Cisco IE 2000 User Manual

Cisco IE 2000 Switch Software

Configuration Guide

Cisco IOS Release 15.0(1)EY

July 2012

Americas Headquarters

Cisco Systems, Inc. 170 West Tasman Drive

San Jose, CA 95134-1706 USA http://www.cisco.com Tel: [phone]

800 553-NETS (6387) Fax: [phone]

Text Part Number: OL-25866-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco IE 2000 Switch Software Configuration Guide

© 2012 Cisco Systems, Inc. All rights reserved.

C O N T E N T S

Preface li

Audience

li

Purpose

li

Conventions li

Related Publications

lii

Obtaining Documentation, Obtaining Support, and Security Guidelines liii

Configuration Overview

C H A P T E R 1

1-1

Features

1-1

Feature Software Licensing

1-1

Ease-of-Deployment and Ease-of-Use Features

1-2

Performance Features

1-2

Management Options

1-3

Industrial Application

1-4

Manageability Features

1-4

Availability and Redundancy Features

1-5

VLAN Features

1-6

Security Features

1-7

QoS and CoS Features

1-10

Monitoring Features

1-11

Default Settings After Initial Switch Configuration

1-11

Network Configuration Examples

1-14

Design Concepts for Using the Switch

1-14

Ethernet-to-the-Factory Architecture

1-15

Enterprise Zone

1-15

Demilitarized Zone

1-16

Manufacturing Zone

1-16

Topology Options

1-18

Where to Go Next

1-21

Using the Command-Line Interface

C H A P T E R 2

2-1

Information About Using the Command-Line Interface 2-1

Command Modes

2-1

Help System

2-3

Cisco IE 2000 Switch Software Configuration Guide

OL-25866-01

iii

Contents

					Understanding Abbreviated Commands						2-4
					No and default Forms of Commands					2-4
					CLI Error Messages	2-5
					Configuration Logging		2-5
					How to Use the CLI to Configure Features						2-6
					Configuring the Command History					2-6
					Changing the Command History Buffer Size								2-6
					Recalling Commands			2-6
					Disabling the Command History Feature							2-7
					Using Editing Features		2-7
					Enabling and Disabling Editing Features							2-7
					Editing Commands Through Keystrokes							2-7
					Editing Command Lines That Wrap						2-9
					Searching and Filtering Output of show and more Commands 2-10
					Accessing the CLI	2-10
					Accessing the CLI through a Console Connection or through Telnet 2-10
					Configuring Switch Alarms
C H A P T E R 3							3-1
					Finding Feature Information		3-1
					Information About Switch Alarms				3-1
					Global Status Monitoring Alarms					3-2
					FCS Error Hysteresis Threshold				3-2
					Port Status Monitoring Alarms				3-2
					Triggering Alarm Options			3-3
					External Alarms	3-4
					Default Switch Alarm Settings				3-5
					How to Configure Switch Alarms				3-5
					Configuring External Alarms				3-5
					Configuring the Power Supply Alarms						3-6
					Configuring the Switch Temperature Alarms							3-6
					Associating the Temperature Alarms to a Relay								3-7
					Configuring the FCS Bit Error Rate Alarm 3-7
					Setting the FCS Error Threshold					3-7
					Setting the FCS Error Hysteresis Threshold								3-8
					Configuring Alarm Profiles			3-8
					Creating an Alarm Profile				3-8
					Modifying an Alarm Profile 3-8
					Attaching an Alarm Profile to a Specific Port								3-9
					Enabling SNMP Traps		3-9
				Cisco IE 2000 Switch Software Configuration Guide
	iv												OL-25866-01

Contents

Monitoring and Maintaining Switch Alarms Status				3-9
Configuration Examples for Switch Alarms			3-10
Configuring External Alarms: Example			3-10
Associating Temperature Alarms to a Relay: Examples					3-10
Creating or Modifying an Alarm Profile: Example 3-10
Setting the FCS Error Hysteresis Threshold: Example					3-11
Configuring a Dual Power Supply: Examples				3-11
Displaying Alarm Settings: Example			3-11
Additional References		3-12
Related Documents		3-12
Standards 3-12
MIBs	3-12
RFCs	3-13

	Technical Assistance		3-13
	Performing Switch Setup Configuration
C H A P T E R 4						4-1
	Restrictions for Performing Switch Setup Configuration							4-1
	Information About Performing Switch Setup Configuration 4-1
	Switch Boot Process		4-1
	Default Switch Boot Settings				4-3
	Switch Boot Optimization			4-3
	Switch Information Assignment				4-4
	Switch Default Settings			4-4
	DHCP-Based Autoconfiguration Overview						4-4
	DHCP Client Request Process					4-5
	DHCP-Based Autoconfiguration and Image Update							4-6
	DHCP Autoconfiguration				4-6
	DHCP Auto-Image Update				4-6
	DHCP Server Configuration Guidelines						4-7
	TFTP Server	4-7
	DNS Server	4-8
	Relay Device	4-8

	How to Obtain Configuration Files	4-9
	How to Control Environment Variables		4-10
	Common Environment Variables	4-11
	Scheduled Reload of the Software Image		4-11
	How to Perform Switch Setup Configuration		4-12
	Configuring DHCP Autoconfiguration (Only Configuration File) 4-12
	Configuring DHCP Auto-Image Update (Configuration File and Image) 4-13
			Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01				v

Contents

Configuring the Client 4-14
Manually Assigning IP Information on a Routed Port 4-14
Manually Assigning IP Information to SVIs		4-15
Modifying the Startup Configuration	4-15
Specifying the Filename to Read and Write the System Configuration 4-15
Manually Booting the Switch	4-16
Booting a Specific Software Image		4-17

	Monitoring Switch Setup Configuration					4-17
	Verifying the Switch Running Configuration 4-17
	Configuration Examples for Performing Switch Setup Configuration 4-18
	Retrieving IP Information Using DHCP-Based Autoconfiguration: Example 4-18
	Scheduling Software Image Reload: Examples							4-20
	Configuring DHCP Auto-Image Update: Example							4-20
	Configuring a Switch as a DHCP Server: Example 4-20
	Configuring Client to Download Files from DHCP Server								4-21
	Additional References			4-22
	Related Documents			4-22
	Standards 4-22
	MIBs	4-22
	RFCs	4-22
	Technical Assistance				4-22
	Configuring Cisco IOS Configuration Engine
C H A P T E R 5							5-1
	Finding Feature Information				5-1
	Prerequisites for Configuring Cisco IOS Configuration Engine								5-1
	Information About Configuring Cisco IOS Configuration Engine								5-2
	Configuration Service				5-3
	Event Service		5-3
	NameSpace Mapper				5-4
	CNS IDs and Device Hostnames					5-4
	ConfigID		5-4
	DeviceID		5-4
	Hostname and DeviceID Interaction						5-5
	Using Hostname, DeviceID, and ConfigID							5-5
	Cisco IOS Agents			5-5
	Initial Configuration 5-5
	Incremental (Partial) Configuration						5-6
	Synchronized Configuration					5-6

			How to Configure Cisco IOS Configuration Engine	5-7
			Cisco IE 2000 Switch Software Configuration Guide
	vi			OL-25866-01

Contents

		Configuring Cisco IOS Agents				5-7
		Enabling CNS Event Agent					5-7
		Enabling Cisco IOS CNS Agent and an Initial Configuration										5-8
		Enabling a Partial Configuration						5-10
		Monitoring and Maintaining Cisco IOS Configuration Engine										5-11
		Configuration Examples for Cisco IOS Configuration Engine									5-11
		Enabling the CNS Event Agent: Example							5-11
		Configuring an Initial CNS Configuration: Examples								5-11
		Additional References 5-12
		Related Documents			5-12
		Standards		5-12
		MIBs	5-12
		RFCs	5-12
		Technical Assistance			5-13
		Configuring Switch Clusters
C H A P T E R 6						6-1
		Finding Feature Information				6-1
		Prerequisites for Configuring Switch Clusters							6-1
		Cluster Command Switch Characteristics							6-1
		Standby Cluster Command Switch Characteristics								6-2
		Candidate Switch and Cluster Member Switch Characteristics 6-2
		Restrictions for Configuring Switch Clusters							6-3
		Information About Configuring Switch Clusters							6-3
		Benefits of Clustering Switches						6-3
		Eligible Cluster Switches				6-3
		How to Plan for Switch Clustering					6-4
		Automatic Discovery of Cluster Candidates and Members										6-5
		Discovery Through CDP Hops						6-5
		Discovery Through Non-CDP-Capable and Noncluster-Capable Devices 6-7
		Discovery Through Different VLANs							6-7
		Discovery Through Different Management VLANs									6-8
		Discovery Through Routed Ports 6-9
		Discovery of Newly Installed Switches 6-10
		IP Addresses		6-11
		Hostnames		6-11
		Passwords		6-12
		SNMP Community Strings 6-12
		TACACS+ and RADIUS				6-12
		LRE Profiles		6-13
									Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01													vii

Contents

Managing Switch Clusters 6-13
Using the CLI to Manage Switch Clusters			6-13
Using SNMP to Manage Switch Clusters			6-14
Additional References		6-15
Related Documents		6-15
Standards 6-15
MIBs	6-15
RFCs	6-15

					Technical Assistance		6-15
					Performing Switch Administration
C H A P T E R 7										7-1
					Finding Feature Information			7-1
					Information About Performing Switch Administration							7-1
					System Time and Date Management						7-1
					System Clock		7-1
					Network Time Protocol				7-2
					NTP Version 4		7-3
					DNS 7-4
					Default DNS Configuration					7-4
					Login Banners	7-4
					System Name and Prompt				7-5
					MAC Address Table		7-5
					Address Table		7-5
					MAC Addresses and VLANs 7-5
					Default MAC Address Table Configuration							7-6
					Address Aging Time for VLANs						7-6
					MAC Address Change Notification Traps							7-6
					Static Addresses		7-6
					Unicast MAC Address Filtering						7-7
					MAC Address Learning on a VLAN 7-8
					ARP Table Management			7-8
					How to Perform Switch Administration						7-9
					Configuring Time and Date Manually						7-9
					Setting the System Clock					7-9
					Configuring the Time Zone					7-9
					Configuring Summer Time (Daylight Saving Time)								7-10
					Configuring Summer Time (Exact Date and Time)								7-11
					Configuring a System Name				7-11
					Setting Up DNS	7-11
				Cisco IE 2000 Switch Software Configuration Guide
	viii												OL-25866-01

Contents

	Configuring Login Banners 7-12
	Configuring a Message-of-the-Day Login Banner									7-12
	Configuring a Login Banner 7-13
	Managing the MAC Address Table						7-13
	Changing the Address Aging Time							7-13
	Configuring MAC Address Change Notification Traps										7-14
	Configuring MAC Address Move Notification Traps										7-15
	Configuring MAC Threshold Notification Traps									7-15
	Adding and Removing Static Address Entries								7-17
	Configuring Unicast MAC Address Filtering								7-17
	Disabling MAC Address Learning on a VLAN								7-17
	Monitoring and Maintaining Switch Administration								7-18
	Configuration Examples for Performing Switch Admininistration 7-18
	Setting the System Clock: Example						7-18
	Configuring Summer Time: Examples							7-18
	Configuring a MOTD Banner: Examples							7-19
	Configuring a Login Banner: Example							7-19
	Configuring MAC Address Change Notification Traps: Example											7-19
	Sending MAC Address Move Notification Traps: Example										7-20
	Configuring MAC Threshold Notification Traps: Example										7-20
	Adding the Static Address to the MAC Address Table: Example											7-20
	Configuring Unicast MAC Address Filtering: Example									7-20
	Additional References			7-21
	Related Documents			7-21
	Standards		7-21
	MIBs	7-21
	RFCs	7-21
	Technical Assistance				7-21
	Configuring PTP
C H A P T E R 8			8-1
	Finding Feature Information				8-1
	Prerequisites for Configuring PTP					8-1
	Restrictions for Configuring PTP					8-1
	Information About Configuring PTP					8-1
	Precision Time Protocol				8-1
	How to Configure PTP			8-2
	Default PTP Settings				8-2
	Setting Up PTP 8-3

	Monitoring and Maintaining the PTP Configuration	8-3
	Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01			ix

Contents

				Troubleshooting the PTP Configuration							8-4
				Additional References				8-4
				Related Documents				8-4
				Standards		8-4
				MIBs	8-4
				RFCs	8-5
				Technical Assistance					8-5
				Configuring PROFINET
C H A P T E R 9							9-1
				Finding Feature Information					9-1
				Restrictions for Configuring PROFINET							9-1
				Information About Configuring PROFINET							9-1
				PROFINET Device Roles					9-2
				PROFINET Device Data Exchange 9-2
				How to Configure PROFINET					9-4
				Configuring PROFINET					9-4
				Default Configuration					9-4
				Enabling PROFINET				9-4
				Monitoring and Maintaining PROFINET							9-5
				Troubleshooting PROFINET					9-5
				Additional References				9-6
				Related Documents				9-6
				Standards		9-6
				MIBs	9-6
				RFCs	9-6
				Technical Assistance					9-6
				Configuring CIP
C H A P T E R 10						10-1
				Finding Feature Information					10-1
				Restrictions for Configuring CIP						10-1
				Information About Configuring CIP						10-1
				How to Configure CIP				10-1
				Default Configuration					10-1
				Enabling CIP 10-2
				Monitoring CIP		10-2
				Troubleshooting CIP			10-2
				Additional References				10-3
				Related Documents				10-3
			Cisco IE 2000 Switch Software Configuration Guide
	x										OL-25866-01

Cisco IE 2000 Switch Software Configuration Guide

12-5

12-4

12-4

12-4

12-3

Contents

Standards 10-3

MIBs 10-3

RFCs 10-3

	Technical Assistance			10-3
	Configuring SDM Templates
C H A P T E R 11				11-1
	Finding Feature Information			11-1
	Prerequisites for Configuring SDM Templates				11-1
	Restrictions for Configuring SDM Templates				11-1
	Information About Configuring SDM Templates				11-1
	SDM Templates		11-1
	Dual IPv4 and IPv6 SDM Default Template				11-3
	How to Configure the Switch SDM Templates				11-4
	Setting the SDM Template 11-4
	Monitoring and Maintaining SDM Templates				11-4
	Configuration Examples for Configuring SDM Templates 11-5
	Configuring the IPv4-and-IPv6 Default Template: Example 11-5
	Additional References		11-6
	Related Documents 11-6
	Standards 11-6
	MIBs	11-6
	RFCs	11-6

	Technical Assistance	11-6
	Configuring Switch-Based Authentication 12-1
C H A P T E R 12
	Finding Feature Information	12-1
	Prerequisites for Configuring Switch-Based Authentication		12-1
	Restrictions for Configuring Switch-Based Authentication		12-1
	Information About Configuring Switch-Based Authentication		12-2
	Prevention for Unauthorized Switch Access 12-2
	Password Protection	12-2

Default Password and Privilege Level Configuration 12-2

Enable Secret Passwords with Encryption

Password Recovery 12-3

Telnet Password for a Terminal Line

Username and Password Pairs

Multiple Privilege Levels

Switch Access with TACACS+

	OL-25866-01		xi

Contents

			TACACS+	12-5
			TACACS+ Operation		12-6
			Default TACACS+ Configuration					12-7
			TACACS+ Server Host and the Authentication Key							12-7
			TACACS+ Login Authentication					12-7
			TACACS+ Authorization for Privileged EXEC Access and Network Services 12-7
			TACACS+ Accounting		12-8
			Switch Access with RADIUS			12-8
			RADIUS	12-8
			RADIUS Operation		12-9
			Default RADIUS Configuration					12-10
			RADIUS Change of Authorization						12-10
			CoA Request Commands			12-12
			RADIUS Server Host		12-14
			RADIUS Login Authentication				12-15
			Radius Method List		12-15
			AAA Server Groups		12-15
			RADIUS Authorization for User Privileged Access and Network Services								12-16
			RADIUS Accounting		12-16
			Establishing a Session with a Router if the AAA Server is Unreachable								12-16
			Vendor-Specific RADIUS Attributes						12-16
			Vendor-Proprietary RADIUS Server Communication							12-17
			Switch Access with Kerberos			12-17
			Understanding Kerberos			12-17
			Kerberos Operation		12-19
			Kerberos Configuration			12-20
			Local Authentication and Authorization						12-20
			Secure Shell	12-21
			SSH 12-21
			SSH Servers, Integrated Clients, and Supported Versions 12-21
			Limitations	12-22
			SSH Configuration Guidelines					12-22
			Switch for Secure Socket Layer HTTP						12-22
			Secure HTTP Servers and Clients						12-22
			Default SSL Settings		12-23
			Certificate Authority Trustpoints						12-23
			CipherSuites 12-24
			Secure Copy Protocol 12-24
			How to Configure Switch-Based Authentication 12-26
			Configuring Password Protection				12-26
			Cisco IE 2000 Switch Software Configuration Guide
	xii										OL-25866-01

Contents

	Setting or Changing a Static Enable Password						12-26
	Protecting Enable and Enable Secret Passwords with Encryption 12-27
	Disabling Password Recovery		12-27
	Setting a Telnet Password for a Terminal Line						12-28
	Configuring Username and Password Pairs					12-28
	Setting the Privilege Level for a Command					12-29
	Changing the Default Privilege Level for Lines						12-29
	Logging Into and Exiting a Privilege Level					12-30
	Configuring TACACS+	12-30
	Identifying the TACACS+ Server Host and Setting the Authentication Key 12-30
	Configuring TACACS+ Login Authentication					12-31
	Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services												12-33
	Starting TACACS+ Accounting		12-33
	Configuring Radius Server Communication				12-33
	Defining AAA Server Groups		12-35
	Configuring RADIUS Login Authentication					12-36
	Configuring RADIUS Authorization for User Privileged Access and Network Services												12-37
	Starting RADIUS Accounting		12-37
	Configuring Settings for All RADIUS Servers					12-37
	Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 12-38
	Configuring CoA on the Switch 12-38
	Configuring the Switch for Local Authentication and Authorization									12-39
	Configuring Secure Shell	12-40
	Setting Up the Switch to Run SSH			12-40
	Configuring the SSH Server		12-40
	Configuring Secure HTTP Servers and Clients 12-42
	Configuring a CA Trustpoint		12-42
	Configuring the Secure HTTP Server				12-42
	Configuring the Secure HTTP Client				12-44
	Monitoring and Maintaining Switch-Based Authentication							12-44
	Configuration Examples for Configuring Switch-Based Authentication									12-45
	Changing the Enable Password: Example				12-45
	Configuring the Encrypted Password: Example					12-45
	Setting the Telnet Password for a Terminal Line: Example								12-45
	Setting the Privilege Level for a Command: Example						12-45
	Configuring the RADIUS Server: Examples				12-45
	Defining AAA Server Groups: Example			12-46
	Configuring Vendor-Specific RADIUS Attributes: Examples								12-46
	Configuring a Vendor-Proprietary RADIUS Host: Example								12-46
	Sample Output for a Self-Signed Certificate: Example							12-46
					Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01												xiii

Contents

Verifying Secure HTTP Connection: Example 12-47
Additional References		12-47
Related Documents		12-47
Standards 12-48
MIBs	12-48
RFCs	12-48

	Technical Assistance			12-48
	Configuring IEEE 802.1x Port-Based Authentication
C H A P T E R 13										13-1
	Finding Feature Information				13-1
	Restrictions for Configuring IEEE 802.1x Port-Based Authentication 13-1
	Information About Configuring IEEE 802.1x Port-Based Authentication										13-1
	IEEE 802.1x Port-Based Authentication						13-1
	Device Roles		13-2
	Authentication Process				13-3
	Switch-to-RADIUS-Server Communication							13-4
	Authentication Initiation and Message Exchange									13-4
	Authentication Manager				13-6
	Port-Based Authentication Methods							13-6
	Per-User ACLs and Filter-Ids 13-7
	Authentication Manager CLI Commands								13-8
	Ports in Authorized and Unauthorized States								13-9
	802.1x	Host Mode		13-9
	Multidomain Authentication					13-10
	802.1x	Multiple Authentication Mode					13-11
	MAC Move		13-12
	MAC Replace		13-12
	802.1x	Accounting		13-13
	802.1x	Accounting Attribute-Value Pairs						13-13
	802.1x	Readiness Check			13-14
	802.1x	Authentication with VLAN Assignment								13-15
	Voice Aware 802.1x Security					13-16
	802.1x	Authentication with Per-User ACLs						13-17
	802.1x	Authentication with Downloadable ACLs and Redirect URLs									13-18

Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL 13-19

Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs 13-19

			VLAN ID-Based MAC Authentication		13-20
			802.1x	Authentication with Guest VLAN	13-20
			802.1x	Authentication with Restricted VLAN 13-21
			Cisco IE 2000 Switch Software Configuration Guide
	xiv				OL-25866-01

Contents

802.1x	Authentication with Inaccessible Authentication Bypass 13-22
Support on Multiple-Authentication Ports				13-22
Authentication Results 13-22
Feature Interactions		13-23
802.1x	Authentication with Voice VLAN Ports			13-23
802.1x	Authentication with Port Security		13-24
802.1x Authentication with Wake-on-LAN			13-24
802.1x	Authentication with MAC Authentication Bypass 13-25
802.1x	User Distribution	13-26

802.1x User Distribution Configuration Guidelines	13-26
Network Admission Control Layer 2 802.1x Validation	13-27
Flexible Authentication Ordering 13-27

Open1x Authentication 13-28

802.1x Supplicant and Authenticator Switches with Network Edge Access Topology (NEAT) 13-28

	802.1x Supplicant and Authenticator Switch Guidelines						13-29
	Using IEEE 802.1x Authentication with ACLs and the RADIUS Filter-Id Attribute 13-29
	Authentication Manager Common Session ID				13-30
	Default 802.1x Authentication Settings			13-30
	802.1x Accounting 13-31
	802.1x Authentication Guidelines		13-32
	VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass
	Guidelines 13-33
	MAC Authentication Bypass Guidelines 13-33
	Maximum Number of Allowed Devices Per Port Guidelines						13-34
	How to Configure IEEE 802.1x Port-Based Authentication					13-34
	802.1x Authentication Configuration Process				13-34
	Configuring the Switch-to-RADIUS-Server Communication						13-36
	Configuring 802.1x Readiness Check			13-36
	Enabling Voice Aware 802.1x Security			13-37
	Configuring 802.1x Violation Modes			13-37
	Configuring the Host Mode	13-38
	Configuring Periodic Reauthentication			13-39
	Configuring Optional 802.1x Authentication Features					13-40
	Configuring 802.1x Accounting		13-42
	Configuring a Guest VLAN	13-42
	Configuring a Restricted VLAN		13-43
	Configuring the Maximum Number of Authentication Attempts 13-43
	Configuring Inaccessible Authentication Bypass				13-44
	Configuring 802.1x User Distribution			13-46
	Configuring NAC Layer 2 802.1x Validation 13-46
				Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01								xv

Contents

Configuring an Authenticator and Supplicant					13-47
Configuring an Authenticator 13-47
Configuring a Supplicant Switch with NEAT					13-47
Configuring 802.1x Authentication with Downloadable ACLs and Redirect URLs 13-48
Configuring Downloadable ACLs			13-48
Configuring a Downloadable Policy				13-49
Configuring Open1x		13-50
Resetting the 802.1x Authentication Configuration to the Default Values							13-51
Monitoring and Maintaining IEEE 802.1x Port-Based Authentication 13-51
Configuration Examples for Configuring IEEE 802.1x Port-Based Authentication							13-51
Enabling a Readiness Check: Example			13-51
Enabling 802.1x Authentication: Example				13-52
Enabling MDA: Example 13-52
Disabling the VLAN Upon Switch Violoation: Example						13-52
Configuring the Radius Server Parameters: Example						13-52
Configuring 802.1x Accounting: Example				13-52
Enabling an 802.1x Guest VLAN: Example				13-53
Displaying Authentication Manager Common Session ID: Examples 13-53
Configuring Inaccessible Authentication Bypass: Example 13-53
Configuring VLAN Groups: Examples			13-54
Configuring NAC Layer 2 802.1x Validation: Example						13-54
Configuring an 802.1x Authenticator Switch: Example						13-54
Configuring an 802.1x Supplicant Switch: Example						13-55
Configuring a Downloadable Policy: Example					13-55
Configuring Open 1x on a Port: Example				13-55
Additional References		13-56
Related Documents		13-56
Standards 13-56
MIBs	13-56
RFCs	13-56

				Technical Assistance	13-57
				Configuring Web-Based Authentication 14-1
C H A P T E R 14
				Finding Feature Information	14-1
				Prerequisites for Configuring Web-Based Authentication		14-1
				Restrictions for Configuring Web-Based Authentication on the IE 2000 Switch 14-1
				Information About Configuring Web-Based Authentication		14-2
				Web-Based Authentication 14-2
				Device Roles 14-2
			Cisco IE 2000 Switch Software Configuration Guide
	xvi					OL-25866-01

Contents

	Host Detection	14-3
	Session Creation	14-3
	Authentication Process		14-4
	Local Web Authentication Banner				14-4
	Web Authentication Customizable Web Pages							14-6
	Web Authentication Guidelines					14-6
	Web-Based Authentication Interactions with Other Features									14-8
	Port Security	14-8
	LAN Port IP	14-8
	Gateway IP	14-9
	ACLs 14-9
	Context-Based Access Control					14-9
	802.1x Authentication			14-9
	EtherChannel	14-9
	Default Web-Based Authentication Settings 14-10
	Configuring Switch-to-RADIUS-Server Communication								14-10
	How to Configure Web-Based Authentication						14-11
	Configuring the Authentication Rule and Interfaces 14-11
	Configuring AAA Authentication				14-11
	Configuring Switch-to-RADIUS-Server Communication								14-12
	Configuring the HTTP Server			14-12
	Customizing the Authentication Proxy Web Pages								14-13
	Specifying a Redirection URL for Successful Login								14-13
	Configuring the Web-Based Authentication Parameters 14-13
	Configuring a Web Authentication Local Banner							14-14
	Removing Web-Based Authentication Cache Entries								14-14
	Monitoring and Maintaining Web-Based Authentication								14-14
	Configuration Examples for Configuring Web-Based Authentication										14-14
	Enabling and Displaying Web-Based Authentication: Examples										14-14
	Enabling AAA: Example		14-15
	Configuring the RADIUS Server Parameters: Example								14-15
	Configuring a Custom Authentication Proxy Web Page: Example										14-15
	Verifying a Custom Authentication Proxy Web Page: Example										14-15
	Configuring a Redirection URL: Example						14-16
	Verifying a Redirection URL: Example					14-16
	Configuring a Local Banner: Example					14-16
	Clearing the Web-Based Authentication Session: Example									14-16
	Additional References	14-17
	Related Documents 14-17
							Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01												xvii

Contents

Standards 14-17

MIBs 14-17

RFCs 14-18

	Technical Assistance		14-18
	Configuring Interface Characteristics
C H A P T E R 15				15-1
	Finding Feature Information		15-1
	Restrictions for Configuring Interface Characteristics				15-1
	Information About Configuring Interface Characteristics				15-1
	Interface Types	15-1
	Port-Based VLANs		15-2
	Switch Ports	15-2
	Routed Ports	15-3
	Access Ports	15-3
	Trunk Ports	15-4
	EtherChannel Port Groups			15-4
	Dual-Purpose Uplink Ports			15-4
	Connecting Interfaces 15-5

			Using Interface Configuration Mode				15-6
			Default Ethernet Interface Settings				15-8
			Interface Speed and Duplex Mode				15-9
			Speed and Duplex Configuration Guidelines						15-9
			IEEE 802.3x Flow Control		15-9
			Auto-MDIX on an Interface		15-10
			SVI Autostate Exclude	15-10
			System MTU 15-10
			How to Configure Interface Characteristics					15-11
			Configuring Layer 3 Interfaces 15-11
			Configuring Interfaces	15-13
			Configuring a Range of Interfaces			15-13
			Interface Range Restrictions			15-13
			Configuring and Using Interface Range Macros						15-14
			Configuring Ethernet Interfaces		15-15
			Setting the Type of a Dual-Purpose Uplink Port						15-15
			Setting the Interface Speed and Duplex Parameters 15-16
			Configuring IEEE 802.3x Flow Control					15-16
			Configuring Auto-MDIX on an Interface					15-17
			Adding a Description for an Interface					15-17
			Configuring SVI Autostate Exclude				15-17
			Cisco IE 2000 Switch Software Configuration Guide
	xviii								OL-25866-01

Contents

		Configuring the System MTU					15-18
		Monitoring and Maintaining Interface Characteristics								15-18
		Monitoring Interface Status					15-18
		Clearing and Resetting Interfaces and Counters								15-19
		Shutting Down and Restarting the Interface							15-19
		Configuration Examples for Configuring Interface Characteristics 15-20
		Configuring the Interface Range: Examples							15-20
		Configuring Interface Range Macros: Examples								15-20
		Setting Speed and Duplex Parameters: Example								15-21
		Enabling auto-MDIX: Example					15-21
		Adding a Description on a Port: Example 15-21
		Configuring SVI Autostate Exclude: Example							15-22
		Additional References			15-22
		Related Documents			15-22
		Standards		15-22
		MIBs	15-22
		RFCs	15-23
		Configuring Smartports Macros 16-1
C H A P T E R 16
		Finding Feature Information				16-1
		Information About Configuring Smartports Macros								16-1
		How to Configure Smartports Macros						16-1
		Default Smartports Settings					16-1
		Smartports Configuration Guidelines 16-2
		Applying Smartports Macros					16-3
		Monitoring and Maintaining Smartports Macros							16-4
		Configuration Examples for Smartports Macros							16-4
		Applying the Smartports Macro: Examples							16-4
		Additional References			16-5
		Related Documents			16-5
		Standards		16-5
		MIBs	16-5
		RFCs	16-6
		Technical Assistance				16-6
		Configuring VLANs
C H A P T E R 17				17-1
		Finding Feature Information				17-1
		Information About Configuring VLANs						17-1
								Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01											xix

Contents

			VLANs 17-1
			Supported VLANs	17-2
			VLAN Port Membership Modes			17-3
			Normal-Range VLANs		17-4
			Token Ring VLANs		17-5
			Normal-Range VLAN Configuration Guidelines								17-6
			Default Ethernet VLAN Configuration						17-6
			Ethernet VLANs		17-7
			VLAN Removal	17-7
			Static-Access Ports for a VLAN					17-7
			Extended-Range VLANs 17-8
			Default VLAN Configuration				17-8
			Extended-Range VLAN Configuration Guidelines									17-8
			VLAN Trunks 17-9
			Trunking Overview		17-9
			IEEE 802.1Q Configuration Guidelines						17-10
			Default Layer 2 Ethernet Interface VLAN Settings									17-11
			Ethernet Interface as a Trunk Port					17-11
			Trunking Interaction with Other Features							17-11
			Allowed VLANs on a Trunk			17-12
			Native VLAN for Untagged Traffic					17-12
			Load Sharing Using Trunk Ports					17-12
			Load Sharing Using STP Port Priorities							17-13
			Load Sharing Using STP Path Cost					17-13
			VMPS 17-14
			Dynamic-Access Port VLAN Membership							17-15
			Default VMPS Client Settings				17-15
			VMPS Configuration Guidelines					17-15
			VMPS Reconfirmation Interval				17-16
			Dynamic-Access Port VLAN Membership							17-16
			How to Configure VLANs		17-17
			Creating or Modifying an Ethernet VLAN						17-17
			Deleting a VLAN	17-17
			Assigning Static-Access Ports to a VLAN						17-17
			Creating an Extended-Range VLAN				17-18
			Creating an Extended-Range VLAN with an Internal VLAN ID 17-18
			Configuring an Ethernet Interface as a Trunk Port								17-19
			Defining the Allowed VLANs on a Trunk							17-19
			Changing the Pruning-Eligible List					17-19
			Configuring the Native VLAN for Untagged Traffic									17-20
			Cisco IE 2000 Switch Software Configuration Guide
	xx											OL-25866-01

Contents

	Load Sharing Using STP Port Priorities							17-21
	Configuring Load Sharing Using STP Path Cost 17-21
	Configuring the VMPS Client					17-22
	Entering the IP Address of the VMPS							17-22
	Configuring Dynamic-Access Ports on VMPS Clients 17-23
	Monitoring and Maintaining VLANs						17-23
	Configuration Examples for Configuring VLANs							17-24
	VMPS Network: Example				17-24
	Configuring a VLAN: Example					17-25
	Configuring an Access Port in a VLAN: Example								17-25
	Configuring an Extended-Range VLAN: Example								17-25
	Configuring a Trunk Port: Example						17-25
	Removing a VLAN: Example					17-25
	Show VMPS Output: Example					17-25
	Additional References			17-26
	Related Documents			17-26
	Standards		17-26
	MIBs	17-26
	RFCs	17-26
	Configuring VTP
C H A P T E R 18			18-1
	Finding VTP Feature Information					18-1
	Prerequisites for Configuring VTP					18-1
	Restrictions for Configuring VTP					18-1
	Information About Configuring VTP					18-2
	VTP	18-2
	VTP Domain			18-2
	VTP Modes		18-3
	VTP Mode Guidelines				18-3
	VTP Advertisements				18-4
	VTP Version 2			18-5
	VTP Version 3			18-5
	VTP Version Guidelines					18-6
	VTP Pruning		18-7
	Default VTP Settings 18-9
	VTP Configuration Guidelines					18-9
	Domain Names 18-10
	Passwords		18-10

	Adding a VTP Client Switch to a VTP Domain	18-10
	Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01			xxi

18-12

18-11

18-12

Contents

How to Configure VTP 18-11

Configuring VTP Domain and Parameters

Configuring a VTP Version 3 Password

Enabling the VTP Version

Enabling VTP Pruning 18-13

				Configuring VTP on a Per-Port Basis						18-13
				Adding a VTP Client Switch to a VTP Domain 18-13
				Monitoring and Maintaining VTP				18-14
				Configuration Examples for Configuring VTP							18-14
				Configuring a VTP Server: Example					18-14
				Configuring a Hidden VTP Password: Example								18-15
				Configuring a VTP Version 3 Primary Server: Example									18-15
				Additional References for Configuring VTP						18-15
				Related Documents			18-15
				Standards		18-15
				MIBs	18-16
				RFCs	18-16
				Configuring Voice VLAN
C H A P T E R 19							19-1
				Finding Feature Information 19-1
				Information About Configuring Voice VLAN							19-1
				Voice VLAN		19-1
				Cisco IP Phone Voice Traffic				19-2
				Cisco IP Phone Data Traffic				19-3
				Default Voice VLAN Configuration					19-3
				Voice VLAN Configuration Guidelines						19-3
				Port Connection to a Cisco 7960 IP Phone							19-4
				Priority of Incoming Data Frames					19-4
				How to Configure VTP			19-5
				Configuring Cisco IP Phone for Voice Traffic								19-5
				Configuring the Priority of Incoming Data Frames									19-5
				Monitoring and Maintaining Voice VLAN						19-6
				Configuration Examples for Configuring Voice VLAN								19-6
				Configuring a Cisco IP Phone for Voice Traffic: Example									19-6
				Configuring the Cisco IP Phone Priority of Incoming Data Frames: Example 19-6
				Additional References for Configuring Voice VLAN								19-6
				Related Documents			19-6
				Standards		19-7
				MIBs	19-7
			Cisco IE 2000 Switch Software Configuration Guide
	xxii												OL-25866-01

Contents

		RFCs	19-7
		Configuring STP
C H A P T E R 20				20-1
		Finding Feature Information				20-1
		Prerequisites for Configuring STP					20-1
		Restrictions for Configuring STP					20-1
		Information About Configuring STP						20-1
		STP	20-2
		Spanning-Tree Topology and BPDUs							20-2
		Bridge ID, Switch Priority, and Extended System ID 20-3
		Spanning-Tree Interface States						20-4
		Blocking State			20-5
		Listening State			20-6
		Learning State			20-6
		Forwarding State				20-6
		Disabled State			20-6
		How a Switch or Port Becomes the Root Switch or Root Port									20-7
		Spanning Tree and Redundant Connectivity								20-7
		Spanning-Tree Address Management							20-8
		Accelerated Aging to Retain Connectivity								20-8
		Spanning-Tree Modes and Protocols							20-9
		Supported Spanning-Tree Instances							20-9
		Spanning-Tree Interoperability and Backward Compatibility									20-10
		STP and IEEE 802.1Q Trunks					20-10
		VLAN-Bridge Spanning Tree					20-10
		Default Spanning-Tree Settings						20-11
		Disabling Spanning Tree				20-11
		Root Switch		20-11
		Secondary Root Switch				20-12
		Port Priority		20-12
		Path Cost		20-13
		Spanning-Tree Timers				20-13
		Spanning-Tree Configuration Guidelines								20-13
		How to Configure STP			20-14
		Changing the Spanning-Tree Mode							20-14
		Configuring the Root Switch					20-15
		Configuring a Secondary Root Switch							20-16
		Configuring Port Priority				20-16
		Configuring Path Cost				20-16
										Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01												xxiii

Contents

Configuring Optional STP Parameters 20-17
Monitoring and Maintaining STP 20-17
Additional References		20-18
Related Documents		20-18
Standards 20-18
MIBs	20-18
RFCs	20-18

C H A P T E R 21	Configuring MSTP		21-1
	Finding Feature Information			21-1
	Information About Configuring MSTP					21-1
	MSTP	21-2
	Multiple Spanning-Tree Regions					21-2
	IST, CIST, and CST 21-2
	Operations Within an MST Region						21-3
	Operations Between MST Regions						21-3
	IEEE 802.1s Terminology				21-4
	Hop Count		21-5
	Boundary Ports 21-5
	IEEE 802.1s Implementation				21-6
	Port Role Naming Change					21-6
	Interoperation Between Legacy and Standard Switches 21-6
	Detecting Unidirectional Link Failure						21-7
	Interoperability with IEEE 802.1D STP 21-8
	RSTP	21-8
	Port Roles and the Active Topology						21-8
	Rapid Convergence			21-9
	Synchronization of Port Roles 21-10
	Bridge Protocol Data Unit Format and Processing 21-11
	Processing Superior BPDU Information 21-12
	Processing Inferior BPDU Information						21-12
	Topology Changes			21-12
	Default MSTP Settings			21-13
	MSTP Configuration Guidelines					21-13
	Root Switch		21-14
	Secondary Root Switch			21-15
	Port Priority		21-15
	Path Cost		21-15

			Link Type to Ensure Rapid Transitions	21-15
			Cisco IE 2000 Switch Software Configuration Guide
	xxiv			OL-25866-01

Contents

	Neighbor Type			21-15
	Restarting the Protocol Migration Process						21-16
	How to Configure MSTP				21-16
	Specifying the MST Region Configuration and Enabling MSTP								21-16
	Configuring the Root Switch					21-17
	Configuring the Optional MSTP Parameters						21-18
	Monitoring and Maintaining MSTP					21-20
	Configuration Examples for Configuring MSTP						21-20
	Configuring the MST Region: Example 21-20
	Additional References				21-21
	Related Documents				21-21
	Standards		21-21
	MIBs	21-21
	RFCs 21-21
	Configuring Optional Spanning-Tree Features
C H A P T E R 22							22-1
	Finding Feature Information 22-1
	Prerequisites for the Optional Spanning-Tree Features							22-1
	Restrictions for the Optional Spanning-Tree Features							22-1
	Information About Configuring the Optional Spanning-Tree Features								22-1
	PortFast	22-1
	BPDU Guard			22-2
	BPDU Filtering			22-3
	UplinkFast		22-3
	BackboneFast			22-5
	EtherChannel Guard				22-7
	Root Guard		22-7
	Loop Guard		22-8
	Default Optional Spanning-Tree Settings						22-9

How to Configure the Optional Spanning-Tree Features 22-9

Enabling Optional SPT Features 22-9

Maintaining and Monitoring Optional Spanning-Tree Features 22-10

	Additional References		22-11
	Related Documents		22-11
	Standards 22-11
	MIBs	22-11
	RFCs	22-12
			Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01				xxv

Contents

C H A P T E R 23				Configuring Resilient Ethernet Protocol							23-1
				Finding Feature Information				23-1
				Prerequisites for REP			23-1
				Restrictions for REP			23-1
				Information About Configuring REP						23-1
				REP	23-1
				Link Integrity 23-4
				Fast Convergence			23-4
				VLAN Load Balancing				23-4
				Spanning Tree Interaction					23-6
				REP Ports		23-6
				REP Segments		23-7
				Default REP Configuration					23-7
				REP Configuration Guidelines						23-7
				REP Administrative VLAN					23-8
				How to Configure REP			23-9
				Configuring the REP Administrative VLAN									23-9
				Configuring REP Interfaces					23-9
				Setting Manual Preemption for VLAN Load Balancing 23-12
				Configuring SNMP Traps for REP							23-12
				Monitoring and Maintaining REP						23-12
				Configuration Examples for Configuring REP								23-13
				Configuring the Administrative VLAN: Example 23-13
				Configuring a Primary Edge Port: Examples									23-13
				Configuring VLAN Blocking: Example								23-14
				Additional References			23-14
				Related Documents 23-14
				Standards		23-14
				MIBs	23-15
				RFCs	23-15
				Configuring FlexLinks and the MAC Address-Table Move Update 24-1
C H A P T E R 24
				Finding Feature Information				24-1
				Restrictions for the FlexLinks and the MAC Address-Table Move Update 24-1
				Information About Configuring the FlexLinks and the MAC Address-Table Move Update 24-1
				FlexLinks		24-1
				VLAN FlexLinks Load Balancing and Support									24-2
				FlexLinks Multicast Fast Convergence								24-3
			Cisco IE 2000 Switch Software Configuration Guide
	xxvi												OL-25866-01

24-7

24-6

24-3

24-3

Contents

Learning the Other FlexLinks Port as the mrouter Port

Generating IGMP Reports

Leaking IGMP Reports 24-4

MAC Address-Table Move Update 24-4

Default Settings for FlexLinks and MAC Address-Table Move Update 24-5

Configuration Guidelines for FlexLinks and MAC Address-Table Move Update 24-6

How to Configure the FlexLinks and MAC Address-Table Move Update

Configuring FlexLinks 24-6

Configuring a Preemption Scheme for FlexLinks

Configuring VLAN Load Balancing on FlexLinks 24-7

Configuring the MAC Address-Table Move Update Feature			24-8
Configuring the MAC Address-Table Move Update Messages 24-8
Maintaining and Monitoring the FlexLinks and MAC Address-Table Move Update				24-9
Configuration Examples for the FlexLinks and MAC Address-Table Move Update				24-9
Configuring FlexLinks Port: Examples 24-9
Configuring a Backup Interface: Example 24-11
Configuring a Preemption Scheme: Example 24-11
Configuring VLAN Load Balancing on FlexLinks: Examples			24-12
Configuring MAC Address-Table Move Update: Example			24-13
Additional References		24-13
Related Documents		24-13
Standards 24-13
MIBs	24-14
RFCs	24-14

C H A P T E R 25		Configuring DHCP	25-1
		Finding Feature Information			25-1
		Information About Configuring DHCP				25-1
		DHCP Snooping		25-1
		DHCP Server	25-1
		DHCP Relay Agent		25-2
		DHCP Snooping		25-2
		Option-82 Data Insertion			25-3
		Cisco IOS DHCP Server Database				25-6
		DHCP Snooping Binding Database				25-6
		Default DHCP Snooping Settings				25-7
		DHCP Snooping Configuration Guidelines 25-8
		DHCP Snooping Binding Database Guidelines 25-9
		Packet Forwarding Address 25-9
						Cisco IE 2000 Switch Software Configuration Guide
	OL-25866-01							xxvii

Contents

DHCP Server Port-Based Address Allocation		25-9
How to Configure DHCP 25-10
Configuring the DHCP Relay Agent	25-10
Specifying the Packet Forwarding Address		25-10
Enabling DHCP Snooping and Option 82 25-11
Enabling the DHCP Snooping Binding Database Agent			25-12
Enabling DHCP Server Port-Based Address Allocation			25-13
Preassigning an IP Address 25-13

Monitoring and Maintaining DHCP 25-14
Configuration Examples for Configuring DHCP 25-15
Enabling DHCP Server Port-Based Address Allocation: Examples 25-15
Enabling DHCP Snooping: Example 25-15
Additional References		25-16
Related Documents		25-16
Standards 25-16
MIBs	25-16
RFCs	25-16

C H A P T E R 26	Configuring Dynamic ARP Inspection 26-1
	Finding Feature Information 26-1
	Prerequisites for Dynamic ARP Inspection	26-1
	Restrictions for Dynamic ARP Inspection	26-1
	Information About Dynamic ARP Inspection	26-1

			Dynamic ARP Inspection 26-1
			Interface Trust States and Network Security		26-3
			Rate Limiting of ARP Packets	26-4
			Relative Priority of ARP ACLs and DHCP Snooping Entries				26-4
			Logging of Dropped Packets	26-4
			Default Dynamic ARP Inspection Settings		26-5
			Dynamic ARP Inspection Configuration Guidelines			26-5
			How to Configure Dynamic ARP Inspection 26-6
			Configuring Dynamic ARP Inspection in DHCP Environments				26-6
			Configuring ARP ACLs for Non-DHCP Environments			26-7
			Limiting the Rate of Incoming ARP Packets		26-9
			Performing Validation Checks	26-10
			Configuring the Log Buffer	26-11
			Monitoring and Maintaining Dynamic ARP Inspection			26-12
			Configuration Examples for Dynamic ARP Inspection 26-12
			Cisco IE 2000 Switch Software Configuration Guide
	xxviii						OL-25866-01

Cisco IE 2000 Switch Software Configuration Guide

26-13

26-13

26-13

26-13

26-13

26-12

Contents

Configuring Dynamic ARP Inspection in DHCP Environments: Example 26-12

Configuring ARP ACLs for Non-DHCP Environments: Example

Additional References

Related Documents

Standards

MIBs

RFCs 26-13

Technical Assistance

C H A P T E R 27	Configuring IP Source Guard	27-1
	Finding Feature Information	27-1
	Prerequisites for IP Source Guard		27-1
	Restrictions for IP Source Guard		27-1
	Information About IP Source Guard		27-1

IP Source Guard 27-1
Source IP Address Filtering	27-2
Source IP and MAC Address Filtering 27-2
IP Source Guard for Static Hosts		27-2
IP Source Guard Configuration Guidelines			27-3
How to Configure IP Source Guard		27-4
Enabling IP Source Guard	27-4
Configuring IP Source Guard for Static Hosts on a Layer 2 Access Port 27-4
Configuring IP Source Guard for Static Hosts on a Private VLAN Host Port 27-5
Monitoring and Maintaining IP Source Guard			27-7
Configuration Examples for IP Source Guard			27-7

	Enabling IPSG with Source IP and MAC Filtering: Example 27-7
	Disabling IPSG with Static Hosts: Example			27-7
	Enabling IPSG for Static Hosts: Examples			27-7
	Displaying IP or MAC Binding Entries: Examples 27-8
	Enabling IPSG for Static Hosts: Examples			27-9
	Additional References		27-10
	Related Documents		27-10
	Standards 27-11
	MIBs	27-11
	RFCs	27-11
	Configuring IGMP Snooping and MVR 28-1
C H A P T E R 28
	Finding Feature Information 28-1

	OL-25866-01		xxix

Contents

			Restrictions for IGMP Snooping and MVR						28-1
			Information About IGMP Snooping and MVR							28-1
			IGMP Snooping 28-2
			IGMP Versions	28-2
			Joining a Multicast Group					28-3
			Leaving a Multicast Group					28-5
			Immediate Leave		28-5
			IGMP Configurable-Leave Timer						28-5
			IGMP Report Suppression					28-6
			Default IGMP Snooping Configuration								28-6
			Snooping Methods			28-6
			Multicast Flooding Time After a TCN Event									28-7
			Flood Mode for TCN			28-7
			Multicast Flooding During a TCN Event								28-7
			IGMP Snooping Querier Guidelines							28-7
			IGMP Report Suppression					28-8
			Multicast VLAN Registration				28-8
			MVR in a Multicast Television Application									28-9
			Default MVR Settings			28-11
			MVR Configuration Guidelines and Limitations 28-11
			IGMP Filtering and Throttling				28-12
			Default IGMP Filtering and Throttling Configuration 28-12
			IGMP Profiles	28-13
			IGMP Throttling Action				28-13
			How to Configure IGMP Snooping and MVR							28-14
			Configuring IGMP Snooping				28-14
			Enabling or Disabling IGMP Snooping								28-14
			Setting IGMP Snooping Parameters							28-14
			Configuring TCN		28-15
			Configuring the IGMP Snooping Querier								28-16
			Disabling IGMP Report Suppression							28-16
			Configuring MVR	28-16
			Configuring MVR Global Parameters							28-16
			Configuring MVR Interfaces					28-17
			Configuring IGMP	28-18
			Configuring IGMP Profiles					28-18
			Configuring IGMP Interfaces					28-18
			Monitoring and Maintaining IGMP Snooping and MVR									28-19
			Configuration Examples for IGMP Snooping							28-21
			Cisco IE 2000 Switch Software Configuration Guide
	xxx											OL-25866-01