Page 1
Catalyst 3750 Metro Switch
Command
Cisco IOS Release 12.2(58)SE
April 2011
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
Reference
Text Part Number: OL-9645-10
Page 2
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Catalyst 3750 Metro Switch Command Reference
©2006-2011 Cisco Systems, Inc. All rights reserved.
IMPLIED, INCLUDING, WITHOUT
Page 3
CONTENTS
Preface xix
Audience xix
Purpose xix
Conventions xix
Filtering show Command Output xx
Related Publications xxi
Obtaining Documentation and Submitting a Service Request xxi
CHAPTER
CHAPTER
1 Using the Command-Line Interface 1-1
CLI Command Modes 1-1
User EXEC Mode 1-2
Privileged EXEC Mode 1-3
Global Configuration Mode 1-3
Interface Configuration Mode 1-4
VLAN Configuration Mode 1-4
Line Configuration Mode 1-4
Commands Changed in Cisco IOS 12.2(25)EY 1-5
2 Catalyst 3750 Metro Switch Cisco IOS Commands 2-1
aaa accounting dot1x 2-1
aaa authentication dot1x 2-3
action 2-5
archive download-sw 2-7
archive tar 2-9
archive upload-sw 2-12
OL-9645-10
arp access-list 2-13
auto qos voip 2-15
bandwidth 2-20
boot config-file 2-23
boot enable-break 2-24
boot helper 2-25
boot helper-config-file 2-26
Catalyst 3750 Metro Switch Command Reference
iii
Page 4
Contents
boot manual 2-27
boot private-config-file 2-28
boot system 2-29
channel-group 2-30
channel-protocol 2-34
class 2-35
class-map 2-40
clear ip arp inspection log 2-42
clear ip arp inspection statistics 2-43
clear ip dhcp snooping 2-44
clear ipv6 dhcp conflict 2-46
clear l2protocol-tunnel counters 2-47
clear lacp 2-48
clear mac address-table 2-49
clear mac address-table move update 2-50
clear pagp 2-51
clear rep counters 2-52
clear spanning-tree counters 2-53
clear spanning-tree detected-protocols 2-54
clear vmps statistics 2-55
clear vtp counters 2-56
cpu traffic qos cos 2-57
cpu traffic qos dscp 2-59
cpu traffic qos precedence 2-61
define interface-range 2-63
delete 2-65
deny (ARP access-list configuration) 2-66
deny (IPv6 access-list configuration) 2-68
deny (MAC access-list configuration) 2-73
dot1x auth-fail max-attempts 2-76
iv
dot1x auth-fail vlan 2-78
dot1x default 2-80
dot1x guest-vlan 2-81
dot1x host-mode 2-83
dot1x initialize 2-85
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 5
dot1x max-reauth-req 2-86
dot1x max-req 2-87
dot1x port-control 2-88
dot1x re-authenticate 2-90
dot1x reauthentication 2-91
dot1x supplicant force-multicast 2-92
dot1x system-auth-control 2-93
dot1x test eapol-capable 2-94
dot1x test timeout 2-95
dot1x timeout 2-96
dot1x violation-mode 2-98
duplex 2-100
errdisable detect cause 2-102
Contents
errdisable detect cause small-frame 2-104
errdisable recovery cause small-frame 2-106
errdisable recovery 2-107
ethernet evc 2-109
ethernet lmi 2-110
ethernet lmi ce-vlan map 2-112
ethernet oam remote-failure 2-114
ethernet uni 2-116
ethernet uni id 2-118
flowcontrol 2-119
interface port-channel 2-121
interface range 2-123
interface vlan 2-125
ip access-group 2-127
ip address 2-130
ip arp inspection filter vlan 2-132
ip arp inspection limit 2-134
OL-9645-10
ip arp inspection log-buffer 2-136
ip arp inspection trust 2-138
ip arp inspection validate 2-140
ip arp inspection vlan 2-142
ip arp inspection vlan logging 2-143
Catalyst 3750 Metro Switch Command Reference
v
Page 6
Contents
ip device tracking 2-145
ip device tracking maximum 2-146
ip device tracking probe 2-147
ip dhcp snooping 2-149
ip dhcp snooping binding 2-150
ip dhcp snooping database 2-152
ip dhcp snooping information option 2-154
ip dhcp snooping information option allowed-untrusted 2-156
ip dhcp snooping information option format remote-id 2-158
ip dhcp snooping limit rate 2-159
ip dhcp snooping trust 2-160
ip dhcp snooping verify 2-161
ip dhcp snooping vlan 2-162
ip dhcp snooping vlan information option format-type circuit-id string 2-163
ip igmp filter 2-165
ip igmp max-groups 2-167
ip igmp profile 2-169
ip igmp snooping 2-171
ip igmp snooping querier 2-173
ip igmp snooping report-suppression 2-175
ip igmp snooping vlan immediate-leave 2-177
ip igmp snooping vlan mrouter 2-178
ip igmp snooping vlan static 2-180
ip sla responder twamp 2-182
ip sla server twamp 2-184
ip source binding 2-186
ip ssh 2-188
ip sticky-arp (global configuration) 2-190
ip sticky-arp (interface configuration) 2-192
ip verify source 2-194
vi
ip vrf (global configuration) 2-196
ip vrf (interface configuration) 2-198
ipv6 access-list 2-200
ipv6 address dhcp 2-202
ipv6 dhcp client request vendor 2-203
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 7
ipv6 dhcp ping packets 2-204
ipv6 dhcp pool 2-205
ipv6 dhcp server 2-207
ipv6 mld snooping 2-209
ipv6 mld snooping last-listener-query-count 2-211
ipv6 mld snooping last-listener-query-interval 2-213
ipv6 mld snooping listener-message-suppression 2-215
ipv6 mld snooping robustness-variable 2-217
ipv6 mld snooping tcn 2-219
ipv6 mld snooping vlan 2-221
ipv6 traffic-filter 2-223
l2protocol-tunnel 2-225
l2protocol-tunnel cos 2-229
Contents
lacp port-priority 2-230
lacp system-priority 2-232
link state group 2-234
link state track 2-236
location (global configuration) 2-237
location (interface configuration) 2-239
logging event 2-241
logging file 2-242
mac access-group 2-244
mac access-list extended 2-246
mac address-table aging-time 2-248
mac address-table learning 2-249
mac address-table move update 2-251
mac address-table notification 2-253
mac address-table static 2-255
mac address-table static drop 2-256
macro apply 2-258
OL-9645-10
macro description 2-261
macro global 2-262
macro global description 2-265
macro name 2-266
match (access-map configuration) 2-268
Catalyst 3750 Metro Switch Command Reference
vii
Page 8
Contents
match (class-map configuration) 2-270
mdix auto 2-273
mls qos 2-275
mls qos aggregate-policer 2-277
mls qos cos 2-279
mls qos dscp-mutation 2-281
mls qos enhanced 2-283
mls qos map 2-285
mls qos queue-set output buffers 2-288
mls qos queue-set output threshold 2-290
mls qos rewrite ip dscp 2-292
mls qos srr-queue input bandwidth 2-294
mls qos srr-queue input buffers 2-296
mls qos srr-queue input cos-map 2-298
mls qos srr-queue input dscp-map 2-300
mls qos srr-queue input priority-queue 2-302
mls qos srr-queue input threshold 2-304
mls qos srr-queue output cos-map 2-306
mls qos srr-queue output cpu-queue 2-308
mls qos srr-queue output dscp-map 2-310
mls qos trust 2-312
mls qos vlan-based 2-315
monitor session 2-316
mpls l2transport route 2-320
mpls ldp holdtime 2-322
mpls mtu 2-323
mvr (global configuration) 2-325
mvr (interface configuration) 2-328
oam protocol cfm svlan 2-332
pagp learn-method 2-333
viii
pagp port-priority 2-335
permit (ARP access-list configuration) 2-337
permit (IPv6 access-list configuration) 2-339
permit (MAC-access list configuration) 2-344
police 2-347
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 9
police aggregate 2-349
police cir 2-351
police cir percent 2-354
policy-map 2-358
port-channel load-balance 2-361
priority 2-363
priority-queue 2-365
private-vlan 2-367
private-vlan mapping 2-370
queue-limit 2-372
queue-set 2-374
random-detect 2-375
random-detect dscp 2-378
Contents
random-detect exponential-weighting-constant 2-382
random-detect precedence 2-385
remote-span 2-388
renew ip dhcp snooping database 2-390
rep admin vlan 2-391
rep block port 2-392
rep lsl-age-timer 2-396
rep preempt delay 2-398
rep preempt segment 2-400
rep segment 2-401
rep stcn 2-404
reserved-only 2-406
rmon collection stats 2-407
sdm prefer 2-408
service instance 2-411
service password-recovery 2-412
service-policy (interface configuration) 2-414
OL-9645-10
service-policy (policy-map class) 2-417
set 2-419
setup 2-421
setup express 2-424
shape 2-426
Catalyst 3750 Metro Switch Command Reference
ix
Page 10
Contents
show access-lists 2-428
show archive status 2-431
show arp access-list 2-432
show auto qos 2-433
show boot 2-436
show class-map 2-438
show controllers cpu-interface 2-439
show controllers ethernet-controller 2-441
show controllers tcam 2-445
show cpu traffic qos 2-447
show dot1q-tunnel 2-449
show dot1x 2-450
show dtp 2-453
show env 2-455
show errdisable detect 2-456
show errdisable flap-values 2-458
show errdisable recovery 2-460
show etherchannel 2-462
show ethernet service evc 2-465
show ethernet service instance 2-466
show ethernet service interface 2-468
show interfaces 2-470
show interfaces counters 2-477
show interfaces rep 2-480
show interfaces transceiver 2-482
show inventory 2-485
show ip arp inspection 2-486
show ip dhcp snooping 2-490
show ip dhcp snooping binding 2-491
show ip dhcp snooping database 2-493
show ip dhcp snooping statistics 2-495
show ip igmp profile 2-498
show ip igmp snooping 2-499
show ip igmp snooping groups 2-501
show ip igmp snooping mrouter 2-503
Catalyst 3750 Metro Switch Command Reference
x
OL-9645-10
Page 11
show ip igmp snooping querier 2-504
show ip sla standards 2-506
show ip sla twamp connection 2-507
show ip sla twamp session 2-509
show ip source binding 2-510
show ip verify source 2-511
show ipv6 dhcp conflict 2-513
show ipv6 mld snooping 2-514
show ipv6 mld snooping address 2-516
show ipv6 mld snooping mrouter 2-518
show ipv6 mld snooping querier 2-520
show ipv6 route updated 2-522
show l2protocol-tunnel 2-524
Contents
show lacp 2-526
show link state group 2-530
show location 2-532
show mac access-group 2-534
show mac address-table 2-535
show mac address-table address 2-537
show mac address-table aging-time 2-538
show mac address-table count 2-540
show mac address-table dynamic 2-542
show mac address-table interface 2-544
show mac address-table learning 2-545
show mac address-table move update 2-546
show mac address-table multicast 2-548
show mac address-table notification 2-550
show mac address-table static 2-552
show mac address-table vlan 2-554
show mls qos 2-556
OL-9645-10
show mls qos aggregate-policer 2-557
show mls qos input-queue 2-558
show mls qos interface 2-559
show mls qos maps 2-562
show mls qos queue-set 2-565
Catalyst 3750 Metro Switch Command Reference
xi
Page 12
Contents
show mls qos vlan 2-567
show monitor 2-568
show mpls l2transport vc 2-570
show mvr 2-574
show mvr interface 2-576
show mvr members 2-578
show pagp 2-580
show parser macro 2-582
show policy-map 2-585
show port-security 2-587
show rep topology 2-590
show sdm prefer 2-592
show setup express 2-595
show spanning-tree 2-596
show storm-control 2-602
show system mtu 2-604
show udld 2-605
show version 2-608
show vlan 2-610
show vlan access-map 2-615
show vlan filter 2-616
show vmps 2-617
show vtp 2-620
shutdown 2-625
shutdown vlan 2-626
small-frame violation rate 2-627
snmp mib rep trap-rate 2-629
snmp-server enable traps 2-630
snmp-server host 2-634
snmp trap mac-notification change 2-639
xii
spanning-tree backbonefast 2-641
spanning-tree bpdufilter 2-642
spanning-tree bpduguard 2-644
spanning-tree cost 2-646
spanning-tree etherchannel guard misconfig 2-648
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 13
spanning-tree extend system-id 2-650
spanning-tree guard 2-651
spanning-tree link-type 2-653
spanning-tree loopguard default 2-655
spanning-tree mode 2-657
spanning-tree mst configuration 2-659
spanning-tree mst cost 2-661
spanning-tree mst forward-time 2-663
spanning-tree mst hello-time 2-664
spanning-tree mst max-age 2-665
spanning-tree mst max-hops 2-666
spanning-tree mst pre-standard 2-668
spanning-tree mst port-priority 2-669
Contents
spanning-tree mst priority 2-671
spanning-tree mst root 2-672
spanning-tree port-priority 2-674
spanning-tree portfast (global configuration) 2-676
spanning-tree portfast (interface configuration) 2-678
spanning-tree uplinkfast 2-680
spanning-tree vlan 2-682
speed 2-685
srr-queue bandwidth limit 2-687
srr-queue bandwidth shape 2-689
srr-queue bandwidth share 2-691
storm-control 2-693
switchport 2-696
switchport access 2-698
switchport backup interface 2-700
switchport block 2-704
switchport host 2-706
OL-9645-10
switchport mode 2-707
switchport mode private-vlan 2-710
switchport nonegotiate 2-712
switchport port-security 2-714
switchport port-security aging 2-718
Catalyst 3750 Metro Switch Command Reference
xiii
Page 14
Contents
switchport priority extend 2-720
switchport private-vlan 2-722
switchport protected 2-724
switchport trunk 2-725
switchport vlan mapping 2-729
switchport voice vlan 2-732
system mtu 2-734
traceroute mac 2-737
traceroute mac ip 2-740
trust 2-742
udld (global configuration) 2-744
udld (interface configuration) 2-746
udld reset 2-748
APPENDIX
uni count 2-749
vlan 2-751
vlan access-map 2-756
vlan filter 2-758
vmps reconfirm (privileged EXEC) 2-760
vmps reconfirm (global configuration) 2-761
vmps retry 2-762
vmps server 2-763
vrf upgrade-cli multi-af-mode 2-765
vtp 2-767
xconnect 2-771
A Catalyst 3750 Metro Switch
Boot Loader Commands A-1
boot A-2
cat A-4
copy A-5
xiv
delete A-6
dir A-7
flash_init A-9
format A-10
fsck A-11
help A-12
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 15
memory A-13
mkdir A-14
more A-15
rename A-16
reset A-17
rmdir A-18
set A-19
type A-22
unset A-23
version A-25
Contents
APPENDIX
B Catalyst 3750 Metro Switch Debug Commands B-1
debug auto qos B-2
debug backup B-4
debug dot1x B-5
debug dtp B-6
debug etherchannel B-7
debug ethernet service B-8
debug interface B-10
debug ip dhcp snooping B-11
debug ip igmp filter B-12
debug ip igmp max-groups B-13
debug ip igmp snooping B-14
debug ip sla error twamp connection B-15
debug ip sla error twamp control reflector B-17
debug ip sla error twamp control server B-19
debug ip sla error twamp session B-21
debug ip sla trace twamp connection B-23
OL-9645-10
debug ip sla trace twamp control reflector B-25
debug ip sla trace twamp control server B-27
debug ip sla trace twamp session B-29
debug ip verify source packet B-31
debug lacp B-32
debug mac-notification B-33
debug matm B-34
debug matm move update B-35
Catalyst 3750 Metro Switch Command Reference
xv
Page 16
Contents
debug monitor B-36
debug mpls atom B-37
debug mpls l2transport vlan B-38
debug mvrdbg B-39
debug nvram B-40
debug pagp B-41
debug platform acl B-42
debug platform backup interface B-43
debug platform cfm B-44
debug platform cpu-queues B-45
debug platform dot1ad B-47
debug platform dot1x B-48
debug platform etherchannel B-49
debug platform fallback-bridging B-50
debug platform forw-tcam B-51
debug platform ip arp inspection B-52
debug platform ip igmp snooping B-53
debug platform ip multicast B-55
debug platform ip unicast B-57
debug platform led B-59
debug platform matm B-60
debug platform messaging application B-61
debug platform mpls B-62
debug platform phy B-63
debug platform pm B-64
debug platform port-asic B-66
debug platform port-security B-67
debug platform qos-acl-tcam B-68
debug platform remote-commands B-69
debug platform rep B-70
xvi
debug platform resource-manager B-71
debug platform snmp B-72
debug platform span B-73
debug platform supervisor-asic B-74
debug platform sw-bridge B-75
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 17
debug platform tcam B-76
debug platform udld B-78
debug platform vlan B-79
debug pm B-80
debug port-security B-82
debug rep B-83
debug qos-manager B-84
debug spanning-tree B-85
debug spanning-tree backbonefast B-87
debug spanning-tree bpdu B-88
debug spanning-tree bpdu-opt B-89
debug spanning-tree mstp B-90
debug spanning-tree switch B-92
Contents
APPENDIX
debug spanning-tree uplinkfast B-94
debug sw-vlan B-95
debug sw-vlan ifs B-97
debug sw-vlan notification B-98
debug sw-vlan vtp B-99
debug udld B-101
debug vqpc B-103
debug xconnect B-104
C Catalyst 3750 Metro Switch
Show Platform Commands C-1
show platform acl C-2
show platform cfm C-3
show platform configuration C-4
show platform etherchannel C-5
show platform forward C-6
show platform ip igmp snooping C-8
OL-9645-10
show platform ip multicast C-9
show platform ip policy C-10
show platform ip unicast C-11
show platform ipc trace C-12
show platform layer4op C-13
show platform mac-address-table C-14
Catalyst 3750 Metro Switch Command Reference
xvii
Page 18
Contents
show platform messaging C-15
show platform monitor C-16
show platform mvr table C-17
show platform pm C-18
show platform port-asic C-19
show platform port-security C-23
show platform qos C-24
show platform resource-manager C-25
show platform snmp counters C-26
show platform spanning-tree C-27
show platform stp-instance C-28
show platform tb C-29
show platform tcam C-30
APPENDIX
I
NDEX
show platform vlan C-32
D Acknowledgments for Open-Source Software D-1
xviii
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 19
Audience
Preface
This guide is for the networking professional using the Cisco IOS command-line interface (CLI) to
manage the Catalyst
should have experience working with the Cisco IOS commands and the switch software features. Before
using this guide, you should have experience working with the concepts and terminology of Ethernet and
local area networking.
3750 Metro switch, hereafter referred to as the switch. Before using this guide, you
Purpose
The Catalyst 3750 Metro switch is supported by a set of enterprise-class features, including Layer 2+
features such as access control lists (ACLs) and quality of service (QoS) and Layer 3 features such as IP
unicast routing, IP multicast routing, and fallback bridging. It also includes features for the service
provider, including multiprotocol label switching (MPLS), Ethernet over MPLS (EoMPLS), hierarchical
QoS, and 802.1Q tunneling.
This guide provides the information you need about the commands that have been created or changed
for use with the Catalyst
commands, see the Cisco IOS documentation set available from the Cisco.com home page by selecting
Service and Support > Technical Documents. On the Cisco Product Documentation home page, select
Release 12.2 from the Cisco IOS Software drop-down list.
This guide does not provide procedures for configuring your switch. For detailed configuration
procedures, see the software configuration guide for this release.
This guide does not describe system messages that you might encounter. For more information, see the
system message guide for this release.
For documentation updates, see the release notes for this release.
Conventions
This publication uses these conventions to convey instructions and information:
Command descriptions use these conventions:
• Commands and keywords are in boldface text.
3750 Metro switches. For information about the standard Cisco IOS Release 12.2
OL-9645-10
• Arguments for which you supply values are in italic.
Catalyst 3750 Metro Switch Command Reference
xix
Page 20
Preface
• Square brackets ([ ]) means optional elements.
• Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements.
• Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional
element.
Interactive examples use these conventions:
• Terminal sessions and system displays are in screen font.
• Information you enter is in boldface screen font.
• Nonprinting characters, such as passwords or tabs, are in angle brackets (< >).
Notes, cautions, and warnings use these conventions and symbols:
Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in
this manual.
Caution Means reader be careful. In this situation, you might do something that could result in equipment
damage or loss of data.
Filtering show Command Output
The show commands have optional output modifiers to filter the command output.
• | begin—Display begins with the line that matches the expression.
• | exclude—Display excludes with the line that matches the expression.
• | include—Display includes with the line that matches the expression.
• expression—Expression in the output to use as a reference point.
Expressions are case sensitive. If you enter | exclude output, the lines that contain output are not
displayed, but the lines that contain Output are displayed.
xx
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 21
Preface
Related Publications
These documents provide complete information about the switch and are available from this Cisco.com
site:
http://www.cisco.com/en/US/products/hw/switches/ps5532/tsd_products_support_series_home.html
Note Before installing, configuring, or upgrading the switch, see these documents:
• For initial configuration information, see the “Using Express Setup” chapter or the “Configuring the
Switch with the CLI-Based Setup Program” appendix in the hardware installation guide.
• For upgrade information, see the “Downloading Software” section in the release notes.
• Release Notes for the Catalyst 3750 Metro Switch
• Catalyst 3750 Metro Switch Software Configuration Guide
• Catalyst 3750 Metro Switch Command Reference
• Catalyst 3750 Metro Switch System Message Guide
• Catalyst 3750 Metro Switch Hardware Installation Guide
• Cisco Small Form-Factor Pluggable Modules Installation Notes
• These compatibility matrix documents are available from this Cisco.com site:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
–
Cisco Gigabit Ethernet Transceiver Modules Compatibility Matrix
–
Cisco 100-Megabit Ethernet SFP Modules Compatibility Matrix
–
Cisco Small Form-Factor Pluggable Modules Compatibility Matrix
–
Compatibility Matrix for 1000BASE-T Small Form-Factor Pluggable Modules
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional
information, see the monthly What’s
revised Cisco
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed
and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free
service and Cisco currently supports RSS version 2.0.
technical documentation, at:
New in Cisco Product Documentation, which also lists all new and
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
xxi
Page 22
Preface
xxii
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 23
Using the Command-Line Interface
The Catalyst 3750 Metro switch is supported by Cisco IOS software. This chapter describes how to use
the switch command-line interface (CLI) to configure software features.
For a complete description of the commands that support these features, see Chapter 2, “Catalyst 3750
Metro Switch Cisco IOS Commands.” For information on the boot loader commands, see Appendix A,
“Catalyst 3750 Metro Switch Boot Loader Commands.” For information on the debug commands, see
Appendix B, “Catalyst 3750 Metro Switch Debug Commands.” For information on the show platform
commands, see Appendix C, “Catalyst 3750 Metro Switch Show Platform Commands.” For more
information on Cisco IOS Release 12.2, see the Cisco IOS Release 12.2 Command Summary.
For task-oriented configuration steps, see the software configuration guide for this release.
CLI Command Modes
This section describes the CLI command mode structure. Command modes support specific Cisco IOS
commands. For example, the interface interface-id command only works when entered in global
configuration mode.
These are the main command modes for the switch:
• User EXEC
CHAP T E R
1
OL-9645-10
• Privileged EXEC
• Global configuration
• Interface configuration
• VLAN configuration
• Line configuration
Table 1-1 lists the main command modes, how to access each mode, the prompt you see in that mode,
and how to exit that mode. The prompts listed use the default name Switch.
Catalyst 3750 Metro Switch Command Reference
1-1
Page 24
Chapter 1 Using the Command-Line Interface
CLI Command Modes
Ta b l e 1-1 Command Modes Summary
Command Mode Access Method Prompt Exit or Access Next Mode
User EXEC This is the first level of access.
(For the switch) Change terminal
settings, perform basic tasks, and
list system information.
Privileged EXEC From user EXEC mode, enter the
enable command.
Global
configuration
Interface
configuration
From privileged EXEC mode,
enter the configure command.
From global configuration mode,
specify an interface by entering
the interface command followed
by an interface identification.
VLAN
configuration
In global configuration mode,
enter the vlan vlan-id command.
Switch>
Switch#
Switch(config)#
Switch(config-if)#
Switch(config-vlan)#
Enter the logout command.
To enter privileged EXEC mode, enter
the enable command.
To exit to user EXEC mode, enter the
disable command.
To enter global configuration mode,
enter the configure command.
To exit to privileged EXEC mode,
enter the exit or end command, or
press Ctrl-Z.
To enter interface configuration mode,
enter the interface configuration
command.
To exit to privileged EXEC mode,
enter the end command, or press
Ctrl-Z.
To exit to global configuration mode,
enter the exit command.
To exit to global configuration mode,
enter the exit command.
Line configuration From global configuration mode,
specify a line by entering the line
command.
User EXEC Mode
After you access the device, you are automatically in user EXEC command mode. The EXEC commands
available at the user level are a subset of those available at the privileged level. In general, use the user
EXEC commands to temporarily change terminal settings, perform basic tests, and list system
information.
The supported commands can vary depending on the version of software in use. To view a
comprehensive list of commands, enter a question mark (?) at the prompt.
Switch> ?
Switch(config-line)#
To return to privileged EXEC mode,
enter the end command, or press
Ctrl-Z.
To exit to global configuration mode,
enter the exit command.
To return to privileged EXEC mode,
enter the end command, or press
Ctrl-Z.
1-2
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 25
Chapter 1 Using the Command-Line Interface
Privileged EXEC Mode
Because many of the privileged commands configure operating parameters, privileged access should be
password-protected to prevent unauthorized use. The privileged command set includes those commands
contained in user EXEC mode, as well as the configure privileged EXEC command through which you
access the remaining command modes.
If your system administrator has set a password, you are prompted to enter it before being granted access
to privileged EXEC mode. The password does not appear on the screen and is case sensitive.
The privileged EXEC mode prompt is the device name followed by the pound sign (#).
Switch#
Enter the enable command to access privileged EXEC mode:
Switch> enable
Switch#
The supported commands can vary depending on the version of software in use. To view a
comprehensive list of commands, enter a question mark (?) at the prompt.
Switch# ?
CLI Command Modes
To return to user EXEC mode, enter the disable privileged EXEC command.
Global Configuration Mode
Global configuration commands apply to features that affect the device as a whole. Use the configure
privileged EXEC command to enter global configuration mode. The default is to enter commands from
the management console.
When you enter the configure command, a message prompts you for the source of the configuration
commands:
Switch# configure
Configuring from terminal, memory, or network [terminal]?
You can specify either the terminal or NVRAM as the source of configuration commands.
This example shows you how to access global configuration mode:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
The supported commands can vary depending on the version of software in use. To view a
comprehensive list of commands, enter a question mark (?) at the prompt.
Switch(config)# ?
To exit global configuration command mode and to return to privileged EXEC mode, enter the end or
exit command, or press Ctrl-Z.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
1-3
Page 26
CLI Command Modes
Interface Configuration Mode
Interface configuration commands modify the operation of the interface. Interface configuration
commands always follow a global configuration command, which defines the interface type.
Use the interface interface-id command to access interface configuration mode. The new prompt means
interface configuration mode.
Switch(config-if)#
The supported commands can vary depending on the version of software in use. To view a
comprehensive list of commands, enter a question mark (?) at the prompt.
Switch(config-if)# ?
To exit interface configuration mode and to return to global configuration mode, enter the exit command.
To exit interface configuration mode and to return to privileged EXEC mode, enter the end command,
or press Ctrl-Z.
VLAN Configuration Mode
Chapter 1 Using the Command-Line Interface
Use this mode to configure normal-range VLANs (VLAN IDs 1 to 1005) or, when VTP mode is
transparent, to configure extended-range VLANs (VLAN IDs 1006 to 4094). When VTP mode is
transparent, the VLAN and VTP configuration is saved in the running configuration file, and you can
save it to the switch startup configuration file by using the copy running-config startup-config
privileged EXEC command. The configurations of VLAN IDs 1 to 1005 are saved in the VLAN database
if VTP is in transparent or server mode. The extended-range VLAN configurations are not saved in the
VLAN database.
Enter the vlan vlan-id global configuration command to access config-vlan mode:
Switch(config)# vlan 2000
Switch(config-vlan)#
The supported keywords can vary but are similar to the commands available in VLAN configuration
mode. To view a comprehensive list of commands, enter a question mark (?) at the prompt.
Switch(config-vlan)# ?
For extended-range VLANs, all characteristics except the maximum transmission unit (MTU) size must
remain at the default setting.
To return to global configuration mode, enter exit; to return to privileged EXEC mode, enter end. All
the commands except shutdown take effect when you exit config-vlan mode.
Line Configuration Mode
1-4
Line configuration commands modify the operation of a terminal line. Line configuration commands
always follow a line command, which defines a line number. Use these commands to change terminal
parameter settings line-by-line or for a range of lines.
Use the line vty line_number [ending_line_number] command to enter line configuration mode. The
new prompt means line configuration mode. The following example shows how to enter line
configuration mode for virtual terminal line
Switch(config)# line vty 0 7
Catalyst 3750 Metro Switch Command Reference
7:
OL-9645-10
Page 27
Chapter 1 Using the Command-Line Interface
The supported commands can vary depending on the version of software in use. To view a
comprehensive list of commands, enter a question mark (?) at the prompt.
Switch(config-line)# ?
To exit line configuration mode and to return to global configuration mode, use the exit command. To
exit line configuration mode and to return to privileged EXEC mode, enter the end command, or press
Ctrl-Z.
Commands Changed in Cisco IOS 12.2(25)EY
Table 1-2 lists describes the commands that have the same function but different syntax than they did in
software releases before Cisco IOS Release 12.2(25)EY.
Ta b l e 1-2 Commands Changed
Commands Changed in Cisco IOS 12.2(25)EY
Releases earlier than
Cisco IOS
Release 12.2(25)EY
debug autoqos debug auto qos Enables debugging of the auto-QoS1 feature.
xconnect {destination
vc-id}
1. auto-QoS = automatic quality of service
Cisco IOS
Release 12.2(25)EY or
later
xconnect {destination
vc-id encapsulation
mpls}
Description
Routes a Layer 2 packets over a specified
point-to-point virtual connection.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
1-5
Page 28
Commands Changed in Cisco IOS 12.2(25)EY
Chapter 1 Using the Command-Line Interface
1-6
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 29
CHAP T E R
2
Catalyst 3750 Metro Switch Cisco IOS Commands
aaa accounting dot1x
Use the aaa accounting dot1x global configuration command to enable authentication, authorization,
and accounting (AAA) accounting and to create method lists defining specific accounting methods on a
per-line or per-interface basis for 802.1x sessions. Use the no form of this command to disable 802.1x
accounting.
aaa accounting dot1x {name | default} start-stop {broadcast group {name | radius | tacacs+}
[group {name | radius | tacacs+} ... ] | group {name | radius | tacacs+} [group {name | radius
| tacacs+} ... ]}
no aaa accounting dot1x {name | default}
Syntax Description name Name of a server group. This is optional when you enter it after the
broadcast group and group keywords.
default Use the accounting methods that follow as the default list for accounting
services.
start-stop Send a start accounting notice at the beginning of a process and a stop
accounting notice at the end of a process. The start accounting record is sent
in the background. The requested-user process begins regardless of whether
or not the start accounting notice was received by the accounting server.
broadcast Enable accounting records to be sent to multiple AAA servers and send
accounting records to the first server in each group. If the first server is
unavailable, the switch uses the list of backup servers to identify the first
server.
group Specify the server group to be used for accounting services. These are valid
server group names:
OL-9645-10
• name—Name of a server group.
• radius—List of all RADIUS hosts.
• tacacs+—List of all TACACS+ hosts.
The group keyword is optional when you enter it after the broadcast group
and group keywords. You can enter more than optional group keyword.
radius (Optional) Enable RADIUS authorization.
tacacs+ (Optional) Enable TACACS+ accounting.
Catalyst 3750 Metro Switch Command Reference
2-1
Page 30
aaa accounting dot1x
Defaults AAA accounting is disabled.
Command Modes Global configuration
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command History
Release Modification
12.2(25)EY This command was introduced.
Usage Guidelines This command requires access to a RADIUS server.
Note We recommend that you enter the dot1x reauthentication interface configuration command before
configuring 802.1x RADIUS accounting on an interface.
Examples This example shows how to configure 802.1x accounting:
Switch(config)# aaa accounting dot1x default start-stop group radius
Switch(config)#
Note The RADIUS authentication server must be properly configured to accept and log update or watchdog
packets from the AAA client.
Related Commands
Command Description
aaa accounting dot1x Specifies one or more AAA methods for use on interfaces running 802.1x.
dot1x reauthentication Enables or disables periodic reauthentication.
dot1x test
Sets the number of seconds between re-authentication attempts.
eapol-capable
reauth-period
2-2
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 31
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
aaa authentication dot1x
Use the aaa authentication dot1x global configuration command to specify one or more authentication,
authorization, and accounting (AAA) methods for use on ports running IEEE 802.1x. Use the no form
of this command to disable authentication.
aaa authentication dot1x {default} method1 [method2...]
no aaa authentication dot1x {default}
aaa authentication dot1x
Syntax Description
default Use the listed authentication methods that follow this argument as the default
list of methods when a user logs in.
method1
[method2...]
At least one of the these keywords:
• enable—Use the enable password for authentication.
• group radius—Use the list of all RADIUS servers for authentication.
• line—Use the line password for authentication.
• local—Use the local username database for authentication.
• local-case—Use the case-sensitive local username database for
authentication.
• none—Use no authentication. The client is automatically authenticated by
the switch without using the information supplied by the client.
Note Though visible in the command-line help strings, the group tacacs+ keyword is not supported.
Defaults No authentication is performed.
Command Modes Global configuration
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines The method argument identifies the list of methods that the authentication algorithm tries in the given
sequence to validate the password provided by the client. The only method that is truly 802.1x-compliant
is the group radius method, in which the client data is validated against a RADIUS authentication
server. The remaining methods enable AAA to authenticate the client by using locally configured data.
For example, the local and local-case methods use the username and password that are saved in the
configuration file. The enable and line methods use the enable and line passwords for authentication.
If you specify group radius, you must configure the RADIUS server by entering the radius-server host
global configuration command.
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
2-3
Page 32
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
aaa authentication dot1x
If you are not using a RADIUS server, you can use the local or local-case methods, which access the
local username database to perform authentication. By specifying the enable or line methods, you can
supply the clients with a password to provide access to the switch.
Use the show running-config privileged EXEC command to display the configured lists of
authentication methods.
Examples This example shows how to enable AAA and how to create an authentication list for 802.1x. This
authentication first tries to contact a RADIUS server. If this action returns an error, the user is allowed
access with no authentication.
Switch(config)# aaa new-model
Switch(config)# aaa authentication dot1x default group radius none
You can verify your settings by entering the show running-config privileged EXEC command.
Related Commands Command Description
aaa new-model Enables the AAA access control model. For syntax information, select Cisco
IOS Security Command Reference, Release 12.2 > Authentication,
Authorization, and Accounting > Authentication Commands.
show running-config Displays the operating configuration. For syntax information, use this link to
the Cisco IOS Release 12.2 Command Reference listing page:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/prod_command_
reference_list.html
Select the Cisco IOS Commands Master List, Release 12.2 to navigate to
the command.
2-4
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 33
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
action
Use the action access map configuration command to set the action for the VLAN access map entry. Use
the no form of this command to set the action to the default value, which is to forward.
action {drop | forward}
no action
action
Syntax Description
drop Drop the packet when the specified conditions are matched.
forward Forward the packet when the specified conditions are matched.
Defaults The default action is to forward packets.
Command Modes Access-map configuration
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines You enter access-map configuration mode by using the vlan access-map global configuration command.
If the action is drop, you should define the access map, including configuring any access control list
(ACL) names in match clauses, before applying the map to a VLAN, or all packets could be dropped.
In access map configuration mode, use the match access map configuration command to define the
match conditions for a VLAN map. Use the action command to set the action that occurs when a packet
matches the conditions.
The drop and forward parameters are not used in the no form of the command.
Examples This example shows how to identify and apply a VLAN access map vmap4 to VLANs 5 and 6 that causes
the VLAN to forward an IP packet if the packet matches the conditions defined in access list al2:
Switch(config)# vlan access-map vmap4
Switch(config-access-map)# match ip address al2
Switch(config-access-map)# action forward
Switch(config-access-map)# exit
Switch(config)# vlan filter vmap4 vlan-list 5-6
You can verify your settings by entering the show vlan access-map privileged EXEC command.
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
2-5
Page 34
action
Related Commands Command Description
access-list {deny | permit} Configures a standard numbered ACL. For syntax information, select
Cisco IOS IP Command Reference, Volume 1 of 3:Addressing
and Services, Release 12.2 > IP Services Commands.
ip access-list Creates a named access list. For syntax information, select Cisco
IOS IP Command Reference, Volume 1 of 3:Addressing and
Services, Release 12.2 > IP Services Commands.
mac access-list extended Creates a named MAC address access list.
match (access-map
configuration)
show vlan access-map Displays the VLAN access maps created on the switch.
vlan access-map Creates a VLAN access map.
Defines the match conditions for a VLAN map.
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
2-6
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 35
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
archive download-sw
Use the archive download-sw privileged EXEC command to download a new image to the switch and
to overwrite or keep the existing image.
archive download-sw {/force-reload | /imageonly | /leave-old-sw | /no-set-boot | /overwrite |
/reload | /safe} source-url
archive download-sw
Syntax Description
/force-reload Unconditionally force a system reload after successfully downloading the
software image.
/imageonly Download only the Cisco IOS software image.
/leave-old-sw Keep the old software version after a successful download.
/no-set-boot Do not alter the setting of the BOOT environment variable to point to the new
software image after it is successfully downloaded.
/overwrite Overwrite the software image in flash memory with the downloaded one.
/reload Reload the system after successfully downloading the image unless the
configuration has been changed and not been saved.
/safe Keep the current software image; do not delete it to make room for the new
software image before the new image is downloaded. The current image is
deleted after the download.
source-url The source URL alias for a local or network file system. These options are
supported:
• The syntax for the local flash file system:
flash:
• The syntax for the FTP:
ftp:[[//username[:password]@location]/directory]/image-name.tar
• The syntax for the Remote Copy Protocol (RCP):
rcp:[[//username@location]/directory]/image-name.tar
• The syntax for the TFTP:
tftp:[[//location]/directory]/image-name.tar
The image-name.tar is the software image to download and install on the
switch.
Note Though visible in the command-line help strings, the no-version-check keyword is not supported.
Defaults The current software image is not overwritten with the downloaded image.
The new image is downloaded to the flash: file system.
The BOOT environment variable is changed to point to the new software image on the flash: file system.
Image names are case sensitive; the image file is provided in tar format.
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
2-7
Page 36
archive download-sw
Command Modes Privileged EXEC
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines Using the /safe or /leave-old-sw option can cause the new image download to fail if there is insufficient
flash memory. If leaving the software in place prevents the new image from fitting in flash memory due
to space constraints, an error results.
If you used the /leave-old-sw option and did not overwrite the old image when you downloaded the new
one, you can remove the old image by using the delete privileged EXEC command. For more
information, see the
“delete” section on page 2-65.
Use the /overwrite option to overwrite the image on the flash device with the downloaded one.
If you specify the command without the /overwrite option, the download algorithm verifies that the new
image is not the same as the one on the switch flash device. If the images are the same, the download
does not occur. If the images are different, the old image is deleted, and the new one is downloaded.
After downloading a new image, enter the reload privileged EXEC command to begin using the new
image, or specify the /reload or /force-reload option in the archive download-sw command.
Examples This example shows how to download a new image from a TFTP server at 172.20.129.10 and overwrite
the image on the switch:
Switch# archive download-sw /overwrite tftp://172.20.129.10/test-image.tar
Related Commands
This example shows how to download only the software image from a TFTP server at 172.20.129.10 to
the switch:
Switch# archive download-sw /imageonly tftp://172.20.129.10/test-image.tar
This example shows how to keep the old software version after a successful download:
Switch# archive download-sw /leave-old-sw tftp://172.20.129.10/test-image.tar
Command Description
archive tar Creates a tar file, lists the files in a tar file, or extracts the files from a tar file.
archive upload-sw Uploads an existing image on the switch to a server.
delete Deletes a file or directory on the flash memory device.
2-8
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 37
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
archive tar
Use the archive tar privileged EXEC command to create a tar file, list files in a tar file, or extract the
files from a tar file.
archive tar {/create destination-url flash:/file-url} | {/table source-url} | {/xtract source-url
flash:/file-url [dir/file...]}
archive tar
Syntax Description /create destination-url
flash:/file-url
Create a new tar file on the local or network file system.
For destination-url, specify the destination URL alias for the local or
network file system and the name of the tar file to create. These options
are supported:
• The syntax for the local flash filesystem:
flash:
• The syntax for the FTP:
ftp:[[//username[:password]@location]/directory]/tar-filename.tar
• The syntax for the Remote Copy Protocol (RCP) is:
rcp:[[//username@location]/directory]/tar-filename.tar
• The syntax for the TFTP:
tftp:[[//location]/directory]/tar-filename.tar
The tar-filename.tar is the tar file to be created.
For flash:/file-url, specify the location on the local flash file system from
which the new tar file is created.
An optional list of files or directories within the source directory can be
specified to write to the new tar file. If none are specified, all files and
directories at this level are written to the newly created tar file.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-9
Page 38
archive tar
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
/table source-url Display the contents of an existing tar file to the screen.
For source-url, specify the source URL alias for the local or network file
system. These options are supported:
• The syntax for the local flash file system:
flash:
• The syntax for the FTP:
ftp:[[//username[:password]@location]/directory]/tar-filename.tar
• The syntax for the RCP:
rcp:[[//username@location]/directory]/tar-filename.tar
• The syntax for the TFTP:
tftp:[[//location]/directory]/tar-filename.tar
The tar-filename.tar is the tar file to display.
/xtract source-url
flash:/file-url [dir/file...]
Extract files from a tar file to the local file system.
For source-url, specify the source URL alias for the local file system.
These options are supported:
• The syntax for the local flash file system:
flash:
• The syntax for the FTP:
ftp:[[//username[:password]@location]/directory]/tar-filename.tar
• The syntax for the RCP:
rcp:[[//username@location]/directory]/tar-filename.tar
• The syntax for the TFTP:
tftp:[[//location]/directory]/tar-filename.tar
The tar-filename.tar is the tar file from which to extract.
For flash:/file-url [dir/file...], specify the location on the local flash file
system into which the tar file is extracted. Use the dir/file... option to
specify an optional list of files or directories within the tar file to be
extracted. If none are specified, all files and directories are extracted.
Defaults None
Command Modes Privileged EXEC
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines Filenames and directory names are case sensitive.
Image names are case sensitive.
2-10
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 39
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
archive tar
Examples This example shows how to create a tar file. The command writes the contents of the new-configs
directory on the local flash device to a file named saved.tar on the TFTP server at 172.20.10.30.
Switch# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs
This example shows how to display the contents of the image-tv0-m.tar file that is in flash memory. The
contents of the tar file are displayed on the screen.
Switch# archive tar /table flash:image-tv0-m.tar
info (219 bytes)
image-tv0-mz-121/ (directory)
image-tv0-mz-121/html/ (directory)
image-tv0-mz-121/html/foo.html (0 bytes)
image-tv0-mz-121/image-tv0-mz-121.bin (610856 bytes)
image-tv0-mz-121/info (219 bytes)
info.ver (219 bytes)
This example shows how to display only the image-tv0-mz-121/html directory and its contents:
Switch# archive tar /table flash:image-tv0-m.tar image-tv0-mz-121/html
image-tv0-mz-121/html/ (directory)
image-tv0-mz-121/html/foo.html (0 bytes)
This example shows how to extract the contents of a tar file on the TFTP server at 172.20.10.30. This
command extracts just the new-configs directory into the root directory on the local flash file system.
The remaining files in the saved.tar file are ignored.
Switch# archive tar /xtract tftp://172.20.10.30/saved.tar flash:/ new-configs
Related Commands Command Description
archive download-sw Downloads a new image to the switch.
archive upload-sw Uploads an existing image on the switch to a server.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-11
Page 40
archive upload-sw
archive upload-sw
Use the archive upload-sw privileged EXEC command to upload an existing switch image to a server.
archive upload-sw destination-url
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
destination-url The destination URL alias for a local or network file system. These options
are supported:
• The syntax for the local flash file system:
flash:
• The syntax for the FTP:
ftp:[[//username[:password]@location]/directory]/image-name.tar
• The syntax for the Remote Copy Protocol (RCP):
rcp:[[//username@location]/directory]/image-name.tar
• The syntax for the TFTP:
tftp:[[//location]/directory]/image-name.tar
The image-name.tar is the name of software image to be stored on the
server.
Defaults Uploads the currently running image from the flash: file system.
Command Modes Privileged EXEC
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines The files are uploaded in this sequence: the Cisco IOS image and the info file. After these files are
uploaded, the software creates the tar file.
Image names are case sensitive.
Examples This example shows how to upload the currently running image to a TFTP server at 172.20.140.2:
Switch# archive upload-sw tftp://172.20.140.2/test-image.tar
Related Commands
Command Description
archive download-sw Downloads a new image to the switch.
archive tar Creates a tar file, lists the files in a tar file, or extracts the files from a tar file.
Catalyst 3750 Metro Switch Command Reference
2-12
OL-9645-10
Page 41
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
arp access-list
Use the arp access-list global configuration command on the switch to define an Address Resolution
Protocol (ARP) access control list (ACL) or to add clauses to the end of a previously defined list. Use
the no form of this command to delete the specified ARP access list.
arp access-list acl-name
no arp access-list acl-name
This command is available only if your switch is running the enhanced multilayer image (EMI).
arp access-list
Syntax Description
Defaults No ARP access lists are defined.
Command Modes Global configuration
Command History
Usage Guidelines After entering the arp access-list command, you enter ARP access-list configuration mode, and these
acl-name Name of the ACL.
Release Modification
12.2(25)EY This command was introduced.
configuration commands are available:
• default: returns a command to its default setting.
• deny: specifies packets to reject. For more information, see the “deny (ARP access-list
configuration)” section on page 2-66.
• exit: exits ARP access-list configuration mode.
• no: negates a command or returns to default settings.
OL-9645-10
• permit: specifies packets to forward. For more information, see the “permit (ARP access-list
configuration)” section on page 2-337.
Use the permit and deny access-list configuration commands to forward and to drop ARP packets based
on the specified matching criteria.
When the ARP ACL is defined, you can apply it to a VLAN by using the ip arp inspection filter vlan
global configuration command. ARP packets containing only IP-to-MAC address bindings are compared
to the ACL. All other types of packets are bridged in the ingress VLAN without validation. If the ACL
permits a packet, the switch forwards it. If the ACL denies a packet because of an explicit deny
statement, the switch drops the packet. If the ACL denies a packet because of an implicit deny statement,
the switch compares the packet to the list of DHCP bindings (unless the ACL is static, which means that
packets are not compared to the bindings).
Catalyst 3750 Metro Switch Command Reference
2-13
Page 42
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
arp access-list
Examples This example shows how to define an ARP access list and to permit both ARP requests and ARP
responses from a host with an IP address of 1.1.1.1 and a MAC address of 0000.0000.abcd:
Switch(config)# arp access-list static-hosts
Switch(config-arp-nacl)# permit ip host 1.1.1.1 mac host 00001.0000.abcd
Switch(config-arp-nacl)# end
You can verify your settings by entering the show arp access-list privileged EXEC command.
Related Commands Command Description
deny (ARP access-list
configuration)
ip arp inspection filter
vlan
permit (MAC-access
list configuration)
show arp access-list Displays detailed information about ARP access lists.
Denies an ARP packet based on matches compared against the DHCP
bindings.
Permits ARP requests and responses from a host configured with a static IP
address.
Permits an ARP packet based on matches compared against the DHCP
bindings.
2-14
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 43
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
auto qos voip
Use the auto qos voip interface configuration command to automatically configure quality of service
(QoS) for voice over IP (VoIP) within a QoS domain. Use the no form of this command to return to the
default setting.
auto qos voip {cisco-phone | cisco-softphone | trust}
no auto qos voip [cisco-phone | cisco-softphone | trust]
auto qos voip
Syntax Description
cisco-phone Identify this port as connected to a Cisco IP phone, and automatically configure QoS
for VoIP. The QoS labels of inbound packets are trusted only when the phone is
detected.
cisco-softphone Identify this port as connected to a device running the Cisco SoftPhone, and
automatically configure QoS for VoIP.
trust Identify this port as connected to a trusted switch or router, and automatically
configure QoS for VoIP. The QoS labels of inbound packets are trusted. For
nonrouted ports, the class of service (CoS) value of the inbound packet is trusted.
For routed ports, the Differentiated Services Code Point (DSCP) value is trusted.
Defaults Auto-QoS is disabled on the port.
When auto-QoS is enabled, it uses the ingress packet label to categorize traffic, to assign packet labels,
and to configure the ingress queues and egress queue-sets.
Ta b l e 2-1 Traffic Types, Packet Labels, and Queues
3
DSCP
4
CoS
CoS-to-Ingress
VoIP Data
Traffic
46 24, 26 48 56 34 –
5 3 6 7 3 –
2, 3, 4, 5, 6, 7 (queue 2) 0, 1 (queue 1)
VoIP Control
Traffic
Routing Protocol
Traffic
Queue Map
CoS-to-Egress
5 (queue 1) 3, 6, 7 (queue 2) 4 (queue 3) 2
Queue Map
1. STP = Spanning Tree Protocol
2. BPDU = bridge protocol data unit
3. DSCP = Differentiated Services Code Point
4. CoS = class of service
Tabl e 2-1 shows the default settings.
STP1 BPDU2
Traffic
Real-Time
Video Traffic All Other Traffic
0, 1
(queue 3)
(queue 4)
OL-9645-10
Table 2-2 shows the generated auto-QoS configuration for the ingress queues.
Catalyst 3750 Metro Switch Command Reference
2-15
Page 44
auto qos voip
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Ta b l e 2-2 Auto-QoS Configuration for the Ingress Queues
Ingress Queue Queue Number CoS-to-Queue Map
SRR1 shared
1 0, 1 81 percent 67 percent
Queue Weight
(Bandwidth)
Queue (Buffer)
Size
Priority 2 2, 3, 4, 5, 6, 7 19 percent 33 percent
1. SRR = shaped round robin. Ingress queues support shared mode only.
Table 2-3 shows the generated auto-QoS configuration for the egress queue-set.
Ta b l e 2-3 Auto-QoS Configuration for the Egress Queue-Set
Queue Number
Egress Queue
1
in the
Queue-Set CoS-to-Queue Map
Queue Weight
(Bandwidth)
Queue (Buffer)
Size
Priority (shaped) 1 5 10 percent 10 percent
SRR shared 2 3, 6, 7 10 percent 10 percent
SRR shared 3 2, 4 60 percent 26 percent
SRR shared 4 0, 1 20 percent 54 percent
1. On an enhanced-services (ES) port, the srr-queue bandwidth shape interface configuration command is not part of the
generated auto qos voip command list.
Command Modes Interface configuration
Command History
Release Modification
12.1(14)AX This command was introduced.
12.2(25)EY The cisco-softphone keyword was added, and the generated auto-QoS
configuration changed.
Usage Guidelines Use this command to configure the QoS appropriate for VoIP traffic within the QoS domain. The QoS
domain includes the switch, the interior of the network, and edge devices that can classify inbound traffic
for QoS.
In releases earlier than Cisco IOS Release 12.2(25)EY, auto-QoS configures the switch only for VoIP
with Cisco IP Phones on switch ports.
In Cisco IOS Release 12.2(25)EY or later, auto-QoS configures the switch for VoIP with Cisco IP Phones
on switch and routed ports and for VoIP with devices running the Cisco SoftPhone application. These
releases support only Cisco IP SoftPhone Version 1.3(3) or later. Connected devices must use Cisco Call
Manager Version 4 or later.
To take advantage of the auto-QoS defaults, you should enable auto-QoS before you configure other QoS
commands. You can fine-tune the auto-QoS configuration after you enable auto-QoS.
2-16
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 45
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Note The switch applies the auto-QoS-generated commands as if the commands were entered from the
command-line interface (CLI). An existing user configuration can cause the application of the generated
commands to fail, or the user configuration might be overridden by the generated commands. These
actions occur without warning. If all the generated commands are successfully applied, any user-entered
configuration that was not overridden remains in the running configuration. Any user-entered
configuration that was overridden can be retrieved by reloading the switch without saving the current
configuration to memory. If the generated commands are not applied, the previous running configuration
is restored.
If this is the first port on which you have enabled auto-QoS, the auto-QoS-generated global configuration
commands are executed, followed by the interface configuration commands. If you enable auto-QoS on
another port, only the auto-QoS-generated interface configuration commands for that port are executed.
When you enable the auto-QoS feature on the first port, these automatic actions occur:
• QoS is globally enabled (mls qos global configuration command), and other global configuration
commands are added.
• When you enter the auto qos voip cisco-phone interface configuration command on a port at the
edge of the network that is connected to a Cisco IP phone, the switch enables the trusted boundary
feature. The switch uses the Cisco Discovery Protocol (CDP) to detect the presence or absence of a
Cisco IP phone. When a Cisco IP phone is detected, the ingress classification on the port is set to
trust the QoS label received in the packet. When a Cisco IP phone is absent, the ingress classification
is set to not trust the QoS label in the packet. The switch configures ingress queues and the egress
queue-set on the port according to the settings in
auto qos voip
Table 2-2 and Ta ble 2-3.
• When you enter the auto qos voip cisco-softphone interface configuration command on a port at
the edge of the network that is connected to a device running the Cisco SoftPhone, the switch uses
policing to decide whether a packet is in or out of profile and to specify the action on the packet. If
the packet does not have a DSCP value of 24, 26, or 46 or is out of profile, the switch changes the
DSCP value to 0. The switch configures ingress and egress queues on the port according to the
settings in
• When you enter the auto qos voip trust interface configuration command on a port connected to the
Table 2-2 and Ta b le 2-3.
interior of the network, the switch trusts the CoS value for nonrouted ports or the DSCP value for
routed ports in ingress packets (the assumption is that traffic has already been classified by other
edge devices). The switch configures the ingress queues and the egress queue-set on the port
according to the settings in
Table 2-2 and Ta bl e 2-3.
You can enable auto-QoS on static, dynamic-access, voice VLAN access, and trunk ports. When
enabling auto-QoS with a Cisco IP Phone on a routed port, you must assign a static IP address to the IP
phone.
To display the QoS commands that are automatically generated when auto-QoS is enabled or disabled,
enable debugging before you enable auto-QoS. Use the debug auto qos privileged EXEC command to
enable auto-QoS debugging. For more information, see the
Note When a device running Cisco SoftPhone is connected to a switch or routed port, the switch supports only
debug auto qos command.
one Cisco SoftPhone application per port.
After auto-QoS is enabled, do not modify a policy map or aggregate policer that includes AutoQoS in its
name. If you need to modify the policy map or aggregate policer, make a copy of it, and change the
copied policy map or policer. To use the new policy map instead of the generated one, remove the
generated policy map from the interface, and apply the new policy map.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-17
Page 46
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
auto qos voip
To disable auto-QoS on a port, use the no auto qos voip interface configuration command. Only the
auto-QoS-generated interface configuration commands for this port are removed. If this is the last port
on which auto-QoS is enabled and you enter the no auto qos voip command, auto-QoS is considered
disabled even though the auto-QoS-generated global configuration commands remain (to avoid
disrupting traffic on other ports affected by the global configuration). You can use the no mls qos global
configuration command to disable the auto-QoS-generated global configuration commands. With QoS
disabled, there is no concept of trusted or untrusted ports because the packets are not modified (the CoS,
DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode
(packets are switched without any rewrites and classified as best effort without any policing).
On a port on which the auto qos voip command is enabled, the queue-set ID that is generated depends
on the interface:
• For a Fast Ethernet interface, auto-QoS generates queue-set 1 (which is the default).
• For a Gigabit Ethernet interface, auto-QoS generates queue-set 2.
Examples This example shows how to enable auto-QoS on a port and to trust the QoS labels received in inbound
packets when the switch or router connected to a port is a trusted device:
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# auto qos voip trust
You can verify your settings by entering the show auto qos interface interface-id privileged EXEC
command.
Related Commands Command Description
debug auto qos Enables debugging of the auto-QoS feature.
mls qos cos Defines the default CoS value of a port or assigns the default
CoS to all inbound packets on the port.
mls qos map {cos-dscp dscp1 ... dscp8
Defines the CoS-to-DSCP map or the DSCP-to-CoS map.
| dscp-cos dscp-list to cos}
mls qos queue-set output buffers Allocates buffers to a queue-set.
mls qos srr-queue input bandwidth Assigns SRR weights to an ingress queue.
mls qos srr-queue input buffers Allocates the buffers between the ingress queues.
mls qos srr-queue input cos-map Maps CoS values to an ingress queue or maps CoS values to
a queue and to a threshold ID.
mls qos srr-queue input dscp-map Maps DSCP values to an ingress queue or maps DSCP values
to a queue and to a threshold ID.
mls qos srr-queue input
priority-queue
Configures the ingress priority queue and guarantees
bandwidth.
mls qos srr-queue output cos-map Maps CoS values to an egress queue or maps CoS values to
a queue and to a threshold ID.
mls qos srr-queue output dscp-map Maps DSCP values to an egress queue or maps DSCP values
to a queue and to a threshold ID.
mls qos trust Configures the port trust state.
queue-set Maps a port to a queue-set.
show auto qos Displays the initial configuration that is generated by the
auto-QoS feature.
2-18
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 47
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command Description
show mls qos interface Displays QoS information at the port level.
srr-queue bandwidth shape Assigns the shaped weights and enables bandwidth shaping
srr-queue bandwidth share Assigns the shared weights and enables bandwidth sharing
auto qos voip
on the four egress queues mapped to a standard port.
on the four egress queues mapped to a port.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-19
Page 48
bandwidth
bandwidth
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Use the bandwidth policy-map class configuration command to specify or modify the minimum
bandwidth provided to a class belonging to a hierarchical policy map attached to an enhanced-services
(ES) port. Use the no form of this command to return to the default setting.
bandwidth {bandwidth-kbps | percent percent}
no bandwidth
Syntax Description
Defaults No bandwidth is specified.
Command Modes Policy-map class configuration
Command History
Usage Guidelines Use the bandwidth command only in a hierarchical policy map attached to an ES port. This command
bandwidth-kbps Amount of bandwidth in kbps assigned to the class. The range is 200 to 2000000.
Allocate the bandwidth in 100-kbps increments; otherwise, the software rounds
down the bandwidth to the nearest 100-kbps increment.
percent percent Percentage of available bandwidth assigned to the parent class. The range is 1 to
100.
Release Modification
12.1(14)AX This command was introduced.
12.2(25)EY Hierarchical service policies can be applied to inbound traffic received on an
ES port.
is not valid for the class-default class in a physical-level policy map.
Use the bandwidth command when you configure a policy map for a class defined by the class-map
global configuration command. The bandwidth command specifies the minimum bandwidth for traffic
in that class when there is traffic congestion in the switch. If the switch is not congested, the class
receives more bandwidth than you specify with this command. Class-based weighted fair queueing
(CBWFQ) derives the weight for packets belonging to the class from the bandwidth allocated to the
class. CBWFQ then uses the weight to ensure that the queue for the class is serviced fairly.
2-20
Note It is important to remember that hard bandwidth guarantees might not be provided and that only relative
bandwidths are assured. That is, class bandwidths are always proportional to the specified percentages
of the port bandwidth. When the link bandwidth is fixed, class bandwidth guarantees are in proportion
to the configured percentages.
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 49
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
These restrictions apply to the bandwidth command:
• If the percent keyword is used, the sum of the class bandwidth percentages within a single policy
map cannot exceed 99 percent. Percentage calculations are based on the bandwidth available at the
parent class (or the port if it is the parent).
• The amount of bandwidth available to a class is dependent on the amount of bandwidth reserved by
the parent class.
• The amount of bandwidth configured should be large enough to accommodate Layer 2 overhead.
• A policy map can have all the class bandwidths specified in either kbps or in percentages, but not a
mix of both. You cannot specify bandwidth in kbps in a child policy (configured through the
service-policy policy-map class configuration command) and then specify bandwidth as a
percentage in the parent policy.
• You cannot use the bandwidth command for the class-default class map in a physical-level policy
map.
• Though visible in the command-line interface, the max-reserved-bandwidth interface
configuration command and the bandwidth interface configuration command are not supported on
the ES ports.
When you configure the bandwidth command in a class policy, you must also configure the bandwidth
or shape policy-map class configuration command in the parent VLAN-level policy.
bandwidth
You must configure the bandwidth or the shape policy-map class configuration command before you
configure either the queue-limit or the random-detect policy-map class configuration command in a
class policy.
You cannot use the bandwidth, queue-limit, random-detect, and the shape policy-map class
configuration commands with the priority policy-map class configuration command in the same class
within the same policy map. However, you can use these commands in the same policy map.
When you use the service-policy interface configuration command to attach the policy map containing
class configurations to an ES port, the switch determines the available bandwidth.
Examples This example shows how to set the minimum bandwidth to 2000 kbps for a class called silver-class. The
class already exists in the switch configuration.
Switch(config)# policy-map polmap6
Switch(config-pmap)# class silver-class
Switch(config-pmap-c)# bandwidth 2000
This example shows how to guarantee 30 percent of the bandwidth for class1 and 25 percent of the
bandwidth for class2 when CBWFQ is configured. A policy map with two classes is created and is then
attached to an ES port.
Switch(config)# policy-map policy1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# bandwidth percent 50
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class2
Switch(config-pmap-c)# bandwidth percent 25
Switch(config-pmap-c)# exit
Switch(config-pmap)# end
Switch(config)# interface gigabitethernet1/1/1
Switch(config-if)# service-policy input policy1
OL-9645-10
This example shows how bandwidth is guaranteed if low-latency queueing (LLQ) and CBWFQ are
configured. In this example, LLQ is enabled in a class called voice1.
Catalyst 3750 Metro Switch Command Reference
2-21
Page 50
bandwidth
Switch(config)# policy-map policy1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# bandwidth percent 50
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class2
Switch(config-pmap-c)# bandwidth percent 25
Switch(config-pmap-c)# exit
Switch(config-pmap)# class voice1
Switch(config-pmap-c)# priority
Switch(config-pmap-c)# exit
Switch(config-pmap)# end
Switch(config)# interface gigabitethernet1/1/1
Switch(config-if)# service-policy output policy1
You can verify your settings by entering the show policy-map privileged EXEC command.
Related Commands Command Description
class Specifies the name of the class whose traffic policy you want to create or
change.
policy-map Creates or modifies a policy map that can be attached to multiple ports to
specify a service policy.
priority Enables the strict-priority queue and gives priority to a class of traffic
belonging to a policy map attached to an ES port.
queue-limit Configures the maximum threshold for tail drop in a policy map attached
to an ES port.
random-detect Configures Weighted Random Early Detection (WRED) in a policy map
attached to an ES port.
service-policy
(policy-map class)
Creates a service policy as a quality of service (QoS) policy within a policy
map.
shape Enables traffic shaping in a policy map attached to an ES port.
show policy-map Displays QoS policy maps.
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
2-22
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 51
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
boot config-file
Use the boot config-file global configuration command to specify the filename that software uses to read
and write a nonvolatile copy of the system configuration. Use the no form of this command to return to
the default setting.
boot config-file flash:/file-url
no boot config-file
boot config-file
Syntax Description
Defaults The default configuration file is flash:config.text.
Command Modes Global configuration
Command History
Usage Guidelines Filenames and directory names are case sensitive.
Related Commands
flash:/file-url The path (directory) and name of the configuration file.
Release Modification
12.1(14)AX This command was introduced.
This command changes the setting of the CONFIG_FILE environment variable. For more information,
see
Appendix A, “Catalyst 3750 Metro Switch Boot Loader Commands.”
Command Description
show boot Displays the settings of the boot environment variables.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-23
Page 52
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
boot enable-break
boot enable-break
Use the boot enable-break global configuration command to enable interrupting the automatic boot
process. Use the no form of this command to return to the default setting.
boot enable-break
no boot enable-break
Syntax Description This command has no arguments or keywords.
Defaults Disabled. The automatic boot process cannot be interrupted by pressing the Break key on the console.
Command Modes Global configuration
Command History
Usage Guidelines When you enter this command, you can interrupt the automatic boot process by pressing the Break key
Note Despite the setting of this command, you can interrupt the automatic boot process at any time by pressing
Related Commands
Release Modification
12.1(14)AX This command was introduced.
on the console after the flash file system is initialized.
the MODE button on the switch front panel.
This command changes the setting of the ENABLE_BREAK environment variable. For more
information, see
Command Description
show boot Displays the settings of the boot environment variables.
Appendix A, “Catalyst 3750 Metro Switch Boot Loader Commands.”
2-24
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 53
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
boot helper
Use the boot helper global configuration command to dynamically load files during boot loader
initialization to extend or patch the functionality of the boot loader. Use the no form of this command
to return to the default.
boot helper filesystem:/file-url ...
no boot helper
boot helper
Syntax Description
Defaults No helper files are loaded.
Command Modes Global configuration
Command History
Usage Guidelines This variable is used only for internal development and testing.
filesystem: Alias for a flash file system. Use flash: for the system board flash device.
/file-url The path (directory) and a list of loadable files to dynamically load during
loader initialization. Separate each image name with a semicolon.
Release Modification
12.1(14)AX This command was introduced.
Filenames and directory names are case sensitive.
This command changes the setting of the HELPER environment variable. For more information, see
Appendix A, “Catalyst 3750 Metro Switch Boot Loader Commands.”
Related Commands
OL-9645-10
Command Description
show boot Displays the settings of the boot environment variables.
Catalyst 3750 Metro Switch Command Reference
2-25
Page 54
boot helper-config-file
boot helper-config-file
Use the boot helper-config-file global configuration command to specify the name of the configuration
file to be used by the helper image. If this is not set, the file specified by the CONFIG_FILE environment
variable is used by all versions of software that are loaded. Use the no form of this command to return to
the default setting.
boot helper-config-file filesystem:/file-url
no boot helper-config file
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
Defaults No helper configuration file is specified.
Command Modes Global configuration
Command History
Usage Guidelines This variable is used only for internal development and testing.
filesystem: Alias for a flash file system. Use flash: for the system board flash
device.
/file-url The path (directory) and helper configuration file to load.
Release Modification
12.1(14)AX This command was introduced.
Filenames and directory names are case sensitive.
This command changes the setting of the HELPER_CONFIG_FILE environment variable. For more
information, see
Appendix A, “Catalyst 3750 Metro Switch Boot Loader Commands.”
Related Commands
Catalyst 3750 Metro Switch Command Reference
2-26
Command Description
show boot Displays the settings of the boot environment variables.
OL-9645-10
Page 55
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
boot manual
Use the boot manual global configuration command to enable manually booting the switch during the
next boot cycle. Use the no form of this command to return to the default setting.
boot manual
no boot manual
Syntax Description This command has no arguments or keywords.
Defaults Manual booting is disabled.
Command Modes Global configuration
boot manual
Command History
Usage Guidelines The next time you reboot the system, the switch is in boot loader mode, which is shown by the switch:
Related Commands
Release Modification
12.1(14)AX This command was introduced.
prompt. To boot the system, use the boot boot loader command, and specify the name of the bootable
image.
This command changes the setting of the MANUAL_BOOT environment variable. For more
information, see
Command Description
show boot Displays the settings of the boot environment variables.
Appendix A, “Catalyst 3750 Metro Switch Boot Loader Commands.”
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-27
Page 56
boot private-config-file
boot private-config-file
Use the boot private-config-file global configuration command to specify the filename that software
uses to read and write a nonvolatile copy of the private configuration. Use the no form of this command
to return to the default setting.
boot private-config-file filename
no boot private-config-file
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
Defaults The default configuration file is private-config.
Command Modes Global configuration
Command History
Usage Guidelines Filenames are case sensitive.
Examples This example shows how to specify the name of the private configuration file to be pconfig:
Related Commands
filename The name of the private configuration file.
Release Modification
12.1(14)AX This command was introduced.
Switch(config)# boot private-config-file pconfig
Command Description
show boot Displays the settings of the boot environment variables.
2-28
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 57
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
boot system
Use the boot system global configuration command to specify the image to load during the next boot
cycle. Use the no form of this command to return to the default setting.
boot system filesystem:/file-url ...
no boot system
boot system
Syntax Description
Defaults The switch attempts to automatically boot the system by using information in the BOOT environment
Command Modes Global configuration
Command History
Usage Guidelines Filenames and directory names are case sensitive.
filesystem: Alias for a flash file system. Use flash: for the system board flash device.
/file-url The path (directory) and name of a bootable image. Separate image names
with a semicolon.
variable. If this variable is not set, the switch attempts to load and execute the first executable image it
can by performing a recursive, depth-first search throughout the flash file system. In a depth-first search
of a directory, each encountered subdirectory is completely searched before continuing the search in the
original directory.
Release Modification
12.1(14)AX This command was introduced.
If you are using the archive download-sw privileged EXEC command to maintain system images, you
never need to use the boot system command. The boot system command is automatically manipulated
to load the downloaded image.
This command changes the setting of the BOOT environment variable. For more information, see
Appendix A, “Catalyst 3750 Metro Switch Boot Loader Commands.”
Related Commands
OL-9645-10
Command Description
show boot Displays the settings of the boot environment variables.
Catalyst 3750 Metro Switch Command Reference
2-29
Page 58
channel-group
channel-group
Use the channel-group interface configuration command to assign a port to an EtherChannel group and
to enable an EtherChannel mode. Use the no form of this command to remove a port from an
EtherChannel group.
channel-group channel-group-number mode {active | {auto [non-silent]} | {desirable
no channel-group
PAgP modes:
LACP modes:
On mode:
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
[non-silent]} | on | passive}
channel-group channel-group-number mode {{auto [non-silent]} | {desirable [non-silent}}
channel-group channel-group-number mode {active | passive}
channel-group channel-group-number mode on
Syntax Description channel-group-number Specify the channel group number. The range is 1 to 12.
mode Specify the EtherChannel mode of the port.
active Unconditionally enable Link Aggregation Protocol (LACP).
Active mode places a port into a negotiating state in which the port initiates
negotiations with other ports by sending LACP packets. A channel is
formed with another port group in either the active or passive mode.
auto Enable the Port Aggregation Protocol (PAgP) only if a PAgP device is
detected.
Auto mode places a port into a passive negotiating state in which the port
responds to PAgP packets it receives but does not start PAgP packet
negotiation. A channel is formed only with another port group in desirable
mode. When auto is enabled, silent operation is the default.
desirable Unconditionally enable PAgP.
Desirable mode places a port into an active negotiating state in which the
port starts negotiations with other ports by sending PAgP packets. A
channel is formed with another port group in either the desirable or auto
mode. When desirable is enabled, silent operation is the default.
non-silent (Optional) Used with the auto or desirable keyword when traffic is
expected from the other device.
on Enable on mode.
In on mode, a usable EtherChannel exists only when both connected port
groups are in the on mode.
passive Enable LACP only if a LACP device is detected.
Passive mode places a port into a negotiating state in which the port
responds to LACP packets it receives but does not initiate LACP packet
negotiation. A channel is formed only with another port group in active
mode.
2-30
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 59
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Defaults No channel groups are assigned.
No mode is configured.
Command Modes Interface configuration
channel-group
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines For Layer 2 EtherChannels, you do not have to create a port-channel first by using the interface
port-channel global configuration command before assigning a physical port to a channel group.
Instead, you can use the channel-group interface configuration command. It automatically creates the
port-channel when the channel group gets its first physical port if the logical interface is not already
created. If you create the port-channel first, the channel-group-number can be the same as the
port-channel-number, or you can use a new number. If you use a new number, the channel-group
command dynamically creates a new port channel.
You do not have to disable the IP address that is assigned to a physical port that is part of a channel group,
but we strongly recommend that you do so.
You create Layer 3 port channels by using the interface port-channel command followed by the no
switchport interface configuration command. You should manually configure the port-channel logical
interface before putting the interface into the channel group.
After you configure an EtherChannel, configuration changes that you make on the port-channel apply to
all the physical ports assigned to the port-channel. Configuration changes applied to the physical port
affect only the port where you apply the configuration. To change the parameters of all ports in an
EtherChannel, apply configuration commands to the port-channel, for example, spanning-tree
commands or commands to configure a Layer 2 EtherChannel as a trunk.
If you do not specify non-silent with the auto or desirable mode, silent is assumed. The silent mode is
used when the switch is connected to a device that is not PAgP-capable and seldom, if ever, sends
packets. A example of a silent partner is a file server or a packet analyzer that is not generating traffic.
In this case, running PAgP on a physical port prevents that port from ever becoming operational.
However, it allows PAgP to operate, to attach the port to a channel group, and to use the port for
transmission. Both ends of the link cannot be set to silent.
With the on mode, a usable EtherChannel exists only when a port group in the on mode is connected to
another port group in the on mode.
OL-9645-10
Caution You should use care when using the on mode. This is a manual configuration, and ports on both ends of
the EtherChannel must have the same configuration. If the group is misconfigured, packet loss or
spanning-tree loops can occur.
Note Enhanced-services (ES) port cannot be bundled with non ES ports.
Catalyst 3750 Metro Switch Command Reference
2-31
Page 60
channel-group
Caution Do not enable Layer 3 addresses on the physical EtherChannel ports. Do not assign bridge groups on the
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Do not configure an EtherChannel in both the PAgP and LACP modes. EtherChannel groups running
PAgP and LACP can coexist on the same switch. Individual EtherChannel groups can run either PAgP
or LACP, but they cannot interoperate.
If you set the protocol by using the channel-protocol interface configuration command, the setting is
not overridden by the channel-group interface configuration command
Do not configure a port that is an active member of an EtherChannel as an 802.1x port. If 802.1x is
enabled on a not-yet active port of an EtherChannel, the port does not join the EtherChannel.
Note If 802.1x is enabled on a not-yet active port of an EtherChannel in software releases earlier than Cisco
IOS Release 12.2(25)EY, the port does not join the EtherChannel.
Do not configure a secure port as part of an EtherChannel or an EtherChannel port as a secure port.
For a complete list of configuration guidelines, see the “Configuring EtherChannels” chapter in the
software guide for this release.
physical EtherChannel ports because it creates loops.
Examples This example shows how to configure EtherChannel. It assigns ports as static-access ports in VLAN 10
to channel 5 with the PAgP mode desirable.
Switch# configure terminal
Switch(config)# interface range fastethernet1/0/4 -5
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# channel-group 5 mode desirable
Switch(config-if-range)# end
This example shows how to configure EtherChannel. It assigns ports as static-access ports in VLAN 10
to channel 5 with the LACP mode active.
Switch# configure terminal
Switch(config)# interface range fastethernet1/0/4 -5
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# channel-group 5 mode active
Switch(config-if-range)# end
You can verify your settings by entering the show running-config privileged EXEC command.
Related Commands Command Description
channel-protocol Restricts the protocol used on a port to manage channeling.
interface port-channel Accesses or creates the port channel.
show etherchannel Displays EtherChannel information for a channel.
show lacp Displays LACP channel-group information.
2-32
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 61
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command Description
show pagp Displays PAgP channel-group information.
show running-config Displays the operating configuration. For syntax information, use
channel-group
this link to the Cisco IOS Release 12.2 Command Reference listing
page:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/prod_
command_reference_list.html
Select the Cisco IOS Commands Master List, Release 12.2 to
navigate to the command.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-33
Page 62
channel-protocol
channel-protocol
Use the channel-protocol interface configuration command to restrict the protocol used on a port to
manage channeling. Use the no form of this command to return to the default setting.
channel-protocol {lacp | pagp}
no channel-protocol
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
Defaults No protocol is assigned to the EtherChannel.
Command Modes Interface configuration
Command History
Usage Guidelines Use the channel-protocol command only to restrict a channel to LACP or PAgP. If you set the protocol
lacp Configure an EtherChannel with the Link Aggregation Control Protocol (LACP).
pagp Configure an EtherChannel with the Port Aggregation Protocol (PAgP).
Release Modification
12.1(14)AX This command was introduced.
by using the channel-protocol command, the setting is not overridden by the channel-group interface
configuration command.
You must use the channel-group interface configuration command to configure the EtherChannel
parameters. The channel-group command also can set the mode for the EtherChannel.
You cannot enable both the PAgP and LACP modes on an EtherChannel group.
PAgP and LACP are not compatible; both ends of a channel must use the same protocol.
Examples This example shows how to specify LACP as the protocol that manages the EtherChannel:
Switch(config-if)# channel-protocol lacp
You can verify your settings by entering the show etherchannel [channel-group-number] protocol
privileged EXEC command.
Related Commands
Catalyst 3750 Metro Switch Command Reference
2-34
Command Description
channel-group Assigns an Ethernet port to an EtherChannel group.
show etherchannel protocol Displays protocol information the EtherChannel.
OL-9645-10
Page 63
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
class
Use the class policy-map configuration command to specify the name of the class whose traffic policy
you want to create or change. Use the no form of this command to delete an existing class from a policy
map.
class {class-map-name | class-default}
no class {class-map-name | class-default}
class
Syntax Description
Defaults No classes are defined.
Command Modes Policy-map configuration
Command History
Usage Guidelines Before using the class command, you must create a class map for matching packets to the class by using
class-map-name Name of the class map.
class-default System default class that matches unclassified packets.
Release Modification
12.1(14)AX This command was introduced.
12.2(55)SE The class-default keyword was added.
the class-map global configuration command. You also must use the policy-map global configuration
command to identify the policy map and to enter policy-map configuration mode. After specifying a
policy map, you can configure a traffic policy for new classes or modify a traffic policy for any existing
classes in that policy map. The class name that you specify with the class command in the policy map
ties the characteristics for that class—that is, its policy—to the class map and its match criteria, as
configured through the class-map global configuration command. You attach the policy map to a port
by using the service-policy interface configuration command.
After you enter the class command, the switch enters policy-map class configuration mode, and these
configuration commands are available:
• bandwidth: specifies or modifies the minimum bandwidth provided to a class belonging to a policy
map. For more information, see the
hierarchical policy map attached to an enhanced-services (ES) port.
bandwidth command. This command is effective only in a
OL-9645-10
• exit: exits policy-map class configuration mode and returns to policy-map configuration mode.
• no: returns a command to its default setting.
• police: configures a single-rate policer, an aggregate policer, or a two-rate traffic policer that uses
the committed information rate (CIR) and the peak information rate (PIR) for a class of traffic. The
policer specifies the bandwidth limitations and the action to take when the limits are exceeded. For
more information, see the
two-rate policer, see the police cir and the police cir percent command. The two-rate traffic policer
commands are effective only in a hierarchical policy map attached to an ES port.
police and police aggregate commands. For more information about the
Catalyst 3750 Metro Switch Command Reference
2-35
Page 64
class
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
• priority: enables the priority queue (low-latency queueing [LLQ]) for a class of traffic. For more
information, see the
attached to an ES port.
• queue-limit: configures the maximum packet threshold for tail drop for a class configured in a
policy map attached to an ES port. For more information, see the
command is effective only in a hierarchical policy map attached to an ES port.
• random-detect: configures Weighted Random Early Detection (WRED) as a drop policy. For more
information, see the
policy map attached to an ES port.
• service-policy: creates a service policy as a quality of service (QoS) policy within a policy map
(called a hierarchical service policy). For more information, see the
class) command. This command is effective only in a hierarchical policy map attached to an ES port.
• set: classifies IP traffic by setting a class of service (CoS), a Differentiated Services Code Point
(DSCP), an IP-precedence, or the multiprotocol label switching (MPLS) experimental (EXP) bits in
the packet. For more information, see the
hierarchical policy map attached to an ES port.
• shape: sets the token bucket committed information rate (CIR) in a policy map. For more
information, see the
attached to an ES port.
• trust: defines a trust state for a traffic class. For more information, see the trust command.
The switch supports up to eight classes, including the default class, in a policy map. Packets that fail to
meet any of the matching criteria are classified as members of the default traffic class. You configure the
default traffic class by specifying class-default as the class name in the class policy-map class
configuration command. You can manipulate the default traffic class (for example, set policies to police
or to shape it) just like any other traffic class, but you cannot delete it.
priority command. This command is effective only in a hierarchical policy map
queue-limit command. This
random-detect command. This command is effective only in a hierarchical
service-policy (policy-map
set command. Some keywords are effective only in a
shape command. This command is effective only in a hierarchical policy map
Within a policy map, the class-default applies to all traffic that is not explicitly matched within the policy
map but that does match the parent policy. If no parent policy is configured, the parent policy represents
the physical port. In the physical-level policy map, class-default is the only class that can be configured.
In a hierarchical policy map attached to an ES port, you define a class policy to use either tail drop or
WRED packet drop by using either the queue-limit policy-map class configuration command or the
random-detect policy-map class configuration command, respectively. You cannot use the queue-limit
and random-detect commands in the same class policy, but they can be used in two class policies in the
same policy map.
In a hierarchical policy map attached to an ES port, you must configure the bandwidth or the shape
policy-map class configuration command before you configure either the queue-limit or the
random-detect policy-map class configuration command in a class policy.
When you configure a policy for a class, specify its bandwidth, and attach the policy map to an ES port,
class-based weighted fair queueing (CBWFQ) determines if the bandwidth requirement of the class can
be satisfied. If so, CBWFQ creates the necessary internal data structures to maintain the state for the
class and allocates a queue for it. If CBWFQ decides that the bandwidth requirement for the class cannot
be satisfied, an error message appears, and the policy is not attached. When a class is removed, available
bandwidth for the port is incremented by the amount previously allocated to the class.
To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode,
use the end command.
You can configure a default class by using the class class-default policy-map configuration command.
Unclassified traffic (traffic that does not meet the match criteria specified in the traffic classes) is treated
as default traffic.
2-36
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 65
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
class
Examples This example shows how to create a policy map called policy1. When attached to an ingress port, the
policy matches all the inbound traffic defined in class1, sets the IP DSCP to 10, and polices the traffic
at an average rate of 1 Mbps and bursts of 20
Traffic exceeding the profile is marked down to a DSCP value obtained from the policed-DSCP map and
then sent.
Switch(config)# class-map class1
Switch(config-cmap)# exit
Switch(config)# policy-map policy1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# set ip dscp 10
Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmit
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface fastethernet1/0/4
Switch(config-if)# service-policy input policy1
This example configures two class policies included in the egress policy map called policy1. Class1
specifies a policy for 802.1Q tunneling traffic that matches packets based on the outer VLAN ID (VLAN
2) and the inner VLAN IDs (3 to 8).
Switch(config)# class-map match-all class1
Switch(config-cmap)# match vlan 2
Switch(config-cmap)# match vlan inner 3 - 8
Switch(config-cmap)# exit
Switch(config)# policy-map policy1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# bandwidth 2000
Switch(config-pmap-c)# queue-limit 40
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# interface gigabitethernet1/1/1
Switch(config-if)# service-policy output policy1
KB. Traffic exceeding the profile is marked down to a
For class1, a minimum of 2000 kbps of bandwidth is expected to be delivered to this class in the event
of congestion. The queue reserved for this class can contain 40 packets before tail drop occurs.
This example shows how to shape the default class. This configuration associates a class-level policy
map with a VLAN-level policy map and then associates the VLAN-level policy map with a
physical-level policy map.
Switch(config)# class-map my-class
Switch(config-cmap)# match ip precedence 1
Switch(config-cmap)# exit
Switch(config)# class-map my-logical-class
Switch(config-cmap)# match vlan 5
Switch(config-cmap)# exit
Switch(config)# policy-map my-class-policy
Switch(config-pmap)# class my-class
Switch(config-pmap-c)# set ip precedence 2
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# policy-map my-logical-policy
Switch(config-pmap)# class my-logical-class
Switch(config-pmap-c)# shape average 400000000
Switch(config-pmap-c)# service-policy my-class-policy
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
Switch(config)# policy-map my-physical-policy
Switch(config-pmap)# class class-default
Switch(config-pmap-c)# shape average 500000000
Switch(config-pmap-c)# service-policy my-logical-policy
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-37
Page 66
class
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
This example shows how to create a hierarchical class-level policy map with two traffic classes. One of
the classes has a class-level classification and a two-rate policer, and the other is the default traffic class.
Packets that fail to meet the matching criteria are classified as members of the default traffic class, and
the IP precedence in this traffic is reset to 0.
Switch(config)# class-map match-all classprece1
Switch(config-cmap)# match ip precedence 1
Switch(config-cmap)# exit
Switch-config)# policy-map precedencepolice
Switch(config-pmap)# class classprece1
Switch(config-pmap-c)# police cir 100000000 pir 200000000 conform-action set-prec-transmit
2 exceed-action set-prec-transmit 3 violate-action set-prec-transmit 4
Switch(config-pmap-c)# exit
Switch(config-pmap)# class class-default
Switch(config-pmap-c)# set ip precedence 0
In the previous hierarchical QoS example, the first traffic class has only one match statement. However,
hierarchical policy maps can support multiple match statements.
This example shows how to configure a default traffic class to a policy map:
Switch# configure terminal
Switch(config)# class-map cm-3
Switch(config-cmap)# match ip dscp 30
Switch(config-cmap)# match protocol ipv6
Switch(config-cmap)# exit
Switch(config)# class-map cm-4
Switch(config-cmap)# match ip dscp 40
Switch(config-cmap)# match protocol ip
Switch(config-cmap)# exit
Switch(config)# policy-map pm3
Switch(config-pmap)# class class-default
Switch(config-pmap-c)# set dscp 10
Switch(config-pmap-c)# exit
Switch(config-pmap)# class cm-3
Switch(config-pmap-c) set dscp 4
Switch(config-pmap-c)# exit
Switch(config-pmap)# class cm-4
Switch(config-pmap-c)# trust cos
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
2-38
You can verify your settings by entering the show policy-map privileged EXEC command.
This example shows how the default traffic class is automatically placed at the end of policy-map pm3
even though class-default was configured first:
Switch# show policy-map pm3
Policy Map pm3
Class cm-3
set dscp 4
Class cm-4
trust cos
Class class-default
set dscp 10
Switch#
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 67
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Related Commands Command Description
bandwidth Specifies or modifies the minimum bandwidth provided to a class belonging
to a policy map attached to an ES port.
class-map Creates a class map to be used for matching packets to the class whose name
you specify.
police Configures a single-rate traffic policer for a class of traffic.
police cir Configures a two-rate traffic policer for a class of traffic.
police cir percent Configures a two-rate traffic policer for a class of traffic based on a
percentage of the available bandwidth.
policy-map Creates or modifies a policy map that can be attached to multiple ports to
specify a service policy.
priority Enables the strict-priority queue and gives priority to a class of traffic
belonging to a policy map attached to an ES port.
queue-limit Configures the maximum threshold for tail drop in a policy map attached to
an ES port.
random-detect Configures WRED in a policy map attached to an ES port.
service-policy Applies a policy map defined by the policy-map global configuration
command to a port.
service-policy
Creates a service policy as a QoS policy within a policy map.
(policy-map class)
set Classifies IP traffic by setting a CoS, a DSCP, an IP-precedence, or the MPLS
EXP bits in the packet.
shape Enables traffic shaping in a policy map attached to an ES port.
show policy-map Displays QoS policy maps.
trust Defines a trust state for the traffic classified through the class policy-map
configuration command.
class
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-39
Page 68
class-map
class-map
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Use the class-map global configuration command to create a class map to be used for matching packets
to the class whose name you specify and to enter class-map configuration mode. Use the no form of this
command to delete an existing class map and to return to global configuration mode.
class-map [match-all | match-any] class-map-name
no class-map [match-all | match-any] class-map-name
Syntax Description
match-all (Optional) Perform a logical-AND of all matching under this class map. All
criteria in the class map must be matched.
match-any (Optional) Perform a logical-OR of the matching statements under this class
map. One or more criteria in the class map must be matched.
class-map-name Name of the class map.
Defaults No class maps are defined.
If neither the match-all nor the match-any keyword is specified, the default is match-all.
Command Modes Global configuration
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines Use this command to specify the name of the class for which you want to create or modify class-map
match criteria and to enter class-map configuration mode. Packets are checked against the match criteria
configured for a class map to decide if the packet belongs to that class. If a packet matches the specified
criteria, the packet is considered a member of the class and is forwarded according to the quality of
service (QoS) specifications set in the traffic policy.
You can create up to 4093 class maps.
2-40
After you enter the class-map command, the switch enters class-map configuration mode, and these
configuration commands are available:
• description: describes the class map (up to 200 characters). The show class-map privileged EXEC
command displays the description and the name of the class map.
• exit: exits from QoS class-map configuration mode.
• match: configures classification criteria. For more information, see the match (class-map
configuration) command.
• no: removes a match statement from a class map.
• rename: renames the current class map. If you rename a class map with a name that is already used,
the message
Catalyst 3750 Metro Switch Command Reference
A class-map with this name already exists appears.
OL-9645-10
Page 69
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
class-map
Only one access control list (ACL) can be configured in a class map. The ACL can have multiple access
control entries (ACEs). Class maps that contain ACLs are not supported in an egress policy attached to
an enhanced-services (ES) port or in a hierarchical ingress policy attached to an ES port.
Examples This example shows how to configure the class map called class1 with one match criterion, which is an
access list called 103:
Switch(config)# access-list 103 permit ip any any dscp 10
Switch(config)# class-map class1
Switch(config-cmap)# match access-group 103
Switch(config-cmap)# exit
This example shows how to delete the class1 class map:
Switch(config)# no class-map class1
You can verify your settings by entering the show class-map privileged EXEC command.
Related Commands Command Description
class Specifies the name of the class whose traffic policy you want to
create or change.
match (class-map
configuration)
policy-map Creates or modifies a policy map that can be attached to multiple
show class-map Displays QoS class maps.
Defines the match criteria for a class map.
ports to specify a service policy.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-41
Page 70
clear ip arp inspection log
clear ip arp inspection log
Use the clear ip arp inspection log privileged EXEC command on the switch to clear the dynamic
Address Resolution Protocol (ARP) inspection log buffer.
clear ip arp inspection log
This command is available only if your switch is running the enhanced multilayer image (EMI).
Syntax Description This command has no arguments or keywords.
Defaults No default is defined.
Command Modes Privileged EXEC
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command History
Examples This example shows how to clear the contents of the log buffer:
Related Commands
Release Modification
12.2(25)EY This command was introduced.
Switch# clear ip arp inspection log
You can verify that the log was cleared by entering the show ip arp inspection log privileged command.
Command Description
arp access-list Defines an ARP access control list (ACL).
ip arp inspection log-buffer Configures the dynamic ARP inspection logging buffer.
ip arp inspection vlan
logging
show ip arp inspection log Displays the configuration and contents of the dynamic ARP
Controls the type of packets that are logged per VLAN.
inspection log buffer.
2-42
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 71
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear ip arp inspection statistics
Use the clear ip arp inspection statistics privileged EXEC command on the switch to clear the dynamic
Address Resolution Protocol (ARP) inspection statistics.
clear ip arp inspection statistics [vlan vlan-range]
This command is available only if your switch is running the enhanced multilayer image (EMI).
clear ip arp inspection statistics
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Examples This example shows how to clear the statistics for VLAN 1:
vlan vlan-range (Optional) Clear statistics for the specified VLAN or VLANs.
You can specify a single VLAN identified by VLAN ID number, a range of
VLANs separated by a hyphen, or a series of VLANs separated by a comma.
The range is 1 to 4094.
Release Modification
12.2(25)EY This command was introduced.
Switch# clear ip arp inspection statistics vlan 1
You can verify that the statistics were deleted by entering the show ip arp inspection statistics vlan 1
privileged EXEC command.
Related Commands
OL-9645-10
Command Description
show ip arp inspection
statistics
Displays statistics for forwarded, dropped, MAC validation failure, and
IP validation failure packets for all VLANs or the specified VLAN.
Catalyst 3750 Metro Switch Command Reference
2-43
Page 72
clear ip dhcp snooping
clear ip dhcp snooping
Use the clear ip dhcp snooping privileged EXEC command to clear the DHCP snooping binding
database, the DHCP snooping binding database agent statistics, or the DHCP snooping statistics
counters.
clear ip dhcp snooping {binding {* | ip-address | interface interface-id | vlan vlan-id} | database
statistics | statistics}
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
binding Clear the DHCP snooping binding database.
* Clear all automatic bindings.
ip-address Clear the binding entry IP address.
interface interface-id Clear the binding input interface.
vlan vlan-id Clear the binding entry VLAN.
database statistics Clear the DHCP snooping binding database agent statistics.
statistics Clear the DHCP snooping statistics counter.
Release Modification
12.2(25)EY This command was introduced.
12.2(37)SE The statistics keyword was introduced.
12.2(44)SE The *, ip-address, interface interface-id, and vlan vlan-id keywords were
introduced.
Usage Guidelines When you enter the clear ip dhcp snooping database statistics command, the switch does not update
the entries in the binding database and in the binding file before clearing the statistics.
Examples This example shows how to clear the DHCP snooping binding database agent statistics:
Switch# clear ip dhcp snooping database statistics
You can verify that the statistics were cleared by entering the show ip dhcp snooping database
privileged EXEC command.
This example shows how to clear the DHCP snooping statistics counters:
Switch# clear ip dhcp snooping statistics
You can verify that the statistics were cleared by entering the show ip dhcp snooping statistics user
EXEC command.
Catalyst 3750 Metro Switch Command Reference
2-44
OL-9645-10
Page 73
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Related Commands Command Description
ip dhcp snooping Enables DHCP snooping on a VLAN.
ip dhcp snooping database Configures the DHCP snooping binding database agent or
the binding file.
show ip dhcp snooping binding Displays the status of DHCP snooping database agent.
show ip dhcp snooping database Displays the DHCP snooping binding database agent
statistics.
show ip dhcp snooping statistics Displays the DHCP snooping statistics.
clear ip dhcp snooping
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-45
Page 74
clear ipv6 dhcp conflict
clear ipv6 dhcp conflict
Use the clear ipv6 dhcp conflict privileged EXEC command to clear an address conflict from the
Dynamic Host Configuration Protocol for IPv6 (DHCPv6) server database.
clear ipv6 dhcp conflict {* | IPv6-address}
Note This command is available only if you have configured a dual IPv4 and IPv6 Switch Database
Management (SDM) template on the switch.
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines To configure the dual IPv4 and IPv6 template, enter the sdm prefer dual-ipv4-and-ipv6 {default |
* Clear all address conflicts.
IPv6-address Clear the host IPv6 address that contains the conflicting address.
Release Modification
12.2(52)SE This command was introduced.
routing | vlan} global configuration command, and reload the switch.
When you configure the DHCPv6 server to detect conflicts, it uses ping. The client uses neighbor
discovery to detect clients and reports to the server through a DECLINE message. If an address conflict
is detected, the address is removed from the pool and is not assigned until the administrator removes the
address from the conflict list.
If you use the asterisk (*) character as the address parameter, DHCP clears all conflicts.
Examples This example shows how to clear all address conflicts from the DHCPv6 server database:
Switch# clear ipv6 dhcp conflict *
Related Commands
Catalyst 3750 Metro Switch Command Reference
2-46
Command Description
show ipv6 dhcp
conflict
Displays address conflicts found by a DHCPv6 server, or reported through
a DECLINE message from a client.
OL-9645-10
Page 75
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear l2protocol-tunnel counters
Use the clear l2protocol-tunnel counters privileged EXEC command to clear the protocol counters in
protocol tunnel ports.
clear l2protocol-tunnel counters [interface-id]
clear l2protocol-tunnel counters
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines Use this command to clear protocol tunnel counters on the switch or on the specified interface.
Examples This example shows how to clear Layer 2 protocol tunnel counters on a port:
interface-id (Optional) Specify interface for which protocol counters are to be cleared.
The interface can be a physical interface or a port channel.
Release Modification
12.1(14)AX This command was introduced.
Switch # clear l2protocol-tunnel counters gigabitethernet1/0/2
You can verify that the information was deleted by entering the show l2protocol-tunnel privileged
EXEC command.
Related Commands
OL-9645-10
Command Description
show l2protocol-tunnel Displays information about ports configured for Layer 2 protocol
tunneling.
Catalyst 3750 Metro Switch Command Reference
2-47
Page 76
clear lacp
clear lacp
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Use the clear lacp privileged EXEC command to clear Link Aggregation Control Protocol (LACP)
channel-group counters.
clear lacp {channel-group-number counters | counters}
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines You can clear all counters by using the clear lacp counters command, or you can clear only the counters
Examples This example shows how to clear all channel-group information:
channel-group-number (Optional) Channel group number. The range is 1 to 12.
counters Clear traffic counters.
Release Modification
12.1(14)AX This command was introduced.
for the specified channel group by using the clear lacp channel-group-number counters command.
Switch# clear lacp counters
Related Commands
Catalyst 3750 Metro Switch Command Reference
2-48
This example shows how to clear LACP traffic counters for group 4:
Switch# clear lacp 4 counters
You can verify that the information was deleted by entering the show lacp counters or the show lacp 4
counters privileged EXEC command.
Command Description
show lacp Displays LACP channel-group information.
OL-9645-10
Page 77
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear mac address-table
Use the clear mac address-table privileged EXEC command to delete from the MAC address table all
dynamic MAC addresses, a specific dynamic MAC address, all dynamic addresses on a particular
interface, or all dynamic addresses on a particular VLAN. This command also clears the MAC address
notification global counters.
clear mac address-table {dynamic [address mac-addr | interface interface-id | vlan vlan-id] |
notification}
clear mac address-table
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Examples This example shows how to remove a specific MAC address from the dynamic address table:
dynamic Delete all dynamic MAC addresses.
dynamic address
mac-addr
dynamic interface
interface-id
dynamic vlan vlan-id (Optional) Delete all dynamic MAC addresses for the specified VLAN. The
notification Clear the notifications in the history table and reset the counters.
Release Modification
12.1(14)AX This command was introduced.
Switch# clear mac address-table dynamic address 0008.0070.0007
(Optional) Delete the specified dynamic MAC address.
(Optional) Delete all dynamic MAC addresses on the specified physical port
or port channel.
range is 1 to 4094.
Related Commands
OL-9645-10
You can verify that the information was deleted by entering the show mac address-table privileged
EXEC command.
Command Description
mac address-table notification Enables the MAC address notification feature.
show mac address-table Displays the MAC address table static and dynamic entries.
show mac address-table notification Displays the MAC address notification settings for all
interfaces or the specified interface.
snmp trap mac-notification change Enables the Simple Network Management Protocol (SNMP)
MAC address notification trap on a specific interface.
Catalyst 3750 Metro Switch Command Reference
2-49
Page 78
clear mac address-table move update
clear mac address-table move update
Use the clear mac address-table move update privileged EXEC command to clear the mac
address-table-move update-related counters.
clear mac address-table move update
Syntax Description This command has no arguments or keywords.
Defaults No default is defined.
Command Modes Privileged EXEC
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command History
Examples This example shows how to clear the mac address-table move update related counters.
Related Commands
Release Modification
12.2(25)SED This command was introduced.
Switch# clear mac address-table move update
You can verify that the information was cleared by entering the show mac address-table move update
privileged EXEC command.
Command Description
mac address-table move update Configures MAC address-table move update on the switch.
show mac address-table move update Displays the MAC address-table move update information on
the switch.
2-50
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 79
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear pagp
Use the clear pagp privileged EXEC command to clear Port Aggregation Protocol (PAgP)
channel-group information.
clear pagp {channel-group-number counters | counters}
clear pagp
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines You can clear all counters by using the clear pagp counters command, or you can clear only the counters
Examples This example shows how to clear all channel-group information:
channel-group-number (Optional) Channel group number. The range is 1 to 12.
counters Clear traffic counters.
Release Modification
12.1(14)AX This command was introduced.
for the specified channel group by using the clear pagp channel-group-number counters command.
Switch# clear pagp counters
Related Commands
OL-9645-10
This example shows how to clear PAgP traffic counters for group 10:
Switch# clear pagp 10 counters
You can verify that information was deleted by entering the show pagp privileged EXEC command.
Command Description
show pagp Displays PAgP channel-group information.
Catalyst 3750 Metro Switch Command Reference
2-51
Page 80
clear rep counters
clear rep counters
Use the clear rep counters privileged EXEC command to clear Resilient Ethernet Protocol (REP)
counters for the specified interface or all interfaces.
clear rep counters [interface interface-id]
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines You can clear all REP counters by using the clear rep counters command, or you can clear only the
Examples This example shows how to clear all REP counters for all REP interfaces:
interface interface-id (Optional) Specify a REP interface whose counters should be cleared.
Release Modification
122(46)SE This command was introduced.
counters for the interface by using the clear rep counters interface interface-id command.
When you enter the clear rep counters command, only the counters visible in the output of the show
interface rep detail command are cleared. SNMP visible counters are not cleared as they are read-only.
Switch# clear rep counters
Related Commands
Catalyst 3750 Metro Switch Command Reference
2-52
You can verify that REP information was deleted by entering the show interfaces rep detail privileged
EXEC command.
Command Description
show interfaces rep detail Displays detailed REP configuration and status information.
OL-9645-10
Page 81
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear spanning-tree counters
Use the clear spanning-tree counters privileged EXEC command to clear the spanning-tree counters.
clear spanning-tree counters [interface interface-id]
clear spanning-tree counters
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines If the interface-id is not specified, spanning-tree counters are cleared for all interfaces.
Examples This example shows how to clear spanning-tree counters for all interfaces:
interface interface-id (Optional) Clear all spanning-tree counters on the specified interface. Valid
interfaces include physical ports, VLANs, and port channels. The VLAN
range is 1 to 4094. The port-channel range is 1 to 12.
Release Modification
12.1(14)AX This command was introduced.
Switch# clear spanning-tree counters
Related Commands
OL-9645-10
Command Description
show spanning-tree Displays spanning-tree state information.
Catalyst 3750 Metro Switch Command Reference
2-53
Page 82
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear spanning-tree detected-protocols
clear spanning-tree detected-protocols
Use the clear spanning-tree detected-protocols privileged EXEC command to restart the protocol
migration process (force the renegotiation with neighboring switches) on all interfaces or on the
specified interface.
clear spanning-tree detected-protocols [interface interface-id]
Syntax Description
Defaults No default is defined.
Command Modes Privileged EXEC
Command History
Usage Guidelines A switch running the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol or the Multiple
interface interface-id (Optional) Restart the protocol migration process on the specified interface.
Valid interfaces include physical ports, VLANs, and port channels. The
VLAN range is 1 to 4094. The port-channel range is 1 to 12.
Release Modification
12.1(14)AX This command was introduced.
Spanning Tree Protocol (MSTP) supports a built-in protocol migration mechanism that enables it to
interoperate with legacy 802.1D switches. If a rapid-PVST+ switch or an MSTP switch receives a legacy
802.1D configuration bridge protocol data unit (BPDU) with the protocol version set to 0, it sends only
802.1D BPDUs on that interface. A multiple spanning-tree (MST) switch can also detect that an interface
is at the boundary of a region when it receives a legacy BPDU, an MST BPDU (version 3) associated
with a different region, or a rapid spanning-tree (RST) BPDU (version 2).
However, the switch does not automatically revert to the rapid-PVST+ or the MSTP mode if it no longer
receives 802.1D BPDUs. It cannot detect whether the legacy switch has been removed from the link
unless the legacy switch is the designated switch. Use the clear spanning-tree detected-protocols
command in this situation.
Examples This example shows how to restart the protocol migration process on a port:
Switch# clear spanning-tree detected-protocols interface gigabitethernet1/0/1
Related Commands
Catalyst 3750 Metro Switch Command Reference
2-54
Command Description
show spanning-tree Displays spanning-tree state information.
spanning-tree link-type Overrides the default link-type setting and enables rapid spanning-tree
transitions to the forwarding state.
OL-9645-10
Page 83
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
clear vmps statistics
Use the clear vmps statistics privileged EXEC command to clear the statistics maintained by the VLAN
Query Protocol (VQP) client.
clear vmps statistics
Syntax Description This command has no arguments or keywords.
Defaults No default is defined.
Command Modes Privileged EXEC
clear vmps statistics
Command History
Examples This example shows how to clear VLAN Membership Policy Server (VMPS) statistics:
Related Commands
Release Modification
12.1(14)AX This command was introduced.
Switch# clear vmps statistics
You can verify that information was deleted by entering the show vmps statistics privileged EXEC
command.
Command Description
show vmps Displays the VQP version, reconfirmation interval, retry count, VMPS IP
addresses, and the current and primary servers.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-55
Page 84
clear vtp counters
clear vtp counters
Use the clear vtp counters privileged EXEC command to clear the VLAN Trunking Protocol (VTP) and
pruning counters.
clear vtp counters
Syntax Description This command has no arguments or keywords.
Defaults No default is defined.
Command Modes Privileged EXEC
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Command History
Examples This example shows how to clear the VTP counters:
Related Commands
Release Modification
12.1(14)AX This command was introduced.
Switch# clear vtp counters
You can verify that information was deleted by entering the show vtp counters privileged EXEC
command.
Command Description
show vtp Displays general information about the VTP management domain, status,
and counters.
2-56
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 85
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
cpu traffic qos cos
Use the cpu traffic qos cos command in global configuration mode to mark the class of service (CoS)
value of CPU traffic. To return to the default value, use the no form of this command.
cpu traffic qos cos {cos-value | trust}
no cpu traffic qos cos {cos-value | trust}
cpu traffic qos cos
Syntax Description
Command Default Control plane (CPU) traffic is not marked for QoS.
Command Modes Global configuration
Command History
Usage Guidelines This feature must be configured globally for a switch; it cannot be configured per-port or per-protocol.
cos-value Specify a CoS value. The range is from 0 to 7. If no CoS value is configured,
the protocol specific value for each packet applies.
trust Configure the switch to trust the CoS value of the incoming packet.
Release Modification
12.2(52)SE This command was introduced.
Enter each cpu traffic qos marking action on a separate line.
The trust keyword configures the switch to trust the incoming CoS, DSCP, or precedence value and mark
the packet according to the global map configuration.
When you configure the switch to trust CoS, the configuration applies to both IP and non-IP traffic.
When you configure the switch to trust or change DSCP or precedence, but not CoS, the configuration
applies only to IP traffic.
When you configure the switch to trust CoS and trust or change DSCP or precedence, then trust CoS
applies to non-IP traffic and trust or change DSCP or precedence applies to IP traffic.
The cpu traffic qos cos global configuration command configures CoS marking for CPU-generated
traffic by either trusting CoS or specifying a CoS value, but not both. A new configuration overwrites
the existing configuration.
Examples This example shows how to specify a CoS value for CPU-generated IP traffic (including IP-SLA and
TWAMP):
Switch(config)# cpu traffic qos cos 2
This example shows how to configure the switch to trust the CoS value of the incoming packet:
Switch(config)# cpu traffic qos cos trust
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
2-57
Page 86
cpu traffic qos cos
Related Commands Command Description
cpu traffic qos dscp Configures the DSCP value for CPU-generated traffic.
cpu traffic qos
Configures the precedence for CPU-generated traffic.
precedence
mls qos map Configures a global map to set CoS, DSCP, and precedence values for
CPU-generated traffic.
show cpu traffic qos Displays the QoS marking values configured for CPU-generated traffic.
show mls qos maps Displays information for all global maps.
show running-config Displays the configured global maps and CPU traffic QoS settings.
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
2-58
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 87
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
cpu traffic qos dscp
Use the cpu traffic qos dscp command in global configuration mode to configure a differentiated
services code point (DSCP) value for CPU traffic. To return to the default value, use the no form of this
command.
cpu traffic qos dscp {dscp-value | trust | dscp-mutation mutation-map-name}
no cpu traffic qos dscp {dscp-value | trust | dscp-mutation mutation-map-name}
cpu traffic qos dscp
Syntax Description
Command Default Control plane (CPU) traffic is not marked for QoS.
Command Modes Global configuration
Command History
Usage Guidelines This feature must be configured globally for a switch; it cannot be configured per-port or per-protocol.
dscp-value Configure the DSCP value for CPU traffic. The range is from 0 to 63. If no
DSCP value is configured, the protocol specific value for each packet
applies.
trust Configure the switch to trust the DSCP value of the incoming packet.
dscp-mutation
mutation-map-name
Release Modification
12.2(52)SE This command was introduced.
Enter each cpu traffic qos marking action on a separate line.
The trust keyword configures the switch to trust the incoming CoS, DSCP, or precedence value and mark
the packet according to the global map configuration.
Configure the switch to change the incoming DSCP value based on the
configured mutation-map.
OL-9645-10
The mutation keyword configures the switch to change the incoming value according to the global
mutation-map configuration.
When you configure the switch to trust CoS, the configuration applies to both IP and non-IP traffic.
When you configure the switch to trust or change DSCP or precedence, but not CoS, the configuration
applies only to IP traffic.
When you configure the switch to trust CoS and trust or change DSCP or precedence, then trust CoS
applies to non-IP traffic and trust or change DSCP or precedence applies to IP traffic.
The cpu traffic qos dscp global configuration command configures DSCP marking for CPU-generated
traffic by trusting DSCP, mutating DSCP or specifying a DSCP value. A new configuration overwrites
the existing configuration.
The cpu traffic qos dscp and cpu traffic qos precedence global configuration commands are mutually
exclusive. A new configuration overwrites the existing configuration.
Catalyst 3750 Metro Switch Command Reference
2-59
Page 88
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
cpu traffic qos dscp
Examples This example shows how to configure the DSCP value of CPU-generated packets:
Switch(config)# cpu traffic qos dscp 36
This example shows how to configure the switch to trust the DSCP value of incoming CPU-generated
packets:
Switch(config)# cpu traffic qos dscp trust
This example shows how to mark the DSCP of CPU-generated IP traffic (including IP-SLA and
TWAMP) based on the DSCP value in the packet.
The example has these results:
• All IP traffic with the DSCP value 0 is assigned DSCP value 30.
• All IP traffic with the DSCP values af41 (34), af42 (36) and af43 (38) are assigned DSCP value 48.
• All other IP and non-IP traffic is processed by the default configuration.
Maps:
Switch(config)# mls qos
Switch(config)# mls qos map dscp-mutation mapname 0 to 30
Switch(config)# mls qos map dscp-mutation mapname 34 36 38 to 48
CPU QoS:
Switch(config)# cpu traffic qos dscp dscp-mutation mapname
Related Commands Command Description
cpu traffic qos cos Configures the CoS value for CPU-generated traffic.
cpu traffic qos
Configures the precedence for CPU-generated traffic.
precedence
mls qos map Configures a global map to set CoS, DSCP, and precedence values for
CPU-generated traffic.
show cpu traffic qos Displays the QoS marking values configured for CPU-generated traffic.
show mls qos maps Displays information for all global maps.
show running-config Displays the configured global maps and CPU traffic QoS settings.
2-60
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 89
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
cpu traffic qos precedence
Use the cpu traffic qos precedence command in global configuration mode to configure quality of
service (QoS) marking for control plane traffic. To return to the default value, use the no form of this
command.
cpu traffic qos precedence {precedence-value | trust | precedence-mutation
mutation-map-name}
no cpu traffic qos precedence {precedence-value | trust | precedence-mutation
mutation-map-name}
cpu traffic qos precedence
Syntax Description
precedence-value Configure the precedence value. The range is from 0 to 7. If no precedence
value is configured, the protocol specific value for each packet applies.
Note You can substitute the following keywords for the numbers 0 to 7:
• routine (0)
• priority (1)
• immediate (2)
• flash (3)
• flash-override (4)
• critical (5)
• internet (6)
• network (7)
trust Configure the switch to trust the precedence value of the incoming packet.
precedence-mutation
mutation-map-name
Configure the switch to change the incoming precedence value based on the
configured mutation-map.
Command Default Control plane (CPU) traffic is not marked for QoS.
Command Modes Global configuration
Command History
Release Modification
12.2(52)SE This command was introduced.
Usage Guidelines This feature must be configured globally for a switch; it cannot be configured per-port or per-protocol.
Enter each cpu traffic qos marking action on a separate line.
The trust keyword configures the switch to trust the incoming CoS, DSCP, or precedence value and mark
the packet according to the global map configuration.
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
2-61
Page 90
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
cpu traffic qos precedence
The mutation keyword configures the switch to change the incoming value according to the global
mutation-map configuration.
When you configure the switch to trust CoS, the configuration applies to both IP and non-IP traffic.
When you configure the switch to trust or change DSCP or precedence but not CoS, the configuration
applies only to IP traffic.
When you configure the switch to trust CoS and trust or change DSCP or precedence, then trust CoS
applies to non-IP traffic and trust or change DSCP or precedence applies to IP traffic.
The cpu traffic qos precedence global configuration command configures precedence marking for
CPU-generated traffic by trusting precedence, mutating precedence or specifying a precedence value. A
new configuration overwrites the existing configuration.
The cpu traffic qos dscp and cpu traffic qos precedence global configuration commands are mutually
exclusive. A new configuration overwrites the existing configuration.
Examples The following example shows how to configure a precedence value of 2 for CPU traffic:
Switch(config)# cpu traffic qos precedence 2
This example shows how to configure the switch to trust the precedence value of incoming
CPU-generated packets:
Switch(config)# cpu traffic qos precedence trust
This example shows how to mark the precedence of CPU-generated IP traffic (including IP-SLA and
TWAMP) based on the precedence value in the packet.
The example has these results:
• All CPU generated IP traffic with the precedence value 0 is assigned precedence value 3.
• All CPU generated IP traffic with the precedence values 2, 3 and 4 is assigned precedence value 6.
• All other IP and non-IP traffic is processed by the default configuration.
Maps:
Switch(config)# mls qos
Switch(config)# mls qos map dscp-mutation mapname 0 to 24
Switch(config)# mls qos map dscp-mutation mapname 16 24 32 to 48
CPU QoS:
Switch(config)# cpu traffic qos precedence precedence-mutation mapname
Related Commands Command Description
cpu traffic qos cos Configures the CoS value for CPU-generated traffic.
cpu traffic qos dscp Configures the DSCP value for CPU-generated traffic.
mls qos map Configures a global map to set CoS, DSCP, and precedence values for
CPU-generated traffic.
show cpu traffic qos Displays the QoS marking values configured for CPU-generated traffic.
show mls qos maps Displays information for all global maps.
show running-config Displays the configured global maps and CPU traffic QoS settings.
2-62
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 91
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
define interface-range
Use the define interface-range global configuration command to create an interface-range macro. Use
the no form of this command to delete the defined macro.
define interface-range macro-name interface-range
no define interface-range macro-name
define interface-range
Syntax Description
macro-name Name of the interface-range macro; up to 32 characters.
interface-range Interface range; for valid values for interface ranges, see “Usage Guidelines.”
Defaults This command has no default setting.
Command Modes Global configuration
Command History
Release Modification
12.1(14)AX This command was introduced.
Usage Guidelines The macro name is a 32-character maximum character string.
A macro can contain up to five ranges.
All interfaces in a range must be the same type; that is, all Fast Ethernet ports, all Gigabit Ethernet ports,
all EtherChannel ports, or all VLANs, but you can combine multiple interface types in a macro.
When entering the interface-range, use this format:
• type {first-interface} - {last-interface}
• You must add a space between the first interface number and the hyphen when entering an
interface-range. For example, fastethernet1/0/1
-5 is a valid range; fastethernet1/0/1-5 is not a
valid range.
Valid values for type and interface:
OL-9645-10
• vlan vlan-id, where vlan-id is from 1 to 4094
VLAN interfaces must have been configured with the interface vlan command. The show
running-config privileged EXEC command displays the configured VLAN interfaces. VLAN
interfaces not displayed by the show running-config command cannot be used in interface-ranges.
• port-channel port-channel-number, where port-channel-number is from 1 to 12
• fastethernet switch number (always 1)/module/{first port} - {last port}
• gigabitethernet switch number (always 1)/module/{first port} - {last port}
For physical interfaces:
• switch number is always 1.
Catalyst 3750 Metro Switch Command Reference
2-63
Page 92
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
define interface-range
• module number is 0 for 10/100 ports and standard SFP module slots; 1 for enhanced-services (ES)
ports.
• the range is type 1/module-number/number - number (for example, gigabitethernet 1/0/1 - 2)
When you define a range, you must enter a space before the hyphen (-), for example:
gigabitethernet1/0/1 - 2
You can also enter multiple ranges. When you define multiple ranges, you must enter a space after the
first entry before the comma
fastethernet1/0/3, gigabitethernet1/0/1 - 2
fastethernet1/0/3 -4, gigabitethernet1/0/1 - 2
Examples This example shows how to create a multiple-interface macro:
Switch(config)# define interface-range macro1 fastethernet1/0/1 -2, fastethernet1/0/5
Related Commands Command Description
interface range Executes a command on multiple ports at the same time.
show running-config Displays the operating configuration. For syntax information, use this
(,). The space after the comma is optional, for example:
link to the Cisco IOS Release 12.2 Command Reference listing page:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/prod_com
mand_reference_list.html
Select the Cisco IOS Commands Master List, Release 12.2 to
navigate to the command.
2-64
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 93
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
delete
Use the delete privileged EXEC command to delete a file or directory on the flash memory device.
delete [/force] [/recursive] filesystem:/file-url
delete
Syntax Description
Command Modes Privileged EXEC
Command History
Usage Guidelines If you use the /force keyword, you are prompted once at the beginning of the deletion process to confirm
/force (Optional) Suppress the prompt that confirms the deletion.
/recursive (Optional) Delete the named directory and all subdirectories and the files
contained in it.
filesystem: Alias for a flash file system.
The syntax for the local flash file system: flash:
/file-url The path (directory) and filename to delete.
Release Modification
12.1(14)AX This command was introduced.
the deletion.
If you use the /recursive keyword without the /force keyword, you are prompted to confirm the deletion
of every file.
The prompting behavior depends on the setting of the file prompt global configuration command. By
default, the switch prompts for confirmation on destructive file operations. For more information about
this command, see the Cisco IOS Command Reference for Release 12.2.
Examples This example shows how to remove the directory that contains the old software image after a successful
download of a new image:
Switch# delete /force /recursive flash:/old-image
You can verify that the directory was removed by entering the dir filesystem: privileged EXEC
command.
Related Commands
OL-9645-10
Command Description
archive download-sw Downloads a new image to the switch and overwrites or keeps the existing
image.
Catalyst 3750 Metro Switch Command Reference
2-65
Page 94
deny (ARP access-list configuration)
deny (ARP access-list configuration)
Use the deny Address Resolution Protocol (ARP) access-list configuration command on the switch to
deny an ARP packet based on matches against the DHCP bindings. Use the no form of this command to
remove the specified access control entry (ACE) from the access list.
deny {[request] ip {any | host sender-ip | sender-ip sender-ip-mask} mac {any | host sender-mac
| sender-mac sender-mac-mask} | response ip {any | host sender-ip | sender-ip sender-ip-mask}
[{any | host target-ip | target-ip target-ip-mask}] mac {any | host sender-mac | sender-mac
sender-mac-mask} [{any | host target-mac | target-mac target-mac-mask}]} [log]
no deny {[request] ip {any | host sender-ip | sender-ip sender-ip-mask} mac {any | host
sender-mac | sender-mac sender-mac-mask} | response ip {any | host sender-ip | sender-ip
sender-ip-mask} [{any | host target-ip | target-ip target-ip-mask}] mac {any | host sender-mac
| sender-mac sender-mac-mask} [{any | host target-mac | target-mac target-mac-mask}]} [log]
This command is available only if your switch is running the enhanced multilayer image (EMI).
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Syntax Description
request (Optional) Define a match for the ARP request. When request is not
specified, matching is performed against all ARP packets.
ip Specify the sender IP address.
any Deny any IP or MAC address.
host sender-ip Deny the specified sender IP address.
sender-ip sender-ip-mask Deny the specified range of sender IP addresses.
mac Deny the sender MAC address.
host sender-mac Deny a specific sender MAC address.
sender-mac
sender-mac-mask
response ip Define the IP address values for the ARP responses.
host target-ip Deny the specified target IP address.
target-ip target-ip-mask Deny the specified range of target IP addresses.
mac Deny the MAC address values for the ARP responses.
host target-mac Deny the specified target MAC address.
target-mac
target-mac-mask
log (Optional) Log a packet when it matches the ACE.
Deny the specified range of sender MAC addresses.
Deny the specified range of target MAC addresses.
Defaults There are no default settings. However, at the end of the ARP access list, there is an implicit deny ip any
mac any command.
Command Modes ARP access-list configuration
Catalyst 3750 Metro Switch Command Reference
2-66
OL-9645-10
Page 95
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
deny (ARP access-list configuration)
Command History
Release Modification
12.2(25)EY This command was introduced.
Usage Guidelines You can add deny clauses to drop ARP packets based on matching criteria.
Examples This example shows how to define an ARP access list and to deny both ARP requests and ARP responses
from a host with an IP address of 1.1.1.1 and a MAC address of 0000.0000.abcd:
Switch(config)# arp access-list static-hosts
Switch(config-arp-nacl)# deny ip host 1.1.1.1 mac host 0000.0000.abcd
Switch(config-arp-nacl)# end
You can verify your settings by entering the show arp access-list privileged EXEC command.
Related Commands
Command Description
arp access-list Defines an ARP access control list (ACL).
ip arp inspection filter vlan Permits ARP requests and responses from a host configured with a
static IP address.
permit (MAC-access list
Permits an ARP packet based on matches against the DHCP bindings.
configuration)
show arp access-list Displays detailed information about ARP access lists.
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-67
Page 96
deny (IPv6 access-list configuration)
deny (IPv6 access-list configuration)
Use the deny command in IPv6 access list configuration mode to set deny conditions for an IPv6 access
list. Use the no form of this command to remove the deny conditions.
deny {protocol} {source-ipv6-prefix/prefix-length | any | host source-ipv6-address} [operator
[port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address}
[operator [port-number]] [dscp value] [fragments] [log] [log-input] [routing] [sequence
value] [time-range name]
no deny {protocol} {source-ipv6-prefix/prefix-length | any | host source-ipv6-address} [operator
[port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address}
[operator [port-number]] [dscp value] [fragments] [log] [log-input] [routing] [sequence
value] [time-range name]
Internet Control Message Protocol
deny icmp {source-ipv6-prefix/prefix-length | any | host source-ipv6-address} [operator
[port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address}
[operator [port-number]] [icmp-type [icmp-code] | icmp-message] [dscp value] [log]
[log-input] [routing] [sequence value] [time-range name]
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
Transmission Control Protocol
deny tcp {source-ipv6-prefix/prefix-length | any | host source-ipv6-address} [operator
[port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address}
[operator [port-number]] [ack] [dscp value] [established] [fin] [log] [log-input] [neq {port |
protocol}] [psh] [range {port | protocol}] [rst] [routing] [sequence value] [syn] [time-range
name] [urg]
User Datagram Protocol
deny udp {source-ipv6-prefix/prefix-length | any | host source-ipv6-address} [operator
[port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address}
[operator [port-number]] [dscp value] [log] [log-input] [neq {port | protocol}] [range {port |
protocol}] [routing] [sequence value] [time-range name]
Note This command is available only if you have configured a dual IPv4 and IPv6 Switch Database
Management (SDM) template on the switch.
Syntax Description protocol Name or number of an Internet protocol. It can be one of the keywords ahp,
esp, icmp, ipv6, pcp, sctp, tcp, or udp, or an integer in the range from 0
255
representing an IPv6 protocol number.
source-ipv6-prefix/prefixlength
any An abbreviation for the IPv6 prefix ::/0.
The source IPv6 network or class of networks about which to set deny
conditions.
This argument must be in the form documented in RFC 2373 where the
address is specified in hexadecimal using 16-bit values between colons.
to
2-68
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Page 97
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
host source-ipv6-address The source IPv6 host address for which to set deny conditions.
operator [port-number] (Optional) Specify an operator that compares the source or destination
destination-ipv6-prefix/
prefix-length
host
destination-ipv6-address
dscp value (Optional) Match a differentiated services code point value against the
fragments (Optional) Match non-initial fragmented packets where the fragment
log (Optional) Send an informational logging message to the console about the
deny (IPv6 access-list configuration)
This source-ipv6-address argument must be in the form documented in
RFC 2373 where the address is specified in hexadecimal using 16-bit
values between colons.
ports of the specified protocol. Operators are lt (less than), gt (greater
than), eq (equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source-ipv6-prefix/prefix-length
argument, it must match the source port.
If the operator is positioned after the destination-ipv6-prefix/prefix-length
argument, it must match the destination port.
The range operator requires two port numbers. All other operators require
one port number.
The optional port-number argument is a decimal number or the name of a
TCP or a UDP port. A port number is a number from 0 to 65535. TCP port
names can be used only when filtering TCP. UDP port names can be used
only when filtering UDP.
The destination IPv6 network or class of networks for which to set deny
conditions.
This argument must be in the form documented in RFC 2373 where the
address is specified in hexadecimal using 16-bit values between colons.
The destination IPv6 host address for which to set deny conditions.
This destination-ipv6-address argument must be in the form documented
in RFC 2373 where the address is specified in hexadecimal using 16-bit
values between colons.
traffic class value in the Traffic Class field of each IPv6 packet header. The
acceptable range is from 0 to 63.
extension header contains a non-zero fragment offset. The fragments
keyword is an option only if the protocol is ipv6 and the operator
[port-number] arguments are not specified.
packet that matches the entry. (The level of messages sent to the console is
controlled by the logging console command.)
OL-9645-10
The message includes the access list name and sequence number, whether
the packet was denied; the protocol, wh e t h e r i t wa s T C P, U D P, I C MP, o r a
number; and, if appropriate, the source and destination addresses and
source and destination port numbers. The message is generated for the first
packet that matches, and then at 5-minute intervals, including the number
of packets denied in the prior 5-minute interval.
Note Logging is not supported for port ACLs.
log-input (Optional) Provide the same function as the log keyword, but the logging
message also includes the receiving interface.
routing (Optional) Match packets with the routing extension header.
Catalyst 3750 Metro Switch Command Reference
2-69
Page 98
deny (IPv6 access-list configuration)
sequence value (Optional) Specify the sequence number for the access list statement. The
time-range name (Optional) Specify the time range that applies to the deny statement. The
icmp-type (Optional) Specify an ICMP message type for filtering ICMP packets.
icmp-code (Optional) Specify an ICMP message code for filtering ICMP packets.
icmp-message (Optional) Specify an ICMP message name for filtering ICMP packets.
ack (Optional) Only for the TCP protocol: Acknowledgment (ACK) bit set.
established (Optional) Only for the TCP protocol: Means the connection has been
fin (Optional) Only for the TCP protocol: Fin bit set; no more data from
neq {port | protocol} (Optional) Match only packets that are not on a given port number.
psh (Optional) Only for the TCP protocol: Push function bit set.
range {port | protocol} (Optional) Match only packets in the range of port numbers.
rst (Optional) Only for the TCP protocol: Reset bit set.
syn (Optional) Only for the TCP protocol: Synchronize bit set.
urg (Optional) Only for the TCP protocol: Urgent pointer bit set.
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
acceptable range is from 1 to 4294967295.
name of the time range and its restrictions are specified by the time-range
and absolute or periodic commands, respectively.
ICMP packets can be filtered by an ICMP message type. The type is a
number from 0 to 255.
ICMP packets that are filtered by ICMP message type can also be filtered
by the ICMP message code. The code is a number from 0 to 255.
ICMP packets can be filtered by an ICMP message name or an ICMP
message type and code. The possible names are listed in the “Usage
Guidelines” section.
established. A match occurs if the TCP datagram has the ACK or RST bits
set. The nonmatching case is that of the initial TCP datagram to form a
connection.
sender.
Note Although visible in the command-line help strings, the flow-label, routing, and
undetermined-transport keywords are not supported.
Defaults No IPv6 access list is defined.
Command Modes IPv6 access list configuration
Command History
Release Modification
12.2(52)SE This command was introduced.
Catalyst 3750 Metro Switch Command Reference
2-70
OL-9645-10
Page 99
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
deny (IPv6 access-list configuration)
Usage Guidelines The deny (IPv6 access-list configuration mode) command is similar to the deny (IPv4 access-list
configuration mode) command, but it is IPv6-specific.
Use the deny (IPv6) command after the ipv6 access-list command to enter IPv6 access list configuration
mode and to define the conditions under which a packet passes the access list.
Specifying IPv6 for the protocol argument matches the IPv6 header of the packet.
By default, the first statement in an access list is number 10, and the subsequent statements are numbered
in increments of 10.
You can add permit, deny, or remark statements to an existing access list without re-entering the entire
list. To add a new statement somewhere other than at the end of the list, create a new statement with an
appropriate entry number between two existing entry numbers to show where it belongs.
Note Every IPv6 ACL has implicit permit icmp any any nd-na, permit icmp any any nd-ns, and deny ipv6
any any statements as its last match conditions. The two permit conditions allow ICMPv6 neighbor
discovery. To disallow ICMPv6 neighbor discovery and to deny icmp any any nd-na or icmp any any
nd-ns, there must be an explicit deny entry in the ACL. For the three implicit statements to take effect,
an IPv6 ACL must contain at least one entry.
The IPv6 neighbor discovery process uses the IPv6 network layer service. Therefore, by default, IPv6
ACLs implicitly allow IPv6 neighbor discovery packets to be sent and received on an interface. In IPv4,
the Address Resolution Protocol (ARP), which is equivalent to the IPv6 neighbor discovery process, uses
a separate data-link layer protocol. Therefore, by default, IPv4 ACLs implicitly allow ARP packets to
be sent and received on an interface.
Both the source-ipv6-prefix/prefix-length and destination-ipv6-prefix/prefix-length arguments are used
for traffic filtering. (The source prefix filters traffic based upon its source; the destination prefix filters
traffic based upon its destination.)
The switch supports IPv6 address matching for a full range of prefix lengths.
The fragments keyword is an option only if the protocol is ipv6 and the operator [port-number]
arguments are not specified.
This is a list of ICMP message names:
beyond-scope destination-unreachable
echo-reply echo-request
header hop-limit
mld-query mld-reduction
mld-report nd-na
nd-ns next-header
no-admin no-route
packet-too-big parameter-option
parameter-problem port-unreachable
reassembly-timeout renum-command
renum-result renum-seq-number
router-advertisement router-renumbering
OL-9645-10
Catalyst 3750 Metro Switch Command Reference
2-71
Page 100
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
deny (IPv6 access-list configuration)
router-solicitation time-exceeded
unreachable
Examples This example configures the IPv6 access list named CISCO and applies the access list to outbound traffic
on a Layer 3 interface. The first deny entry prevents all packets that have a destination TCP port number
greater than 5000 from leaving the interface. The second deny entry prevents all packets that have a
source UDP port number less than 5000 from leaving the interface. The second deny also logs all
matches to the console. The first permit entry permits all ICMP packets to leave the interface. The second
permit entry permits all other traffic to leave the interface. The second permit entry is necessary because
an implicit deny-all condition is at the end of each IPv6 access list.
Switch(config)# ipv6 access-list CISCO
Switch(config-ipv6-acl)# deny tcp any any gt 5000
Switch config-ipv6-acl)# deny ::/0 lt 5000 ::/0 log
Switch(config-ipv6-acl)# permit icmp any any
Switch(config-ipv6-acl)# permit any any
Switch(config-ipv6-acl)# exit
Switch(config)# interface gigabitethernet0/2
Switch(config-if)# no switchport
Switch(config-if)# ipv6 address 2001::/64 eui-64
Switch(config-if)# ipv6 traffic-filter CISCO out
Related Commands
Command Description
ipv6 access-list Defines an IPv6 access list and enters IPv6 access list configuration mode.
ipv6 traffic-filter Filters incoming or outgoing IPv6 traffic on an interface.
permit (IPv6
Sets permit conditions for an IPv6 access list.
access-list
configuration)
show ipv6 access-list Displays the contents of all current IPv6 access lists.
2-72
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Loading...