exchange WCCP protocol messages. If such an address is used, IP multicast routing must be enabled so that the messages that use the configured group (multicast) addresses are received correctly.

This option instructs the router to use the specified multicast IP address to coalesce the “I See You” responses for the “Here I Am” messages that it has received on this group address. The response is sent to the group address as well. The default is for no group address to be configured, in which case all “Here I Am” messages are responded to with a unicast reply.

ip wccp { web-cache | service-number } redirect-list access-list

This option instructs the router to use an access list to control the traffic that is redirected to the web caches of the service group specified by the service name given. The access-list argument specifies either the number or the name of a standard or extended access list. The access list itself specifies which traffic is permitted to be redirected. The default is for no redirect list to be configured (all traffic is redirected).

WCCP requires that the following protocol and ports not be filtered by any access lists:

  • User Datagram Protocol (UDP) (protocol type 17) port 2048. This port is used for control signaling. Blocking this type of traffic will prevent WCCP from establishing a connection between the router and cache engines.

ip wccp { web-cache | service-number } group-list access-list

This option instructs the router to use an access list to control the cache engines that are allowed to participate in the specified service group. The access-list argument specifies either the number of a standard or extended access list or the name of any type of named access list. The access list itself specifies which cache engines are permitted to participate in the service group. The default is for no group list to be configured, in which case all cache engines may participate in the service group.


Note The ip wccp {web-cache | service-number} group-list command syntax resembles the ip wccp {web-cache | service-number} group-listen command, but these are entirely different commands. The ip wccp group-listen command is an interface configuration command used to configure an interface to listen for multicast notifications from a cache cluster. Refer to the description of the ip wccp group-listen command in the Cisco IOS IP Application Services Command Reference.


ip wccp { web-cache | service-number } password password

This option instructs the router to use MD5 authentication on the messages received from the service group specified by the service name given. Use this form of the command to set the password on the router. You must also configure the same password separately on each web cache. The password can be up to a maximum of eight characters. Messages that do not authenticate when authentication is enabled on the router are discarded. The default is for no authentication password to be configured and for authentication to be disabled.

Examples

The following example shows how to configure a router to run WCCP reverse-proxy service, using the multicast address of 239.0.0.0:

Router(config)# ip multicast-routing
Router(config)# ip wccp 99 group-address 239.0.0.0
Router(config)# interface gigabitethernet 3/1
Router(config-if)# ip wccp 99 group-listen
 

The following example shows how to configure a router to redirect web-related packets without a destination of 10.168.196.51 to the web cache:

Router(config)# access-list 100 deny ip any host 10.168.196.51
Router(config)# access-list 100 permit ip any any
Router(config)# ip wccp web-cache redirect-list 100
Router(config)# interface gigabitethernet 3/2
Router(config-if)# ip wccp web-cache redirect out
 

 
Related Commands

Command
Description

ip wccp check services all

Enables all WCCP services.

ip wccp version

Specifies which version of WCCP you wish to use on your router.

show ip wccp

Displays global statistics related to WCCP.

ip wccp check services all

To enable all Web Cache Communication Protocol (WCCP) services, use the ip wccp check services all command in global configuration mode. To disable all services, use the no form of this command.

ip wccp check services all

no ip wccp check services all

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

WCCP services are not enabled on the router.

 
Command Modes

Global configuration (config)

 
Command History

Release
Modification

12.2(31)SG

Support introduced on the Catalyst 4500 series switch.

IOS XE 3.2(0)SG
(15.0(2)SG)

Support extended to Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E.

IOS XE 3.3.0 SG (15.1(1)SG)

Supported extended to Supervisor Engine 7-E and Supervisor Engine 7L-E.

 
Usage Guidelines

With the ip wccp check services all command, WCCP can be configured to check all configured services for a match and perform redirection for those services if appropriate. The caches to which packets are redirected can be controlled by a redirect ACL access control list (ACL) as well as by the priority value of the service.

It is possible to configure an interface with more than one WCCP service. When more than one WCCP service is configured on an interface, the precedence of a service depends on the relative priority of the service compared to the priority of the other configured services. Each WCCP service has a priority value as part of its definition.

If no WCCP services are configured with a redirect ACL, the services are considered in priority order until a service is found which matches the IP packet. If no services match the packet, the packet is not redirected. If a service matches the packet and the service has a redirect ACL configured, then the IP packet will be checked against the ACL. If the packet is rejected by the ACL, the packet will not be passed down to lower priority services unless the ip wccp check services all command is configured. When the ip wccp check services all command is configured, WCCP will continue to attempt to match the packet against any remaining lower priority services configured on the interface.


Note The priority of a WCCP service group is determined by the web cache appliance. The priority of a WCCP service group cannot be configured via Cisco IOS software.



Note The ip wccp check services all command is a global WCCP command that applies to all services and is not associated with a single service.


Examples

The following example shows how to configure all WCCP services:

Router(config)# ip wccp check services all

 
Related Commands

Command
Description

ip wccp

Enables support of the specified WCCP service for participation in a service group.

ip wccp group-listen

Configures an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP).

ip wccp redirect

Enables packet redirection on an inbound or outbound interface using Web Cache Communication Protocol (WCCP).

ip wccp redirect exclude in

Configure an interface to exclude packets received on an interface from being checked for redirection.

ip wccp version

Specifies which version of WCCP you wish to use on your router.

ip wccp group-listen

To configure an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP), use the ip wccp group-listen command in interface configuration mode. To disable the reception of IP multicast packets for WCCP, use the no form of this command.

ip wccp { web-cache | service-number } group-listen

no ip wccp { web-cache | service-number } group-listen

 
Syntax Description

web-cache

The web cache service.

service-number

WCCP service number; valid values are from 0 to 254.

 
Defaults

This command is disabled by default.

 
Command Modes

Interface configuration (config-if)

 
Command History

Release
Modification

12.2(31)SG

Support introduced on the Catalyst 4500 series switch.

IOS XE 3.2(0)SG
(15.0(2)SG)

Support extended to Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E.

IOS XE 3.3.0 SG
(15.1(1)SG)

Supported extended to Supervisor Engine 7-E and Supervisor Engine 7L-E.

 
Usage Guidelines

On routers that are to be members of a Service Group when IP multicast is used, the following configuration is required:

  • Configure the IP multicast address for use by the WCCP Service Group.
  • Configure the interfaces on which the router wishes to receive the IP multicast address with the ip wccp { web-cache | service-number } group-listen interface configuration command.

Examples

The following example shows how to enable the multicast packets for a web cache with a multicast address of 224.1.1.100:

Switch# configure terminal
Switch(config)# ip wccp web-cache group-address 224.1.1.100
Switch(config)# interface gigabitethernet 3/1
Switch(config-if)# ip wccp web-cache group-listen
 
 
 
 
 

 
Related Commands

Command
Description

ip wccp

Enables support of the WCCP service for participation in a service group.

ip wccp check services all

Enables all Web Cache Communication Protocol (WCCP) services.

ip wccp redirect

Enables WCCP redirection on an interface.

ip wccp redirect

Enables packet redirection on an inbound or outbound interface using Web Cache Communication Protocol (WCCP).

ip wccp redirect exclude in

Configures an interface to exclude packets received on an interface from being checked for redirection.

ip wccp version

Specifies which version of WCCP you wish to use on your router.

ip wccp redirect

To enable packet redirection on an inbound or outbound interface using Web Cache Communication Protocol (WCCP), use the ip wccp redirect command in interface configuration mode. To disable WCCP redirection, use the no form of this command.

ip wccp { web-cache | service-number } redirect { in | out }

no ip wccp { web-cache | service-number } redirect { in | out }

 
Syntax Description

web-cache

Enables the web cache service.

service-number

Identification number of the cache engine service group; valid values are from 0 to 254.

If Cisco cache engines are used in the cache cluster, the reverse proxy service is indicated by a value of 99.

in

Specifies packet redirection on an inbound interface.

out

Specifies packet redirection on an outbound interface.

 
Command Default

Redirection checking on the interface is disabled.

 
Command Modes

Interface configuration (config-if)

 
Command History

Release
Modification

12.2(31)SG

Support introduced on the Catalyst 4500 series switch.

IOS XE 3.2(0)SG
(15.0(2)SG)

Support extended to Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E.

15.0(2)SG1

web-cache and service-number keywords supports on Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E.

IOS XE 3.3.0 SG (15.1(1)SG)

Supported extended to Supervisor Engine 7-E and Supervisor Engine 7L-E.

 
Usage Guidelines

The ip wccp {web-cache | service-number} redirect in command allows you to configure WCCP redirection on an interface receiving inbound network traffic. When the command is applied to an interface, all packets arriving at that interface will be compared against the criteria defined by the specified WCCP service. If the packets match the criteria, they will be redirected.

Likewise, the ip wccp {web-cache | service-number} redirect out command allows you to configure the WCCP redirection check at an outbound interface.


Tips Be careful not to confuse the ip wccp {web-cache | service-number} redirect {out | in} interface configuration command with the ip wccp redirect exclude in interface configuration command.


Examples

The following example shows how to configure a session in which reverse proxy packets on Ethernet interface 3/1 are being checked for redirection and redirected to a Cisco Cache Engine:

Switch(config)# ip wccp 99
Switch(config)# interface gigabitethernet 3/1
Switch(config-if)# ip wccp 99 redirect out
 

The following example shows how to configure a session in which HTTP traffic arriving on GigabitEthernet interface 3/1 is redirected to a Cache Engine:

Switch(config)# ip wccp web-cache
Switch(config)# interface gigabitethernet 3/1
Switch(config-if)# ip wccp web-cache redirect in

 
Related Commands

Command
Description

ip wccp check services all

Configures an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP).

ip wccp group-listen

Configures an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP).

ip wccp redirect exclude in

Enables redirection exclusion on an interface.

show ip interface

Displays the usability status of interfaces that are configured for IP.

show ip wccp

Displays the WCCP global configuration and statistics.

p wccp redirect exclude in

To configure an interface to exclude packets received on an interface from being checked for redirection, use the ip wccp redirect exclude in command in interface configuration mode. To disable the ability of a router to exclude packets from redirection checks, use the no form of this command.

ip wccp redirect exclude in

no ip wccp redirect exclude in

 
Syntax Description

This command has no arguments or keywords.

 
Command Default

Redirection exclusion is disabled.

 
Command Modes

Interface configuration (config-if)

 
Command History

Release
Modification

12.2(31)SG

Support introduced on the Catalyst 4500 series switch.

IOS XE 3.2(0)SG
(15.0(2)SG)

Support extended to Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E.

IOS XE 3.3.0 SG
(15.1(1)SG)

Supported extended to Supervisor Engine 7-E and Supervisor Engine 7L-E.

 
Usage Guidelines

This configuration command instructs the interface to exclude inbound packets from any redirection check. Note that the command is global to all the services and should be applied to any inbound interface that will be excluded from redirection.

This command is intended to be used to accelerate the flow of packets from a cache engine to the Internet as well as allow for the use of the Web Cache Communication Protocol (WCCP) v2 packet return feature.

Examples

In the following example, packets arriving on GigabitEthernet interface 3/1 are excluded from WCCP output redirection checks:

Router (config)# interface gigabitethernet 3/1
Router (config-if)# ip wccp redirect exclude in

 
Related Commands

Command
Description

ip wccp

Enables support of the WCCP service for participation in a service group.

ip wccp redirect

Enable packet redirection on an inbound or outbound interface using Web Cache Communication Protocol (WCCP).

ip wccp redirect out

Configures redirection on an interface in the outgoing direction.

ip wccp check services all

Configures an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP).

ip wccp group-listen

Configures an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP).

ip wccp redirect exclude in

Enables redirection exclusion on an interface.

show ip interface

Displays the usability status of interfaces that are configured for IP.

show ip wccp

Displays the WCCP global configuration and statistics.

ipv6 mld snooping

To enable IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping globally or on the specified VLAN, use the ipv6 mld snooping command without keywords. To disable MLD snooping on a switch or the VLAN, use the no form of this command.

ipv6 mld snooping [ vlan vlan-id ]

no ipv6 mld snooping [ vlan vlan-id ]

 
Syntax Description

vlan vlan-id

(Optional) Enables or disables IPv6 MLD snooping on the specified VLAN. The VLAN ID range is 1 to 1001 and 1006 to 4094.

 
Defaults

MLD snooping is globally disabled on the switch.

MLD snooping is enabled on all VLANs. However, MLD snooping must be globally enabled before VLAN snooping can take place.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(40)SG

This command was introduced on the Catalyst 4500.

 
Usage Guidelines

When MLD snooping is globally disabled, it is disabled on all the existing VLAN interfaces. When you globally enable MLD snooping, it is enabled on all VLAN interfaces that are in the default state (enabled). VLAN configuration overrides global configuration on interfaces on which MLD snooping has been disabled.

If MLD snooping is globally disabled, you cannot enable it on a VLAN. If MLD snooping is globally enabled, you can disable it on individual VLANs.

VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in MLD snooping.

Examples

This example shows how to globally enable MLD snooping:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping
Switch(config)# end
Switch#
 

This example shows how to disable MLD snooping on a VLAN:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# no ipv6 mld snooping vlan 11
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 mld snooping user EXEC command.

 
Related Commands

Command
Description

show ipv6 mld snooping

Displays IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping configuration of the switch or the VLAN.

ipv6 mld snooping last-listener-query-count

To configure IP version 6 (IPv6) Multicast Listener Discovery Mulitcast Address Specific Queries (MASQs) that will be sent before aging out a client, use the ipv6 mld snooping last-listener-query-count command. To reset the query count to the default settings, use the no form of this command.

ipv6 mld snooping [ vlan vlan-id ] last-listener-query-count integer_value

no ipv6 mld snooping [ vlan vlan-id ] last-listener-query-count

 
Syntax Description

vlan vlan-id

(Optional) Configures last-listener query count on the specified VLAN. The VLAN ID range is 1 to 1001 and 1006 to 4094.

integer_value

The integer range is 1 to 7.

 
Command Default

The default global count is 2.

The default VLAN count is 0 (the global count is used).

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(40)SG

This command was introduced on the Catalyst 4500.

 
Usage Guidelines

In MLD snooping, the IPv6 multicast switch periodically sends out queries to hosts belonging to the multicast group. If a host wants to leave a multicast group, it can silently leave or it can respond to the query with a Multicast Listener Done message (equivalent to an IGMP Leave message). When Immediate Leave is not configured (it should not be configured if multiple clients for a group exist on the same port), the configured last-listener query count determines the number of MASQs that are sent before an MLD client is aged out.

When the last-listener query count is set for a VLAN, this count overrides the value configured globally. When the VLAN count is not configured (set to the default of 0), the global count is used.

VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in MLD snooping.

Examples

This example shows how to globally set the last-listener query count:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping last-listener-query-count 1
Switch(config)# end
Switch#
 

This example shows how to set the last-listener query count for VLAN 10:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping vlan 10 last-listener-query-count 3
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 mld snooping [ vlan vlan-id ] user EXEC command.

 
Related Commands

Command
Description

ipv6 mld snooping last-listener-query-interval

Configures IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping last-listener query interval on the switch or on a VLAN.

show ipv6 mld snooping

Displays IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping configuration of the switch or the VLAN.

show ipv6 mld snooping querier

Displays IP version 6 (IPv6) MLD snooping querier-related information most recently received by the switch or the VLAN.

ipv6 mld snooping last-listener-query-interval

To configure IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping last-listener query interval on the switch or on a VLAN, use the ipv6 mld snooping last-listener-query-interval command. To reset the query time to the default settings, use the no form of this command.

ipv6 mld snooping [ vlan vlan-id ] last-listener-query-interval integer_value

no ipv6 mld snooping [ vlan vlan-id ] last-listener-query-interval

 
Syntax Description

vlan vlan-id

(Optional) Configures last-listener query interval on the specified VLAN. The VLAN ID range is 1 to 1001 and 1006 to 4094.

integer_value

Sets the time period (in thousandths of a second) that a multicast switch must wait after issuing a MASQ before deleting a port from the multicast group. The range is 100 to 32,768. The default is 1000 (1 second),

 
Command Default

The default global query interval (maximum response time) is 1000 (1 second).

The default VLAN query interval (maximum response time) is 0 (the global count is used).

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(40)SG

This command was introduced on the Catalyst 4500.

 
Usage Guidelines

The last-listener-query-interval time is the maximum time that a multicast switch waits after issuing a Mulitcast Address Specific Query (MASQ) before deleting a port from the multicast group.

In MLD snooping, when the IPv6 multicast switch receives an MLD leave message, it sends out queries to hosts belonging to the multicast group. If there are no responses from a port to a MASQ for a length of time, the switch deletes the port from the membership database of the multicast address. The last listener query interval is the maximum time that the switch waits before deleting a nonresponsive port from the multicast group.

When a VLAN query interval is set, the global query interval is overridden. When the VLAN interval is set at 0, the global value is used.

VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in MLD snooping.

Examples

This example shows how to globally set the last-listener query interval to 2 seconds:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping last-listener-query-interval 2000
Switch(config)# end
Switch#
 

This example shows how to set the last-listener query interval for VLAN 1 to 5.5 seconds:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping vlan 1 last-listener-query-interval 5500
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 MLD snooping [ vlan vlan-id ] user EXEC command.

 
Related Commands

Command
Description

ipv6 mld snooping last-listener-query-count

Configures IP version 6 (IPv6) Multicast Listener Discovery Mulitcast Address Specific Queries (MASQs) that will be sent before aging out a client.

show ipv6 mld snooping querier

Displays IP version 6 (IPv6) MLD snooping querier-related information most recently received by the switch or the VLAN.

ipv6 mld snooping listener-message-suppression

To enable IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping listener message suppression, use the ipv6 mld snooping listener-message-suppression command. To disable MLD snooping listener message suppression, use the no form of this command.

ipv6 mld snooping listener-message-suppression

no ipv6 mld snooping listener-message-suppression

 
Command Default

The default is for MLD snooping listener message suppression to be disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(40)SG

This command was introduced on the Catalyst 4500.

 
Usage Guidelines

MLD snooping listener message suppression is equivalent to IGMP snooping report suppression. When it is enabled, received MLDv1 reports to a group are forwarded to IPv6 multicast switchs only once in every report-forward time. This prevents the forwarding of duplicate reports.

Examples

This example shows how to enable MLD snooping listener message suppression:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping listener-message-suppression
Switch(config)# end
Switch#
 

This example shows how to disable MLD snooping listener message suppression:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# no ipv6 mld snooping listener-message-suppression
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 mld snooping [ vlan vlan-id ] user EXEC command.

 
Related Commands

Command
Description

ipv6 mld snooping

Enables IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping globally or on the specified VLAN.

show ipv6 mld snooping

Displays IP version 6 (IPv6) MLD snooping configuration of the switch or the VLAN.

ipv6 mld snooping robustness-variable

To configure the number of IP version 6 (IPv6) Multicast Listener Discovery (MLD) queries that the switch sends before deleting a listener that does not respond, or to enter a VLAN ID to configure the number of queries per VLAN, use the ipv6 mld snooping robustness-variable command. To reset the variable to the default settings, use the no form of this command.

ipv6 mld snooping [ vlan vlan-id ] robustness-variable integer_value

no ipv6 mld snooping [ vlan vlan-id ] robustness-variable

 
Syntax Description

vlan vlan-id

(Optional) Configures the robustness variable on the specified VLAN. The VLAN ID range is 1 to 1001 and 1006 to 4094.

integer_value

The robustness value ranges from 1 to 3.

 
Command Default

The default global robustness variable (number of queries before deleting a listener) is 2.

The default VLAN robustness variable (number of queries before aging out a multicast address) is 0, which means that the system uses the global robustness variable for aging out the listener.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(40)SG

This command was introduced on the Catalyst 4500.

 
Usage Guidelines

Robustness is measured by the number of MLDv1 queries sent with no response before a port is removed from a multicast group. A port is deleted when there are no MLDv1 reports received for the configured number of MLDv1 queries. The global value determines the number of queries that the switch waits before deleting a listener that does not respond, and it applies to all VLANs that do not have a VLAN value set.

The robustness value configured for a VLAN overrides the global value. If the VLAN robustness value is 0 (the default), the global value is used.

VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in MLD snooping.

Examples

This example shows how to configure the global robustness variable so that the switch sends out three queries before it deletes a listener port that does not respond:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping robustness-variable 3
Switch(config)# end
Switch#
 

This example shows how to configure the robustness variable for VLAN 1. This value overrides the global configuration for the VLAN:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping vlan 1 robustness-variable 1
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 MLD snooping [ vlan vlan-id ] user EXEC command.

 
Related Commands

Command
Description

ipv6 mld snooping last-listener-query-count

Configures IP version 6 (IPv6) Multicast Listener Discovery Mulitcast Address Specific Queries (MASQs) that will be sent before aging out a client.

show ipv6 mld snooping

Displays IP version 6 (IPv6) MLD snooping configuration of the switch or the VLAN.

ipv6 mld snooping tcn

To configure IP version 6 (IPv6) Multicast Listener Discovery (MLD) Topology Change Notifications (TCNs), use the ipv6 mld snooping tcn commands. To reset the default settings, use the no form of the commands.

ipv6 mld snooping tcn { flood query count integer_value | query solicit }

no ipv6 mld snooping tcn { flood query count integer_value | query solicit }

 
Syntax Description

flood query count integer_value

Sets the flood query count, which is the number of queries that are sent before forwarding multicast data to only those ports requesting it. The range is 1 to 10.

query solicit

Enables soliciting of TCN queries.

 
Command Default

TCN query soliciting is disabled.

When enabled, the default flood query count is 2.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(25)SG

This command was introduced on the Catalyst 4500.

Examples

This example shows how to enable TCN query soliciting:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping tcn query solicit.
Switch(config)# end
Switch#
 

This example shows how to set the flood query count to 5:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping tcn flood query count 5.
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 MLD snooping [ vlan vlan-id ] user EXEC command.

 
Related Commands

Command
Description

show ipv6 mld snooping

Displays IP version 6 (IPv6) MLD snooping configuration of the switch or the VLAN.

ipv6 mld snooping vlan

To configure IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping parameters on the VLAN interface, use the ipv6 mld snooping vlan command. To reset the parameters to the default settings, use the no form of this command.

ipv6 mld snooping vlan vlan-id [ immediate-leave | mrouter interface interface-id | static ipv6-multicast-address interface interface-id ]

no ipv6 mld snooping vlan vlan-id [ immediate-leave | mrouter interface interface-id | static ip-address interface interface-id ]

 
Syntax Description

vlan vlan-id

Specifies a VLAN number. The range is 1 to 1001 and 1006 to 4094.

immediate-leave

(Optional) Enables MLD Immediate-Leave processing on a VLAN interface. Use the no form of the command to disable the Immediate Leave feature on the interface.

mrouter interface

(Optional) Configures a multicast switch port. The no form of the command removes the configuration.

static ipv6-multicast-address

(Optional) Configures a multicast group with the specified IPv6 multicast address.

interface interface-id

Adds a Layer 2 port to the group. The mrouter or static interface can be a physical port or a port-channel interface ranging from 1 to 48.

 
Command Default

MLD snooping Immediate-Leave processing is disabled.

By default, there are no static IPv6 multicast groups.

By default, there are no multicast switch ports.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(40)SG

This command was introduced on the Catalyst 4500.

 
Usage Guidelines

You should only configure the Immediate-Leave feature when there is only one receiver on every port in the VLAN. The configuration is saved in NVRAM.

The static keyword is used for configuring the MLD member ports statically.

The configuration and the static ports and groups are saved in NVRAM.

VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in MLD snooping.

Examples

This example shows how to enable MLD Immediate-Leave processing on VLAN 1:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping vlan 1 immediate-leave
Switch(config)# end
Switch#
 

This example shows how to disable MLD Immediate-Leave processing on VLAN 1:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# no ipv6 mld snooping vlan 1 immediate-leave
Switch(config)# end
Switch#
 

This example shows how to configure a port as a multicast switch port:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping vlan 1 mrouter interface GigabitEthernet1/1
Switch(config)# end
Switch#
 

This example shows how to configure a static multicast group:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ipv6 mld snooping vlan 2 static FF12::34 interface GigabitEthernet1/1
Switch(config)# end
Switch#
 

You can verify your settings by entering the show ipv6 mld snooping vlan vlan-id user EXEC command.

 
Related Commands

Command
Description

ipv6 mld snooping

Enables IP version 6 (IPv6) Multicast Listener Discovery (MLD) snooping globally or on the specified VLAN.

show ipv6 mld snooping

Displays IP version 6 (IPv6) MLD snooping configuration of the switch or the VLAN.

issu abortversion

To cancel the ISSU upgrade or the downgrade process in progress and to restore the Catalyst 4500 series switch to its state before the start of the process, use the issue abortversion command.

issu abortversion active-slot [ active-image-new ]

 
Syntax Description

active-slot

Specifies the slot number for the current standby supervisor engine.

active-image-new

(Optional) Name of the new image present in the current standby supervisor engine.

 
Defaults

There are no default settings

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.2(31)SGA

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You can use the issu abortversion command at any time to stop the ISSU process. To complete the process enter the issu commitversion command. Before any action is taken, a check ensures that both supervisor engines are either in the run version (RV) or load version (LV) state.

When the issu abortversion command is entered before the issu runversion command, the standby supervisor engine is reset and reloaded with the old image. When the issu abortversion command is entered after the issu runversion command, a change takes place and the new standby supervisor engine is reset and reloaded with the old image.

Examples

This example shows how you can reset and reload the standby supervisor engine:

Switch# issu abortversion 2
Switch#

 
Related Commands

Command
Description

issu acceptversion

Halts the rollback timer and ensures that the new Cisco IOS software image is not automatically stopped during the ISSU process.

issu commitversion

Loads the new Cisco IOS software image into the new standby supervisor engine.

issu loadversion

Starts the ISSU process.

issu runversion

Forces a change from the active supervisor engine to the standby supervisor engine and causes the newly active supervisor engine to run the new image specified.

show issu state

Displays the ISSU state and current booted image name during the ISSU process.

issu acceptversion

To halt the rollback timer and to ensure that the new Cisco IOS software image is not automatically stopped during the ISSU process, use the issu acceptversion command.

issu acceptversion active-slot [ active-image-new ]

 
Syntax Description

active-slot

Specifies the slot number for the currently active supervisor engine.

active-image-new

(Optional) Name of the new image on the currently active supervisor engine.

 
Defaults

Rollback timer resets automatically 45 minutes after you enter the issu runversion command.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.2(31)SGA

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

After you are satisfied with the new image and have confirmed the new supervisor engine is reachable by both the console and the network, enter the issu acceptversion command to halt the rollback timer. If the issu acceptversion command is not entered within 45 minutes from the time the issu runversion command is entered, the entire ISSU process is automatically rolled back to the previous version of the software. The rollback timer starts immediately after you enter the issu runversion command.

If the rollback timer expires before the standby supervisor engine goes to a hot standby state, the timer is automatically extended by up to 15 minutes. If the standby state goes to a hot-standby state within this extension time or the 15 minute extension expires, the switch aborts the ISSU process. A warning message that requires your intervention is displayed every 1 minute of the timer extension.

If the rollback timer is set to a long period of time, such as the default of 45 minutes, and the standby supervisor engine goes into the hot standby state in 7 minutes, you have 38 minutes (45 minus 7) to roll back if necessary.

Use the issu set rollback-timer to configure the rollback timer.

Examples

This example shows how to halt the rollback timer and allow the ISSU process to continue:

Switch# issu acceptversion 2
Switch#

 
Related Commands

Command
Description

issu abortversion

Cancels the ISSU upgrade or the downgrade process in progress and restores the switch to its state before the start of the process.

issu commitversion

Loads the new Cisco IOS software image into the new standby supervisor engine.

issu loadversion

Starts the ISSU process.

issu runversion

Forces a change from the active supervisor engine to the standby supervisor engine and causes the newly active supervisor engine to run the new image specified.

issu set rollback-timer

Configures the In Service Software Upgrade (ISSU) rollback timer value.

show issu state

Displays the ISSU state and current booted image name during the ISSU process.

issu commitversion

To load the new Cisco IOS software image into the new standby supervisor engine, use the issu commitversion command.

issu commitversion standby-slot [standby-image-new]

 
Syntax Description

standby-slot

Specifies the slot number for the currently active supervisor engine.

standby-image-new

(Optional) Name of the new image on the currently active supervisor engine.

 
Defaults

Enabled by default.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.2(31)SGA

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The issu commitversion command verifies that the standby supervisor engine has the new Cisco IOS software image in its file system and that both supervisor engines are in the run version (RV) state. If these conditions are met, the following actions take place:

  • The standby supervisor engine is reset and booted with the new version of Cisco IOS software.
  • The standby supervisor engine moves into the Stateful Switchover (SSO) mode and is fully stateful for all clients and applications with which the standby supervisor engine is compatible.
  • The supervisor engines are moved into final state, which is the same as initial state.

Entering the issu commitversion command completes the In Service Software Upgrade (ISSU) process. This process cannot be stopped or reverted to its original state without starting a new ISSU process.

Entering the issu commitversion command without entering the issu acceptversion command is equivalent to entering both the issu acceptversion and the issu commitversion commands. Use the
issu commitversion command if you do not intend to run in the current state for an extended period of time and are satisfied with the new software version.

Examples

This example shows how you can configure the standby supervisor engine to be reset and reloaded with the new Cisco IOS software version:

Switch# issu commitversion 1
Switch#
 
 
 

 
Related Commands

Command
Description

issu acceptversion

Halts the rollback timer and ensures that the new Cisco IOS software image is not automatically stopped during the ISSU process.

issu commitversion

Loads the new Cisco IOS software image into the new standby supervisor engine.

issu loadversion

Starts the ISSU process.

issu runversion

Forces a change from the active supervisor engine to the standby supervisor engine and causes the newly active supervisor engine to run the new image specified.

show issu state

Displays the ISSU state and current booted image name during the ISSU process.

issu loadversion

To start the ISSU process, use the issu loadversion command.

issu loadversion active-slot active-image-new standby-slot standby-image-new [ force ]

 
Syntax Description

active-slot

Specifies the slot number for the currently active supervisor engine.

active-image-new

Specifies the name of the new image on the currently active supervisor engine.

standby-slot

Specifies the standby slot on the networking device.

standby-image-new

Specifies the name of the new image on the standby supervisor engine.

force

(Optional) Overrides the automatic rollback when the new Cisco IOS software version is detected to be incompatible.

 
Defaults

This command has no default settings.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.2(31)SGA

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The issu loadversion command causes the standby supervisor engine to be reset and booted with the new Cisco IOS software image specified by the command. If both the old image and the new image are ISSU capable, ISSU compatible, and have no configuration mismatches, the standby supervisor engine moves into Stateful Switchover (SSO) mode, and both supervisor engines move into the load version (LV) state.

It will take several seconds after the issu loadversion command is entered for Cisco IOS software to load onto the standby supervisor engine and the standby supervisor engine to transition to SSO mode.

Examples

This example shows how to initiate the ISSU process:

Switch# issu loadversion 1 bootflash:new-image 2 slavebootflash:new-image
Switch#

 
Related Commands

Command
Description

issu abortversion

Cancels the ISSU upgrade or the downgrade process in progress and restores the switch to its state before the start of the process.

issu acceptversion

Halts the rollback timer and ensures that the new Cisco IOS software image is not automatically stopped during the ISSU process.

issu commitversion

Loads the new Cisco IOS software image into the new standby supervisor engine.

issu runversion

Forces a change from the active supervisor engine to the standby supervisor engine and causes the newly active supervisor engine to run the new image specified.

show issu state

Displays the ISSU state and current booted image name during the ISSU process.

issu runversion

To force a change from the active supervisor engine to the standby supervisor engine and to cause the newly active supervisor engine to run the new image specified in the issu loadversion command, use the issu runversion command.

issu runversion standby-slot [ standby-image-new ]

 
Syntax Description

standby-slot

Specifies the standby slot on the networking device.

standby-image-new

(Optional) Specifies the name of the new image on the standby supervisor engine.

 
Defaults

This command has no default settings.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

12.2(31)SGA

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The issu runversion command changes the currently active supervisor engine to standby supervisor engine and the real standby-supervisor engine is booted with the old image version following and resets the switch. As soon as the standby-supervisor engine moves into the standby state, the rollback timer is started.

Examples

This example shows how to force a change of the active-supervisor engine to standby-supervisor engine:

Switch# issu runversion 2
Switch#

 
Related Commands

Command
Description

issu abortversion

Cancels the ISSU upgrade or the downgrade process in progress and restores the switch to its state before the start of the process.

issu acceptversion

Halts the rollback timer and ensures that the new Cisco IOS software image is not automatically stopped during the ISSU process.

issu commitversion

Loads the new Cisco IOS software image into the new standby supervisor engine.

issu loadversion

Starts the ISSU process.

show issu state

Displays the ISSU state and current booted image name during the ISSU process.

issu set rollback-timer

To configure the In Service Software Upgrade (ISSU) rollback timer value, use the
issu set rollback-timer command.

issu set rollback-timer seconds

 
Syntax Description

seconds

Specfies the rollback timer value, in seconds. The valid timer value range is from 0 to 7200 seconds (2 hours). A value of 0 seconds disables the rollback timer.

 
Defaults

Rollback timer value is 2700 seconds.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(31)SGA

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Use the issue set rollback-timer command to configure the rollback timer value. You can only enable this command when the supervisor engines are in the init state.

Examples

This example shows how you can set the rollback timer value to 3600 seconds, or 1 hour:

Switch# configure terminal
Switch(config)# issu set rollback-timer 3600
Switch(config)# end
Switch#

 
Related Commands

Command
Description

issu acceptversion

Halts the rollback timer and ensures that the new Cisco IOS software image is not automatically stopped during the ISSU process.

issu set rollback-timer

Configures the In Service Software Upgrade (ISSU) rollback timer value.

l2protocol-tunnel

To enable protocol tunneling on an interface, use the l2protocol-tunnel command. You can enable tunneling for the Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. To disable tunneling on the interface, use the no form of this command.

l2protocol-tunnel [ cdp | stp | vtp ]

no l2protocol-tunnel [ cdp | stp | vtp ]

 
Syntax Description

cdp

(Optional) Enables tunneling of CDP.

stp

(Optional) Enables tunneling of STP.

vtp

(Optional) Enables tunneling of VTP.

 
Defaults

The default is that no Layer 2 protocol packets are tunneled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You must enter this command, with or without protocol types, to tunnel Layer 2 packets.

Layer 2 protocol tunneling across a service-provider network ensures that Layer 2 information is propagated across the network to all customer locations. When protocol tunneling is enabled, protocol packets are encapsulated with a well-known Cisco multicast address for transmission across the network. When the packets reach their destination, the well-known MAC address is replaced by the Layer 2 protocol MAC address.

You can enable Layer 2 protocol tunneling for CDP, STP, and VTP individually or for all three protocols.

Examples

This example shows how to enable protocol tunneling for the CDP packets:

Switch(config-if)# l2protocol-tunnel cdp
Switch(config-if)#

 
Related Commands

Command
Description

l2protocol-tunnel cos

Configures the class of service (CoS) value for all tunneled Layer 2 protocol packets.

l2protocol-tunnel drop-threshold

Sets a drop threshold for the maximum rate of Layer 2 protocol packets per second to be received before an interface drops packets.

l2protocol-tunnel shutdown-threshold

Configures the protocol tunneling encapsulation rate.

l2protocol-tunnel cos

To configure the class of service (CoS) value for all tunneled Layer 2 protocol packets, use the l2protocol-tunnel cos command. To return to the default value of zero, use the no form of this command.

l2protocol-tunnel cos value

no l2protocol-tunnel cos

 
Syntax Description

value

Specifies the CoS priority value for tunneled Layer 2 protocol packets. The range is 0 to 7, with 7 being the highest priority.

 
Defaults

The default is to use the CoS value that is configured for data on the interface. If no CoS value is configured, the default is 5 for all tunneled Layer 2 protocol packets.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(18)EW

This command was first introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

When enabled, the tunneled Layer 2 protocol packets use this CoS value.

The value is saved in NVRAM.

Examples

This example shows how to configure a Layer 2 protocol tunnel CoS value of 7:

Switch(config)# l2protocol-tunnel cos 7
Switch(config)#

 
Related Commands

Command
Description

l2protocol-tunnel

Enables protocol tunneling on an interface.

l2protocol-tunnel drop-threshold

Sets a drop threshold for the maximum rate of Layer 2 protocol packets per second to be received before an interface drops packets.

l2protocol-tunnel shutdown-threshold

Configures the protocol tunneling encapsulation rate.

l2protocol-tunnel drop-threshold

To set a drop threshold for the maximum rate of Layer 2 protocol packets per second to be received before an interface drops packets, use the I2protocol-tunnel drop-threshold command. You can set the drop threshold for the Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. To disable the drop threshold on the interface, use the no form of this command.

l2protocol-tunnel drop -threshold [ cdp | stp | vtp ] value

no l2protocol-tunnel drop -threshold [ cdp | stp | vtp ] value

 
Syntax Description

cdp

(Optional) Specifies a drop threshold for CDP.

stp

(Optional) Specifies a drop threshold for STP.

vtp

(Optional) Specifies a drop threshold for VTP.

value

Specifies a threshold in packets per second to be received for encapsulation before the interface shuts down, or specifies the threshold before the interface drops packets. The range is 1 to 4096. The default is no threshold.

 
Defaults

The default is no drop threshold for the number of the Layer 2 protocol packets.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The l2protocol-tunnel drop-threshold command controls the number of protocol packets per second that are received on an interface before it drops packets. When no protocol option is specified with a keyword, the threshold is applied to each of the tunneled Layer 2 protocol types. If you also set a shutdown threshold on the interface, the drop-threshold value must be less than or equal to the shutdown-threshold value.

When the drop threshold is reached, the interface drops the Layer 2 protocol packets until the rate at which they are received is below the drop threshold.

Examples

This example shows how to configure the drop threshold rate:

Switch(config-if)# l2protocol-tunnel drop-threshold cdp 50
Switch(config-if)#

 
Related Commands

Command
Description

l2protocol-tunnel

Enables protocol tunneling on an interface.

l2protocol-tunnel cos

Configures the class of service (CoS) value for all tunneled Layer 2 protocol packets.

l2protocol-tunnel shutdown-threshold

Configures the protocol tunneling encapsulation rate.

l2protocol-tunnel shutdown-threshold

To configure the protocol tunneling encapsulation rate, use the I2protocol-tunnel shutdown-threshold command. You can set the encapsulation rate for the Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. To disable the encapsulation rate on the interface, use the no form of this command.

l2protocol-tunnel shutdown-threshold [ cdp | stp | vtp ] value

no l2protocol-tunnel shutdown-threshold [ cdp | stp | vtp ] value

 
Syntax Description

cdp

(Optional) Specifies a shutdown threshold for CDP.

stp

(Optional) Specifies a shutdown threshold for STP.

vtp

(Optional) Specifies a shutdown threshold for VTP.

value

Specifies a threshold in packets per second to be received for encapsulation before the interface shuts down. The range is 1 to 4096. The default is no threshold.

 
Defaults

The default is no shutdown threshold for the number of Layer 2 protocol packets.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The l2-protocol-tunnel shutdown-threshold command controls the number of protocol packets per second that are received on an interface before it shuts down. When no protocol option is specified with the keyword, the threshold is applied to each of the tunneled Layer 2 protocol types. If you also set a drop threshold on the interface, the shutdown-threshold value must be greater than or equal to the drop-threshold value.

When the shutdown threshold is reached, the interface is error disabled. If you enable error recovery by entering the errdisable recovery cause l2ptguard command, the interface is brought out of the error-disabled state and allowed to retry the operation again when all the causes have timed out. If the error recovery feature generation is not enabled for l2ptguard, the interface stays in the error-disabled state until you enter the shutdown and no shutdown commands.

Examples

This example shows how to configure the maximum rate:

Switch(config-if)# l2protocol-tunnel shutdown-threshold cdp 50
Switch(config-if)#

 
Related Commands

Command
Description

l2protocol-tunnel

Enables protocol tunneling on an interface.

l2protocol-tunnel cos

Configures the class of service (CoS) value for all tunneled Layer 2 protocol packets.

l2protocol-tunnel drop-threshold

Sets a drop threshold for the maximum rate of Layer 2 protocol packets per second to be received before an interface drops packets.

lacp port-priority

To set the LACP priority for the physical interfaces, use the lacp port-priority command.

lacp port-priority priority

 
Syntax Description

priority

Priority for the physical interfaces; valid va lues are from 1 to 65535.

 
Defaults

Priority is set to 32768.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.1(13)EW

This command was introduced on the Catalyst 4500 series switches.

 
Usage Guidelines

You must assign each port in the switch a port priority that can be specified automatically or by entering the lacp port-priority command. The port priority is used with the port number to form the port identifier. The port priority is used to decide which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating.

Although this command is a global configuration command, the priority value is supported only on port channels with LACP-enabled physical interfaces.This command is supported on LACP-enabled interfaces.

When setting the priority, the higher numbers indicate lower priorities.

Examples

This example shows how to set the priority for the interface:

Switch(config-if)# lacp port-priority 23748
Switch(config-if)#

 
Related Commands

Command
Description

channel-group

Assigns and configure an EtherChannel interface to an EtherChannel group.

channel-protocol

Enables LACP or PAgP on an interface.

lacp system-priority

Sets the priority of the system for LACP.

show lacp

Displays LACP information.

lacp system-priority

To set the priority of the system for LACP, use the lacp system-priority command.

lacp system-priority priority

 
Syntax Description

priority

Priority of the system; va lid values are from 1 to 65535.

 
Defaults

Priority is set to 32768.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(13)EW

This command was introduced on the Catalyst 4500 series switches.

 
Usage Guidelines

You must assign each switch that is running LACP a system priority that can be specified automatically or by entering the lacp system-priority command. The system priority is used with the switch MAC address to form the system ID and is also used during negotiation with other systems.

Although this command is a global configuration command, the priority value is supported on port channels with LACP-enabled physical interfaces.

When setting the priority, tthe higher numbers indicate lower priorities.

You can also enter the lacp system-priority command in interface configuration mode. After you enter the command, the system defaults to global configuration mode.

Examples

This example shows how to set the system priority:

Switch(config)# lacp system-priority 23748
Switch(config)#

 
Related Commands

Command
Description

channel-group

Assigns and configure an EtherChannel interface to an EtherChannel group.

channel-protocol

Enables LACP or PAgP on an interface.

lacp system-priority

Sets the priority of the system for LACP.

show lacp

Displays LACP information.

license right-to-use activate


Note This command only applies to Catalyst 4500-X and Supervisor Engine 7-E and 7L-E.


To activate PRTU licenses use the license right-to-use activate command.

license right-to-use activate feature-name [acceptEula]

 
Syntax Description

feature-name

Specifies the feature name (e.g., entservices, ipbase, lanbase)

acceptEula

(Optional). Activates the PRTU license. The End User License Agreement is accepted but does not display.

 
Defaults

PRTU licenses are inactive

 
Command Modes

privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.4.2SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Use this command to activate PRTU licenses that are inactive.

Downloading the license file from cisco portal and installing the license are not required. The PRTU licenses are bundled with image. Because the PRTU license is of highest precedence, when the PRTU license is activated, other license of the same feature switch to inactive state.

Examples

The following example shows how to activate PRTU licenses:

Switch# license right-to-use activate entservices

 
Related Commands

Command
Description

license right-to-use deactivate

Deactivates the PRTU license

license right-to-use deactivate


Note This command only applies to Catalyst 4500-X and Supervisor Engine 7-E and 7L-E.


To deactivate the PRTU license use the license right-to-use deactivate command.

license right-to-use deactivate feature-name

 
Syntax Description

feature-name

Specifies the feature name (e.g., entservices, ipbase, lanbase)

 
Defaults

PRTU licenses are inactive

 
Command Modes

privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.4.2SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Use this command to deactivate the PRTU licenses that are active.

The PRTU licenses can be deactivated provided any other valid license is available for the same feature.

For example, to deactivate a entservices PRTU license, the switch should contain a valid evaluation license. Else, the deactivation will fail.

Examples

The following example shows how to deactivate PRTU licenses:

Switch# license right-to-use deactivate entservices

 
Related Commands

Command
Description

license right-to-use activate

Activates the PRTU license

lldp tlv-select power-management

To to enable power negotiation through LLDP, use the lldp tlv-select power-management interface command.

lldp tlv-select power-management

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

Enabled on POEP ports

 
Command Modes

Interface level

 
Command History

Release
Modification

12.2(54)SG

Support was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You need to disable this feature if you do not want to perform power negotiation through LLDP.

This feature is not supported on non-POEP ports; the CLI is suppressed on such ports and TLV is not exchanged.

Examples

This example shows how to enable LLDP power negotiation on interface Gigabit Ethernet 3/1:

Switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# int gi 3/1
Switch(config-if)# lldp tlv-select power-management

 
Related Commands

Command
Description

lldp run

Cisco IOS Command Reference library.

logging event link-status global (global configuration)

To change the default switch-wide global link-status event messaging settings, use the
logging event link-status global command. Use the no form of this command to disable the link-status event messaging.

logging event link-status global

no logging event link-status global

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

The global link-status messaging is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(25)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

If link-status logging event is not configured at the interface level, this global link-status setting takes effect for each interface.

Examples

This example shows how to globally enable link status message on each interface:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# logging event link-status global
Switch(config)# end
Switch#

 
Related Commands

Command
Description

logging event link-status (interface configuration)

Enables the link-status event messaging on an interface.

logging event link-status (interface configuration)

To enable the link-status event messaging on an interface, use the logging event link-status command. Use the no form of this command to disable link-status event messaging. Use the
logging event link-status use-global command to apply the global link-status setting.

logging event link-status

no logging event link-status

logging event link-status use-global

 
Defaults

Global link-status messaging is enabled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(25)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

To enable system logging of interface state-change events on a specific interface, enter the
logging event link-status command in interface configuration mode.

To enable system logging of interface state-change events on all interfaces in the system, enter the logging event link-status global command in global configuration mode. All interfaces without the state change event configuration use the global setting.

Examples

This example shows how to enable logging event state-change events on interface gi11/1:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gi11/1
Switch(config-if)# logging event link-status
Switch(config-if)# end
Switch#
 

This example shows how to turn off logging event link status regardless of the global setting:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gi11/1
Switch(config-if)# no logging event link-status
Switch(config-if)# end
Switch#
 

This example shows how to enable the global event link-status setting on interface gi11/1:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gi11/1
Switch(config-if)# logging event link-status use-global
Switch(config-if)# end
Switch#

 
Related Commands

Command
Description

logging event link-status global (global configuration)

Changes the default switch-wide global link-status event messaging settings.

logging event trunk-status global (global configuration)

To enable the trunk-status event messaging globally, use the logging event trunk-status global command. Use the no form of this command to disable trunk-status event messaging.

logging event trunk - status global

no logging event trunk - status global

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

Global trunk-status messaging is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(25)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

If trunk-status logging event is not configured at the interface level, the global trunk-status setting takes effect for each interface.

Examples

This example shows how to globally enable link status messaging on each interface:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# logging event trunk-status global
Switch(config)# end
Switch#

 
Related Commands

Command
Description

logging event trunk-status global (global configuration)

Enables the trunk-status event messaging on an interface.

logging event trunk-status (interface configuration)

To enable the trunk-status event messaging on an interface, use the logging event trunk-status command. Use the no form of this command to disable the trunk-status event messaging. Use the
logging event trunk-status use-global command to apply the global trunk-status setting.

logging event trunk-status

no logging event trunk-status

logging event trunk-status use-global

 
Defaults

Global trunk-status messaging is enabled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(25)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

To enable system logging of interface state-change events on a specific interface, enter the
logging event trunk-status command in interface configuration mode.

To enable system logging of interface state-change events on all interfaces in the system, enter the logging event trunk-status use-global command in global configuration mode. All interfaces without the state change event configuration use the global setting.

Examples

This example shows how to enable logging event state-change events on interface gi11/1:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gi11/1
Switch(config-if)# logging event trunk-status
Switch(config-if)# end
Switch#
 

This example shows how to turn off logging event trunk status regardless of the global setting:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gi11/1
Switch(config-if)# no logging event trunk-status
Switch(config-if)# end
Switch#
 

This example shows how to enable the global event trunk-status setting on interface gi11/1:

Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface gi11/1
Switch(config-if)# logging event trunk-status use-global
Switch(config-if)# end
Switch#

 
Related Commands

Command
Description

logging event trunk-status global (global configuration)

Enables the trunk-status event messaging on an interface.

mab

To enable and configure MAC authorization bypass (MAB) on a port, use the mab command in interface configuration mode. To disable MAB, use the no form of this command.

mab [ eap ]

no mab [ eap ]


Note The mab command is totally independent of the effect of the dot1x system-auth control command.


 
Syntax Description

eap

(Optional) Specifies that a full EAP conversation should be used, as opposed to standard RADIUS Access-Request, Access-Accept conversation.

 
Command Default

Disabled

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(50)SG

Support for this command was introduced.

 
Usage Guidelines

When a port is configured for MAB as a fallback method, it operates in a typical dot1X method until a configurable number of failed attempts to request the identity of the host. The authenticator learns the MAC address of the host and uses that information to query an authentication server to see whether this MAC address will be granted access.

Examples

The following example shows how to enable MAB on a port:

Switch(config-if)# mab
Switch(config-if)#
 

The following example shows how to enable and configure MAB on a port:

Switch(config-if)# mab eap
Switch(config-if)#
 

The following example shows how to disable MAB on a port:

Switch(config-if)# no mab
Switch(config-if)#
 
 

 
Related Commands

Command
Description

show authentication

Displays Authentication Manager information.

show mab

Displays MAB information.

show running-config

Displays the running configuration information.

mab logging verbose

Use the mab logging verbose global configuration command on the switch stack or on a standalone switch to filter detailed information from MAC authentication bypass (MAB) system messages.

mab logging verbose

no mab logging verbose

 
Defaults

Detailed logging of system messages is not enabled.

 
Syntax Description

This command has no arguments or keywords.

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(55)SE

This command was introduced.

 
Usage Guidelines

This command filters details, such as anticipated success, from MAC authentication bypass (MAB) system messages.

Examples

To filter verbose MAB system messages:

Switch(config)# mab logging verbose
 

You can verify your settings by entering the show running-config privileged EXEC command.

 
Related Commands

Command
Description

authentication logging verbose

Filters details from authentication system messages.

dot1x logging verbose

Filters details from 802.1x system messages.

mab logging verbose

Filters details from MAC authentication bypass (MAB) system messages.

mac access-list extended

To define the extended MAC access lists, use the mac access-list extended command. To remove the MAC access lists, use the no form of this command.

mac access-list extended name

no mac access-list extended name

 
Syntax Description

name

ACL to which the entry belongs.

 
Defaults

MAC access lists are not defined.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

When you enter the ACL name, follow these naming conventions:

  • Maximum of 31 characters long and can include a-z, A-Z, 0-9, the dash character (-), the underscore character (_), and the period character (.)
  • Must start with an alpha character and must be unique across all ACLs of all types
  • Case sensitive
  • Cannot be a number
  • Must not be a keyword; keywords to avoid are all, default-action, map, help, and editbuffer

When you enter the mac access-list extended name command, you use the following subset to create or delete entries in a MAC layer access list:

[ no ] { permit | deny } {{ src-mac mask | any } [ dest-mac mask ]} [ protocol-family { appletalk | arp-non-ipv4 | decnet | ipx | ipv6 | rarp-ipv4 | rarp-non-ipv4 | vines | xns } | <arbitrary ethertype> | name-coded ethertype].

Table 1-3 describes the syntax of the mac access-list extended subcommands.

 

Table 1-3 mac access-list extended Subcommands

Subcommand
Description

any

Specifies any source-host or destination-host.

arbitrary ethertype

(Optional) Specifies an arbitrary ethertype in the range 1536 to 65535 (Decimal or Hexadecimal)

deny

Prevents access if the conditions are matched.

dest-mac mask

(Optional) Specifies a destination MAC address of the form: dest-mac-address dest-mac-address-mask .

name-coded ethertype

(Optional) Denotes a predefined name-coded ethertype for common protocols:

aarp—AppleTalk ARP

amber—DEC-Amber

appletalk—AppleTalk/EtherTalk

dec-spanning—DEC-Spanning-Tree

decnet-iv—DECnet Phase IV

diagnostic—DEC-Diagnostic

dsm—DEC-DSM

etype-6000—0x6000

etype-8042—0x8042

lat—DEC-LAT

lavc-sca—DEC-LAVC-SCA

mop-console—DEC-MOP Remote Console

mop-dump—DEC-MOP Dump

msdos—DEC-MSDOS

mumps—DEC-MUMPS

netbios—DEC-NETBIOS

protocol-family An Ethernet protocol family

vines-echo—VINES Echo

vines-ip—VINES IP

xns-idp—XNS IDP

no

(Optional) Deletes a statement from an access list.

permit

Allows access if the conditions are matched.

protocol-family

(Optional) Name of the protocol family. Table 1-4 lists which packets are mapped to a particular protocol family.

src-mac mask

Source MAC address in the form: source-mac-address source-mac-address-mask .

Table 1-4 describes mapping an Ethernet packet to a protocol family.

 

Table 1-4 Mapping an Ethernet Packet to a Protocol Family

Protocol Family
Ethertype in Packet Header

Appletalk

0x809B, 0x80F3

Arp-Non-Ipv4

0x0806 and protocol header of Arp is a non-Ip protocol family

Decnet

0x6000-0x6009, 0x8038-0x8042

Ipx

0x8137-0x8138

Ipv6

0x86DD

Rarp-Ipv4

0x8035 and protocol header of Rarp is Ipv4

Rarp-Non-Ipv4

0x8035 and protocol header of Rarp is a non-Ipv4 protocol family

Vines

0x0BAD, 0x0BAE, 0x0BAF

Xns

0x0600, 0x0807

When you enter the src-mac mask or dest-mac mask value, follow these guidelines:

  • Enter the MAC addresses as three 4-byte values in dotted hexadecimal format such as 0030.9629.9f84.
  • Enter the MAC address masks as three 4-byte values in dotted hexadecimal format. Use 1 bit as a wildcard. For example, to match an address exactly, use 0000.0000.0000 (can be entered as 0.0.0).
  • For the optional protocol parameter, you can enter either the EtherType or the keyword.
  • Entries without a protocol parameter match any protocol.
  • The access list entries are scanned in the order that you enter them. The first matching entry is used. To improve performance, place the most commonly used entries near the beginning of the access list.
  • An implicit deny any any entry exists at the end of an access list unless you include an explicit permit any any entry at the end of the list.
  • All new entries to an existing list are placed at the end of the list. You cannot add entries to the middle of a list.

Examples

This example shows how to create a MAC layer access list named mac_layer that denies traffic from 0000.4700.0001, which is going to 0000.4700.0009, and permits all other traffic:

Switch(config)# mac access-list extended mac_layer
Switch(config-ext-macl)# deny 0000.4700.0001 0.0.0 0000.4700.0009 0.0.0 protocol-family appletalk
Switch(config-ext-macl)# permit any any
Switch(config-ext-macl)# end
Switch#

 
Related Commands

Command
Description

show vlan access-map

Displays VLAN access map information.

mac-address (virtual switch)

To specify a Media Access Control (MAC) address to use as the common router MAC address for interfaces on the active and standby chassis, use the mac-address virtual switch configuration submode command. To return to the default setting, use the no form of this command.

mac-address {mac-address | use-virtual | chassis}

no mac-address {mac-address | use-virtual | chassis}

 
Syntax Description

mac-address

Specifies the MAC address in hexadecimal format.

use-virtual

Specifies the MAC address range reserved for the virtual switch system (VSS).

chassis

Specifies a MAC address derived from the chassis.

 
Defaults

The router MAC address is derived from the Cisco pool of virtual switch specific MAC addresses intended for the domain 1-255.

 
Command Modes

Virtual switch configuration submode (config-vs-domain)

 
Command History

Release
Modification

Cisco IOS XE 3.4.0SG and 15.1(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

When a virtual switch boots, the router MAC address is derived from the Cisco pool of virtual switch specific MAC addresses. The router address is used as the common router MAC address for interfaces on both the active and the standby chassis. Between switchovers, this MAC address is maintained on the new active switch. You can enter the mac-address mac-address command to specify a MAC address to use or the mac-address use-virtual command to use the MAC address range reserved for the VSS.

The MAC address range reserved for the VSS is derived from a reserved pool of addresses with the domain ID encoded in the leading 6 bits of the last octet and trailing 2 bits of the previous octet of the mac-address. The last two bits of the first octet is allocated for the protocol mac-address that is derived by adding the protocol ID (0 to 3) to the router MAC address.


Note You must reload the virtual switch for the new router MAC address to take effect. If the MAC address you configured is different from the current MAC address, the following message is displayed:

Console (enable)#


Examples

The following example shows how to specify the MAC address to use in hexadecimal format:

Router(config)# switch virtual domain test-mac-address
Router(config-vs-domain)# mac-address 0000.0000.0000
Router(config-vs-domain)#
 

The following example shows how to specify the MAC address range reserved for the VSS:

Router(config)# switch virtual domain test-mac-address
Router(config-vs-domain)# mac-address use-virtual
Router(config-vs-domain)#

 
Related Commands

Command
Description

switch virtual domain (virtual switch)

Assigns a switch number and enters virtual switch domain configuration submode.

mac-address-table aging-time

To configure the aging time for the entries in the Layer 2 table, use the mac-address-table aging-time command. To reset the seconds value to the default setting, use the no form of this command.

mac-address-table aging-time seconds [ vlan vlan_id ]

no mac-address-table aging-time seconds [ vlan vlan_id ]

 
Syntax Description

seconds

Aging time in seconds; valid values are 0 and from 10 to 1000000 seconds.

vlan vlan_id

(Optional) Single VLAN number or a range of VLANs; valid values are from 1 to 4094.

 
Defaults

Aging time is set to 300 seconds.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

 
Usage Guidelines

If you do not enter a VLAN, the change is applied to all routed-port VLANs.

Ente r 0 s econd s to disable aging.

Examples

This example shows how to configure the aging time to 400 seconds:

Switch(config)# mac-address-table aging-time 400
Switch(config)#
 

This example shows how to disable aging:

Switch(config)# mac-address-table aging-time 0
Switch(config)

 
Related Commands

Command
Description

show mac-address-table aging-time

Displays MAC address table aging information.

mac-address-table dynamic group protocols

To enable the learning of MAC addresses in both the “ip” and “other” protocol buckets, even though the incoming packet may belong to only one of the protocol buckets, use the
mac - address - table dynamic group protocols command. To disable grouped learning, use the no form of this command.

mac-address-table dynamic group protocols { ip | other } { ip | other }

no mac-address-table dynamic group protocols { ip | other } { ip | other }

 
Syntax Description

ip

Specifies the “ip” protocol bucket.

other

Specifies the “other” protocol bucket.

 
Defaults

The group learning feature is disabled.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The entries within the “ip” and “other” protocol buckets are created according to the protocol of the incoming traffic.

When you use the mac-address-table dynamic group protocols command, an incoming MAC address that might belong to either the “ip” or the “other” protocol bucket, is learned on both protocol buckets. Therefore, any traffic destined to this MAC address and belonging to any of the protocol buckets is unicasted to that MAC address, rather than flooded. This reduces the unicast Layer 2 flooding that might be caused if the incoming traffic from a host belongs to a different protocol bucket than the traffic that is destined to the sending host.

Examples

This example shows that the MAC addresses are initially assigned to either the “ip” or the “other” protocol bucket:

Switch# show mac-address-table dynamic
Unicast Entries
vlan mac address type protocols port
-------+---------------+--------+---------------------+--------------------
1 0000.0000.5000 dynamic other GigabitEthernet1/1
1 0001.0234.6616 dynamic ip GigabitEthernet3/1
1 0003.3178.ec0a dynamic assigned GigabitEthernet3/1
1 0003.4700.24c3 dynamic ip GigabitEthernet3/1
1 0003.4716.f475 dynamic ip GigabitEthernet3/1
1 0003.4748.75c5 dynamic ip GigabitEthernet3/1
1 0003.47f0.d6a3 dynamic ip GigabitEthernet3/1
1 0003.47f6.a91a dynamic ip GigabitEthernet3/1
1 0003.ba06.4538 dynamic ip GigabitEthernet3/1
1 0003.fd63.3eb4 dynamic ip GigabitEthernet3/1
1 0004.2326.18a1 dynamic ip GigabitEthernet3/1
1 0004.5a5d.de53 dynamic ip GigabitEthernet3/1
1 0004.5a5e.6ecc dynamic ip GigabitEthernet3/1
1 0004.5a5e.f60e dynamic ip GigabitEthernet3/1
1 0004.5a5f.06f7 dynamic ip GigabitEthernet3/1
1 0004.5a5f.072f dynamic ip GigabitEthernet3/1
1 0004.5a5f.08f6 dynamic ip GigabitEthernet3/1
1 0004.5a5f.090b dynamic ip GigabitEthernet3/1
1 0004.5a88.b075 dynamic ip GigabitEthernet3/1
1 0004.c1bd.1b40 dynamic ip GigabitEthernet3/1
1 0004.c1d8.b3c0 dynamic ip GigabitEthernet3/1
1 0004.c1d8.bd00 dynamic ip GigabitEthernet3/1
1 0007.e997.74dd dynamic ip GigabitEthernet3/1
1 0007.e997.7e8f dynamic ip GigabitEthernet3/1
1 0007.e9ad.5e24 dynamic ip GigabitEthernet3/1
1 000b.5f0a.f1d8 dynamic ip GigabitEthernet3/1
1 000b.fdf3.c498 dynamic ip GigabitEthernet3/1
1 0010.7be8.3794 dynamic assigned GigabitEthernet3/1
1 0012.436f.c07f dynamic ip GigabitEthernet3/1
1 0050.0407.5fe1 dynamic ip GigabitEthernet3/1
1 0050.6901.65af dynamic ip GigabitEthernet3/1
1 0050.da6c.81cb dynamic ip GigabitEthernet3/1
1 0050.dad0.af07 dynamic ip GigabitEthernet3/1
1 00a0.ccd7.20ac dynamic ip GigabitEthernet3/1
1 00b0.64fd.1c23 dynamic ip GigabitEthernet3/1
1 00b0.64fd.2d8f dynamic assigned GigabitEthernet3/1
1 00d0.b775.c8bc dynamic ip GigabitEthernet3/1
1 00d0.b79e.de1d dynamic ip GigabitEthernet3/1
1 00e0.4c79.1939 dynamic ip GigabitEthernet3/1
1 00e0.4c7b.d765 dynamic ip GigabitEthernet3/1
1 00e0.4c82.66b7 dynamic ip GigabitEthernet3/1
1 00e0.4c8b.f83e dynamic ip GigabitEthernet3/1
1 00e0.4cbc.a04f dynamic ip GigabitEthernet3/1
1 0800.20cf.8977 dynamic ip GigabitEthernet3/1
1 0800.20f2.82e5 dynamic ip GigabitEthernet3/1
Switch#
 

This example shows how to assign MAC addresses that belong to either the “ip” or the “other” bucket to both buckets:

Switch(config)# mac-address-table dynamic group protocols ip other
Switch(config)# exit
Switch# show mac address-table dynamic
Unicast Entries
vlan mac address type protocols port
-------+---------------+--------+---------------------+--------------------
1 0000.0000.5000 dynamic ip,other GigabitEthernet1/1
1 0001.0234.6616 dynamic ip,other GigabitEthernet3/1
1 0003.4700.24c3 dynamic ip,other GigabitEthernet3/1
1 0003.4716.f475 dynamic ip,other GigabitEthernet3/1
1 0003.4748.75c5 dynamic ip,other GigabitEthernet3/1
1 0003.47c4.06c1 dynamic ip,other GigabitEthernet3/1
1 0003.47f0.d6a3 dynamic ip,other GigabitEthernet3/1
1 0003.47f6.a91a dynamic ip,other GigabitEthernet3/1
1 0003.ba0e.24a1 dynamic ip,other GigabitEthernet3/1
1 0003.fd63.3eb4 dynamic ip,other GigabitEthernet3/1
1 0004.2326.18a1 dynamic ip,other GigabitEthernet3/1
1 0004.5a5d.de53 dynamic ip,other GigabitEthernet3/1
1 0004.5a5d.de55 dynamic ip,other GigabitEthernet3/1
1 0004.5a5e.6ecc dynamic ip,other GigabitEthernet3/1
1 0004.5a5e.f60e dynamic ip,other GigabitEthernet3/1
1 0004.5a5f.08f6 dynamic ip,other GigabitEthernet3/1
1 0004.5a5f.090b dynamic ip,other GigabitEthernet3/1
1 0004.5a64.f813 dynamic ip,other GigabitEthernet3/1
1 0004.5a66.1a77 dynamic ip,other GigabitEthernet3/1
1 0004.5a6b.56b2 dynamic ip,other GigabitEthernet3/1
1 0004.5a6c.6a07 dynamic ip,other GigabitEthernet3/1
1 0004.5a88.b075 dynamic ip,other GigabitEthernet3/1
1 0004.c1bd.1b40 dynamic ip,other GigabitEthernet3/1
1 0004.c1d8.b3c0 dynamic ip,other GigabitEthernet3/1
1 0004.c1d8.bd00 dynamic ip,other GigabitEthernet3/1
1 0005.dce0.7c0a dynamic assigned GigabitEthernet3/1
1 0007.e997.74dd dynamic ip,other GigabitEthernet3/1
1 0007.e997.7e8f dynamic ip,other GigabitEthernet3/1
1 0007.e9ad.5e24 dynamic ip,other GigabitEthernet3/1
1 0007.e9c9.0bc9 dynamic ip,other GigabitEthernet3/1
1 000b.5f0a.f1d8 dynamic ip,other GigabitEthernet3/1
1 000b.fdf3.c498 dynamic ip,other GigabitEthernet3/1
1 0012.436f.c07f dynamic ip,other GigabitEthernet3/1
1 0050.0407.5fe1 dynamic ip,other GigabitEthernet3/1
1 0050.6901.65af dynamic ip,other GigabitEthernet3/1
1 0050.da6c.81cb dynamic ip,other GigabitEthernet3/1
1 0050.dad0.af07 dynamic ip,other GigabitEthernet3/1
1 00a0.ccd7.20ac dynamic ip,other GigabitEthernet3/1
1 00b0.64fd.1b84 dynamic assigned GigabitEthernet3/1
1 00d0.b775.c8bc dynamic ip,other GigabitEthernet3/1
1 00d0.b775.c8ee dynamic ip,other GigabitEthernet3/1
1 00d0.b79e.de1d dynamic ip,other GigabitEthernet3/1
1 00e0.4c79.1939 dynamic ip,other GigabitEthernet3/1
1 00e0.4c7b.d765 dynamic ip,other GigabitEthernet3/1
1 00e0.4c82.66b7 dynamic ip,other GigabitEthernet3/1
1 00e0.4c8b.f83e dynamic ip,other GigabitEthernet3/1
1 00e0.4c8c.0861 dynamic ip,other GigabitEthernet3/1
1 0800.20d1.bf09 dynamic ip,other GigabitEthernet3/1
Switch#

mac-address-table learning vlan

To enable MAC address learning on a VLAN, use the mac-address-table learning global configuration command. Use the no form of this command to disable MAC address learning on a VLAN to control which VLANs can learn MAC addresses.

mac-address-table learning vlan vlan-id

no mac-address-table learning vlan vlan-id

 
Syntax Description

vlan-id

Specifies a single VLAN ID or a range of VLAN IDs separated by a hyphen or comma. Valid VLAN IDs are 1 to 4094.

 
Defaults

Enabled on all VLANs

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was modified to support the disable learning feature on the Catalyst 4500 series switch.

 
Usage Guidelines

When you control MAC address learning on a VLAN, you can manage the available table space by controlling which VLANs, and which ports can learn MAC addresses.

You can disable MAC address learning on a single VLAN ID (for example, by entering
no mac-address-table learning vlan 223) or on a range of VLAN IDs (for example, by entering
no mac-address-table learning vlan 1-20, 15.)

Before you disable MAC address learning, familiarize yourself with the network topology and the switch system configuration. If you disable MAC address learning on a VLAN, flooding may occur in the network. For example, if you disable MAC address learning on a VLAN with a configured switch virtual interface (SVI), the switch floods all IP packets in the Layer 2 domain. If you disable MAC address learning on a VLAN that includes more than two ports, every packet entering the switch is flooded in that VLAN domain. Disable MAC address learning only in VLANs that contain two ports. Use caution before disabling MAC address learning on a VLAN with an SVI.

You cannot disable MAC address learning on a VLAN that the switch uses internally. This action causes the switch to generate an error message and rejects the no mac-address-table learning vlan command. To view used internal VLANs, enter the show vlan internal usage privileged EXEC command.

If you disable MAC address learning on a VLAN configured as a PVLAN primary or a secondary VLAN, the MAC addresses are still learned on the VLAN (primary or secondary) associated with the PVLAN.

You cannot disable MAC address learning on an RSPAN VLAN. The configuration is not allowed.

If you disable MAC address learning on a VLAN that includes a secure port, MAC address learning is not disabled on the secure port. If you later disable port security on the interface, the disabled MAC address learning state is enabled.

To display the MAC address learning status of a specific VLAN or for all VLANs, enter the
show mac-address-table learning vlan command.

Examples

This example shows how to disable MAC address learning on VLAN 2003:

Switch(config)# no mac-address-table learning vlan 2003

 
Related Commands

Command
Description

show mac address-table learning

Displays the MAC address learning status on all VLANs or on the specified VLAN.

mac-address-table notification

To enable MAC address notification on a switch, use the mac-address-table notification command. To return to the default setting, use the no form of this command

mac-address-table notification [[ change [ history-size hs_value | interval intv_value ]] | [ mac-move ] | [ threshold [ limit percentage | interval time]] | [ learn-fail [ interval time | limit num_fail ]]

no mac-address-table notificatio n [[ change [ history-size hs_value | interval intv_value ]] | [ mac-move ] | [ threshold [ limit percentage | interval time]] | [ learn-fail [ interval time | limit num_fail ]]

 
Syntax Description

change

(Optional) Specifies enabling MAC change notification.

history-size hs_value

(Optional) Sets a maximum number of entries in the MAC change notification history table. The range is 0 to 500 entries.

interval intv_value

(Optional) Sets a notification trap interval: the set interval time between two consecutive traps. The range is 0 to 2,147,483,647 seconds.

mac-move

(Optional) Specifies enabling MAC move notification.

threshold

(Optional) Specifies enabling MAC threshold notification.

limit percentage

(Optional) Specifies the percentage of MAT utilization threshold; valid values are from 1 to 100 percent.

interval time

(Optional) Specifies the time between MAC threshold notifications; valid values are greater than or equal to 120 seconds.

learn-fail

(Optional) Specifies syslog (level 6) notifications of failures to install MAC addresses learned in software into hardware. Disabled by default.

interval time

(Optional) Specifies the syslog interval between hardware MAC learning failure notifications. The default value is 150 seconds. The range is between 1 to 100000 seconds.

limit num_fail

(Optional) Specifies the number of hardware MAC learning failures to be allowed in a notification interval.

 
Defaults

MAC address notification feature is disabled.

The default MAC change trap interval value is 1 second.

The default number of entries in the history table is 1.

MAC move notification is disabled.

MAC threshold monitoring feature is disabled.

The default limit is 50 percent.

The default time is 120 seconds.

Hardware MAC learning failure syslog notification is disabled.

The default limit is 1000.

The default interval is 150 seconds.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(31)SG

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(52)SG

Support introduced for the learn-fail keyword on Supervisor Engine 6-E and Catalyst 4900M.

 
Usage Guidelines

You can enable the MAC change notification feature using the mac-address-table notification change command. If you do this, you must also enable MAC notification traps on an interface using the
snmp trap mac-notification change interface configuration command and configure the switch to send MAC change traps to the NMS using the snmp-server enable traps mac-notification global configuration command.

When the history-size option is configured, the existing MAC change history table is deleted, and a new table is created.

Examples

This example shows how to set the MAC address notification history table size to 300 entries:

Switch(config)# mac-address-table notification change history-size 300
Switch(config)#
 

This example shows how to set the MAC address notification interval time to 1250 seconds:

Switch(config)# mac-address-table notification change interval 1250
Switch(config)#
 

This example shows how to enable hardware MAC address learning failure syslog notification:

Switch(config)# mac address-table notification learn-fail
 

This example shows how to set the interval of hardware MAC address learning failure syslog notification to 30 seconds:

Switch(config)# mac address-table notification learn-fail interval 30

 
Related Commands

Command
Description

clear mac-address-table

Clears the global counter entries from the Layer 2 MAC address table.

mac-address-table notification

Enables MAC address notification on a switch.

snmp-server enable traps

Enables SNMP notifications.

snmp trap mac-notification change

Enables SNMP MAC address notifications.

mac-address-table static

To configure the static MAC addresses for a VLAN interface or drop unicast traffic for a MAC address for a VLAN interface, use the mac-address-table static command. To remove the static MAC address configurations, use the no form of this command.

mac-address-table static mac-addr { vlan vlan-id } { interface type | drop }

no mac-address-table static mac-addr { vlan vlan-id } { interface type } { drop }

 
Syntax Description

mac-addr

MAC address; optional when using the no form of this command.

vlan vlan-id

VLAN and valid VLAN number; valid values are from 1 to 4094.

interface type

Interface type and number; valid options are FastEthernet and GigabitEthernet.

drop

Drops all traffic received from and going to the configured MAC address in the specified VLAN.

 
Defaults

This command has no default settings.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switches.

 
Usage Guidelines

When a static MAC address is installed, it is associated with a port.

The output interface specified must be a Layer 2 interface and not an SVI.

If you do not enter a protocol type, an entry is automatically created for each of the four protocol types.

Entering the no form of this command does not remove the system MAC addresses.

When removing a MAC address, entering interface int is optional. For unicast entries, the entry is removed automatically. For multicast entries, if you do not specify an interface, the entire entry is removed. You can specify the selected ports to be removed by specifying the interface.

Examples

This example shows how to add the static entries to the MAC address table:

Switch(config)# mac-address-table static 0050.3e8d.6400 vlan 100 interface fastethernet5/7
Switch(config)#
 

 
Related Commands

Command
Description

show mac-address-table static

Displays the static MAC address table entries only.

macro apply cisco-desktop

To enable the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop, use the macro apply cisco-desktop c ommand.

macro apply cisco-desktop $AVID access_vlanid

 
Syntax Description

$AVID access_vlanid

Specifies an access VLAN ID.

 
Defaults

This command has no default settings.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply the macro, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1
Switch(config-if)# macro apply cisco-desktop $AVID 50
Switch(config-if)#
 

The contents of this macro are as follows:

# Basic interface - Enable data VLAN only
# Recommended value for access vlan (AVID) should not be 1
switchport access vlan $AVID [access_vlanid]
switchport mode access
# Enable port security limiting port to a single
# MAC address -- that of desktop
switchport port-security
# Ensure port-security age is greater than one minute
# and use inactivity timer
# “Port-security maximum 1” is the default and will not
# Show up in the config
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity
# Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable

 
Related Commands

Command
Description

macro apply cisco-phone

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop and a Cisco IP phone.

macro apply cisco-router

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a router.

macro apply cisco-switch

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to another switch.

macro apply cisco-phone

To enable the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop and a Cisco IP phone, use the macro apply cisco-phone command.

macro apply cisco-phone $AVID access_vlanid $VVID voice_vlanid

 
Syntax Description

$AVID access_vlanid

Specifies an access VLAN ID.

$VVID voice_vlanid

Specifies a voice VLAN ID.

 
Defaults

This command has no default settings.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply the macro, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1
Switch(config-if)# macro apply cisco-phone $AVID 10 $VVID 50
Switch(config-if)#
 

The contents of this macro are as follows:

# VoIP enabled interface - Enable data VLAN
# and voice VLAN (VVID)
# Recommended value for access vlan (AVID) should not be 1\
switchport access vlan $AVID [access_vlan_id]
switchport mode access
# Update the Voice VLAN (VVID) value which should be
# different from data VLAN
# Recommended value for voice vlan (VVID) should not be 1
switchport voice vlan $VVID [voice_vlan_id]
# Enable port security limiting port to a 3 MAC
# addressees -- One for desktop and two for phone
switchport port-security
switchport port-security maximum 3
# Ensure port-security age is greater than one minute
# and use inactivity timer
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity
# Enable auto-qos to extend trust to attached Cisco phone
auto qos voip cisco-phone
# Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable@

 
Related Commands

Command
Description

macro apply cisco-desktop

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop.

macro apply cisco-router

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a router.

macro apply cisco-switch

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to another switch.

macro apply cisco-router

To enable the Cisco-recommended features and settings that are suitable for connecting a switch port to a router, use the macro apply cisco-router command.

macro apply cisco-router $NVID native_vlanid

 
Syntax Description

$NVID native_vlanid

Specifies a native VLAN ID.

 
Defaults

This command has no default settings.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply the macro apply cisco-router command, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1
Switch(config-if)# macro apply cisco-router $NVID 80
Switch(config-if)#
 

The contents of this macro are as follows:

# Access Uplink to Distribution
switchport trunk encapsulation dot1q
# Define unique Native VLAN on trunk ports
# Recommended value for native vlan (NVID) should not be 1
switchport trunk native vlan $NVID [native_vlan_id]
# Update the allowed VLAN range (VRANGE) such that it
# includes data, voice and native VLANs
# switchport trunk allowed vlan $VRANGE [vlan_range]
# Hardcode trunk and disable negotiation to
# speed up convergence
# Hardcode speed and duplex to router
switchport mode trunk
switchport nonegotiate
speed 100
duplex full
# Configure qos to trust this interface
auto qos voip trust
qos trust dscp
# Ensure fast access to the network when enabling the interface.
# Ensure that switch devices cannot become active on the interface.
spanning-tree portfast
spanning-tree bpduguard enable

 
Related Commands

Command
Description

macro apply cisco-desktop

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop.

macro apply cisco-phone

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop and a Cisco IP phone.

macro apply cisco-router

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a router.

macro apply cisco-switch

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to another switch.

macro apply cisco-switch

To enable the Cisco-recommended features and settings that are suitable for connecting a switch port to another switch, use the macro apply cisco-switch command.

macro apply cisco-switch $NVID native_vlanid

 
Syntax Description

$NVID native_vlanid

Specifies a native VLAN ID.

 
Defaults

This command has no default settings.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(18)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply this macro, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1
Switch(config-if)# macro apply cisco-switch $NVID 45
Switch(config-if)#
 

The contents of this macro are as follows:

# Access Uplink to Distribution
switchport trunk encapsulation dot1q
# Define unique Native VLAN on trunk ports
# Recommended value for native vlan (NVID) should not be 1
switchport trunk native vlan $NVID [native_vlan_id]
# Update the allowed VLAN range (VRANGE) such that it
# includes data, voice and native VLANs
# switchport trunk allowed vlan $VRANGE
# Hardcode trunk and disable negotiation to
# speed up convergence
switchport mode trunk
switchport nonegotiate
# Configure qos to trust this interface
auto qos voip trust
# 802.1w defines the link as pt-pt for rapid convergence
spanning-tree link-type point-to-point

 
Related Commands

Command
Description

macro apply cisco-desktop

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop.

macro apply cisco-phone

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop and a Cisco IP phone.

macro apply cisco-router

Enables the Cisco-recommended features and settings that are suitable for connecting a switch port to a router.

macro auto device

Use the macro auto device command to simplify changing the parameters for a built-in functions for a device type. Use the no form of this command to revert to the intial parameter values.

macro auto device device_type [params values]

no macro auto device device_type [params values]

 
Syntax Description

device_type

Specifies the device type.

  • phone—Apply interface configs on detecting a phone
  • switch—Apply interface configs on detecting a switch
  • router—Apply interface configs on detecting a router
  • ap—Apply interface configs on detecting an ap
  • lwap—Apply interface configs on detecting a light weight ap
  • dmp—Apply interface configs on detecting a DMP
  • ipvsc—Apply interface configs on detecting a IPVSC

param name=value

(Optional) parameter=value —Replace default values that begin with $. Enter new values in the form of name value pair separated by a space: [<name1>=<value1> <name2>=<value2>...]. Default values are shown in parenthesis.

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Although you can use the macro auto execute command to produce the same effect as the macro auto device command, the later is simpler.

Examples

This example shows how to change the access VLAN and voice VLAN from their default value to user defined values for phone devices.

(config)# macro auto device phone ACCESS_VLAN=10 VOICE_VLAN=20

 
Related Commands

Command
Description

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto processing

Enables Auto SmartPorts macros on a specific interface.

macro auto sticky

Specifies not to remove configurations applied by ASP across link flaps and device removal.

shell trigger

Creates a user defined trigger.

macro auto execute (built-in function)

Use the macro auto execute configuration command to change built-in function default values or to map user-defined triggers to built-in functions and to pass the parameter values. Use the no form of this command to unmap the trigger.

macro auto execute event_trigger builtin shell_function [param name=values]

no macro auto execute event_trigger builtin shell_function [param name=values]

 
Syntax Description

event_trigger

Defines mapping from an event trigger to a built-in macro.

Specify an event trigger :

  • CISCO_PHONE_EVENT
  • CISCO_SWITCH_EVENT
  • CISCO_ROUTER_EVENT
  • CISCO_WIRELESS_AP_EVENT
  • CISCO_WIRELESS_LIGHTWEIGHT_AP_EVENT
  • CISCO_DMP_EVENT
  • CISCO_IPVSC_EVENT
  • WORD —Apply a user-defined event trigger.

shell_function

Specifies a built-in macro name :

  • CISCO_PHONE_AUTO_SMARTPORT
    (Optional) Specify the parameter values: $ACCESS_VLAN=(1) and $VOICE_VLAN=(2).
  • CISCO_SWITCH_AUTO_SMARTPORT
    (Optional) Specify the parameter values: $NATIVE_VLAN=(1).
  • CISCO_ROUTER_AUTO_SMARTPORT
    (Optional) Specify the parameter values: $NATIVE_VLAN=(1).
  • CISCO_AP_AUTO_SMARTPORT
    (Optional) Specify the parameter values: $NATIVE_VLAN=(1).
  • CISCO_LWAP_AUTO_SMARTPORT
    (Optional) Specify the parameter values: $ACCESS_VLAN=(1).
  • CISCO_DMP_AUTO_SMARTPORT
  • CISCO_IP_CAMERA_AUTO_SMARTPORT

param name=value

(Optional) Specifies values for the parameters that are to be used in the function body.

 
Defaults

Auto Smartports is disabled.

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The switch automatically maps from builtin event triggers to builtin functions. The builtin functions are system-defined functions in the software image.

Use the macro auto execute global configuration command to replace the builtin function default values with values specific to your switch.

You can also create user-defined triggers and use this command to map the triggers to builtin functions.

You can create user-defined event triggers by entering the shell trigger global configuration command. Use the show shell privileged EXEC command to display the contents of the builtin and user-defined triggers and functions.

Examples

This example shows how to use two built-in Auto Smartports macros for connecting Cisco switches and Cisco IP phones to the switch. It modifies the default voice VLAN, access VLAN, and native VLAN for the trunk interface:

Switch# configure terminal
Switch(config)#!!! the next command modifies the access and voice vlans
Switch(config)#!!! for the built in Cisco IP phone auto smartport macro
Switch(config)# macro auto execute CISCO_PHONE_EVENT builtin CISCO_PHONE_AUTO_SMARTPORT ACCESS_VLAN=10 VOICE_VLAN=20
Switch(config)#
Switch(config)#!!! the next command modifies the native vlan
Switch(config)#!!! for the built in switch auto smartport macro
Switch(config)# macro auto execute CISCO_SWITCH_EVENT builtin CISCO_SWITCH_AUTO_SMARTPORT NATIVE_VLAN=10
Switch(config)#!!! the next example creates a user-defined trigger and maps it to a builtin functions
Switch(config)# shell trigger myTrigger “user-defined trigger”
Switch(config)# macro auto execute myTrigger builtin CISCO_PHONE_AUTO_SMARTPORT_ACCESSVLAN voice_vlan
Switch(config)#!!! the next command enables auto smart ports globally
Switch(config)# macro auto global processing fallback CDP
 
Switch# !!! here's the running configuration of the interface connected
Switch# !!! to another Cisco Switch after the Macro is applied
Switch#
Switch# show running-config interface Gi1/0/1
Building configuration...
 
Current configuration : 284 bytes
!
interface GigabitEthernet1/0/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport mode trunk
srr-queue bandwidth share 10 10 60 20
queue-set 2
priority-queue out
mls qos trust cos
auto qos voip trust
macro description CISCO_SWITCH_EVENT
end

 
Related Commands

Command
Description

macro auto device

Simplifies changing the parameters for a built-in functions for a device type.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto processing

Enables Auto SmartPorts macros on a specific interface.

macro auto sticky

Specifies not to remove configurations applied by ASP across link flaps and device removal.

shell trigger

Creates a user defined trigger.

Refer to IOS documentation.

macro auto execute (remotely-defined trigger)

Use the macro auto execute configuration command to map a trigger to a remotely defined function. Use the no form of this command to unmap the trigger.

macro auto execute trigger_name remote url

no macro auto execute trigger_name remote url

 
Syntax Description

trigger_name

Specifies the trigger name.

url

Specifies the remotely-defined URL

 
Defaults

None

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command enables you to store shell functions in a central location and utilized by ASP on many switches. This alleviates the problem of updating functions on every switch for each modification.
 
Triggering of the remotely defined function requires network connectivity to the URL, which is accessed for each execution of the function.

Examples

This example shows how to map a trigger to the remotely defined function myfunction - the filename that contains the function body:

Switch(config)# macro auto execute mytrigger remote tftp://dirt/tftpboot/myfunction

 
Related Commands

Command
Description

macro auto device

Simplifies changing the parameters for a built-in functions for a device type.

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto processing

Enable Auto SmartPorts macros on a specific interface.

macro auto sticky

Specifies not to remove configurations applied by ASP across link flaps and device removal.

JAY]<

Create a user defined trigger.

macro auto execute (user-defined function)

Use the macro auto execute configuration command to map a trigger to a user-defined function. Use the no form of this command to unmap the trigger.

macro auto execute trigger_name [param_name=value] {function body}

no macro auto execute trigger_name [param_name=value]

 
Syntax Description

trigger_name

Specifies the trigger name.

param name=value

(Optional) Specifies values for the parameters that are to be used in the function body.

function_body

Shell functions with CLIs.

 
Defaults

None.

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Because the function defined in this command does not have a name, you cannot use it to map to another trigger. This is the only way that you can map a trigger to a user defined function. Shell functions defined in the non-configure mode can not be used to map triggers.

Examples

This example shows how to map the user-defined event trigger Cisco Digital Media Player (DMP) to a user-defined macro.

a. Connect the DMP to an 802.1x- or MAB-enabled switch port.

b. On the RADIUS server, set the attribute-value pair to auto-smart-port =CISCO_DMP_EVENT.

c. On the switch, create the event trigger CISCO_DMP_EVENT, and enter the user-defined macro commands shown below.

d. The switch recognizes the attribute-value pair=CISCO_DMP_EVENT response from the RADIUS server and applies the macro associated with this event trigger.

Switch(config)# shell trigger CISCO_DMP_EVENT Cisco DMP player
Switch(config)# macro auto execute CISCO_DMP_EVENT {
if [[ $LINKUP -eq YES ]]; then
conf t
interface $INTERFACE
macro description $TRIGGER
switchport access vlan 1
switchport mode access
switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity
spanning-tree portfast
spanning-tree bpduguard enable
exit
fi
if [[ $LINKUP -eq NO ]]; then
conf t
interface $INTERFACE
no macro description $TRIGGER
no switchport access vlan 1
if [[ $AUTH_ENABLED -eq NO ]]; then
no switchport mode access
fi
no switchport port-security
no switchport port-security maximum 1
no switchport port-security violation restrict
no switchport port-security aging time 2
no switchport port-security aging type inactivity
no spanning-tree portfast
no spanning-tree bpduguard enable
exit
fi
}
Switch(config)# end

 
Related Commands

Command
Description

macro auto device

Simplifies changing the parameters for a built-in functions for a device type.

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto processing

Enables Auto SmartPorts macros on a specific interface.

macro auto sticky

Specifies not to remove configurations applied by ASP across link flaps and device removal.

shell trigger

Creates a user defined trigger.

macro auto global processing

Use the macro auto global processing global configuration command to enable Auto SmartPorts macros on the switch. Use the no form of this command to disable Auto SmartPorts (ASP) macros globally.

macro auto global processing [cdp | lldp]

no macro auto global processing [ cdp | ldp]


Note Starting with Release 15.0(2)SG, the fallback option has been deprecated.


 
Syntax Description

cdp

Selects CDP as fallback mode.

lldp

Selects LLDP as fallback mode.

 
Defaults

Auto Smartports is disabled.

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Use the macro auto global processing global configuration command to globally enable Auto Smartports macros on the switch. To disable ASP macros on a specific port, use the no macro auto processing command in the interface mode before ASP is enabled globally.

Auto Smartports macros dynamically configure ports based on the device type detected on the port. When the switch detects a new device on a port it applies the appropriate ASP macro. When a link-down event occurs on a port, the switch removes the macro. For example, when you connect a Cisco IP phone to a port, ASP automatically applies the IP phone macro. The IP phone macro enables quality of service (QoS), security features, and a dedicated voice VLAN to ensure proper treatment of delay-sensitive voice traffic.

ASP uses event triggers to map devices to macros. The most common event triggers are based on Cisco Discovery Protocol (CDP) messages received from connected devices. The detection of a device invokes a CDP event trigger: Cisco IP phone, Cisco wireless access point, Cisco switch, or Cisco router. Other event triggers use MAC authentication bypass (MAB) and 802.1X authentication messages.

Use CDP if port authentication is enabled and the RADIUS server does not send an event trigger.

Select LLDP to apply auto configuration if authentication fails.

If authentication is enabled on a port, a switch ignores CDP and LLDP messages unless the cdp keyword is enabled.

When using 802.1X or MAB authentication, configure the RADIUS server to support the Cisco attribute-value (AV) pair auto-smart-port=event trigger.

When CDP-identified devices advertise multiple capabilities, a switch chooses a capability in this priority order: switch, router, access point, lightweight access point, phone, host.

To verify that an ASP macro is applied to an interface, use the show running config command.

The macro auto global processing cdp and macro auto global processing lldp commands enables ASP globally if it is not already enabled, and set the fallback to CDP or LLDP, respectively. However, the no macro auto global processing [cdp | lldp] command only removes the fallback mechanism. It does not disable ASP globally; only the no macro auto global processing command disables ASP globally.

The keywords cdp and lldp are also controlled at the interface level; by default, CDP is the fallback mechanism on an interface. If you prefer LLDP, first enter the no macro auto processing cdp command, then enter the macro auto processing lldp command.

If you want to activate both CDP and LLDP, you must enable them in sequence. For example, you would first enter the macro auto processing cdp command, then the macro auto processing lldp command.

Examples

This example shows how enable ASP on a switch and to disable the feature on Gi1/0/1:

Switch(config)# interface interface Gi1/0/1
Switch(config-if)# no macro auto processing
Switch(config)# macro auto global processing

 
Related Commands

Command
Description

macro auto device

Simplifies changing the parameters for a built-in functions for a device type.

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto processing

Enables ASP macros on a specific interface.

macro auto sticky

Enables a user to not remove configurations applied by ASP across link flaps and device removal.

shell trigger

Creates a user defined trigger.

macro auto mac-address-group

Use the macro auto mac-address-group command to configure a group of MAC-address or OUIs as a trigger. Use the no form of this command to unconfigure the group.

macro auto mac-address-group grp_name

no macro auto mac-address-group grp_namel

 
Syntax Description

grp_name

Specifies the group name.

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command changes the mode to config-mac-addr-grp, in which you can add or remove a MAC address or OUI from the group.

You can specify a list of MACs or OUIs, or a range of OUIs (maximum of 5 in the range).

Examples

This example shows how to configure testGroup as a trigger:

Switch(config)# macro auto mac-address-group testGroup
Switch(config-addr-grp-mac)# mac-address list 1111.1111.1111 2222.2222.2222
Switch(config-addr-grp-mac)# exit
Switch(config)# exit

 
Related Commands

Command
Description

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto processing

Enables Auto SmartPorts macros on a specific interface.

macro auto sticky

Specifies not to remove configurations applied by ASP across link flaps and device removal.

shell trigger

Creates a user defined trigger.

Refer to IOS documentation.

macro auto monitor

To enable the device classifier, use the macro auto monitor global configuration command. Use the no form of this command to disable the device classifier.

macro auto monitor

no macro auto monitor

 
Syntax Description

This command has no arguments or keywords.

 
Command Default

Device classifier is enabled.

 
Command Modes

Global configuration

 
Command History

Release
Modification

Release IOS XE 3.3.0 SG (15.1(1)SG)

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Use the no macro auto monitor global configuration command to disable the device classifier. You cannot disable the device classifier while it is being used by features such as ASP.

Examples

This example shows how to enable the ASP device classifier on a switch:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# macro auto monitor
Switch(config)# end

 
Related Commands

Command
Description

show macro auto monitor clients

Displays the clients using the device classifier facility on the switch.

show macro auto monitor device

Displays the devices connected to a switch, along with their properties and classifications.

show macro auto monitor type

Displays all the device types known to the device classification agent.

macro auto processing


Note Only use this command when Auto SmartPorts (ASP) is enabled globally; when ASP is disabled globally, interface-level control has no effect.


Use the macro auto processing interface configuration command to enable ASP macros on a specific interface. Use the no form of this command to disable ASP on a specific interface before ASP is enabled globally.

macro auto processing [fallback cdp] [fallback lldp]

no macro auto processing [fallback cdp] [fallback lldp]

 
Syntax Description

fallback cdp

Specifies as CDP as the fallback mechanism.

fallback lldp

Specifies as LLDP as the fallback mechanism.

 
Defaults

Fallback mechanism is CDP.

 
Command Modes

Interface level configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The no macro auto processing command should be configured on all interfaces where ASP is not desirable (such as Layer 3 and EtherChannel interfaces) before ASP is enabled globally.

At the interface level, the default fallback mechanism is CDP. To change the mechanism to LLDP, enter the no macro auto processing fallback cdp command, followed by the macro auto processing fallback lldp command.

Examples

This example shows how to enable the feature on an interface:

Switch(config)# interface Gi3/1
Switch(config-if)# macro auto processing

 
Related Commands

Command
Description

macro auto execute (built-in function)

Configures mapping from an event trigger to a built-in macro.

shell trigger

Creates a user defined trigger.

show shell functions

Displays configurations included for all the builtin functions including user created and built-in functions.

show shell triggers

Displays detail for all supported user created and built-in triggers.

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto sticky

Use the macro auto sticky configuration to specify not to remove configurations applied by ASP across link flaps and device removal.

macro auto sticky

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

Not sticky (macros are removed

 
Command Modes

Global configuration

 
Command History

Release
Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command enables you to avoid unnecessary removal of ASP configurations when a feature intentionally shuts down a link (like EnergyWise, which shuts down inactive links to save energy). When such a feature is enabled, you don't want ASP macros to be applied and removed unnecessarily. So you configure the sticky feature.

Examples

This example shows how to specify not to remove configurations:

Switch(config)# macro auto sticky

 
Related Commands

Command
Description

macro auto execute (built-in function)

Changes built-in function default values or to map user-defined triggers to built-in functions, and to pass the parameter values.

macro auto execute (remotely-defined trigger)

Maps a trigger to a remotely defined functions.

macro auto execute (user-defined function)

Maps a trigger to a user-defined function.

macro auto global processing

Enables Auto Smartports on a switch.

macro auto processing

Enables Auto SmartPorts macros on a specific interface.

shell trigger

Creates a user defined trigger.

macro global apply cisco-global

To apply the system-defined default template to the switch, use the macro global apply cisco-global global configuration command on the switch stack or on a standalone switch.

macro global apply cisco-global

 
Syntax Description

This command has no keywords or variables.

 
Defaults

This command has no default setting.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(31)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

These examples show how to apply the system-defined default to the switch:

Switch(config)# macro global apply cisco-global
Changing VTP domain name from gsg-vtp to [smartports] Device mode already VTP TRANSPARENT.
Switch(config)#

macro global apply system-cpp

To apply the control plane policing default template to the switch, use the macro global apply system-cpp global configuration command on the switch stack or on a standalone switch.

macro global apply system-cpp

 
Syntax Description

This command has no keywords or variables.

 
Defaults

This command has no default setting.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(31)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to apply the system-defined default to the switch:

Switch (config)# macro global apply system-cpp
Switch (config)#

 
Related Commands

Command
Description

macro global apply cisco-global

Applies the system-defined default template to the switch.

macro global description

Enters a description about the macros that are applied to the switch.

macro global description

To enter a description about the macros that are applied to the switch, use the macro global description global configuration command on the switch stack or on a standalone switch. Use the no form of this command to remove the description.

macro global description text

no macro global description text

 
Syntax Description

text

Enters a description about the macros that are applied to the switch.

 
Defaults

This command has no default setting.

 
Command Modes

Global configuration mode

 
Command History

Release
Modification

12.2(31)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

This command associates comment text, or the macro name, with a switch. When multiple macros are applied on a switch, the description text will be from the last applied macro.

Examples

This example shows how to add a description to a switch:

Switch(config)# macro global description udld aggressive mode enabled
 

You can verify your settings by entering the show parser macro description privileged EXEC command.

 
Related Commands

Command
Description

macro global apply cisco-global

Applies the system-defined default template to the switch.

main-cpu

To enter the main CPU submode and manually synchronize the configurations on the two supervisor engines, use the main-cpu command.

main-cpu

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

This command has no default settings.

 
Command Modes

Redundancy mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch. (Catalyst 4507R only).

 
Usage Guidelines

The main CPU submode is used to manually synchronize the configurations on the two supervisor engines. From the main CPU submode, use the auto-sync command to enable automatic synchronization of the configuration files in NVRAM.


Note After you enter the main CPU submode, you can use the auto-sync command to automatically synchronize the configuration between the primary and secondary route processors based on the primary configuration. In addition, you can use all of the redundancy commands that are applicable to the main CPU.


Examples

This example shows how to reenable the default automatic synchronization feature using the auto-sync standard command to synchronize the startup-config and config-register configuration of the active supervisor engine with the standby supervisor engine. The updates for the boot variables are automatic and cannot be disabled.

Switch(config)# redundancy
Switch(config-red)# main-cpu
Switch(config-r-mc)# auto-sync standard
Switch(config-r-mc)# end
Switch# copy running-config startup-config
Switch#

 
Related Commands

Command
Description

auto-sync

Enables automatic synchronization of the configuration files in NVRAM.

match

To specify a match clause by selecting one or more ACLs for a VLAN access-map sequence, use the match subcommand. To remove the match clause, use the no form of this command.

match { ip address { acl-number | acl-name }} | { mac address acl-name }

no match { ip address { acl-number | acl-name }} | { mac address acl-name }


Note If a match clause is not specified, the action for the VLAN access-map sequence is applied to all packets. All packets are matched against that sequence in the access map.


 
Syntax Description

ip address acl-number

Selects one or more IP ACLs for a VLAN access-map sequence; valid values are from 1 to 199 and from 1300 to 2699.

ip address acl-name

Selects an IP ACL by name.

mac address acl-name

Selects one or more MAC ACLs for a VLAN access-map sequence.

 
Defaults

This command has no default settings.

 
Command Modes

VLAN access-map mode

 
Command History

Release
Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The match clause specifies the IP or MAC ACL for traffic filtering.

The MAC sequence is not effective for IP packets. IP packets should be access controlled by IP match clauses.

Refer to the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide for additional configuration guidelines and restrictions.

Refer to the Cisco IOS Command Reference publication for additional match command information.

Examples

This example shows how to define a match clause for a VLAN access map:

Switch(config)# vlan access-map ganymede 10
Switch(config-access-map)# match ip address 13
Switch(config-access-map)#

 
Related Commands

Command
Description

show vlan access-map

Displays the contents of a VLAN access map.

vlan access-map

Enters VLAN access-map command mode to create a VLAN access map.

match (class-map configuration)

To define the match criteria for a class map, use the match class-map configuration command. To remove the match criteria, use the no form of this command.

match { access-group acl-index-or-name | cos cos-list | [ lp ] dscp dscp-list | [ lp ] precedence ip-precedence-list | qos-group value | protocol [ ip | ipv6 | arp ]

no match { access-group acl-index-or-name | cos cos-list | [ lp ] dscp dscp-list | [ lp ] precedence ip-precedence-list | qos-group value | protocol [ ip | ipv6 | arp ]

 
Syntax Description

access-group acl-index-or-name

Number or name of an IP standard or extended access control list (ACL) or MAC ACL. For an IP standard ACL, the ACL index range is 1 to 99 and 1300 to 1999. For an IP extended ACL, the ACL index range is 100 to 199 and 2000 to 2699.

cos cos-list

Lists up to four Layer 2 class of service (CoS) values to match against a packet. Separate each value with a space. The range is 0 to 7.

[ lp ] dscp dscp-list

(Optional) IP keyword. It specifies that the match is for IPv4 packets only. If not used, the match is for both IPv4 and IPv6 packets.

Lists up to eight IP Differentiated Services Code Point (DSCP) values to match against a packet. Separate each value with a space. The range is 0 to 63. You also can enter a mnemonic name for a commonly used value.

[ lp ] precedence ip-precedence-list

(Optional) IP keyword. It specifies that the match is for IPv4 packets only. If not used, the match is for both IPv4 and IPv6 packets.

Lists up to eight IP-precedence values to match against a packet. Separate each value with a space. The range is 0 to 7. You also can enter a mnemonic name for a commonly used value.

qos-group value

Specifies the internally generated qos-group value assigned to a packet on the input qos classification.

protocol ip

Specifies IP in the Ethernet header. Though visible in the command-line help strings, the only protocol types supported are IP, IPv6, and ARP.

protocol ipv6

Specifies IPv6 in the Ethernet header. Though visible in the command-line help strings the only protocol types supported are IP, IPv6, and ARP.

protocol arp

Specifies ARP in the Ethernet header. Though visible in the command-line help strings the only protocol types supported are IP, IPv6, and ARP.

 
Defaults

No match criteria are defined.

 
Command Modes

Class-map configuration mode

 
Command History

Release
Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switches.

12.2(40)SG

Support extended to Supervisor Engine 6-E and the Catalyst 4900M chassis.

12.2(46)SG

Added support for the match protocol arp command on the Supervisor Engine 6-E and Catalyst 4900M chassis.

 
Usage Guidelines

Before entering the match command, you must first enter the class-map global configuration command to specify the name of the class whose match criteria you want to establish. The match command is used to specify which fields in the packets are examined to classify the packets. If a packet matches the specified criteria, the packet is considered a member of the class and is forwarded according to the quality of service (QoS) specifications set in the traffic policy.

For the match ip dscp dscp-list or the match ip precedence ip-precedence-list command, you can enter a mnemonic name for a commonly used value. For example, you can enter the match ip dscp af11 command, which is the same as entering the match ip dscp 10 command. You can enter the match ip precedence critical command, which is the same as entering the match ip precedence 5 command. For a list of supported mnemonics, enter the match ip dscp ? or the match ip precedence ? command to see the command-line help strings.

To match only IPv6 packets, you must use the match protocol ipv6 command. To match only IPv4 packets you can use either the ip prefix or the protocol ip keyword.

To match only ARP packets, you must use the match protocol arp command.

You can configure the match cos cos-list , match ip dscp dscp-list , match ip precedence ip-precedence-list command in a class map within a policy map.

The match cos cos-list command applies only to Ethernet frames that carry a VLAN tag.

The match qos-group command is used by the class-map to identify a specific QoS group value assigned to a packet. The QoS group value is local to the switch and is associated with a packet on the input Qos classification.

Packets that do not meet any of the matching criteria are classified as members of the default traffic class. You configure it by specifying class-default as the class name in the class policy-map configuration command. For more information, see the “class” section.

Examples

This example shows how to create a class map called class2, which matches all the inbound traffic with DSCP values of 10, 11, and 12:

Switch# configure terminal
Switch(config)# class-map class2
Switch(config-cmap)# match ip dscp 10 11 12
Switch(config-cmap)# exit
Switch#
 

This example shows how to create a class map called class3, which matches all the inbound traffic with IP-precedence values of 5, 6, and 7 for both IPv4 and IPv6 traffic:

Switch# configure terminal
Switch(config)# class-map class3
Switch(config-cmap)# match ip precedence 5 6 7
Switch(config-cmap)# exit
Switch#
 

This example shows how to delete the IP-precedence match criteria and to classify traffic using acl1 :

Switch# configure terminal
Switch(config)# class-map class2
Switch(config-cmap)# match ip precedence 5 6 7
Switch(config-cmap)# no match ip precedence
Switch(config-cmap)# match access-group acl1
Switch(config-cmap)# exit
Switch#
 

This example shows how to specify a class-map that applies only to IPv6 traffic on a Supervisor Engine 6-E:

Switch# configure terminal
Switch(config)# class-map match all ipv6 only
Switch(config-cmap)# match dscp af21
Switch(config-cmap)# match protocol ipv6
Switch(config-cmap)# exit
Switch#
 

You can verify your settings by entering the show class-map privileged EXEC command.

 
Related Commands

Command
Description

class-map

Creates a class map to be used for matching packets to the class whose name you specify and to enter class-map configuration mode.

show class-map

Displays class map information.

match flow ip

To specify match criteria to treat flows with a unique source or destination address as new flows, use the match flow ip command. To disable this function, use the no form of this command.

match flow ip { source - address [ ip destination-address ip protocol L4 source-address L4 destination-address ] | destination - address }

no match flow ip { source - address [ ip destination-address ip protocol L4 source-address L4 destination-address ] | destination - address }

 
Syntax Description

source - address

Establishes a new flow from a flow with a unique IP source address.

ip destination-address ip protocol L4 source-address L4 destination-address

(Optional) Comprises the full flow keyword; treats each flow with unique IP source, destination, protocol, and Layer 4 source and destination address as a new flow.

destination - address

Establishes a new flow from a flow with a unique IP destination address.

 
Defaults

This command has no default settings..

 
Command Modes

class-map configuration submode

 
Command History

Release
Modification

12.2(25)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(25)SG

Support for the full flow option was added.

 
Usage Guidelines

When you specify the source-address keyword, each flow with a unique source address is treated as a new flow.

When you specify the destination-address keyword, each flow with a unique destination address is treated as a new flow.

A policy map is called a flow-based policy map when you configure the flow keywords on the class map that it uses. To attach a flow-based policy map as a child to an aggregate policy map, use the service - policy command.


Note The match flow command is available on the Catalyst 4500 series switch only when
Supervisor Engine VI (WS-X4516-10GE) is present.


Examples

This example shows how to create a flow-based class map associated with a source address:

Switch(config)# class-map match-all c1
Switch(config-cmap)# match flow ip source-address
Switch(config-cmap)# end
Switch#
Switch# show class-map c1
Class Map match-all c1 (id 2)
Match flow ip source-address
Switch#
 

This example shows how to create a flow-based class map associated with a destination address:

Switch(config)# class-map match-all c1
Switch(config-cmap)# match flow ip destination-address
Switch(config-cmap)# end
Switch#
 
Switch# show class-map c1
Class Map match-all c1 (id 2)
Match flow ip destination-address
Switch#
 

Assume there are two active flows on the Fast Ethernet interface 6/1 with source addresses 192.168.10.20 and 192.168.10.21. The following example shows how to maintain each flow to 1 Mbps with an allowed burst value of 9000 bytes:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# class-map c1
Switch(config-cmap)# match flow ip source-address
Switch(config-cmap)# exit
Switch(config)# policy-map p1
Switch(config-pmap)# class c1
Switch(config-pmap-c)# police 1000000 9000
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface fastethernet6/1
Switch(config-if)# service-policy input p1
Switch(config-if)# end
Switch# write memory
 
Switch# show policy-map interface
FastEthernet6/1
 
Service-policy input: p1
 
Class-map: c1 (match-all)
15432182 packets
Match: flow ip source-address
police: Per-interface
Conform: 64995654 bytes Exceed: 2376965424 bytes
 
Class-map: class-default (match-any)
0 packets
Match: any
0 packets
Switch#
 

This example shows two active flows on the Fast Ethernet interface 6/1 with destination addresses of 192.168.20.20 and 192.168.20.21. The following example shows how to maintain each flow to 1 Mbps with an allowed burst value of 9000 bytes:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# class-map c1
Switch(config-cmap)# match flow ip destination-address
Switch(config-cmap)# exit
Switch(config)# policy-map p1
Switch(config-pmap)# class c1
Switch(config-pmap-c)# police 1000000 9000
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface fastethernet6/1
Switch(config-if)# service-policy input p1
Switch(config-if)# end
Switch# write memory
 
Switch# show policy-map interface
FastEthernet6/1
 
Service-policy input: p1
 
Class-map: c1 (match-all)
2965072 packets
Match: flow ip destination-address
police: Per-interface
Conform: 6105636 bytes Exceed: 476652528 bytes
 
Class-map: class-default (match-any)
0 packets
Match: any
0 packets
Switch#
 

Assume there are two active flows as shown below on the Fast Ethernet interface 6/1:

SrcIp DstIp IpProt SrcL4Port DstL4Port
--------------------------------------------------------
192.168.10.10 192.168.20.20 20 6789 81
192.168.10.10 192.168.20.20 20 6789 21
 

With the following configuration, each flow is policed to a 1000000 bps with an allowed 9000-byte burst value.


Note If you use the match flow ip source-address|destination-address command, these two flows are consolidated into one flow because they have the same source and destination address.


Switch# conf terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# class-map c1
Switch(config-cmap)# match flow ip source-address ip destination-address ip protocol l4 source-port l4 destination-port
Switch(config-cmap)# exit
Switch(config)# policy-map p1
Switch(config-pmap)# class c1
Switch(config-pmap-c)# police 1000000 9000
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface fastEthernet 6/1
Switch(config-if)# service-policy input p1
Switch(config-if)# end
Switch# write memory
Switch# show policy-map interface
FastEthernet6/1
 
class-map c1
match flow ip source-address ip destination-address ip protocol l4 source-port l4 destination-port
!
policy-map p1
class c1
police 1000000 bps 9000 byte conform-action transmit exceed-action drop
!
interface FastEthernet 6/1
service-policy input p1
 
Switch# show class-map c1
Class Map match-all c1 (id 2)
Match flow ip source-address ip destination-address ip protocol l4 source-port l4 destination-port
 
Switch# show policy-map p1
Policy Map p1
Class c1
police 1000000 bps 9000 byte conform-action transmit exceed-action drop
 
Switch# show policy-map interface
FastEthernet6/1
 
Service-policy input: p1
 
Class-map: c1 (match-all)
15432182 packets
Match: flow ip source-address ip destination-address ip protocol l4 source-port l4 destination-port
police: Per-interface
Conform: 64995654 bytes Exceed: 2376965424 bytes
 
 
Class-map: class-default (match-any)
0 packets
Match: any
0 packets
Switch#

 
Related Commands

Command
Description

service-policy (interface configuration)

Attaches a policy map to an interface.

show class-map

Displays class map information.

show policy-map

Displays information about the policy map.

show policy-map interface

Displays the statistics and configurations of the input and output policies that are attached to an interface.

mdix auto

To enable the automatic medium-dependent interface crossover (auto-MDIX) feature on the interface, use the mdix auto command. When auto-MDIX is enabled, the interface automatically detects the required cable connection type (straight-through or crossover) and configures the connection appropriately. Use the no form of this command to disable auto-MDIX.

mdix auto

no mdix auto

 
Syntax Description

This command has no arguments or keywords.

 
Defaults

Auto-MDIX is enabled.

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(31)SGA

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(46)SG

Added supported and unsupported linecard information to the usage guidelines.

 
Usage Guidelines

The following linecards support Auto-MDIX through the CLI on their copper media ports: WS-X4124-RJ45, WS-X4148-RJ45 (hardware revision 3.0 or higher), and WS-X4232-GB-RJ45 (hardware revision 3.0, or higher), WS-X4920-GE-RJ45, and WS-4648-RJ45V+E (Auto-MDIX support when inline power is disabled on the port).

Linecards that support auto-MDIX by default when port auto-negotiation enabled and cannot be turned off using an mdix CLI command include: WS-X4448-GB-RJ45, WS-X4548-GB-RJ45, WS-X4424-GB-RJ45, and WS-X4412-2GB-T.

Linecards that cannot support auto-MDIX functionality, either by default or CLI commands, include: WS-X4548-GB-RJ45V, WS-X4524-GB-RJ45V, WS-X4506-GB-T, WS-X4148-RJ, WS-X4248-RJ21V, WS-X4248-RJ45V, WS-X4224-RJ45V, and WS-X4232-GB-RJ.

When you enable auto-MDIX on an interface, you must also set the interface speed to be autoneogiated so that the feature operates correctly.

When auto-MDIX (and autonegotiation of speed) is enabled on one or both of connected interfaces, link up occurs even if the cable type (straight-through or crossover) is incorrect.

Examples

This example shows how to enable auto MDIX on a port:

Switch# configure terminal
Switch(config)# interface FastEthernet6/3
Switch(config-if)# speed auto
Switch(config-if)# mdix auto
Switch(config-if)# end

 
Related Commands

Command
Description

speed

Configures the interface speed.

show interfaces

Displays traffic on a specific interface.

show interfaces (virtual switch)

Displays the interface capabilities for an interface or for all the interfaces on a switch.

show interfaces status

Displays the interface status.

media-type

To select the connector for a dual-mode capable port, use the media-type command.

media - type { rj45 | sfp }

 
Syntax Description

rj45

Uses the RJ-45 connector.

sfp

Uses the SFP connector.

 
Defaults

sfp

 
Command Modes

Interface configuration mode

 
Command History

Release
Modification

12.2(20)EWA

Support for this command was introduced for the WS-X4306-GB-T module and the WS-X4948 chassis.

 
Usage Guidelines

This command is supported on all ports on the WS-X4306-GB-T module and ports 1/45-48 on the WS-X4948 chassis.

Entering the show interface capabilities command provides the Multiple Media Types field, which displays the value no if a port is not dual-mode capable and lists the media types (sfp and rj45) for dual-mode capable ports.

Examples

This example shows how to configure port 5/45 on a WS-X4948 chassis to use the RJ-45 connector:

Switch(config)# interface gigabitethernet 5/45
Switch(config-if)# media-type rj45

mode

To set the redundancy mode, use the mode command.

mode { rpr | sso }

 
Syntax Description

rpr

Specifies RPR mode.

sso

Specifies SSO mode.

 
Defaults

If you are upgrading the current supervisor engine from Cisco IOS Release 12.2(18)EW or an earlier release to 12.2(20)EWA, and the RPR mode has been saved to the startup configuration, both supervisor engines will continue to operate in RPR mode after the software upgrade. To use SSO mode, you must manually change the redundancy mode to SSO.

 
Command Modes

Redundancy configuration mode

 
Command History

Release
Modification

12.2(20)EWA

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

RPR and SSO mode are not supported on Catalyst 4500 series switches that are configured with Supervisor Engine 2.

The mode command can be entered only from within redundancy configuration mode.

Follow these guidelines when configuring your system to RPR or SSO mode:

  • You must use identical Cisco IOS images and supervisor engines to support RPR and SSO mode. Redundancy may not work due to differences between the Cisco IOS release and supervisor engine capabilities.
  • Any modules that are not online at the time of a switchover are reset and reloaded on a switchover.
  • If you perform an OIR of the module within 60 seconds before a stateful switchover, the module resets during the stateful switchover and the port states are restarted.
  • The FIB tables are cleared on a switchover. Routed traffic is interrupted until route tables reconverge.

The redundant supervisor engine reloads on any mode change and begins to work in the current mode.

Examples

This example shows how to set the redundancy mode to SSO:

Switch(config)# redundancy
Switch(config-red)# mode sso
Switch(config-red)#

 
Related Commands

Command
Description

redundancy

Enters the redundancy configuration mode.

redundancy force-switchover

Forces a switchover from the active to the standby supervisor engine.

show redundancy

Displays redundancy facility information.

show running-config

Displays the running configuration of a switch.

monitor capture {access-list | class-map}

To specify an access list or class map as the core filter, use the monitor capture {access-list | class-map} command. To remove the filter, use the no form of this command.

monitor capture name {access-list name | class-map name}

no monitor capture name {access-list name | class-map name}

 
Syntax Description

name

Specifies a capture point.

access-list name

Specifies access list name

class-map name

Specifies class map name

 
Defaults

None

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The access list or class map is defined with configuration commands. The access list or class map should be defined prior to entering the monitor capture command. We can specify the core filter as a class map, access lis, t or an explicit in-line filter. If the filter has already been specified when you enter the monitor capture command, it replaces the older one.

Examples

The following example shows how to define a core system filter using an existing ACL or class-map:

Switch# monitor capture mycap filter access-list myacl
 
Switch# monitor capture mycap filter class-map mycm
Switch# no monitor capture mycap filter class-map mycm

monitor capture [clear | export]

To clear capture buffer contents or to store the packets to a file, use the monitor capture [clear | export filename] command.

monitor capture name [clear] [export filename]

 
Syntax Description

name

Specifies a capture point.

clear

Clears all the packets in the capture buffer.

export filename

Store all the packets in capture buffer to a.pcap file.

 
Defaults

none

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The clear option empties the capture buffer and the export option stores the packets in the capture buffer to the file. You should use these commands only when the storage destination is a capture buffer. These commands are usable either during capture or when it has stopped either because one or more end conditions has been met or you entered the stop command. If you enter the clear command after the capture has stopped, further export (or decode) and display commands have no impact because the buffer has no packets.

Examples

The following example shows how to associate or disassociate a capture file:

Switch# monitor capture mycap export bootflash:mycap.pcap
Switch# monitor capture mycap clear

monitor capture [interface | vlan | control-plane]

To specify one or more attachment points with direction, use the monitor capture [interface | vlan | control-plane] command. To remove the attachment point, use the no form of this command.

monitor capture name [{interface name | vlan num | control-plane} {in | out | both}]

no monitor capture name [{interface name | vlan num | control-plane} {in | out | both}]

 
Syntax Description

name

Specifies a capture point.

interface name

Specifies an interface. Interface range is allowed.

vlan num

Specifies a VLAN.

control-plane

Specifies control plane.

input | output | both

Specific traffic direction.

 
Defaults

None

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Specifies one or more attachment points with direction. We can specify a range of interfaces also. The command can be repeated as many times as needed to add multiple attachment points.

We need to mention at least one attachment point. For VLAN, the direction has to be set to both.

Examples

The following example shows how to add an attachment point:

Switch# monitor capture mycap interface gigabitEthernet 3/1 in
 

The following example shows how to remove an attachment point:

Switch# no monitor capture mycap interface gigabitEthernet 3/1 in

monitor capture file location buffer-size

To specify the capture destination, use the monitor capture command. To remove the details, use the no form of this command.

monitor capture name [[file location filename [buffer-size <1-100>] [ring <2-10>] [size <1-100>]] | [buffer [circular] size <1-100>]]

]no monitor capture name [file | buffer]

 
Syntax Description

file location filename

Specifies filename of location.

buffer-size <1-100>

Specifies bufer size in MB.

ring <2-10>

Specifies number of files.

size <1-100>

Specifies the file size.

buffer [circular] size <1-100>

Specifies that the capture destination is a buffer. By default, the mode is linear.

The keyword circular sets the buffer mode to circular.

The keyword size specifies the buffer size.

 
Defaults

The default buffer size is one MB.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

The capture destination can be a file in storage disk or a memory buffer. This command specifies the parameters related to packet storage.

The file option specifies that the packets must be stored to a file. To reduce or avoid any loss in packet capture, you can use the buffer-size option. The capture and store operations require more CPU, limiting the capture throughput.

You can increase the throughput by triggering lock-step mode, wherein the packets are first captured in the buffer. Within this mode, the “duration” parameter defines the capture duration. Once the buffer is full or the duration closes, the buffer is written to the file, greatly increasing the capture throughput. The lock-step mode is automatically triggered by specifying the buffer size to 32MB or higher.

The size of the capture file can be limited with the size option. The file location must one of the following:

  • Internal bootflash (bootflash:)
  • External flash (slot0:)
  • USB (usb0:)

Do not specify any other devices.

The destination file can be a ring of files rather than a single file. The ring option specifies the number of files in the ring whereas size specifies the total size of all the files. In ring file mode, when the file size limit has reached, it accommodates space for new packets by removing the oldest file.

If the capture destination is a buffer, you must use the show command to decode and display the packets from the buffer. If the circular option is specified, capture continues until you explicitly issue the stop command. If no space exists in the buffer, oldest packet(s) are removed to accommodate the new ones. If the circular option is not provided, newer packets are discarded when the capture buffer is full.

Examples

The following example usages show how to specify a file or a ring of files as the capture destination:

Switch# monitor capture mycap associate buffer-size 1000000file location bootflash:mycap.pcap
Switch# monitor capture mycap file location bootflash:mycap.pcap size 40
Switch# monitor capture mycap file location bootflash:mycap.pcap ring 4 size 40
Switch# monitor capture mycap file location bootflash:mycap.pcap buffer-size 8
Switch# monitor capture mycap file location bootflash:mycap.pcap ring 4 size 40 buffer-size 16
Switch# no monitor capture mycap file
 

The following example shows how to setup capture in lock-step mode:

Switch# monitor capture mycap file location bootflash:mycap.pcap buffer-size 64
Switch# no monitor capture mycap file
 

The following example shows how to make a circular buffer as the capture destination and operate on the buffer:

Switch# monitor capture mycap int gi 3/1 in match ipv4 any any
Switch# monitor capture mycap buffer circular size 1
Switch# monitor capture mycap start
Switch#
Switch# sh monitor capture mycap buffer
0.000000 10.1.1.164 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
1.000000 10.1.1.165 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
2.000000 10.1.1.166 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
3.000000 10.1.1.167 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
4.000000 10.1.1.168 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.000000 10.1.1.169 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
6.000000 10.1.1.170 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
7.000000 10.1.1.171 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
8.000000 10.1.1.172 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
9.000000 10.1.1.173 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
10.000000 10.1.1.174 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
11.000000 10.1.1.175 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
12.000000 10.1.1.176 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
Switch# sh monitor capture mycap buffer detailed
Frame 1: 256 bytes on wire (2048 bits), 256 bytes captured (2048 bits)
Arrival Time: Apr 12, 2012 10:59:06.255983000 PDT
Epoch Time: 1334253546.255983000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 256 bytes (2048 bits)
Capture Length: 256 bytes (2048 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
Ethernet II, Src: 00:00:00:00:03:01 (00:00:00:00:03:01), Dst: 54:75:d0:3a:85:3f (54:75:d0:3a:85:3f)
Destination: 54:75:d0:3a:85:3f (54:75:d0:3a:85:3f)
Address: 54:75:d0:3a:85:3f (54:75:d0:3a:85:3f)
.......0................ = IG bit: Individual address (unicast)
......0................. = LG bit: Globally unique address (factory default)
Source: 00:00:00:00:03:01 (00:00:00:00:03:01)
Address: 00:00:00:00:03:01 (00:00:00:00:03:01)
.......0................ = IG bit: Individual address (unicast)
......0................. = LG bit: Globally unique address (factory default)
Switch# sh monitor capture mycap buffer dump
0.000000 10.1.1.164 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
0000 54 75 d0 3a 85 3f 00 00 00 00 03 01 08 00 45 00 Tu.:.?........E.
0010 00 ee 00 00 00 00 40 11 59 58 0a 01 01 a4 14 01......@.YX......
0020 01 02 4e 21 4e 22 00 da 6e 13 00 01 02 03 04 05..N!N"..n.......
0030 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15................
0040 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25.......... !"#$%
0050 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 &'()*+,-./012345
0060 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 6789:;<=>?@ABCDE
0070 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 FGHIJKLMNOPQRSTU
0080 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 VWXYZ[\]^_`abcde
0090 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 fghijklmnopqrstu
00a0 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 vwxyz{|}~.......
00b0 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95................
00c0 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5................
00d0 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5................
00e0 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5................
00f0 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 63 24 51 ee............c$Q.
 
1.000000 10.1.1.165 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
Switch# monitor capture mycap clear
Switch# sh monitor capture mycap buffer detailed
Switch# monitor capture mycap stop

monitor capture limit

To specify capture limits, use the monitor capture limit command. To remove the limits, use the no form of this command.

monitor capture name limit {duration seconds] [packet-length size] [packets num]

no monitor capture name limit [duration] [packet-length] [packets]

 
Syntax Description

name

Specifies a capture point.

duration seconds

Specifies duration in seconds.

packet-length size

Specifies packet length. If the actual packet is longer, only the first size bytes are stored.

packets num

Specifies number of packets to be processed.

 
Defaults

Entire packet is processed if packet-length is not specified.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

Specifies session duration, packet segment length and number of packets to be stored

Examples

The following example shows how to associate/disassociate a capture file:

Switch# monitor capture mycap limit duration 10
 
Switch# monitor capture mycap limit packet-length 128
 
Switch# monitor capture mycap limit packets 100
 
Switch# no monitor capture mycap limit duration packet-length packets
 
Switch# monitor capture mycap limit duration 10 packet-length 128 packets 100
 
Switch# no monitor capture mycap limit

monitor capture mycap match

To define an expliciti in-line core filter, use the monitor capture mycap match command. To remove it, use the no form of this command.

Switch# [no] monitor capture mycap match {any | mac mac-match-string | ipv4 ipv4-match-string | ipv6 ipv6-match-string}
 

To use a filter for MAC, use the format below

Switch# [no] monitor capture mycap match mac {src-mac-addr src-mac-mask | any | host src-mac-addr} | {dest-mac-addr dest-mac-mask | any | host dest-mac-addr}
 

To use a filter for IPv4/IPv6, use one of the formats below

Switch# [no] monitor capture mycap match {ipv4 | ipv6} [src-prefix/length | any | host src-ip-addr] [dest-prefix/length | any | host dest-ip-addr]
 
Switch# [no] monitor capture mycap match {ipv4 | ipv6} proto {tcp | udp} [src-prefix/length | any | host src-ip-addr] [eq | gt | lt | neq <0-65535>] [dest-prefix/length | any | host dest-ip-addr] [eq | gt | lt | neq <0-65535>]

 
Syntax Description

any

Specifies “any” packet

mac mac-match-string

Specifies a Layer 2 packet

ipv4 ipv4-match-string

Specifies an IPv4 packet

ipv6 ipv6-match-string

Specifies an IPv6 packet

match name

Specifies a capture point

src-mac-addr

Specifies source MAC address

src-mac-mask

Specifies source MAC mask

host src-mac-addr

Source (or destination) MAC (or IP) address

dest-mac-addr

Specifies a destination MAC address

dest-mac-mask

Specifies a destination MAC mask

host dest-mac-addr

Specifies a source (or destination) MAC (or IP) address

src-prefix/length

Specifies a source prefix / length

host src-ip-addr

Specifies a host source IP address

dest-prefix/length

Specifices a destination prefix / length

host dest-ip-addr

Specifies a source (or destination) MAC (or IP) address

proto {tcp | udp}

Specifies the protocol to be used

{eq | gt | lt | neq} <0-65535>

Specifies Equal, Greater Than, Less than, Not Equal To

 
Defaults

none

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

You can specify the core filter as a class map, access list, or an explicit in-line filter. If the filter has already been specified when you enter this command, it replaces the older one.

The explicit, in-line filter is intended as a simple way to specify a core filter. In certain situations, you must go through the approval process to change a configuration, which could be time-consuming. Although explicit filters simplify this process, be aware that support is more extensive for access list and class maps.

You can capture IPv4, IPv6, MAC, or “any” traffic by specifying the appropriate keywords. Depending on the traffic type, the usage varies. For a MAC, you can specify an address or prefix. For IPv4 or IPv6, you can match on several fields. For source or destination ports, several operators are supported.

Examples

The following example usages show how to set or remove an explicit filter:

Switch# monitor capture mycap match any
 
Switch# monitor capture mycap match mac any any
 
Switch# monitor capture mycap match mac host 0000.0a01.0102 host 0000.0a01.0103
 
Switch# monitor capture mycap match ipv4 any any
 
Switch# monitor capture mycap match ipv4 host 10.1.1.2 host 20.1.1.2
 
Switch# monitor capture mycap match ipv4 proto udp 10.1.1.0/24 eq 20001 20.1.1.0/24 eq 20002
 
Switch# monitor capture mycap match ipv4 proto udp 10.1.1.2/24 eq 20001 any
 
Switch# no monitor capture mycap match

monitor capture start

To start or stop a capture point, use the monitor capture command.

monitor capture name start [capture-filter filter-string] [display [display-filter filter-string]] [brief | detailed | dump | stop]

 
Syntax Description

name

Specifies a capture point.

start

Starts the Wireshark session and captures live traffic.

capture-filter filter-string

Specifies the capture filter.

display [display-filter filter-string]

Decodes and displays the filter. Optionally, specifies the display filter.

[brief | detailed | dump]

Specifies the display mode. Default is brief.

stop

Stops the Wireshark session.

 
Defaults

The default display mode is brief.

 
Command Modes

Privileged EXEC mode

 
Command History

Release
Modification

IOS XE 3.3.0SG/
15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

 
Usage Guidelines

These commands start or stop a capture session, assuming all mandatory parameters are specified. We must ensure that resources like CPU and memory are available before starting the session. Because the capture and display filters must observe the Wireshark display filter syntax, ensure that the filters are accurate (for example, specify the filters within double-quotes).

If the packets will be stored and displayed, do not use display filter; in this mode, if a packet is stored, it is displayed as well. If you provide a display filter, it is ignored.

If a capture filter is specified, the capture is limited to 65536 packets. In this release, there is a limitation that the timestamp will be incorrect when we use a capture filter.

Examples

The following example shows how to start or stop a capture session in various modes:

Switch# monitor capture mycap int gi 3/1 in match ipv4 any any
Switch# monitor capture mycap file location bootflash:mycap.pcap
Switch# monitor capture mycap limit packets 100 duration 60
 
Switch# monitor capture mycap start
Switch#
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001"
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001" display
A file by the same capture file name already exists, overwrite?[confirm]
 
0.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.12 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.13 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.14 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.15 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.16 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.17 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.18 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.19 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.20 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.21 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.22 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.23 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.24 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.25 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.26 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.27 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.28 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.29 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.30 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
Switch# monitor capture mycap start capture-filter "udp.port == 20001" display display-filter "udp.port == 20002"
%Display-filter cannot be specified when capture is associated to a file. Ignoring display filter%
A file by the same capture file name already exists, overwrite?[confirm]
 
0.000000 10.1.1.96 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.97 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.98 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.99 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.100 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.101 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.102 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.103 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.104 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.105 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.106 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.107 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.108 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.109 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
Switch#
Switch# monitor capture mycap start capture-filter "udp.port == 20001" display display-filter "udp.port == 20002" detailed
%Display-filter cannot be specified when capture is associated to a file. Ignoring display filter%
A file by the same capture file name already exists, overwrite?[confirm]
 
Frame 1: 256 bytes on wire (2048 bits), 256 bytes captured (2048 bits)
Arrival Time: Dec 31, 1969 17:00:00.000000000 PDT
Epoch Time: 0.000000000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 256 bytes (2048 bits)
Capture Length: 256 bytes (2048 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
Ethernet II, Src: 00:00:00:00:03:01 (00:00:00:00:03:01), Dst: 54:75:d0:3a:85:3f (54:75:d0:3a:85:3f)
Destination: 54:75:d0:3a:85:3f (54:75:d0:3a:85:3f)
Address: 54:75:d0:3a:85:3f (54:75:d0:3a:85:3f)
.......0................ = IG bit: Individual address (unicast)
......0................. = LG bit: Globally unique address (factory default)
Source: 00:00:00:00:03:01 (00:00:00:00:03:01)
Address: 00:00:00:00:03:01 (00:00:00:00:03:01)
.......0................ = IG bit: Individual address (unicast)
......0................. = LG bit: Globally unique address (factory default)
 
Switch# monitor capture mycap start capture-filter "udp.port == 20001" display dump
A file by the same capture file name already exists, overwrite?[confirm]
 
0.000000 10.1.1.6 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
0000 54 75 d0 3a 85 3f 00 00 00 00 03 01 08 00 45 00 Tu.:.?........E.
0010 00 ee 00 00 00 00 40 11 59 f6 0a 01 01 06 14 01......@.Y.......
0020 01 02 4e 21 4e 22 00 da 6e b1 00 01 02 03 04 05..N!N"..n.......
0030 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15................
0040 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25.......... !"#$%
0050 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 &'()*+,-./012345
0060 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 6789:;<=>?@ABCDE
0070 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 FGHIJKLMNOPQRSTU
0080 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 VWXYZ[\]^_`abcde
0090 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 fghijklmnopqrstu
00a0 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 vwxyz{|}~.......
00b0 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95................
00c0 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5................
00d0 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5................
00e0 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5................
00f0 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 ac 69 6e fd.............in.
 
0.000000 10.1.1.7 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
 
Switch#
Switch# monitor capture mycap start display display-filter "udp.port == 20002"
%Display-filter cannot be specified when capture is associated to a file. Ignoring display filter%
A file by the same capture file name already exists, overwrite?[confirm]
 
0.000000 10.1.1.41 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
1.000000 10.1.1.42 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
2.000000 10.1.1.43 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
3.000000 10.1.1.44 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
4.000000 10.1.1.45 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.000000 10.1.1.46 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.998993 10.1.1.47 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
6.998993 10.1.1.48 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
7.998993 10.1.1.49 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
8.998993 10.1.1.50 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
9.998993 10.1.1.51 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
10.998993 10.1.1.52 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
 
Switch#
Switch# monitor capture mycap start display display-filter "udp.port == 20002" dump
%Display-filter cannot be specified when capture is associated to a file. Ignoring display filter%
A file by the