Cisco HWIC-4ESW, HWIC-D-9ESW User Manual

Cisco HWIC-4ESW and HWIC-D-9ESW
EtherSwitch Interface Cards

First Published: May 17, 2005
Last Updated: April 15, 2006

This document provides configuration tasks for the 4-port Cisco HWIC-4ESW and the 9-port
Cisco HWIC-D-9ESW EtherSwitch high-speed WAN interface cards (HWICs) hardware feature
supported on Cisco 1800 (modular), Cisco 2800, and Cisco 3800 series integrated services routers.

Cisco EtherSwitch HWICs are 10/100BASE-T Layer 2 Ethernet switches with Layer 3 routing
capability. (Layer 3 routing is forwarded to the host and is not actually performed at the switch.) Traffic
between different VLANs on a switch is routed through the router platform. Any one port on a
Cisco EtherSwitch HWIC may be configured as a stacking port to link to another Cisco EtherSwitch
HWIC or EtherSwitch network module in the same system. An optional power module can also be added
to provide inline power for IP telephones. The HWIC-D-9ESW HWIC requires a double-wide card slot.

This hardware feature does not introduce any new or modified Cisco IOS commands.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all of the features documented in this module. To reach
links to specific feature documentation in this module and to see a list of the releases in which each feature is
supported, use the “Feature Information for the Cisco HWIC-4ESW and the Cisco HWIC-D-9ESW

EtherSwitch Cards” section on page 117.

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image
support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on
Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at
the login dialog box and follow the instructions that appear.

Corporate Headquarters:
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA

© 2006 Cisco Systems, Inc. All rights reserved.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Contents

Contents

The following sections provide information about the Cisco EtherSwitch HWICs.

• Prerequisites for EtherSwitch HWICs, page 2

• Restrictions for EtherSwitch HWICs, page 2

• Information About EtherSwitch HWICs, page 3

• How to Configure EtherSwitch HWICs, page 5

• Configuration Examples for EtherSwitch HWICs, page 106

• Additional References, page 116

• Command Reference, page 117

Prerequisites for EtherSwitch HWICs

The following are prerequisites to configuring EtherSwitch HWICs:

• Configuration of IP routing. (Refer to the Cisco IOS IP Configuration Guide.)

• Use of the Cisco IOS T release, beginning with Release 12.3(8)T4 or later for Cisco HWIC-4ESW

and Cisco HWIC-D-9ESW support. (Refer to the Cisco IOS documentation.)

Restrictions for EtherSwitch HWICs

The following restrictions apply to the Cisco HWIC-4ESW and the Cisco HWIC-D-9ESW EtherSwitch
HWICs:

• No more than two Ethernet Switch HWICs or network modules may be installed in a host router.

Multiple Ethernet Switch HWICs or network modules installed in a host router will not act
independently of each other. They must be stacked, as they will not work at all otherwise.

• The ports of a Cisco EtherSwitch HWIC must NOT be connected to the Fast Ethernet/Gigabit

onboard ports of the router.

• There is no inline power on the ninth port (port 8) of the HWIC-D-9ESW card.

• There is no Auto MDIX support on the ninth port (port 8) of the HWIC-D-9ESW card when either

speed or duplex is not set to auto.

• There is no support for online insertion/removal (OIR) of the EtherSwitch HWICs.

• When Ethernet Switches have been installed and configured in a host router, OIR of the

CompactFlash memory card in the router must not occur. OIR of the CompactFlash memory card
will compromise the configuration of the Ethernet Switches.

• VTP pruning is not supported.

• There is a limit of 200 secure MAC addresses per module that can be supported by an EtherSwitch

HWIC.

Book Title

2

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Prerequisites for Installing Two Ethernet Switch Network Modules in a Single Chassis

Prerequisites for Installing Two Ethernet Switch Network
Modules in a Single Chassis

A maximum of two Ethernet switch network modules can be installed in a single chassis. If two Ethernet
switch network modules of any type are installed in the same chassis, the following configuration
requirements must be met:

• Both Ethernet switch network modules must have an optional Gigabit Ethernet expansion board

installed.

• An Ethernet crossover cable must be connected to the two Ethernet switch network modules using

the optional Gigabit Ethernet expansion board ports.

• Intrachassis stacking for the optional Gigabit Ethernet expansion board ports must be configured.

For information about intrachassis stacking configuration, see the 16- and 36-Port Ethernet Switch
Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 series feature document.

Note Without this configuration and connection, duplications will occur in the VLAN databases, and

unexpected packet handling may occur.

Information About EtherSwitch HWICs

To configure the Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch HWICs, you should understand the
following concepts:

• VLANs, page 3

• Inline Power for Cisco IP Phones, page 4

• Layer 2 Ethernet Switching, page 4

• 802.1x Authentication, page 4

• Spanning Tree Protocol, page 4

• Cisco Discovery Protocol, page 4

• Switched Port Analyzer, page 4

• IGMP Snooping, page 4

• Storm Control, page 5

• Intrachassis Stacking, page 5

• Fallback Bridging, page 5

VLANs

For information on the concept of VLANs, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1047027

Book Title

3

Information About EtherSwitch HWICs

Inline Power for Cisco IP Phones

For information on the concept of inline power for Cisco IP phones, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1048439

Layer 2 Ethernet Switching

For information on the concept of Layer 2 Ethernet switching, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1048478

802.1x Authentication

For information on the concept of 802.1x authentication, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1051006

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Spanning Tree Protocol

For information on the concept of Spanning Tree Protocol, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1048458

Cisco Discovery Protocol

For information on the concept of the Cisco Discovery Protocol, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1048498

Switched Port Analyzer

For information on the concept of switched port analyzer, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1053663

IGMP Snooping

For information on the concept of IGMP snooping, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1053727

Book Title

4

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Storm Control

For information on the concept of storm control, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1051018

Intrachassis Stacking

For information on the concept of intrachassis stacking, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1051061

Fallback Bridging

For information on the concept of fallback bridging, refer to the material at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_4/gt1636nm.ht
m#1054833

How to Configure EtherSwitch HWICs

How to Configure EtherSwitch HWICs

See the following sections for configuration tasks for the EtherSwitch HWICs.

• Configuring VLANs, page 6

• Configuring VLAN Trunking Protocol, page 10

• Configuring Layer 2 Interfaces, page 13

• Configuring 802.1x Authentication, page 23

• Configuring Spanning Tree, page 35

• Configuring MAC Table Manipulation, page 46

• Configuring Cisco Discovery Protocol, page 50

• Configuring the Switched Port Analyzer (SPAN), page 53

• Configuring Power Management on the Interface, page 56

• Configuring IP Multicast Layer 3 Switching, page 57

• Configuring IGMP Snooping, page 61

• Configuring Per-Port Storm Control, page 68

• Configuring Stacking, page 71

• Configuring Fallback Bridging, page 73

• Configuring Separate Voice and Data Subnets, page 89

• Managing the EtherSwitch HWIC, page 92

Book Title

5

How to Configure EtherSwitch HWICs

Configuring VLANs

This section describes how to configure VLANs on the switch and contains the following sections:

• Adding a VLAN Instance, page 6

• Deleting a VLAN Instance from the Database, page 8

Adding a VLAN Instance

A total of 15 VLANs can be supported by an EtherSwitch HWIC.

Follow the steps below to configure a Fast Ethernet interface as Layer 2 access.

SUMMARY STEPS

1. enable

2. vlan database

3. vlan vlan_id

4. exit

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

vlan database

Example:

Router# vlan database

Step 3

vlan vlan_id

Example:

Router(vlan)# vlan 1

Step 4

exit

Example:

Router(vlan)# exit

Verifying the VLAN Configuration

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters VLAN configuration mode.

Adds an Ethernet VLAN.

Updates the VLAN database, propagates it throughout the
administrative domain, and returns to privileged EXEC mode.

You can verify the VLAN configuration in VLAN database mode.

Use the show command in VLAN database mode to verify the VLAN configuration, as shown below:

Router(vlan)# show

VLAN ISL Id: 1
Name: default

Book Title

6

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Media Type: Ethernet
VLAN 802.10 Id: 100001
State: Operational
MTU: 1500
Translational Bridged VLAN: 1002
Translational Bridged VLAN: 1003

VLAN ISL Id: 2
Name: VLAN0002
Media Type: Ethernet
VLAN 802.10 Id: 100002
State: Operational
MTU: 1500

VLAN ISL Id: 3
Name: Red_VLAN
Media Type: Ethernet
VLAN 802.10 Id: 100003
State: Operational
MTU: 1500

VLAN ISL Id: 1002
Name: fddi-default
Media Type: FDDI
VLAN 802.10 Id: 101002
State: Operational
MTU: 1500
Bridge Type: SRB
Translational Bridged VLAN: 1
Translational Bridged VLAN: 1003

How to Configure EtherSwitch HWICs

VLAN ISL Id: 1003
Name: token-ring-default
Media Type: Token Ring
VLAN 802.10 Id: 101003
State: Operational
MTU: 1500
Bridge Type: SRB
Ring Number: 0
Bridge Number: 1
Parent VLAN: 1005
Maximum ARE Hop Count: 7
Maximum STE Hop Count: 7
Backup CRF Mode: Disabled
Translational Bridged VLAN: 1
Translational Bridged VLAN: 1002

VLAN ISL Id: 1004
Name: fddinet-default
Media Type: FDDI Net
VLAN 802.10 Id: 101004
State: Operational
MTU: 1500
Bridge Type: SRB
Bridge Number: 1
STP Type: IBM

VLAN ISL Id: 1005
Name: trnet-default
Media Type: Token Ring Net
VLAN 802.10 Id: 101005
State: Operational
MTU: 1500
Bridge Type: SRB

Book Title

7

How to Configure EtherSwitch HWICs

Bridge Number: 1
STP Type: IBM

Router(vlan)# exit

APPLY completed.

Exiting....

Router#
Router#

Enter the show vlan-switch command in EXEC mode using the Cisco IOS CLI to verify the VLAN
configuration, as shown below.

Router# show vlan-switch

VLAN Name Status Ports

---- -------------------------------- --------- ---------------------------------­1 default active Fa0/1/1, Fa0/1/2, Fa0/1/3, Fa0/1/4
Fa0/1/5, Fa0/1/6, Fa0/1/7, Fa0/1/8
Fa0/3/0, Fa0/3/2, Fa0/3/3, Fa0/3/4
Fa0/3/5, Fa0/3/6, Fa0/3/7, Fa0/3/8
2 VLAN0002 active Fa0/1/0
3 Red_VLAN active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ -----­1 enet 100001 1500 - - - - - 1002 1003
2 enet 100002 1500 - - - - - 0 0
3 enet 100003 1500 - - - - - 0 0
1002 fddi 101002 1500 - - - - - 1 1003
1003 tr 101003 1500 1005 0 - - srb 1 1002
1004 fdnet 101004 1500 - - 1 ibm - 0 0
1005 trnet 101005 1500 - - 1 ibm - 0 0

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Router#

Deleting a VLAN Instance from the Database

You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or
Token Ring VLANs 1002 to 1005.

Follow the steps below to delete a VLAN from the database.

SUMMARY STEPS

1. enable

2. vlan database

3. no vlan vlan_id

4. exit

Book Title

8

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

vlan database

Example:

Router# vlan database

Step 3

no vlan vlan_id

Example:

Router(vlan)# no vlan 1

Step 4

exit

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters VLAN configuration mode.

Deletes an Ethernet VLAN.

Updates the VLAN database, propagates it throughout the
administrative domain, and returns to privileged EXEC mode.

Example:

Router(vlan)# exit

Verifying VLAN Deletion

You can verify that a VLAN has been deleted from the switch in VLAN database mode.

Use the show command in VLAN database mode to verify that a VLAN has been deleted from the
switch, as shown in the following output example:

Router(vlan)# show

VLAN ISL Id: 1
Name: default
Media Type: Ethernet
VLAN 802.10 Id: 100001
State: Operational
MTU: 1500
Translational Bridged VLAN: 1002
Translational Bridged VLAN: 1003

VLAN ISL Id: 1002
Name: fddi-default
Media Type: FDDI
VLAN 802.10 Id: 101002
State: Operational
MTU: 1500
Bridge Type: SRB
Translational Bridged VLAN: 1
Translational Bridged VLAN: 1003
<output truncated>

Router(vlan)#

Book Title

9

How to Configure EtherSwitch HWICs

Enter the show vlan-switch brief command in EXEC mode, using the Cisco IOS CLI to verify that a
VLAN has been deleted from the switch, as shown in the following output example:

Router# show vlan-switch brief

VLAN Name Status Ports

---- -------------------------------- --------- ------------------------------­1 default active Fa0/1/0, Fa0/1/1, Fa0/1/2
Fa0/1/3, Fa0/1/4, Fa0/1/5
Fa0/1/6, Fa0/1/7, Fa0/1/8
300 VLAN0300 active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
Router#

Configuring VLAN Trunking Protocol

This section describes how to configure the VLAN Trunking Protocol (VTP) on an EtherSwitch HWIC,
and contains the following tasks:

• Configuring a VTP Server, page 10

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

• Configuring a VTP Client, page 12

• Disabling VTP (VTP Transparent Mode), page 12

• Verifying VTP, page 13

Note VTP pruning is not supported by EtherSwitch HWICs.

Configuring a VTP Server

When a switch is in VTP server mode, you can change the VLAN configuration and have it propagate
throughout the network.

Follow the steps below to configure the switch as a VTP server.

SUMMARY STEPS

1. enable

2. vlan database

3. vtp server

4. vtp domain domain_name

5. vtp password password_value

6. exit

10

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

How to Configure EtherSwitch HWICs

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

enable

Example:

Router> enable

vlan database

Example:

Router# vlan database

vtp server

Example:

Router(vlan)# vtp server

vtp domain domain_name

Example:

Router(vlan)# vtp domain distantusers

vtp password password_value

Example:

Router(vlan)# vtp password philadelphis

exit

Example:

Router(vlan)# exit

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters VLAN configuration mode.

Configures the switch as a VTP server.

Defines the VTP domain name, which can be up to 32 characters
long.

(Optional) Sets a password, which can be from 8 to 64 characters
long, for the VTP domain.

Updates the VLAN database, propagates it throughout the
administrative domain, exits VLAN configuration mode, and
returns to privileged EXEC mode.

Book Title

11

How to Configure EtherSwitch HWICs

Configuring a VTP Client

When a switch is in VTP client mode, you cannot change the VLAN configuration on the switch. The
client switch receives VTP updates from a VTP server in the management domain and modifies its
configuration accordingly.

Follow the steps below to configure the switch as a VTP client.

SUMMARY STEPS

1. enable

2. vlan database

3. vtp client

4. exit

DETAILED STEPS

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Step 1

enable

Example:

Router> enable

Step 2

vlan database

Example:

Router# vlan database

Step 3

vtp client

Example:

Router(vlan)# vtp client

Step 4

exit

Example:

Router(vlan)# exit

Disabling VTP (VTP Transparent Mode)

When you configure the switch as VTP transparent, you disable VTP on the switch. A VTP transparent
switch does not send VTP updates and does not act on VTP updates received from other switches.

Follow the steps below to disable VTP on the switch.

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters VLAN configuration mode.

Configures the switch as a VTP client.

Updates the VLAN database, propagates it throughout the
administrative domain, exits VLAN configuration mode and
returns to privileged EXEC mode.

SUMMARY STEPS

Book Title

12

1. enable

2. vlan database

3. vtp transparent

4. exit

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

How to Configure EtherSwitch HWICs

Step 1

enable

Example:

Router> enable

Step 2

vlan database

Example:

Router# vlan database

Step 3

vtp transparent

Example:

Router(vlan)# vtp transparent

Step 4

exit

Example:

Router(vlan)# exit

Verifying VTP

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters VLAN configuration mode.

Configures VTP transparent mode.

Updates the VLAN database, propagates it throughout the
administrative domain, exits VLAN configuration mode, and
returns to privileged EXEC mode.

Use the show vtp status command to verify VTP status:

Router# show vtp status

VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 256
Number of existing VLANs : 5
VTP Operating Mode : Server
VTP Domain Name :
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0xBF 0x86 0x94 0x45 0xFC 0xDF 0xB5 0x70
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00
Local updater ID is 1.3.214.25 on interface Fa0/0 (first interface found)
Router#

Configuring Layer 2 Interfaces

This section provides the following configuration information:

• Configuring a Range of Interfaces, page 14 (required)

• Defining a Range Macro, page 14 (optional)

• Configuring Layer 2 Optional Interface Features, page 15 (optional)

Book Title

13

How to Configure EtherSwitch HWICs

Configuring a Range of Interfaces

Use the following task to configure a range of interfaces.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface range {macro macro_name | FastEthernet interface-id [ - interface-id] | vlan vlan_ID}

[, FastEthernet interface-id [ - interface-id] | vlan vlan-ID]

DETAILED STEPS

Command or Action Purpose

Step 1

Step 2

enable

Example:

Router> enable

configure terminal

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Step 3

interface range {macro macro_name |
FastEthernet interface-id [ - interface-id] |
vlan vlan-ID} [, FastEthernet interface-id [ -
interface-id] | vlan vlan-ID]

Example:

Router(config)# interface range FastEthernet
0/1/0 - 0/1/3

Defining a Range Macro

Use the following task to define an interface range macro.

Select the range of interfaces to be configured.

• The space before the dash is required. For example, the

command interface range fastethernet 0/<slot>/0 -
0/<slot>/3 is valid; the command interface range
fastethernet 0/<slot>/0-0/<slot>/3 is not valid.

• You can enter one macro or up to five comma-separated

ranges.

• Comma-separated ranges can include both VLANs and

physical interfaces.

• You are not required to enter spaces before or after the

comma.

• The interface range command only supports VLAN

interfaces that are configured with the interface vlan
command.

SUMMARY STEPS

Book Title

14

1. enable

2. configure terminal

3. define interface-range macro_name {FastEthernet interface-id [ - interface-id] | {vlan vlan_ID -

vlan_ID} | [, FastEthernet interface-id [ - interface-id]

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

define interface-range macro_name {FastEthernet
interface-id [ - interface-id] | {vlan vlan_ID

- vlan-ID} | [, FastEthernet interface-id [ -
interface-id]

Example:

Router(config)# define interface-range
first_three FastEthernet0/1/0 - 2

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

• Defines a range of macros.

Verifying Configuration of an Interface Range Macro

Use the show running-configuration command to show the defined interface-range macro
configuration, as shown below:

Router# show running-configuration | include define

define interface-range first_three FastEthernet0/1/0 - 2

Configuring Layer 2 Optional Interface Features

• Interface Speed and Duplex Configuration Guidelines, page 15

• Configuring the Interface Speed, page 16

• Configuring the Interface Duplex Mode, page 16

• Verifying Interface Speed and Duplex Mode Configuration, page 17

• Configuring a Description for an Interface, page 18

• Configuring a Fast Ethernet Interface as a Layer 2 Trunk, page 19

• Configuring a Fast Ethernet Interface as Layer 2 Access, page 21

Interface Speed and Duplex Configuration Guidelines

When configuring an interface speed and duplex mode, note these guidelines:

• If both ends of the line support autonegotiation, Cisco highly recommends the default auto

negotiation settings.

• If one interface supports auto negotiation and the other end does not, configure duplex and speed on

both interfaces; do not use the auto setting on the supported side.

• Both ends of the line need to be configured to the same setting; for example, both hard-set or both

auto-negotiate. Mismatched settings are not supported.

Book Title

15

How to Configure EtherSwitch HWICs

Caution Changing the interface speed and duplex mode configuration might shut down and reenable the interface

during the reconfiguration.

Configuring the Interface Speed

Use the following task to set the interface speed.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface fastethernet interface-id

4. speed [10 | 100 | auto]

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

Example:

Router(config)# interface fastethernet 0/1/0

Step 4

speed [10 | 100 | auto ]

Example:

Router(config-if)# speed 100

Note If you set the interface speed to auto on a 10/100-Mbps Ethernet interface, both speed and duplex are

automatically negotiated.

Configuring the Interface Duplex Mode

Follow the steps below to set the duplex mode of a Fast Ethernet interface.

Selects the interface to be configured.

Selects the interface to be configured.

16

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

SUMMARY STEPS

1. enable

2. configure terminal

3. interface fastethernet interface-id

4. duplex [auto | full | half]

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects the interface to be configured.

Example:

Router(config)# interface fastethernet 0/1/0

Step 4

duplex [auto | full | half]

Example:

Router(config-if)# duplex auto

Note If you set the port speed to auto on a 10/100-Mbps Ethernet interface, both speed and duplex are

automatically negotiated. You cannot change the duplex mode of auto negotiation interfaces.

The following example shows how to set the interface duplex mode to auto on Fast Ethernet interface 3:

Router(config)# interface fastethernet 0/1/0
Router(config-if)# speed 100
Router(config-if)# duplex auto
Router(config-if)# end

Verifying Interface Speed and Duplex Mode Configuration

Use the show interfaces command to verify the interface speed and duplex mode configuration for an
interface, as shown in the following output example.

Router# show interfaces fastethernet 0/1/0

Sets the duplex mode of the interface.

FastEthernet0/1/0 is up, line protocol is up

Hardware is Fast Ethernet, address is 000f.f70a.f272 (bia 000f.f70a.f272)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)

Book Title

17

How to Configure EtherSwitch HWICs

Auto-duplex, Auto-speed
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:11, output never, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec

4 packets input, 1073 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
6 packets output, 664 bytes, 0 underruns(0/0/0)
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

Router#

Configuring a Description for an Interface

You can add a description of an interface to help you remember its function. The description appears in
the output of the following commands: show configuration, show running-config, and show
interfaces.

Use the description command to add a description for an interface.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

SUMMARY STEPS

1. enable

2. configure terminal

3. interface fastethernet interface-id

4. description string

18

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

Example:

Router(config)# interface fastethernet 0/1/0

Step 4

description string

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects the interface to be configured.

Adds a description for an interface.

Example:

Router(config-if)# description newinterface

Configuring a Fast Ethernet Interface as a Layer 2 Trunk

Use this task to configure a Fast Ethernet interface as a Layer 2 trunk.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface fastethernet interface-id

4. shutdown

5. switchport mode trunk

6. switchport trunk native vlan vlan-num

7. switchport trunk allowed vlan {add | except | none | remove} vlan1[,vlan[,vlan[,...]]

8. no shutdown

9. end

Book Title

19

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

Example:

Router(config)# interface fastethernet 0/1/0

Step 4

shutdown

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects the interface to be configured.

(Optional) Shuts down the interface to prevent traffic flow
until configuration is complete.

Step 5

Step 6

Step 7

Step 8

Step 9

Example:

Router(config-if)# shutdown

switchport mode trunk

Example:

Router(config-if)# switchport mode trunk

switchport trunk native vlan vlan-num

Example:

Router(config-if)# switchport trunk native vlan
1

switchport trunk allowed vlan {add | except |
none | remove} vlan1[,vlan[,vlan[,...]]

Example:

Router(config-if)# switchport trunk allowed
vlan add vlan1, vlan2, vlan3

no shutdown

Example:

Router(config-if)# no shutdown

end

Configures the interface as a Layer 2 trunk.

Note Encapsulation is always dot1q.

(Optional) For 802.1Q trunks, specifies the native VLAN.

(Optional) Configures the list of VLANs allowed on the trunk.
All VLANs are allowed by default. You cannot remove any of
the default VLANs from a trunk.

Activates the interface. (Required only if you shut down the
interface.)

Exits configuration mode.

Example:

Router(config-if)# end

Book Title

20

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Note Ports do not support Dynamic Trunk Protocol (DTP). Ensure that the neighboring switch is set to a mode

that will not send DTP.

Verifying a Fast Ethernet Interface as a Layer 2 Trunk

Use the following show commands to verify the configuration of a Fast Ethernet interface as a Layer 2
trunk.

router# show running-config interfaces fastEthernet 0/3/1

Building configuration...
Current configuration: 71 bytes
!
interface FastEthernet0/3/1
switchport mode trunk
no ip address
end
Router#

Router# show interfaces trunk

Port Mode Encapsulation Status Native vlan
Fa0/3/1 on 802.1q trunking 1

How to Configure EtherSwitch HWICs

Port Vlans allowed on trunk
Fa0/3/1 1-1005

Port Vlans allowed and active in management domain
Fa0/3/1 1

Port Vlans in spanning tree forwarding state and not pruned
Fa0/3/1 1

Router#

Configuring a Fast Ethernet Interface as Layer 2 Access

Follow these steps below to configure a Fast Ethernet interface as Layer 2 access.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface fastethernet interface-id

4. shutdown

5. switchport mode access

6. switchport access vlan vlan-num

7. no shutdown

8. end

Book Title

21

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

Example:

Router(config)# interface fastethernet 0/1/0

Step 4

shutdown

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects the interface to be configured.

(Optional) Shuts down the interface to prevent traffic flow
until configuration is complete.

Step 5

Step 6

Step 7

Step 8

Example:

Router(config-if)# shutdown

switchport mode access

Example:

Router(config-if)# switchport mode access

switchport access vlan vlan-num

Example:

Router(config-if)# switchport access vlan 1

no shutdown

Example:

Router(config-if)# no shutdown

end

Example:

Router(config-if)# end

Configures the interface as a Layer 2 access.

For access ports, specifies the access VLAN.

Activates the interface.

• Required only if you shut down the interface.

Exits configuration mode.

22

Verifying a Fast Ethernet Interface as Layer 2 Access

Use the show running-config interface command to verify the running configuration of the interface,
as shown below.

Router# show running-config interface fastethernet 0/1/2

Building configuration...
Current configuration: 76 bytes
!
interface FastEthernet0/1/2

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

switchport access vlan 3
no ip address
end

Use the show interfaces command to verify the switchport configuration of the interface, as shown
below.

Router# show interfaces f0/1/0 switchport

Name: Fa0/1/0
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Disabled
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 1
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none

How to Configure EtherSwitch HWICs

Router#

Configuring 802.1x Authentication

This section describes how to configure 802.1x port-based authentication on an EtherSwitch HWIC:

• Information About the Default 802.1x Configuration, page 23

• Enabling 802.1x Authentication, page 25

• Configuring the Switch-to-RADIUS-Server Communication, page 26

• Enabling Periodic Reauthentication, page 28

• Changing the Quiet Period, page 29

• Changing the Switch-to-Client Retransmission Time, page 30

• Setting the Switch-to-Client Frame-Retransmission Number, page 32

• Enabling Multiple Hosts, page 33

• Resetting the 802.1x Configuration to the Default Values, page 34

• Displaying 802.1x Statistics and Status, page 35

Information About the Default 802.1x Configuration

Table 1 shows the default 802.1x configuration.

Book Title

23

How to Configure EtherSwitch HWICs

Table 1 Default 802.1x Configuration

Feature Default Setting

Authentication, authorization, and
accounting (AAA)

RADIUS server

• IP address

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Disabled.

• None specified.

• UDP authentication port

• Key

• 1645.

• None specified.

Per-interface 802.1x enable state Disabled (force-authorized).

The port transmits and receives normal traffic without

802.1x-based authentication of the client.

Periodic reauthentication Disabled.

Number of seconds between

3600 seconds.

reauthentication attempts

Quiet period 60 seconds (number of seconds that the switch remains in

the quiet state following a failed authentication exchange
with the client).

Retransmission time 30 seconds (number of seconds that the switch should

wait for a response to an EAP request/identity frame
from the client before retransmitting the request).

Maximum retransmission number 2 times (number of times that the switch will send an

EAP-request/identity frame before restarting the
authentication process).

Multiple host support Disabled.

Client timeout period 30 seconds (when relaying a request from the

authentication server to the client, the amount of time the
switch waits for a response before retransmitting the
request to the client). This setting is not configurable.

Authentication server timeout period 30 seconds (when relaying a response from the client to

the authentication server, the amount of time the switch
waits for a reply before retransmitting the response to the
server). This setting is not configurable.

24

Book Title

802.1x Configuration Guidelines

These are the 802.1x authentication configuration guidelines:

• When the 802.1x protocol is enabled, ports are authenticated before any other Layer 2 feature is

enabled.

• The 802.1x protocol is supported on Layer 2 static-access ports, but it is not supported on these port

types:

–

Trunk port—If you try to enable 802.1x on a trunk port, an error message appears, and 802.1x
is not enabled. If you try to change the mode of an 802.1x-enabled port to trunk, the port mode
is not changed.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

–

Switch Port Analyzer (SPAN) destination port—You can enable 802.1x on a port that is a SPAN
destination port; however, 802.1x is disabled until the port is removed as a SPAN destination.
You can enable 802.1x on a SPAN source port.

Enabling 802.1x Authentication

To enable 802.1x port-based authentication, you must enable AAA and specify the authentication
method list. A method list describes the sequence and authentication methods to be queried to
authenticate a user.

The software uses the first method listed to authenticate users; if that method fails to respond, the
software selects the next authentication method in the method list. This process continues until there is
successful communication with a listed authentication method or until all defined methods are
exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other
authentication methods are attempted.

Beginning in privileged EXEC mode, follow these steps to configure 802.1x port-based authentication.
This procedure is required.

SUMMARY STEPS

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

1. enable

2. configure terminal

3. aaa authentication dot1x {default | listname} method1 [method2...]

4. interface interface-id

5. dot1x port-control auto

6. end

7. show dot1x

8. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Book Title

25

How to Configure EtherSwitch HWICs

Command or Action Purpose

Step 3

aaa authentication dot1x {default | listname}
method1 [method2...]

Example:

Router(config)# aaa authentication dot1x
default newmethod

Step 4

interface interface-id

Example:

Router(config)# interface 0/1/3

Step 5

dot1x port-control auto

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Creates an 802.1x authentication method list.

• To create a default list that is used when a named list is

not specified in the authentication command, use the
default keyword followed by the methods that are to be

used in default situations. The default method list is
automatically applied to all interfaces.

• Enter at least one of these keywords:

–

group radius—Use the list of all RADIUS servers
for authentication.

–

none—Use no authentication. The client is
automatically authenticated without the switch
using the information supplied by the client.

Enters interface configuration mode and specifies the
interface to be enabled for 802.1x authentication.

Enables 802.1x on the interface.

Step 6

Step 7

Step 8

Example:

Router(config-if)# dot1x port-control auto

end

Example:

Router(config-if)# end

show dot1x

Example:

Router# show dot1x

copy running-config startup-config

Example:

Router# copy running-config startup-config

To disable AAA, use the no aaa new-model global configuration command. To disable 802.1x AAA
authentication, use the no aaa authentication dot1x {default | list-name} method1 [method2...] global
configuration command. To disable 802.1x, use the dot1x port-control force-authorized or the no
dot1x port-control interface configuration command.

• For feature interaction information with trunk,

dynamic, dynamic-access, EtherChannel, secure, and
SPAN ports see the “802.1x Configuration Guidelines”

section on page 24.

Returns to privileged EXEC mode.

Verifies your entries.

(Optional) Saves your entries in the configuration file.

Configuring the Switch-to-RADIUS-Server Communication

RADIUS security servers are identified by their host name or IP address, host name and specific UDP
port numbers, or IP address and specific UDP port numbers. The combination of the IP address and UDP
port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP
ports on a server at the same IP address. If two different host entries on the same RADIUS server are

Book Title

26

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

configured for the same service—for example, authentication—the second host entry configured acts as
the fail-over backup to the first one. The RADIUS host entries are tried in the order that they were
configured.

Follow these steps to configure the RADIUS server parameters on the switch. This procedure is required.

SUMMARY STEPS

1. enable

2. configure terminal

3. radius-server host {hostname | ip-address} auth-port port-number key string

4. end

5. show running-config

6. copy running-config startup-config

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Example:

Router# configure terminal

radius-server host {hostname | ip-address}
auth-port port-number key string

Example:

Router# raduis-server host hostseven auth-port
75 key newauthority75

Configures the RADIUS server parameters on the switch.

• For hostname | ip-address, specify the host name or IP

address of the remote RADIUS server.

• For auth-port port-number, specify the UDP

destination port for authentication requests. The default
is 1645.

• For key string, specify the authentication and

encryption key used between the switch and the
RADIUS daemon running on the RADIUS server. The
key is a text string that must match the encryption key
used on the RADIUS server.

NoteAlways configure the key as the last item in the

radius-server host command syntax because
leading spaces are ignored, but spaces within and at
the end of the key are used. If you use spaces in the
key, do not enclose the key in quotation marks
unless the quotation marks are part of the key. This
key must match the encryption used on the
RADIUS daemon.

• If you want to use multiple RADIUS servers, repeat this

command.

Book Title

27

How to Configure EtherSwitch HWICs

Command or Action Purpose

Step 4

end

Example:

Router(config-if)# end

Step 5

show running-config

Example:

Router# show running-config

Step 6

copy running-config startup-config

Example:

Router# copy running-config startup-config

To delete the specified RADIUS server, use the no radius-server host {hostname | ip-address} global
configuration command.

You can globally configure the timeout, retransmission, and encryption key values for all RADIUS
servers by using the radius-server host global configuration command. If you want to configure these
options on a per-server basis, use the radius-server timeout, radius-server retransmit, and the
radius-server key global configuration commands.

You also need to configure some settings on the RADIUS server. These settings include the IP address
of the switch and the key string to be shared by both the server and the switch. For more information,
refer to the RADIUS server documentation.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Returns to privileged EXEC mode.

Verifies your entries.

(Optional) Saves your entries in the configuration file.

Enabling Periodic Reauthentication

You can enable periodic 802.1x client reauthentication and specify how often it occurs. If you do not
specify a time period before enabling reauthentication, the number of seconds between reauthentication
attempts is 3600 seconds.

Automatic 802.1x client reauthentication is a global setting and cannot be set for clients connected to
individual ports.

Follow these steps to enable periodic reauthentication of the client and to configure the number of
seconds between reauthentication attempts.

SUMMARY STEPS

1. enable

2. configure terminal

3. dot1x re-authentication

4. dot1x timeout re-authperiod seconds

5. end

6. show dot1x

7. copy running-config startup-config

28

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

dot1x re-authentication

Example:

Router(config)# dot1x re-authentication

Step 4

dot1x timeout re-authperiod seconds

Example:

Router(config)# dot1x timeout re-authperiod 120

Step 5

end

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables periodic reauthentication of the client.

• Periodic reauthentication is disabled by default.

Sets the number of seconds between reauthentication
attempts.

• The range is 1 to 4294967295; the default is 3600

seconds.

• This command affects the behavior of the switch only

if periodic reauthentication is enabled

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

Step 6

show dot1x

Example:

Router# show dot1x

Step 7

copy running-config startup-config

Example:

Router# copy running-config startup-config

To disable periodic reauthentication, use the no dot1x re-authentication global configuration
command. To return to the default number of seconds between reauthentication attempts, use the no
dot1x timeout re-authperiod global configuration command.

Changing the Quiet Period

When the switch cannot authenticate the client, the switch remains idle for a set period of time, and then
tries again. The idle time is determined by the quiet-period value. A failed authentication of the client
might occur because the client provided an invalid password. You can provide a faster response time to
the user by entering smaller number than the default.

Follow these steps to change the quiet period.

Verifies your entries.

(Optional) Saves your entries in the configuration file.

Book Title

29

How to Configure EtherSwitch HWICs

SUMMARY STEPS

1. enable

2. configure terminal

3. dot1x timeout quiet-period seconds

4. end

5. show dot1x

6. copy running-config startup-config

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Step 6

Example:

Router# configure terminal

dot1x timeout quiet-period seconds

Example:

Router(config)#dot1x timeout quiet-period 120

end

Example:

Router(config-if)# end

show dot1x

Example:

Router# show dot1x

copy running-config startup-config

Example:

Router# copy running-config startup-config

To return to the default quiet time, use the no dot1x timeout quiet-period global configuration
command.

Sets the number of seconds that the switch remains in the
quiet state following a failed authentication exchange with
the client.

• The range is 0 to 65535 seconds; the default is 60.

Returns to privileged EXEC mode.

Verifies your entries.

(Optional) Saves your entries in the configuration file.

Changing the Switch-to-Client Retransmission Time

The client responds to the EAP-request/identity frame from the switch with an EAP-response/identity
frame. If the switch does not receive this response, it waits a set period of time (known as the
retransmission time), and then retransmits the frame.

Book Title

30

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Note You should change the default value of this command only to adjust for unusual circumstances such

as unreliable links or specific behavioral problems with certain clients and authentication servers.

Follow the steps below to change the amount of time that the switch waits for client notification.

SUMMARY STEPS

1. enable

2. configure terminal

3. dot1x timeout tx-period seconds

4. end

5. show dot1x

6. copy running-config startup-config

DETAILED STEPS

How to Configure EtherSwitch HWICs

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Command or Action Purpose

enable

Enables privileged EXEC mode.

• Enter your password if prompted.

Example:

Router> enable

configure terminal

Enters global configuration mode.

Example:

Router# configure terminal

dot1x timeout tx-period seconds

Sets the number of seconds that the switch waits for a
response to an EAP-request/identity frame from the client

Example:

Router(config)# dot1x timeout tx-period seconds

end

before retransmitting the request.

• The range is 1 to 65535 seconds; the default is 30.

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

show dot1x

Verifies your entries.

Example:

Router# show dot1x

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Example:

Router# copy running-config startup-config

To return to the default retransmission time, use the no dot1x timeout tx-period global configuration
command.

Book Title

31

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

How to Configure EtherSwitch HWICs

Setting the Switch-to-Client Frame-Retransmission Number

In addition to changing the switch-to-client retransmission time, you can change the number of times
that the switch sends an EAP-request/identity frame (assuming no response is received) to the client
before restarting the authentication process.

Note You should change the default value of this command only to adjust for unusual circumstances such

as unreliable links or specific behavioral problems with certain clients and authentication servers.

Follow the steps below to set the switch-to-client frame-retransmission number.

SUMMARY STEPS

1. enable

2. configure terminal

3. dot1x max-req count

4. end

5. show dot1x

6. copy running-config startup-config

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

dot1x max-req count

Example:

Router(config)# dot1x max-req 5

Step 4

end

Example:

Router(config-if)# end

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Sets the number of times that the switch sends an
EAP-request/identity frame to the client before restarting
the authentication process.

• The range is 1 to 10; the default is 2.

Returns to privileged EXEC mode.

32

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command or Action Purpose

Step 5

show dot1x

Example:

Router# show dot1x

Step 6

copy running-config startup-config

Example:

Router# copy running-config startup-config

To return to the default retransmission number, use the no dot1x max-req global configuration
command.

Enabling Multiple Hosts

You can attach multiple hosts to a single 802.1x-enabled port. In this mode, only one of the attached
hosts must be successfully authorized for all hosts to be granted network access. If the port becomes
unauthorized (reauthentication fails, and an EAPOL-logoff message is received), all attached clients are
denied access to the network.

Follow these steps below to allow multiple hosts (clients) on an 802.1x-authorized port that has the
dot1x port-control interface configuration command set to auto.

How to Configure EtherSwitch HWICs

Verifies your entries.

(Optional) Saves your entries in the configuration file.

SUMMARY STEPS

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

1. enable

2. configure terminal

3. interface interface-id

4. dot1x multiple-hosts

5. end

6. show dot1x interface interface-id

7. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Book Title

33

How to Configure EtherSwitch HWICs

Command or Action Purpose

Step 3

interface interface-id

Example:

Router# interface 0/1/2

Step 4

dot1x multiple-hosts

Example:

Router(config-if)# dot1x multiple-hosts

Step 5

end

Example:

Router(config-if)# end

Step 6

show dot1x

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enters interface configuration mode.

Allows multiple hosts (clients) on an 802.1x-authorized
port.

• Make sure that the dot1x port-control interface

configuration command is set to auto for the specified
interface.

Returns to privileged EXEC mode.

Verifies your entries.

Example:

Router# show dot1x

Step 7

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Example:

Router# copy running-config startup-config

To disable multiple hosts on the port, use the no dot1x multiple-hosts interface configuration command.

Resetting the 802.1x Configuration to the Default Values

You can reset the 802.1x configuration to the default values with a single command.

Follow these steps to reset the 802.1x configuration to the default values.

SUMMARY STEPS

1. enable

2. configure terminal

3. dot1x default

4. end

5. show dot1x

34

6. copy running-config startup-config

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

dot1x default

Example:

Router(config)# dot1x default

Step 4

end

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Resets the configurable 802.1x parameters to the default
values.

Returns to privileged EXEC mode.

Example:

Router(config)# end

Step 5

show dot1x

Example:

Router# show dot1x

Step 6

copy running-config startup-config

Example:

Router# copy running-config startup-config

Displaying 802.1x Statistics and Status

To display 802.1x statistics for all interfaces, use the show dot1x statistics privileged EXEC command.
To display 802.1x statistics for a specific interface, use the show dot1x statistics interface interface-id
privileged EXEC command.

To display the 802.1x administrative and operational status for the switch, use the show dot1x privileged
EXEC command. To display the 802.1x administrative and operational status for a specific interface, use
the show dot1x interface interface-id privileged EXEC command.

Configuring Spanning Tree

Verifies your entries.

(Optional) Saves your entries in the configuration file.

• Enabling Spanning Tree, page 36

• Configuring Spanning Tree Port Priority, page 37

• Configuring Spanning Tree Port Cost, page 38

• Configuring the Bridge Priority of a VLAN, page 41

• Configuring Hello Time, page 42

Book Title

35

How to Configure EtherSwitch HWICs

• Configuring the Forward-Delay Time for a VLAN, page 42

• Configuring the Maximum Aging Time for a VLAN, page 43

• Configuring the Root Bridge, page 44

Enabling Spanning Tree

You can enable spanning tree on a per-VLAN basis. The switch maintains a separate instance of
spanning tree for each VLAN (except on VLANs on which you disable spanning tree).

SUMMARY STEPS

1. enable

2. configure terminal

3. spanning-tree vlan vlan-ID

4. end

5. show spanning-tree vlan vlan-id

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

spanning-tree vlan vlan-ID

Example:

Router(config)# spanning-tree vlan 200

Step 4

end

Example:

Router(config)# end

Step 5

show spanning-tree vlan vlan-id

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables spanning tree on a per-VLAN basis

Returns to privileged EXEC mode.

Verifies spanning tree configuration

Example

36

Example:

Router# show spanning-tree vlan 200

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Use the show spanning-tree vlan to verify spanning tree configuration, as illustrated below:

Router# show spanning-tree vlan 200

VLAN200 is executing the ieee compatible Spanning Tree protocol
Bridge Identifier has priority 32768, address 0050.3e8d.6401
Configured hello time 2, max age 20, forward delay 15
Current root has priority 16384, address 0060.704c.7000
Root port is 264 (FastEthernet0/1/8), cost of root path is 38
Topology change flag not set, detected flag not set
Number of topology changes 0 last change occurred 01:53:48 ago
Times: hold 1, topology change 24, notification 2
hello 2, max age 14, forward delay 10
Timers: hello 0, topology change 0, notification 0

Port 264 (FastEthernet0/1/8) of VLAN200 is forwarding
Port path cost 19, Port priority 128, Port Identifier 129.9.
Designated root has priority 16384, address 0060.704c.7000
Designated bridge has priority 32768, address 00e0.4fac.b000
Designated port id is 128.2, designated path cost 19
Timers: message age 3, forward delay 0, hold 0
Number of transitions to forwarding state: 1
BPDU: sent 3, received 3417

Router#

How to Configure EtherSwitch HWICs

Configuring Spanning Tree Port Priority

Follow the steps below to configure the spanning tree port priority of an interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface {ethernet | fastethernet} interface-id

4. spanning-tree port-priority port-priority

5. spanning-tree vlan vlan-ID port-priority port-priority

6. end

7. show spanning-tree interface

DETAILED STEPS

Command or Action Purpose

Step 1

Step 2

enable

Example:

Router> enable

configure terminal

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Book Title

37

How to Configure EtherSwitch HWICs

Command or Action Purpose

Step 3

interface {ethernet | fastethernet}

interface-id

Example:

Router(config)# interface fastethernet 0/1/6

Step 4

spanning-tree port-priority port-priority

Example:

Router(config-if)# spanning-tree port-priority

8

Step 5

spanning-tree vlan vlan-ID port-priority
port-priority

Example:

Router (config-if)# spanning-tree vlan vlan1
port-priority 12

Step 6

end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Selects an interface to configure.

Configures the port priority for an interface.

• The of port-priority value can be from 4 to 252 in

increments of 4.

• Use the no form of this command to restore the

defaults.

Configures the priority for a VLAN.

Returns to privileged EXEC mode.

Step 7

Example

Example:

Router(config)# end

show spanning-tree interface fastethernet

interface-id

Example:

Router# show spanning-tree interface
fastethernet 0/1/6

Use the show spanning-tree interface to verify spanning-tree interface and the spanning-tree port priority
configuration, as illustrated below:

Router# show spanning-tree interface fastethernet 0/1/6

Port 264 (FastEthernet0/1/6) of VLAN200 is forwarding
Port path cost 19, Port priority 100, Port Identifier 129.8.
Designated root has priority 32768, address 0010.0d40.34c7
Designated bridge has priority 32768, address 0010.0d40.34c7
Designated port id is 128.1, designated path cost 0
Timers: message age 2, forward delay 0, hold 0
Number of transitions to forwarding state: 1
BPDU: sent 0, received 13513
Router#

(Optional) Saves your entries in the configuration file.

Configuring Spanning Tree Port Cost

Spanning tree port costs are explained in the following section.

Book Title

38

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Calculating Port Cost

Port cost value calculations are based on the bandwidth of the port. There are two classes of values. Short
(16-bit) values are specified by the IEEE 802.1D specification and range in value from 1 to 65535. Long
(32-bit) values are specified by the IEEE 802.1t specification and range in value from 1 to 200,000,000.

Assigning Short Port Cost Values

You can manually assign port costs in the range of 1 to 65535. Default cost values are as follows.

Port Speed Default Cost Value

10 Mbps 100

100 Mbps 19

Assigning Long Port Cost Values

You can manually assign port costs in the range of 1 to 200,000,000. Recommended cost values are as
follows.

How to Configure EtherSwitch HWICs

SUMMARY STEPS

Port Speed Recommended Value Recommended Range

10 Mbps 2,000,000 200,000 to 20,000,000

100 Mbps 200,000 20,000 to 2,000,000

Follow the steps below to configure the spanning tree port cost of an interface.

1. enable

2. configure terminal

3. interface {ethernet | fastethernet} interface-id

4. spanning-tree cost port-cost

5. spanning-tree vlan vlan-ID cost port-cost

6. end

7. show spanning-tree interface

Book Title

39

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface {ethernet | fastethernet}

interface-id

Example:

Router(config)# interface fastethernet 0/1/6

Step 4

spanning-tree cost port-cost

Example:

Router(config-if)# spanning-tree cost 2000

Step 5

spanning-tree vlan vlan-ID cost port-cost

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects an interface to configure.

Configures the port cost for an interface.

• The value of port_cost can be from 1 to 200,000,000 (1

to 65,535 in Cisco IOS Releases 12.1(2)E and earlier).

• Use the no form of this command to restore the

defaults.

Configures the VLAN port cost for an interface.

Step 6

Step 7

Example

Example:

Router(config-if)# spanning-tree vlan 200 cost
2000

end

Example:

Router(config)# end

show spanning-tree interface fastethernet

interface-id

Example:

Router# show spanning-tree interface
fastethernet 0/1/6

Use the show spanning-tree vlan to verify the spanning-tree port cost configuration.

Router# show spanning-tree vlan 200

Port 264 (FastEthernet0/1/8) of VLAN200 is forwarding
Port path cost 17, Port priority 64, Port Identifier 129.8.
Designated root has priority 32768, address 0010.0d40.34c7
Designated bridge has priority 32768, address 0010.0d40.34c7
Designated port id is 128.1, designated path cost 0
Timers: message age 2, forward delay 0, hold 0

• The value port-cost can be from 1 to 65,535.

• Use the no form of this command to restore the

defaults.

Returns to privileged EXEC mode.

(Optional) Saves your entries in the configuration file.

40

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Number of transitions to forwarding state: 1
BPDU: sent 0, received 13513

Router#

Configuring the Bridge Priority of a VLAN

Use the following task to configure the spanning tree bridge priority of a VLAN.

SUMMARY STEPS

1. enable

2. configure terminal

3. spanning-tree vlan vlan-ID priority bridge-priority

4. show spanning-tree vlan bridge [brief]

DETAILED STEPS

How to Configure EtherSwitch HWICs

Step 1

Step 2

Step 3

Command or Action Purpose

enable

Enables privileged EXEC mode.

• Enter your password if prompted.

Example:

Router> enable

configure terminal

Enters global configuration mode.

Example:

Router# configure terminal

spanning-tree vlan vlan-ID priority
bridge-priority

Example:

Router(config)# spanning-tree vlan 200 priority
2

Configures the bridge priority of a VLAN. The
bridge_priority value can be from 1 to 65535.

• Use the no form of this command to restore the

defaults.

Caution Exercise care when using this command. For

most situations spanning-tree vlan vlan-ID root
primary and the spanning-tree vlan vlan-ID
root secondary are the preferred commands to

modify the bridge priority.

Step 4

show spanning-tree vlan bridge

Example:

Router(config-if)# spanning-tree cost 200

Verifies the bridge priority.

Book Title

41

How to Configure EtherSwitch HWICs

Example

Use the show spanning-tree vlan bridge command to verify the bridge priority, as shown below.

Router# show spanning-tree vlan 200 bridge brief

Hello Max Fwd
Vlan Bridge ID Time Age Delay Protocol

---------------- -------------------- ---- ---- ----- -------­VLAN200 33792 0050.3e8d.64c8 2 20 15 ieee
Router#

Configuring Hello Time

Use the following tasks to configure the hello interval for the spanning tree.

SUMMARY STEPS

1. enable

2. configure terminal

3. spanning-tree vlan vlan-ID hello-time hello-time

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

spanning-tree vlan vlan-ID hello-time
hello-time

Example:

Router(config)# spanning-tree vlan 200
hello-time 5

Configuring the Forward-Delay Time for a VLAN

Use the following task to configure the forward delay for the spanning tree

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Configures the hello time of a VLAN.

• The hello_time value can be from 1 to 10 seconds.

• Use the no form of this command to restore the defaults

SUMMARY STEPS

Book Title

42

1. enable

2. configure terminal

3. spanning-tree vlan vlan-ID forward-time forward-time

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

spanning-tree vlan vlan-ID forward-time
forward-time

Example:

Router(config)# spanning-tree vlan 20
forward-time 5

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Configures the forward time of a VLAN.

• The value of forward-time can be from 4 to 30 seconds.

• Use the no form of this command to restore the

defaults.

Configuring the Maximum Aging Time for a VLAN

Follow the steps below to configure the maximum age interval for the spanning tree.

SUMMARY STEPS

1. enable

2. configure terminal

3. spanning-tree vlan vlan-ID max-age max-age

Book Title

43

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

spanning-tree vlan vlan-ID max-age max-age

Example:

Router(config)# spanning-tree vlan 200 max-age
30

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Configures the maximum aging time of a VLAN.

• The value of max_age can be from 6 to 40 seconds.

• Use the no form of this command to restore the

defaults.

Configuring the Root Bridge

The EtherSwitch HWIC maintains a separate instance of spanning tree for each active VLAN configured
on the switch. A bridge ID, consisting of the bridge priority and the bridge MAC address, is associated
with each instance. For each VLAN, the switch with the lowest bridge ID will become the root bridge
for that VLAN.

To configure a VLAN instance to become the root bridge, the bridge priority can be modified from the
default value (32768) to a significantly lower value so that the bridge becomes the root bridge for the
specified VLAN. Use the spanning-tree vlan root command to alter the bridge priority.

The switch checks the bridge priority of the current root bridges for each VLAN. The bridge priority for
the specified VLANs is set to 8192 if this value will cause the switch to become the root for the specified
VLANs.

If any root switch for the specified VLANs has a bridge priority lower than 8192, the switch sets the
bridge priority for the specified VLANs to 1 less than the lowest bridge priority.

For example, if all switches in the network have the bridge priority for VLAN 100 set to the default value
of 32768, entering the spanning-tree vlan 100 root primary command on a switch will set the bridge
priority for VLAN 100 to 8192, causing the switch to become the root bridge for VLAN 100.

Note The root switch for each instance of spanning tree should be a backbone or distribution switch. Do not

configure an access switch as the spanning tree primary root.

Use the diameter keyword to specify the Layer 2 network diameter (that is, the maximum number of
bridge hops between any two end stations in the Layer 2 network). When you specify the network
diameter, the switch automatically picks an optimal hello time, forward delay time, and maximum age
time for a network of that diameter, which can significantly reduce the spanning tree convergence time.
You can use the hello keyword to override the automatically calculated hello time.

44

Note We recommend that you avoid configuring the hello time, forward delay time, and maximum age time

manually after configuring the switch as the root bridge.

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Follow these steps to configure the switch as the root.:

SUMMARY STEPS

1. enable

2. configure terminal

3. spanning-tree vlan vlaN-ID root primary [diameter hops [hello-time seconds]]

4. end

5. no spanning-tree vlan vlan-ID

6. show spanning-tree vlan vlan-ID

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Step 6

Example:

Router# configure terminal

spanning-tree vlan vlan-ID root primary
[diameter hops [hello-time seconds]]

Example:

Router(config)# spanning-tree vlan 200 root
primary

end

Example:

Router(config)# end

no spanning-tree vlan vlan-ID

Example:

Router(config)# spanning-tree vlan 200 root
primary

show spanning-tree vlan vlan-ID

Example:

Router(config)# show spanning-tree vlan 200

Configures a switch as the root switch.

• Use the no form of this command to restore the

defaults.

Returns to privileged EXEC mode.

Disables spanning tree on a per-VLAN basis.

Verifies spanning tree on a per-VLAN basis.

Example

Use the show spanning-tree vlan command to verify the that the spanning tree is disabled, as illustrated
below:

Book Title

45

How to Configure EtherSwitch HWICs

Router# show spanning-tree vlan 200

<output truncated>
Spanning tree instance for VLAN 200 does not exist.
Router#

Configuring MAC Table Manipulation

Port security is implemented by providing the user with the option to make a port secure by allowing only
well-known MAC addresses to send in data traffic. Up to 200 secure MAC addresses per HWIC are
supported.

• Enabling Known MAC Address Traffic, page 46

• Creating a Static Entry in the MAC Address Table, page 47

• Configuring and Verifying the Aging Timer, page 49

Enabling Known MAC Address Traffic

Follow these steps to enable the MAC address secure option.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

SUMMARY STEPS

1. enable

2. configure terminal

3. mac-address-table secure mac-address fastethernet interface-id [vlan vlan-id]

4. end

5. show mac-address-table secure

46

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

mac-address-table secure mac-address
fastethernet interface-id [vlan vlan-id]]

Example:

Router(config)# mac-address-table secure

0000.0002.0001 fastethernet 0/1/1 vlan 2

Step 4

end

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Secures the MAC address traffic on the port.

Returns to privileged EXEC mode.

Example:

Router(config)# end

Step 5

show mac-address-table secure

Example:

Router# show mac-address-table secure

Example

Use the show mac-address-table secure to verify the configuration, as illustrated below:

Router# show mac-address-table secure

Secure Address Table:
Destination Address Address Type VLAN Destination Port

------------------- ------------ ---- --------------------

0000.0002.0001 Secure 2 FastEthernet0/1/1

Creating a Static Entry in the MAC Address Table

Follow these steps to create a static entry in the MAC address table.

SUMMARY STEPS

Verifies the configuration.

1. enable

2. configure terminal

3. mac-address-table static mac-address fastethernet interface-id [vlan vlan-id]

4. end

5. show mac-address-table

Book Title

47

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

Router(config)# mac-address-table static

mac-address fastethernet interface-id [vlan
vlan-id]

Example:

Router(config)# mac-address-table static
00ff.ff0d.2dc0 fastethernet 0/1/1

Step 4

end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Creates a static entry in the MAC address table.

When the vlan-id is not specified, VLAN 1 is taken by default.

Returns to privileged EXEC mode.

Step 5

Example

Example:

Router(config)# end

show mac-address-table

Example:

Router# show mac-address-table

Use the show mac command to verify the MAC address table, as illustrated below:

Router# show mac-address-table

Destination Address Address Type VLAN Destination Port

------------------- ------------ ---- -------------------­00ff.ff0d.2dc0 Self 1 Vlan1

0007.ebc7.ff84 Static 1 FastEthernet0/3/5

0007.ebc8.018b Static 1 FastEthernet0/3/6
000b.bf94.0006 Static 1 FastEthernet0/3/3
000b.bf94.0038 Static 1 FastEthernet0/3/0
000b.bf94.0039 Static 1 FastEthernet0/3/1
000b.bf94.0008 Static 314 FastEthernet0/3/2
000b.bf94.0038 Static 314 FastEthernet0/3/0
000b.bf94.0008 Static 331 FastEthernet0/3/2
000b.bf94.0038 Static 331 FastEthernet0/3/0
000b.bf94.0008 Static 348 FastEthernet0/3/2
000b.bf94.0038 Static 348 FastEthernet0/3/0

Verifies the MAC address table.

48

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Configuring and Verifying the Aging Timer

The aging timer may be configured from 16 seconds to 4080 seconds, in 16-second increments.

Follow these steps to configure the aging timer.

SUMMARY STEPS

1. enable

2. configure terminal

3. mac-address-table aging-time time

4. end

5. show mac-address-table aging-time

DETAILED STEPS

Command or Action Purpose

Step 1

Step 2

enable

Example:

Router> enable

configure terminal

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Example

Example:

Router# configure terminal

mac-address-table aging-time time

Example:

Router(config)# mac-address-table aging-time
4080

end

Example:

Router(config)# end

show mac-address-table aging-time

Example:

Router# show mac-address-table aging-time

Use the show mac-address-table aging-time command to verify the MAC address table aging timer, as
illustrated below:

Router # show mac-address-table aging-time
Mac address aging time 320

Configures the MAC address aging timer age in seconds.

• The range is 0 to 10000 seconds.

Returns to privileged EXEC mode.

Verifies the MAC address table.

Book Title

49

How to Configure EtherSwitch HWICs

Configuring Cisco Discovery Protocol

• Enabling Cisco Discovery Protocol, page 50

• Enabling CDP on an Interface, page 51

• Monitoring and Maintaining CDP, page 52

Enabling Cisco Discovery Protocol

To enable Cisco Discovery Protocol (CDP) globally, use the following commands.

SUMMARY STEPS

1. enable

2. configure terminal

3. cdp run

4. end

5. show cdp

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

cdp run

Example:

Router(config)# cdp run

Step 4

end

Example:

Router(config)# end

Step 5

show cdp

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables CDP globally.

Returns to privileged EXEC mode.

Verifies the CDP configuration.

Example:

Router# show cdp

Book Title

50

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Example

Use the show cdp command to verify the CDP configuration:

Router# show cdp

Global CDP information:
Sending CDP packets every 120 seconds
Sending a holdtime value of 180 seconds
Sending CDPv2 advertisements is enabled
Router#

Enabling CDP on an Interface

Use the steps below to enable CDP on an interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface {ethernet | fastethernet}

4. cdp enable

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface {ethernet | fastethernet}

interface-id

Example:

Router(config)# interface fastethernet 0/1/1

Step 4

cdp enable

5. end

6. show cdp interface interface-id

7. show cdp neighbors

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects an interface to configure.

Enables CDP globally.

Example:

Router(config)# cdp enable

Book Title

51

How to Configure EtherSwitch HWICs

Command or Action Purpose

Step 5

end

Example:

Router(config)# end

Step 6

show cdp interface interface-id

Example:

Router# show cdp interface

Step 7

show cdp neighbors

Example:

Router# show cdp neighbors

Example

Use the show cdp command to verify the CDP configuration for an interface.

Router# show cdp interface fastethernet 0/1/1

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Returns to privileged EXEC mode.

Verifies the CDP configuration on the interface.

Verifies the information about the neighboring equipment.

FastEthernet0/1/1 is up, line protocol is up
Encapsulation ARPA
Sending CDP packets every 120 seconds
Holdtime is 180 seconds
Router#

Router# show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
tftp-switch Fas 0/0 125 R S I 2811 Fas 0/3/6
hwic-3745-2 Fas 0/1/0 149 R S I 3745 Fas 0/1
Router#

Monitoring and Maintaining CDP

Use the following commands to monitor and maintain CDP on your device.

SUMMARY STEPS

1. enable

2. clear cdp counters

3. clear cdp table

4. show cdp

52

5. show cdp entry entry-name [protocol | version]

6. show cdp interface interface-id

7. show cdp neighbors interface-id [detail]

8. show cdp traffic

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

clear cdp counters

Example:

Router# clear cdp counters

Step 3

clear cdp table

Example:

Router# clear cdp table

Step 4

show cdp

Example:

Router# show cdp

Step 5

show cdp entry entry_name [protocol | version]

Example:

Router# show cdp entry newentry

Step 6

show cdp interface interface-id

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

(Optional) Resets the traffic counters to zero.

(Optional) Deletes the CDP table of information about
neighbors.

(Optional) Verifies global information such as frequency of
transmissions and the holdtime for packets being transmitted.

(Optional) Verifies information about a specific neighbor.

• The display can be limited to protocol or version

information.

(Optional) Verifies information about interfaces on which
CDP is enabled.

Example:

Router# show cdp interface 0/1/1

Step 7

Step 8

show cdp neighbors interface-id [detail]

Example:

Router# show cdp neighbors 0/1/1

show cdp traffic

(Optional) Verifies information about neighbors.

• The display can be limited to neighbors on a specific

interface and can be expanded to provide more detailed
information.

(Optional) Verifies CDP counters, including the number of
packets sent and received and checksum errors.

Example:

Router# show cdp traffic

Configuring the Switched Port Analyzer (SPAN)

This section describes how to configure a switched port analyzer (SPAN) session for an EtherSwitch
HWIC.

• Configuring the SPAN Sources, page 54

• Configuring SPAN Destinations, page 54

• Configuring Power Management on the Interface, page 56

Book Title

53

How to Configure EtherSwitch HWICs

Note An EtherSwitch HWIC supports only one SPAN session. Either Tx or both Tx and Rx monitoring is

supported.

Configuring the SPAN Sources

Use the following task to configure the source for a SPAN session.

SUMMARY STEPS

1. enable

2. configure terminal

3. monitor session 1 {source {interface interface-id} | {vlan vlan-ID}} [, | - | rx | tx | both]

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

monitor session 1 {source {interface
interface-id} | {vlan vlan-ID}} [, | - | rx |
tx | both]

Example:

Router(config)# monitor session 1 source
interface fastethernet 0/3/1

Configuring SPAN Destinations

To configure the destination for a SPAN session, use the following commands.

SUMMARY STEPS

1. enable

2. configure terminal

• Enter your password if prompted.

Enters global configuration mode.

Specifies the SPAN session (number 1), the source
interfaces or VLANs, and the traffic direction to be
monitored.

• The example shows how to configure the SPAN session

to monitor bidirectional traffic from source interface
Fast Ethernet 0/3/1.

54

3. monitor session session-id {destination {interface type interface-id} [, | -] | {vlan vlan-ID}}

4. show monitor session

5. no monitor session session-id

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command or Action Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

monitor session session-id {destination
{interface interface-id} | {vlan vlan-ID}} [, |

- | rx | tx | both]

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Specifies the SPAN session (number 1), the source
interfaces or VLANs, and the traffic direction to be
monitored.

Step 4

Step 5

Example

Example:

Router(config)# monitor session 1 source
interface fastethernet 0/3/1

show monitor session session-id

Example:

Router(config)# show monitor session 1

no monitor session session-id

Example:

Router(config)# no monitor session 1

Use the show monitor session command to verify the sources and destinations configured for the SPAN
session.

Router# show monitor session 1

Session 1

--------­Source Ports:
RX Only: None
TX Only: None
Both: Fa0/1/0
Source VLANs:
RX Only: None
TX Only: None
Both: None
Destination Ports: Fa0/1/1
Filter VLANs: None

• The example shows how to configure the SPAN session

to monitor bidirectional traffic from source interface
Fast Ethernet 0/3/1.

Verifies the sources and destinations configured for the
SPAN session.

Clears existing SPAN configuration.

Book Title

55

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

How to Configure EtherSwitch HWICs

Configuring Power Management on the Interface

The HWICs can supply inline power to a Cisco 7960 IP phone, if necessary. The Cisco 7960 IP phone
can also be connected to an AC power source and supply its own power to the voice circuit. When the
Cisco 7960 IP phone is supplying its own power, an HWICs can forward IP voice traffic to and from the
phone.

A detection mechanism on the HWIC determines whether it is connected to a Cisco 7960 IP phone. If
the switch senses that there is no power on the circuit, the switch supplies the power. If there is power
on the circuit, the switch does not supply it.

You can configure the switch never to supply power to the Cisco 7960 IP phone and to disable the
detection mechanism.

Follow these steps to manage the powering of the Cisco IP phones.

SUMMARY STEPS

1. enable

2. configure terminal

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

Example:

Router(config)# interface fastethernet 0/3/1

Step 4

power inline {auto |never}

3. interface fastethernet interface-id

4. power inline {auto | never}

5. end

6. show power inline

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Selects a particular Fast Ethernet interface for
configuration.

Configures the port to supply inline power automatically to a
Cisco IP phone.

Example:

Router(config-if)# power inline auto

Book Title

56

• Use never to permanently disable inline power on the

port.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 5

end

Example:

Router(config-if)# end

Step 6

show power inline

Example:

Router# show power inline

Example

Use the show power inline command to verify the power configuration on the ports, as illustrated below.

Router# show power inline

PowerSupply SlotNum. Maximum Allocated Status

----------- -------- ------- --------- -----­ INT-PS 0 120.000 101.500 PS GOOD

How to Configure EtherSwitch HWICs

Returns to privileged EXEC mode.

Displays power configuration on the ports.

Interface Config Phone Powered PowerAllocated

--------- ------ ----- ------- -------------­Fa0/1/0 auto Cisco On 6.300 Watts
Fa0/1/1 auto Cisco On 6.300 Watts
Fa0/1/2 auto Cisco On 6.300 Watts
Fa0/1/3 auto Cisco On 6.300 Watts
Fa0/1/4 auto Cisco On 6.300 Watts
Fa0/1/5 auto Cisco On 6.300 Watts
Fa0/1/6 auto Cisco On 6.300 Watts
Fa0/1/7 auto Cisco On 6.300 Watts
Fa0/3/0 auto Cisco On 6.300 Watts
Fa0/3/1 auto Cisco On 6.300 Watts
Fa0/3/2 auto Cisco On 6.300 Watts
Fa0/3/3 auto Cisco On 6.300 Watts
Fa0/3/4 auto Cisco On 6.300 Watts
Fa0/3/5 auto Cisco On 6.300 Watts
Fa0/3/6 auto IEEE-2 On 7.000 Watts
Fa0/3/7 auto Cisco On 6.300 Watts

Configuring IP Multicast Layer 3 Switching

These sections describe how to configure IP multicast Layer 3 switching:

• Enabling IP Multicast Routing Globally, page 57

• Enabling IP Protocol-Independent Multicast (PIM) on Layer 3 Interfaces, page 59

• Verifying IP Multicast Layer 3 Hardware Switching Summary, page 60

• Verifying the IP Multicast Routing Table, page 61

Enabling IP Multicast Routing Globally

You must enable IP multicast routing globally before you can enable IP multicast Layer 3 switching on
Layer 3 interfaces.

Book Title

57

How to Configure EtherSwitch HWICs

For complete information and procedures, refer to these publications:

• Cisco IOS IP Configuration Guide, Release 12.2, at this URL:

• Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2, at this

• Cisco IOS IP Command Reference, Volume 2 of 3: Routing Protocols, Release 12.2, at this URL:

• Cisco IOS IP Command Reference, Volume 3 of 3: Multicast, Release 12.2, at this URL:

Use the following commands to enable IP multicast routing globally.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip multicast-routing

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipr_c/

URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipras_r/index.htm

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fiprrp_r/index.htm

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fiprmc_r/index.htm

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

ip multicast-routing

Example:

Router(config)# ip multicast-routing

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables IP multicast routing globally.

58

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enabling IP Protocol-Independent Multicast (PIM) on Layer 3 Interfaces

You must enable protocol-independent multicast (PIM) on the Layer 3 interfaces before enabling IP
multicast Layer 3 switching functions on those interfaces.

Beginning in global configuration mode, follow these steps to enable IP PIM on a Layer 3 interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface vlan vlan-id

4. ip pim {dense-mode | sparse-mode | sparse-dense-mode}

DETAILED STEPS

Command Purpose

Step 1

Step 2

enable

Example:

Router> enable

configure terminal

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

How to Configure EtherSwitch HWICs

Step 3

Step 4

Examples

Example:

Router# configure terminal

interface vlan vlan-id

Router(config)# interface vlan 1

ip pim {dense-mode | sparse-mode |
sparse-dense-mode}

Example:

Router(config-if)# ip pim sparse-dense mode

The following example shows how to enable PIM on an interface using the default mode
(sparse-dense-mode):

Router(config-if)# ip pim sparse-dense mode
Router(config-if)#

The following example shows how to enable PIM sparse mode on an interface:

Router(config-if)# ip pim sparse-mode
Router(config-if)#

Selects the interface to be configured.

Enables IP PIM on a Layer 3 interface.

Book Title

59

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

How to Configure EtherSwitch HWICs

Verifying IP Multicast Layer 3 Hardware Switching Summary

Note The show interface statistics command does not verify hardware-switched packets, only packets

switched by software.

The show ip pim interface count command verifies the IP multicast Layer 3 switching enable state on
IP PIM interfaces and verifies the number of packets received and sent on the interface.

Use the following show commands to verify IP multicast Layer 3 switching information for an IP PIM
Layer 3 interface.

Step 1 Router# show ip pim interface count

State:* - Fast Switched, D - Distributed Fast Switched

H - Hardware Switching Enabled

Address Interface FS Mpackets In/Out

10.0.0.1 VLAN1 * 151/0
Router#

Step 2 Router# show ip mroute count

IP Multicast Statistics
5 routes using 2728 bytes of memory
4 groups, 0.25 average sources per group
Forwarding Counts:Pkt Count/Pkts per second/Avg Pkt Size/Kilobits per second
Other counts:Total/RPF failed/Other drops(OIF-null, rate-limit etc)

Group:209.165.200.225 Source count:1, Packets forwarded: 0, Packets received: 66
Source:10.0.0.2/32, Forwarding:0/0/0/0, Other:66/0/66
Group:209.165.200.226, Source count:0, Packets forwarded: 0, Packets received: 0
Group:209.165.200.227, Source count:0, Packets forwarded: 0, Packets received: 0
Group:209.165.200.228, Source count:0, Packets forwarded: 0, Packets received: 0
Router#

Note A negative counter means that the outgoing interface list of the corresponding entry is NULL, and this

indicates that this flow is still active.

Step 3 Router# show ip interface vlan 1

Vlan1 is up, line protocol is up
Internet address is 10.0.0.1/24
Broadcast address is 209.165.201.1
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Multicast reserved groups joined:209.165.201.2 209.165.201.3 209.165.201.4 209.165.201.5
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled

60

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

IP fast switching on the same interface is disabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF Fast switching turbo vector
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Policy routing is disabled
Network address translation is disabled
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
BGP Policy Mapping is disabled
Router#

Verifying the IP Multicast Routing Table

How to Configure EtherSwitch HWICs

Use the show ip mroute command to verify the IP multicast routing table:

Router# show ip mroute 224.10.103.10

IP Multicast Routing Table
Flags:D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
L - Local, P - Pruned, R - RP-bit set, F - Register flag,
T - SPT-bit set, J - Join SPT, M - MSDP created entry,
X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
U - URD, I - Received Source Specific Host Report, Z - Multicast Tunnel,
Y - Joined MDT-data group, y - Sending to MDT-data group
Outgoing interface flags:H - Hardware switched, A - Assert winner
Timers:Uptime/Expires
Interface state:Interface, Next-Hop or VCD, State/Mode

(*, 209.165.201.2), 00:09:21/00:02:56, RP 0.0.0.0, flags:DC
Incoming interface:Null, RPF nbr 0.0.0.0
Outgoing interface list:
Vlan1, Forward/Sparse-Dense, 00:09:21/00:00:00, H

Router#

Note The RPF-MFD flag indicates that the flow is completely hardware switched. The H flag indicates that

the flow is hardware-switched on the outgoing interface.

Configuring IGMP Snooping

This section describes how to configure IGMP snooping on your router and consists of the following
configuration information and procedures:

• Enabling or Disabling IGMP Snooping, page 62

• Enabling IGMP Immediate-Leave Processing, page 64

• Statically Configuring an Interface to Join a Group, page 65

• Configuring a Multicast Router Port, page 67

Book Title

61

How to Configure EtherSwitch HWICs

Enabling or Disabling IGMP Snooping

By default, IGMP snooping is globally enabled on the EtherSwitch HWIC. When globally enabled or
disabled, it is also enabled or disabled in all existing VLAN interfaces. By default, IGMP snooping is
enabled on all VLANs, but it can be enabled and disabled on a per-VLAN basis.

Global IGMP snooping overrides the per-VLAN IGMP snooping capability. If global snooping is
disabled, you cannot enable VLAN snooping. If global snooping is enabled, you can enable or disable
snooping on a VLAN basis.

Follow the steps below to globally enable IGMP snooping on the EtherSwitch HWIC.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip igmp snooping

4. end

5. show ip igmp snooping

6. copy running-config startup-config

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

ip igmp snooping

Example:

Router(config)# ip igmp snooping

Step 4

end

Example:

Router(config)# end

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Globally enables IGMP snooping in all existing VLAN
interfaces.

Returns to privileged EXEC mode.

62

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 5

show ip igmp snooping

Example:

Router# show ip igmp snooping

Step 6

copy running-config startup-config

Example:

Router# copy running-config startup-config

To globally disable IGMP snooping on all VLAN interfaces, use the no ip igmp snooping global
command.

Use the following steps to enable IGMP snooping on a VLAN interface.

SUMMARY STEPS

1. enable

How to Configure EtherSwitch HWICs

Displays snooping configuration.

(Optional) Saves your configuration to the startup
configuration.

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

ip igmp snooping vlan vlan-id

Example:

Router(config)# ip igmp snooping vlan 1

Step 4

end

2. configure terminal

3. ip igmp snooping vlan vlan-id

4. end

5. show ip igmp snooping

6. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables IGMP snooping on the VLAN interface.

Returns to privileged EXEC mode.

Example:

Router(config)# end

Book Title

63

How to Configure EtherSwitch HWICs

Command Purpose

Step 5

show ip igmp snooping [vlan vlan-id]

Example:

Router# show ip igmp snooping vlan 1

Step 6

copy running-config startup-config

Example:

Router# copy running-config startup-config

To disable IGMP snooping on a VLAN interface, use the no ip igmp snooping vlan vlan-id global
configuration command for the specified VLAN number (for example, vlan1).

Enabling IGMP Immediate-Leave Processing

When you enable IGMP Immediate-Leave processing, the EtherSwitch HWIC immediately removes a
port from the IP multicast group when it detects an IGMP version 2 Leave message on that port.
Immediate-Leave processing allows the switch to remove an interface that sends a Leave message from
the forwarding table without first sending out group-specific queries to the interface. You should use the
Immediate-Leave feature only when there is only a single receiver present on every port in the VLAN.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Displays snooping configuration.

• (Optional) vlan-id is the number of the VLAN.

(Optional) Saves your configuration to the startup
configuration.

SUMMARY STEPS

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Use the following steps to enable IGMP Immediate-Leave processing.

1. enable

2. configure terminal

3. ip igmp snooping vlan vlan-id immediate-leave

4. end

5. show ip igmp snooping

6. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Book Title

64

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 3

ip igmp snooping vlan vlan-id immediate-leave

Example:

Router(config)# ip igmp snooping vlan 1
immediate-leave

Step 4

end

Example:

Router(config)# end

Step 5

show ip igmp snooping

Example:

Router# show ip igmp snooping

Step 6

copy running-config startup-config

Example:

Router# copy running-config startup-config

How to Configure EtherSwitch HWICs

Enables IGMP Immediate-Leave processing on the VLAN
interface.

Returns to privileged EXEC mode.

Displays snooping configuration.

(Optional) Saves your configuration to the startup
configuration.

To disable Immediate-Leave processing, follow Steps 1 and 2 to enter interface configuration mode, and
use the no ip igmp snooping vlan vlan-id immediate-leave global configuration command.

Statically Configuring an Interface to Join a Group

Ports normally join multicast groups through the IGMP report message, but you can also statically
configure a host on an interface.

Follow the steps below to add a port as a member of a multicast group.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip igmp snooping vlan vlan-id static mac-address interface interface-id

4. end

5. show mac-address-table multicast [vlan vlan-id] [user | igmp-snooping] [count]

6. show igmp snooping

7. copy running-config startup-config

Book Title

65

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

ip igmp snooping vlan vlan-id static
mac-address interface interface-id

Example:

Router(config)# ip igmp snooping vlan 1 static

0100.5e05.0505 interface Fa0/1/1

Step 4

end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables IGMP snooping on the VLAN interface.

Returns to privileged EXEC mode.

Step 5

Step 6

Step 7

Example:

Router(config)# end

show mac-address-table multicast [vlan
vlan-id] [user | igmp-snooping] [count]

Example:

Router# show mac-address-table multicast
vlan 1 igmp-snooping

show ip igmp snooping

Example:

Router# show ip igmp snooping

copy running-config startup-config

Example:

Router# copy running-config startup-config

Displays MAC address table entries for a VLAN.

• vlan-id is the multicast group VLAN ID.

• user displays only the user-configured multicast

entries.

• igmp-snooping displays entries learned via IGMP

snooping.

• count displays only the total number of entries for the

selected criteria, not the actual entries.

Displays snooping configuration.

(Optional) Saves your configuration to the startup
configuration.

66

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Configuring a Multicast Router Port

Follow the steps below to enable a static connection to a multicast router.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip igmp snooping vlan vlan-id mrouter {interface interface-id | learn pim-dvmrp}

4. end

5. show ip igmp snooping

6. show ip igmp snooping mrouter [vlan vlan-id]

7. copy running-config startup-config

DETAILED STEPS

Command Purpose

Step 1

Step 2

enable

Example:

Router> enable

configure terminal

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Example:

Router# configure terminal

ip igmp snooping vlan vlan-id mrouter
{interface interface-id | learn pim-dvmrp}

Example:

Router(config)# ip igmp snooping vlan1
interface Fa0/1/1 learn pim-dvmrp

end

Example:

Router(config)# end

show ip igmp snooping

Example:

Router# show ip igmp snooping

Enables IGMP snooping on the VLAN interface and enables
route discovery.

Returns to privileged EXEC mode.

Displays snooping configuration.

Book Title

67

How to Configure EtherSwitch HWICs

Command Purpose

Step 6

Step 7

show ip igmp snooping mrouter [vlan vlan-id]

Example:

Router# show ip igmp snooping mroute vlan
vlan1

copy running-config startup-config

Example:

Router# copy running-config startup-config

Configuring Per-Port Storm Control

You can use these techniques to block the forwarding of unnecessary flooded traffic. This section
describes how to configure per-port storm control and characteristics on your router and consists of the
following configuration procedures:

• Enabling Per-Port Storm Control, page 68

• Disabling Per-Port Storm Control, page 69

By default, unicast, broadcast, and multicast suppression is disabled.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Displays Mroute discovery information.

(Optional) Saves your configuration to the startup
configuration.

Enabling Per-Port Storm Control

Use these steps to enable per-port storm control.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface interface-id

4. storm-control {broadcast | multicast | unicast} level level-high [level-low]

5. storm-control action shutdown

6. end

7. show storm-control [interface] [broadcast | multicast | unicast | history]

68

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface interface-id

Example:

Router(config)# interface 0/3/1

Step 4

storm-control {broadcast | multicast |
unicast} level level-high [level-low]

Example:

Router(config-if)# Storm-control
broadcast level 7

Step 5

storm-control action shutdown

Example:

Router(config-if)# Storm-control action
shutdown

Step 6

end

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters interface configuration mode and specifies the port to
configure.

Configures broadcast, multicast, or unicast per-port storm control.

• Specify the rising threshold level for either broadcast, multicast,

or unicast traffic. The storm control action occurs when traffic
utilization reaches this level.

• (Optional) Specify the falling threshold level. The normal

transmission restarts (if the action is filtering) when traffic drops
below this level.

Selects the shutdown keyword to disable the port during a storm.

• The default is to filter out the traffic.

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

Step 7

show storm-control [interface]
[broadcast | multicast | unicast |
history]

Example:

Router(config-if)# show storm-control

Note If any type of traffic exceeds the upper threshold limit, all of the other types of traffic will be stopped.

Disabling Per-Port Storm Control

Follow these steps to disable per-port storm control.

Verifies your entries.

Book Title

69

How to Configure EtherSwitch HWICs

SUMMARY STEPS

1. enable

2. configure terminal

3. interface interface-id

4. no storm-control {broadcast | multicast | unicast} level level-high [level-low]

5. no storm-control action shutdown

6. end

7. show storm-control {broadcast | multicast | unicast}

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Example:

Router# configure terminal

interface interface-id

Example:

Router(config)# interface 0/3/1

no storm-control {broadcast | multicast
| unicast} level level-high [level-low]

Example:

Router(config-if)# no storm-control
broadcast level 7

no storm-control action shutdown

Example:

Router(config-if)# no storm-control
action shutdown

Enters interface configuration mode and specifies the port to
configure.

Disables per-port storm control.

Disables the specified storm control action.

70

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 6

end

Example:

Router(config-if)# end

Step 7

show storm-control [interface]
[{broadcast | multicast | unicast |
history}]

Example:

Router(config-if)# show storm-control

Configuring Stacking

Stacking is the connection of two switch modules resident in the same chassis so that they behave as a
single switch. When a chassis is populated with two switch modules, the user must configure both of
them to operate in stacked mode. This is done by selecting one port from each switch module and
configuring it to be a stacking partner. The user must then use a cable to connect the stacking partners
from each switch module to physically stack the switch modules. Any one port in a switch module can
be designated as the stacking partner for that switch module.

Follow the steps below to configure a pair of ports on two different switch modules as stacking partners.

How to Configure EtherSwitch HWICs

Returns to privileged EXEC mode.

Verifies your entries.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface fastethernet interface-id

4. no shutdown

5. switchport stacking-partner interface FastEthernet partner-interface-id

6. exit

7. interface fastethernet partner-interface-id

8. no shutdown

9. end

Book Title

71

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface fastethernet interface-id

Example:

Router# interface fastethernet 0/3/1

Step 4

no shutdown

Example:

Router# no shutdown

Step 5

switchport stacking-partner interface
fastethernet partner-interface-id

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters interface configuration mode and specifies the port to
configure.

Activates the interface.

• This step is required only if you shut down the interface.

Selects and configures the stacking partner port.

• To restore the defaults, use the no form of this command.

Step 6

Step 7

Step 8

Step 9

Example:

Router(config-if)# switchport
stacking-partner interface FastEthernet
partner-interface-id

exit

Example:

Router(config-if)# exit

interface fastethernet

partner-interface-id

Example:

Router# interface fastethernet 0/3/1

no shutdown

Example:

Router(config)# no shutdown

end

Example:

Router(config)# end

Returns to privileged configuration mode.

Enters interface configuration mode and specifies the
partner-interface.

Activates the stacking partner interface.

Exits configuration mode.

72

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Note Both stacking partner ports must have their speed and duplex parameters set to auto.

Caution If stacking is removed, stacked interfaces will go to shutdown state. Other nonstacked ports will be left

unchanged.

Configuring Fallback Bridging

This section describes how to configure fallback bridging on your switch. It contains this configuration
information:

• Understanding the Default Fallback Bridging Configuration, page 73

• Creating a Bridge Group, page 74

• Preventing the Forwarding of Dynamically Learned Stations, page 75

• Configuring the Bridge Table Aging Time, page 77

How to Configure EtherSwitch HWICs

• Filtering Frames by a Specific MAC Address, page 78

• Adjusting Spanning-Tree Parameters, page 79

• Monitoring and Maintaining the Network, page 89

Understanding the Default Fallback Bridging Configuration

Table 2 shows the default fallback bridging configuration.

Table 2 Default Fallback Bridging Configuration

Feature Default Setting

Bridge groups None are defined or assigned to an interface. No

Switch forwards frames for stations that it has
dynamically learned

Bridge table aging time for dynamic entries 300 seconds.

MAC-layer frame filtering Disabled.

Spanning tree parameters:

• Switch priority

• Interface priority

• Interface path cost

VLAN-bridge STP is defined.

Enabled.

• 32768

• 128

• 10 Mbps: 100

100 Mbps: 19
1000 Mbps: 4

• Hello BPDU interval

• Forward-delay interval

• Maximum idle interval

• 2 seconds

• 20 seconds

• 30 seconds

Book Title

73

How to Configure EtherSwitch HWICs

Creating a Bridge Group

To configure fallback bridging for a set of switched virtual interfaces (SVIs), these interfaces must be
assigned to bridge groups. All interfaces in the same group belong to the same bridge domain. Each SVI
can be assigned to only one bridge group.

Follow the steps below to create a bridge group and assign an interface to it.

SUMMARY STEPS

1. enable

2. configure terminal

3. no ip routing

4. bridge bridge-group protocol vlan-bridge

5. interface interface-id

6. bridge-group bridge-group

7. end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

no ip routing

Example:

Router(config)# no ip routing

Step 4

bridge bridge-group protocol
vlan-bridge

Example:

Router(config)# bridge 100 protocol
vlan-bridge

8. show vlan-bridge

9. show running-config

10. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Disables IP routing.

Assigns a bridge group number and specifies the VLAN-bridge
spanning-tree protocol to run in the bridge group.

• The ibm and dec keywords are not supported.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

• Frames are bridged only among interfaces in the same group.

74

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 5

interface interface-id

Example:

Router(config)# interface 0/3/1

Step 6

bridge-group bridge-group

Example:

Router(config-if)# bridge-group 100

Step 7

end

Example:

Router(config-if)# end

Step 8

show vlan-bridge

How to Configure EtherSwitch HWICs

Enters interface configuration mode and specifies the interface on
which you want to assign the bridge group.

• The specified interface must be an SVI: a VLAN interface that you

created by using the interface vlan vlan-id global configuration
command.

• These ports must have IP addresses assigned to them.

Assigns the interface to the bridge group created in Step 2.

• By default, the interface is not assigned to any bridge group. An

interface can be assigned to only one bridge group.

Returns to privileged EXEC mode.

(Optional) Verifies forwarding mode.

Example:

Router# show vlan-bridge

Step 9

show running-config

(Optional) Verifies your entries.

Example:

Router# show running-config

Step 10

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Example:

Router# copy running-config
startup-config

To remove a bridge group, use the no bridge bridge-group protocol vlan-bridge global configuration
command. To remove an interface from a bridge group, use the no bridge-group bridge-group interface
configuration command.

Preventing the Forwarding of Dynamically Learned Stations

By default, the switch forwards any frames for stations that it has dynamically learned. When this
activity is disabled , the switch only forwards frames whose addresses have been statically configured
into the forwarding cache.

Follow the steps below to prevent the switch from forwarding frames for stations that it has dynamically
learned.

SUMMARY STEPS

1. enable

2. configure terminal

3. no bridge bridge-group acquire

Book Title

75

How to Configure EtherSwitch HWICs

4. end

5. show running-config

6. copy running-config startup-config

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

no bridge bridge-group acquire

Example:

Router(config)# no bridge 100
acquire

Step 4

end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables the switch to stop forwarding any frames for stations that it has
dynamically learned through the discovery process and to limit frame
forwarding to statically configured stations.

• The switch filters all frames except those whose destined-to

addresses have been statically configured into the forwarding
cache. To configure a static address, use the bridge bridge-group
address mac-address {forward | discard} global configuration
command.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

Returns to privileged EXEC mode.

Step 5

Step 6

Example:

Router(config)# end

show running-config

Example:

Router# show running-config

copy running-config startup-config

Example:

Router# copy running-config
startup-config

To cause the switch to forward frames to stations that it has dynamically learned, use the bridge
bridge-group acquire global configuration command.

Book Title

76

Verifies your entry.

(Optional) Saves your entry in the configuration file.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Configuring the Bridge Table Aging Time

A switch forwards, floods, or drops packets based on the bridge table. The bridge table maintains both
static and dynamic entries. Static entries are entered by you. Dynamic entries are entered by the bridge
learning process. A dynamic entry is automatically removed after a specified length of time, known as
aging time, from the time the entry was created or last updated.

If you are likely to move hosts on a switched network, decrease the aging time to enable the switch to
quickly adapt to the change. If hosts on a switched network do not continuously send packets, increase
the aging time to keep the dynamic entries for a longer time and thus reduce the possibility of flooding
when the hosts send again.

Follow the steps below to configure the aging time.

SUMMARY STEPS

1. enable

2. configure terminal

3. bridge bridge-group aging-time seconds

4. end

5. show running-config

6. copy running-config startup-config

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

bridge bridge-group aging-time
seconds

Example:

Router(config)# bridge 100
aging-time 10000

Step 4

end

Example:

Router(config)# end

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Specifies the length of time that a dynamic entry remains in the bridge
table from the time the entry was created or last updated.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

• For seconds, enter a number from 0 to 1000000. The default is 300

seconds.

Returns to privileged EXEC mode.

Book Title

77

How to Configure EtherSwitch HWICs

Command Purpose

Step 5

show running-config

Verifies your entry.

Example:

Router# show running-config

Step 6

copy running-config startup-config

(Optional) Saves your entry in the configuration file.

Example:

Router# copy running-config
startup-config

To return to the default aging-time interval, use the no bridge bridge-group aging-time global
configuration command.

Filtering Frames by a Specific MAC Address

A switch examines frames and sends them through the internetwork according to the destination address;
a switch does not forward a frame back to its originating network segment. You can use the software to
configure specific administrative filters that filter frames based on information other than the paths to
their destinations.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

SUMMARY STEPS

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

You can filter frames with a particular MAC-layer station destination address. Any number of addresses
can be configured in the system without a performance penalty.

Follow the steps below to filter by the MAC-layer address.

1. enable

2. configure terminal

3. bridge bridge-group address mac-address {forward | discard} [interface-id]

4. end

5. show running-config

6. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Book Title

78

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 3

show running-config

Example:

Router: show running-config

Step 4

copy running-config startup-config

Example:

Router# copy running-config
startup-config

To disable the frame forwarding ability, use the no bridge bridge-group address mac-address global
configuration command.

Adjusting Spanning-Tree Parameters

You might need to adjust certain spanning-tree parameters if the default values are not suitable for your
switch configuration. Parameters affecting the entire spanning tree are configured with variations of the
bridge global configuration command. Interface-specific parameters are configured with variations of
the bridge-group interface configuration command.

How to Configure EtherSwitch HWICs

Verifies your entry.

(Optional) Saves your entry in the configuration file.

You can adjust spanning-tree parameters by performing any of the tasks in these sections:

• Changing the Switch Priority, page 79

• Changing the Interface Priority, page 81

• Assigning a Path Cost, page 82

• Adjusting BPDU Intervals, page 83

• Adjusting the Interval Between Hello BPDUs, page 83

• Changing the Forward-Delay Interval, page 84

• Changing the Maximum-Idle Interval, page 85

• Disabling the Spanning Tree on an Interface, page 87

Note Only network administrators with a good understanding of how switches and STP function should

make adjustments to spanning-tree parameters. Poorly planned adjustments can have a negative
impact on performance. A good source on switching is the IEEE 802.1d specification; for more
information, refer to the “References and Recommended Reading” appendix in the Cisco IOS
Configuration Fundamentals Command Reference, Release 12.2.

Changing the Switch Priority

You can globally configure the priority of an individual switch when two switches tie for position as the
root switch, or you can configure the likelihood that a switch will be selected as the root switch. This
priority is determined by default; however, you can change it.

Follow the steps below to change the switch priority.

Book Title

79

How to Configure EtherSwitch HWICs

SUMMARY STEPS

1. enable

2. configure terminal

3. bridge bridge-group priority number

4. end

5. show running-config

6. copy running-config startup-config

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Step 6

Example:

Router# configure terminal

bridge bridge-group priority number

Example:

Router(config)# bridge 100 priority
5

end

Example:

Router(config)# end

show running-config

Example:

Router: show running-config

copy running-config startup-config

Example:

Router# copy running-config
startup-config

Changes the priority of the switch.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

• For number, enter a number from 0 to 65535. The default is 32768.

The lower the number, the more likely the switch will be chosen as
the root.

Returns to privileged EXEC mode.

Verifies your entry.

(Optional) Saves your entry in the configuration file.

80

This command does not have a no form. To return to the default setting, use the bridge bridge-group
priority number global configuration command, and set the priority to the default value. To change the

priority on an interface, use the bridge-group priority interface configuration command (described in
the next section).

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Changing the Interface Priority

You can change the priority for an interface. When two switches tie for position as the root switch, you
configure an interface priority to break the tie. The switch with the lower interface value is elected.

Follow the steps below to change the interface priority.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface interface-id

4. bridge-group bridge-group priority number

5. end

6. show running-config

7. copy running-config startup-config

DETAILED STEPS

How to Configure EtherSwitch HWICs

Step 1

Step 2

Step 3

Step 4

Step 5

Command Purpose

enable

Enables privileged EXEC mode.

• Enter your password if prompted.

Example:

Router> enable

configure terminal

Enters global configuration mode.

Example:

Router# configure terminal

interface interface-id

Enters interface configuration mode and specifies the interface to set
the priority.

Example:

Router(config)# interface 0/3/1

bridge bridge-group priority number

Changes the prioriyt of the bridge.

Example:

Router(config-if)# bridge 100
priority 4

end

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

Book Title

81

How to Configure EtherSwitch HWICs

Command Purpose

Step 6

show running-config

Example:

Router: show running-config

Step 7

copy running-config startup-config

Example:

Router# copy running-config
startup-config

To return to the default setting, use the bridge-group bridge-group priority number interface
configuration command.

Assigning a Path Cost

Each interface has a path cost associated with it. By convention, the path cost is 1000/data rate of the
attached LAN, in Mbps.

Follow the steps below to assign a path cost.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Verifies your entry.

(Optional) Saves your entry in the configuration file.

SUMMARY STEPS

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface interface-id

1. enable

2. configure terminal

3. interface interface-id

4. bridge-group bridge-group path-cost cost

5. end

6. show running-config

7. copy running-config startup-config

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters interface configuration mode and specifies the interface to set
the priority.

Example:

Router(config)# interface 0/3/1

Book Title

82

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 4

bridge bridge-group path-costs cost

Example:

Router(config-if)# bridge 100
pathcost 4

Step 5

end

Example:

Router(config-if)# end

Step 6

show running-config

Example:

Router: show running-config

Step 7

copy running-config startup-config

Example:

Router# copy running-config
startup-config

How to Configure EtherSwitch HWICs

Changes the path cost.

Returns to privileged EXEC mode.

Verifies your entry.

(Optional) Saves your entry in the configuration file.

To return to the default path cost, use the no bridge-group bridge-group path-cost cost interface
configuration command.

Adjusting BPDU Intervals

You can adjust bridge protocol data unit (BPDU) intervals as described in these sections:

• Adjusting the Interval Between Hello BPDUs, page 83

• Changing the Forward-Delay Interval, page 84

• Changing the Maximum-Idle Interval, page 85

Note Each switch in a spanning tree adopts the interval between hello BPDUs, the forward delay interval,

and the maximum idle interval parameters of the root switch, regardless of what its individual
configuration might be.

Adjusting the Interval Between Hello BPDUs

Follow the steps below to adjust the interval between hello BPDUs.

SUMMARY STEPS

1. enable

2. configure terminal

3. bridge bridge-group hello-time seconds

4. end

5. show running-config

Book Title

83

How to Configure EtherSwitch HWICs

6. copy running-config startup-config

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

bridge bridge-group hello-time
seconds

Example:

Router(config-if)# bridge 100
hello-time 5

Step 4

end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Specifies the interval between hello BPDUs.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

• For seconds, enter a number from 1 to 10. The default is 2 seconds.

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

Step 5

show running-config

Example:

Router: show running-config

Step 6

copy running-config startup-config

Example:

Router# copy running-config
startup-config

To return to the default setting, use the no bridge bridge-group hello-time global configuration
command.

Changing the Forward-Delay Interval

The forward-delay interval is the amount of time spent listening for topology change information after
an interface has been activated for switching and before forwarding actually begins.

Follow the steps below to change the forward-delay interval.

SUMMARY STEPS

Verifies your entry.

(Optional) Saves your entry in the configuration file.

84

1. enable

2. configure terminal

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

3. bridge bridge-group forward-time seconds

4. end

5. show running-config

6. copy running-config startup-config

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

bridge bridge-group forward-time
seconds

Example:

Router(config-if)# bridge 100
forward-time 25

Step 4

end

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Specifies the forward-delay interval.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

• For seconds, enter a number from 10 to 200. The default is 20

seconds.

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

Step 5

show running-config

Example:

Router: show running-config

Step 6

copy running-config startup-config

Example:

Router# copy running-config
startup-config

To return to the default setting, use the no bridge bridge-group forward-time seconds global
configuration command.

Changing the Maximum-Idle Interval

If a switch does not hear BPDUs from the root switch within a specified interval, it recomputes the
spanning-tree topology.

Follow the steps below to change the maximum-idle interval (maximum aging time).

Verifies your entry.

(Optional) Saves your entry in the configuration file.

Book Title

85

How to Configure EtherSwitch HWICs

SUMMARY STEPS

1. enable

2. configure terminal

3. bridge bridge-group max-age seconds

4. end

5. show running-config

6. copy running-config startup-config

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Step 3

Step 4

Step 5

Step 6

Example:

Router# configure terminal

bridge bridge-group max-age seconds

Example:

Router(config-if)# bridge 100
forward-time 25

end

Example:

Router(config-if)# end

show running-config

Example:

Router: show running-config

copy running-config startup-config

Example:

Router# copy running-config
startup-config

Specifies the interval the switch waits to hear BPDUs from the root
switch.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

• For seconds, enter a number from 10 to 200. The default is 30

seconds.

Returns to privileged EXEC mode.

Verifies your entry.

(Optional) Saves your entry in the configuration file.

86

To return to the default setting, use the no bridge bridge-group max-age global configuration command.

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Disabling the Spanning Tree on an Interface

When a loop-free path exists between any two switched subnetworks, you can prevent BPDUs generated
in one switching subnetwork from impacting devices in the other switching subnetwork, yet still permit
switching throughout the network as a whole. For example, when switched LAN subnetworks are
separated by a WAN, BPDUs can be prevented from traveling across the WAN link.

Follow the steps below to disable spanning tree on an interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface interface-id

4. bridge-group bridge-group spanning-disabled

5. end

6. show running-config

7. copy running-config startup-config

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface interface-id

Example:

Router(config)# interface 0/3/1

Step 4

bridge-group bridge-group
spanning-disabled

Example:

Router(config-if)# bridge 100
spanning-disabled

Step 5

end

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters interface configuration mode and specifies the interface to set
the priority.

Disables spanning tree on the interface.

• For bridge-group, specify the bridge group number. The range is 1

to 255.

Returns to privileged EXEC mode.

Example:

Router(config-if)# end

Book Title

87

How to Configure EtherSwitch HWICs

Command Purpose

Step 6

show running-config

Example:

Router: show running-config

Step 7

copy running-config startup-config

Example:

Router# copy running-config
startup-config

To reenable spanning tree on the interface, use the no bridge-group bridge-group spanning-disabled
interface configuration command.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Verifies your entry.

(Optional) Saves your entry in the configuration file.

88

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Monitoring and Maintaining the Network

To monitor and maintain the network, use one or more of the following privileged EXEC commands.

Command Purpose

clear bridge bridge-group

Removes any learned entries from the forwarding database and
clears the transmit and receive counts for any statically
configured entries.

show bridge [bridge-group]

show bridge [bridge-group] [interface-id] [address]
[group] [verbose]

Displays details about the bridge group.

Displays classes of entries in the bridge forwarding database.

Configuring Separate Voice and Data Subnets

For ease of network administration and increased scalability, network managers can configure the
HWICs to support Cisco IP phones such that the voice and data traffic reside on separate subnets. You
should always use separate VLANs when you are able to segment the existing IP address space of your
branch office.

User priority bits in the 802.1p portion of the 802.1Q standard header are used to provide prioritization
in Ethernet switches. This is a vital component in designing Cisco AVVID networks.

The HWICs provides the performance and intelligent services of Cisco IOS software for branch office
applications. The HWICs can identify user applications—such as voice or multicast video—and classify
traffic with the appropriate priority levels.

How to Configure EtherSwitch HWICs

Note Refer to the Cisco AVVID QoS Design Guide for more information on how to implement end-to-end QoS

SUMMARY STEPS

as you deploy Cisco AVVID solutions.

Follow these steps to automatically configure Cisco IP phones to send voice traffic on the voice VLAN
ID (VVID) on a per-port basis (see the “Voice Traffic and VVID” section on page 90).

1. enable

2. configure terminal

3. interface interface-id

4. switchport mode trunk

5. switchport voice vlan vlan-id

Book Title

89

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

Step 4

interface interface-id

Example:

Router(config)# interface 0/2/1

switchport mode trunk

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters the interface configuration mode and the port to be
configured (for example, interface fa0/3/1).

Configures the port to trunk mode.

Example:

Router(config-if)# switchport mode trunk

Step 5

switchport voice vlan vlan-id

Example:

Router(config-if)# switchport voice vlan
100

Voice Traffic and VVID

The HWICs can automatically configure voice VLAN. This capability overcomes the management
complexity of overlaying a voice topology onto a data network while maintaining the quality of voice
traffic. With the automatically configured voice VLAN feature, network administrators can segment
phones into separate logical networks, even though the data and voice infrastructure is physically the
same. The voice VLAN feature places the phones into their own VLANs without the need for end-user
intervention. A user can plug the phone into the switch, and the switch provides the phone with the
necessary VLAN information.

Configuring a Single Subnet for Voice and Data

For network designs with incremental IP telephony deployment, network managers can configure the
HWICs so that the voice and data traffic coexist on the same subnet. This might be necessary when it is
impractical either to allocate an additional IP subnet for IP phones or to divide the existing IP address
space into an additional subnet at the remote branch, it might be necessary to use a single IP address
space for branch offices. (This is one of the simpler ways to deploy IP telephony.)

This configuration approach must address two key considerations:

• Network managers should ensure that existing subnets have enough available IP addresses for the

new Cisco IP phones, each of which requires a unique IP address.

Configures the voice port with a VVID that will be used
exclusively for voice traffic.

90

• Administering a network with a mix of IP phones and workstations on the same subnet might pose

a challenge.

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Beginning in privileged EXEC mode, follow these steps to automatically configure Cisco IP phones to
send voice and data traffic on the same VLAN.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface interface-id

4. switchport access vlan vlan-id

5. end

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Step 3

Step 4

Step 5

interface interface-id

Example:

Router(config)# interface 0/2/1

switchport access vlan vlan-id

Example:

Router(config-if)# switchport access vlan
100

end

Example:

Router# end

Verifying Switchport Configuration

Use the show run interface command to verify the switchport configuration.

Router# show run interface interface-id

Use the write memory command to save the current configuration in flash memory.

Router# write memory

Enters the interface configuration mode and the port to be
configured (e.g., interface fa0/1/1).

Sets the native VLAN for untagged traffic.

• The value of vlan-id represents the ID of the VLAN that is

sending and receiving untagged traffic on the port. Valid
IDs are from 1 to 1001. Leading zeroes are not permitted.

Returns to the privileged EXEC mode.

Book Title

91

How to Configure EtherSwitch HWICs

Managing the EtherSwitch HWIC

This section describes how to perform basic management tasks on the HWICs with the Cisco IOS
command line interface. You might find this information useful when you configure the switch for the
purposed described in the preceding sections.

The following topics are included:

• Adding Trap Managers, page 92

• Configuring IP Information, page 93

• Enabling Switch Port Analyzer, page 96

• Managing the ARP Table, page 98

• Managing the MAC Address Tables, page 98

• Removing Dynamic Addresses, page 100

• Adding Secure Addresses, page 101

• Configuring Static Addresses, page 103

• Clearing All MAC Address Tables, page 105

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Adding Trap Managers

A trap manager is a management station that receives and processes traps. When you configure a trap
manager, community strings for each member switch must be unique. If a member switch has an IP
address assigned to it, the management station accesses the switch by using its assigned IP address.

By default, no trap manager is defined, and no traps are issued.

Follow these steps to add a trap manager and community string.

SUMMARY STEPS

1. enable

2. configure terminal

3. snmp-server host ip-address traps snmp vlan-membership

4. end

DETAILED STEPS

Command Purpose

Step 1

Step 2

enable

Example:

Router> enable

configure terminal

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Book Title

92

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 3

snmp-server host ip-address traps snmp
vlan-membership

Example:

Router(config)# snmp-server host

172.16.128.263 traps1 snmp vlancommunity1

Step 4

end

Example:

Router(config)# end

Verifying Trap Managers

Use the show running-config command to verify that the information was entered correctly by
displaying the running configuration:

Router# show running-config

How to Configure EtherSwitch HWICs

Enters the trap manager IP address, community string, and the
traps to generate.

Returns to privileged EXEC mode.

Configuring IP Information

This section describes how to assign IP information on the HWICs. The following topics are included:

• Assigning IP Information to the Switch, page 93

• Specifying a Domain Name and Configuring the DNS, page 95

Assigning IP Information to the Switch

You can use a BOOTP server to automatically assign IP information to the switch; however, the BOOTP
server must be set up in advance with a database of physical MAC addresses and corresponding IP
addresses, subnet masks, and default gateway addresses. In addition, the switch must be able to access
the BOOTP server through one of its ports. At startup, a switch without an IP address requests the
information from the BOOTP server; the requested information is saved in the switch running the
configuration file. To ensure that the IP information is saved when the switch is restarted, save the
configuration by entering the write memory command in privileged EXEC mode.

You can change the information in these fields. The mask identifies the bits that denote the network
number in the IP address. When you use the mask to subnet a network, the mask is then referred to as a
subnet mask. The broadcast address is reserved for sending messages to all hosts. The CPU sends traffic
to an unknown IP address through the default gateway.

Follow these steps to enter the IP information.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface vlan_id

4. ip address ip-address subnet-mask

5. exit

Book Title

93

How to Configure EtherSwitch HWICs

6. ip default-gateway ip-address

7. end

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

interface vlan_id

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters interface configuration mode and specifies the VLAN to
which the IP information is assigned.

Step 4

Step 5

Step 6

Step 7

Example:

Router(config)# interface vlan 1

ip address ip-address subnet-mask

Example:

Router(config)# ip address 192.0.2.10

255.255.255.255

exit

Example:

Router(config)# exit

ip default-gateway ip-address

Example:

Router# ip default-gateway 192.0.2.20

end

Example:

Router# end

Use the following procedure to remove the IP information from a switch.

• VLAN 1 is the management VLAN, but you can configure

any VLAN from IDs 1 to 1001.

Enters the IP address and subnet mask.

Returns to global configuration mode.

Enters the IP address of the default router.

Returns to privileged EXEC mode.

94

Note Using the no ip address command in configuration mode disables the IP protocol stack and

removes the IP information. Cluster members without IP addresses rely on the IP protocol
stack being enabled.

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Use these steps to remove an IP address.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface vlan_id

4. no ip address

5. end

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Step 3

interface vlan_id

Example:

Router(config)# interface vlan 1

Step 4

no ip address

Example:

Router(config-subif)# no ip address

Step 5

end

Example:

Router(config-subif)# end

Caution If you are removing the IP address through a telnet session, your connection to the switch

will be lost.

Specifying a Domain Name and Configuring the DNS

Each unique IP address can have a host name associated with it. The Cisco IOS software maintains an
EXEC mode and related Telnet support operations. This cache speeds the process of converting names
to addresses.

Enters interface configuration mode, and enters the VLAN to
which the IP information is assigned.
VLAN 1 is the management VLAN, but you can configure any
VLAN from IDs 1 to 1001.

Removes the IP address and subnet mask.

Returns to privileged EXEC mode.

Book Title

95

How to Configure EtherSwitch HWICs

IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain.
Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco
Systems is a commercial organization that IP identifies by a com domain name, so its domain name is
cisco.com. A specific device in this domain, the FTP system, for example, is identified as ftp.cisco.com.

To track domain names, IP has defined the concept of a domain name server (DNS), the purpose of which
is to hold a cache (or database) of names mapped to IP addresses. To map domain names to IP addresses,
you must first identify the host names and then specify a name server and enable the DNS, the Internet’s
global naming scheme that uniquely identifies network devices.

Specifying the Domain Name

You can specify a default domain name that the software uses to complete domain name requests. You
can specify either a single domain name or a list of domain names. When you specify a domain name,
any IP host name without a domain name has that domain name appended to it before being added to the
host table.

Specifying a Name Server

You can specify up to six hosts that can function as a name server to supply name information for the
DNS.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enabling the DNS

If your network devices require connectivity with devices in networks for which you do not control name
assignment, you can assign device names that uniquely identify your devices within the entire
internetwork. The Internet’s global naming scheme, the DNS, accomplishes this task. This service is
enabled by default.

Enabling Switch Port Analyzer

You can monitor traffic on a given port by forwarding incoming and outgoing traffic on the port to
another port in the same VLAN. A Switch Port Analyzer (SPAN) port cannot monitor ports in a different
VLAN, and a SPAN port must be a static-access port. Any number of ports can be defined as SPAN ports,
and any combination of ports can be monitored. SPAN is supported for up to 2 sessions.

Follow the steps below to enable SPAN.

SUMMARY STEPS

1. enable

2. configure terminal

3. monitor session session-id {destination | source} {interface | vlan interface-id | vlan-id}} [, | - |

both | tx | rx]

4. end

DETAILED STEPS

Book Title

96

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

Step 4

monitor session session-id {destination | source}
{interface | vlan interface-id | vlan-id}} [, |

- | both | tx | rx]

Example:

Router(config)# monitor session session-id
{destination | source} {interface | vlan

interface-id | vlan-id}} [, | - | both | tx | rx]

end

How to Configure EtherSwitch HWICs

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enables port monitoring for a specific session (“number”).

• Optionally, supply a SPAN destination interface and a

source interface.

Returns to privileged EXEC mode.

Example:

Router(config)# end

Disabling SPAN

SUMMARY STEPS

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Follow these steps to disable SPAN.

1. enable

2. configure terminal

3. no monitor session session-id

4. end

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Example:

Router# configure terminal

Book Title

97

How to Configure EtherSwitch HWICs

Command Purpose

Step 3

Step 4

no monitor session session-id

Example:

Router(config)# no monitor session 37

end

Example:

Router(config)# end

Managing the ARP Table

To communicate with a device (on Ethernet, for example), the software first must determine the 48-bit
MAC or local data link address of that device. The process of determining the local data link address
from an IP address is called address resolution.

The Address Resolution Protocol (ARP) associates a host IP address with the corresponding media or
MAC addresses and VLAN ID. Taking an IP address as input, ARP determines the associated MAC
address. Once a MAC address is determined, the IP-MAC address association is stored in an ARP cache
for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network.
Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet
is specified by the Subnetwork Access Protocol (SNAP). By default, standard Ethernet-style ARP
encapsulation (represented by the arpa keyword) is enabled on the IP interface.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Disables port monitoring for a specific session.

Returns to privileged EXEC mode.

When you manually add entries to the ARP table by using the CLI, you must be aware that these entries
do not age and must be manually removed.

Managing the MAC Address Tables

This section describes how to manage the MAC address tables on the HWICs. The following topics are
included:

• Understanding MAC Addresses and VLANs, page 99

• Changing the Address Aging Time, page 99

• Configuring the Aging Time, page 99

• Verifying Aging-Time Configuration, page 100

The switch uses the MAC address tables to forward traffic between ports. All MAC addresses in the
address tables are associated with one or more ports. These MAC tables include the following types of
addresses:

• Dynamic address—A source MAC address that the switch learns and then drops when it is not in use.

• Secure address—A manually entered unicast address that is usually associated with a secured port.

Secure addresses do not age.

• Static address—A manually entered unicast or multicast address that does not age and that is not

lost when the switch resets.

The address tables list the destination MAC address and the associated VLAN ID, module, and port
number associated with the address. The following shows an example of a list of addresses as they would
appear in the dynamic, secure, or static address table.

98

Book Title

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Router# show mac-address-table

Destination Address Address Type VLAN Destination Port

------------------- ------------ ---- -------------------­000a.000b.000c Secure 1 FastEthernet0/1/8
000d.e105.cc70 Self 1 Vlan1
00aa.00bb.00cc Static 1 FastEthernet0/1/0

Understanding MAC Addresses and VLANs

All addresses are associated with a VLAN. An address can exist in more than one VLAN and have
different destinations in each. Multicast addresses, for example, could be forwarded to port 1 in VLAN
1 and ports 9, 10, and 11 in VLAN 5.

Each VLAN maintains its own logical address table. A known address in one VLAN is unknown in
another until it is learned or statically associated with a port in the other VLAN. An address can be secure
in one VLAN and dynamic in another. Addresses that are statically entered in one VLAN must be static
addresses in all other VLANs.

Changing the Address Aging Time

Dynamic addresses are source MAC addresses that the switch learns and then drops when they are not
in use. Use the Aging Time field to define how long the switch retains unseen addresses in the table. This
parameter applies to all VLANs.

How to Configure EtherSwitch HWICs

Configuring the Aging Time

Setting too short an aging time can cause addresses to be prematurely removed from the table. Then
when the switch receives a packet for an unknown destination, it floods the packet to all ports in the same
VLAN as the receiving port. This unnecessary flooding can impact performance. Setting too long an
aging time can cause the address table to be filled with unused addresses; it can cause delays in
establishing connectivity when a workstation is moved to a new port.

Follow these steps to configure the dynamic address table aging time.

SUMMARY STEPS

1. enable

2. configure terminal

3. mac-address-table aging-time seconds

4. end

Book Title

99

How to Configure EtherSwitch HWICs

DETAILED STEPS

Command Purpose

Step 1

enable

Example:

Router> enable

Step 2

configure terminal

Example:

Router# configure terminal

Step 3

mac-address-table aging-time seconds

Example:

Router(config)# mac-address-table
aging-time 30000

Step 4

end

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards

Enables privileged EXEC mode.

• Enter your password if prompted.

Enters global configuration mode.

Enters the number of seconds that dynamic addresses are to be
retained in the address table.

• Valid entries are from 10 to 1000000.

Returns to privileged EXEC mode.

Example:

Router(config)# end

Verifying Aging-Time Configuration

Use the show mac-address-table aging-time command to verify configuration:

Router# show mac-address-table aging-time

Removing Dynamic Addresses

Follow these steps to remove a dynamic address entry.

SUMMARY STEPS

1. enable

2. configure terminal

3. no mac-address-table dynamic hw-addr

4. end

100

Book Title