File Directory105
DHCP Auto Configuration/Image Update106
Chapter 7: Administration: Stack Management 116
Overview116
Types of Units in Stack117
Stack Topology118
Unit ID Assignment119
Master Selection Process120
Stack Changes120
Unit Failure in Stack121
Stack Ports123
Software Auto Synchronization in Stack126
Stack Management130
Chapter 8: Administration: Time Settings132
System Time Configuration133
SNTP Modes134
System Time 135
SNTP Unicast137
SNTP Multicast/Anycast139
SNTP Authentication 140
Time Range141
Recurring Time Range143
Chapter 9: Administration: Discovery 144
Bonjour144
LLDP and CDP145
Discover - LLDP147
Discovery - CDP167
Workflow178
Port Settings179
Error Recovery Settings183
Loopback Detection Settings184
Link Aggregation186
UDLD193
PoE201
Green Ethernet212
Chapter 11: Smartport 219
Overview219
How the Smartport Feature Works224
Auto Smartport225
Error Handling228
Default Configuration228
Relationships with Other Features229
Common Smartport Tasks229
Configuring Smartport Using The Web-based Interface231
Built-in Smartport Macros236
Chapter 12: VLAN Management247
Overview247
Regular VLANs254
Private VLAN Settings262
GVRP Settings262
VLAN Groups263
Voice VLAN269
Access Port Multicast TV VLAN282
Customer Port Multicast TV VLAN285
Overview527
SSH User Authentication533
SSH Server Authentication534
Change User Password on the SSH Server536
Chapter 25: Security: IPv6 First Hop Security537
IPv6 First Hop Security Overview537
Router Advertisement Guard540
Neighbor Discovery Inspection541
DHCPv6 Guard541
Neighbor Binding Integrity542
IPv6 Source Guard544
Attack Protection545
Policies, Global Parameters and System Defaults547
Common Tasks549
Default Settings and Configuration551
Configuring IPv6 First Hop Security through Web GUI552
SNA Sessions643
SNA Graphics644
Top Right-Hand Menu646
Topology View647
Right-Hand Information Panel654
Operations667
Overlays672
Tags676
Search680
Notifications682
Device Authorization Control (DAC)685
DAC Workflow685
Services693
Saving SNA Settings709
Technical Details710
This section provides an introduction to the web-based configuration utility, and covers the
following topics:
1
•Starting the Web-based Configuration Utility
•Out-Of-Band Port
•USB Port
•Basic or Advanced Display Mode
•Quick Start Device Configuration
•Interface Naming Conventions
•Window Navigation
•Search Facility
Starting the Web-based Configuration Utility
This section describes how to navigate the web-based switch configuration utility.
If you are using a pop-up blocker, make sure it is disabled.
Browser Restrictions
If you are using IPv6 interfaces on your management station, use the IPv6 global address and
not the IPv6 link local address to access the device from your browser.
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the device you are configuring in the address bar on the browser, and
then press Enter.
NOTE When the device is using the factory default IP address of 192.168.1.254, its system LED
flashes continuously. When the device is using a DHCP-assigned IP address or an
administrator-configured static IP address, the system LED is on solid.
On the SG350XG and the SG550XG, the default IP address 192.168.1.254 is configured to the
OOB port of the device, while on the other devices it is configured on the default VLAN (Vlan
1). To access the device with the IP address configured on the OOB port, make sure the OOB
port is connected to your network or PC.
Logging In
The default username/password is cisco/cisco. The first time that you log in with the default
username and password, you are required to enter a new password.
NOTE If you have not previously selected a language for the GUI, the language of the Login page is
determined by the language(s) requested by your browser and the lang uages configured on your
device. If your browser requests Chinese, for example, and Chinese has been loaded into your
device, the Login page is automatically displayed in Chinese. If Chinese has not been loaded
into your device, the Login page appears in English.
The languages loaded into the device have a language and country code (en-US, en-GB and so
on). For the Login page to be automatically displayed in a particular language, based on the
browser request, both the language and country code of the browser request must match those
of the language loaded on the device. If the browser request contains only the language code
without a country code (for example: fr). The first embedded language with a matching
language code is taken (without matching the country code, for example: fr_CA).
STEP 1 Enter the username/password. The password can contain up to 64 ASCII characters.
Password-complexity rules are described in Password Strength.
STEP 2 If you are not using English, select the desired language fr om the Lan guage dro p-down menu.
To add a new language to the device or update a current one, see the description of the
Language Menu described in Application Header.
STEP 3 If this is the first time that you logged on with the default user ID (cisco) and the default
password (cisco) or your password has expired, the Change Password Page appears. See
Password Expiration for additional information.
STEP 4 Choose whether to select Password Complexity Settings in the Password Strength page.
STEP 5 Enter the new password and click Apply.
When the login attempt is successful, the Getting Started page appears.
1
If you entered an incorrect username or password, an error message appears and the Login
page remains displayed on the window.
Select Don't show this page on startup to prevent the Getting Started page from being
displayed each time that you log on to the system. If you select this option, the System
Summary page is opened instead of the Getting Started page.
HTTP/HTTPS
You can either open an HTTP session (not secured) by clicking Log In, or you can open an
HTTPS (secured) session, by clicking Secure Browsing (HTTPS). You are asked to approve
the logon with a default RSA key, and an HTTPS session is opened.
NOTE There is no need to input the username/password prior to clicking the Secure Browsing
(HTTPS) button.
For information on how to configure HTTPS, see SSL Server.
Password Expiration
The New Password page is displayed in the following cases:
•The first time that you access the device with the default username cisco and password
cisco. This page forces you to replace the factory default password.
•When the password expires, this page forces you to select a new password.
Logging Out
By default, the application logs out after ten minutes of inactivity. You can change this default
value as described in the Defining Idle Session Timeout section.
!
CAUTION Unless the Running Configuration is copied to the Startup Configuration, rebooting the device
removes all changes made since the last time the file was saved. Save the Running
Configuration to the Startup Configuration before log ging off to preserve any changes you
made during this session.
A flashing red X icon to the left of the Save application link indicates that Running
Configuration changes have not yet been saved to the Startup Configuration file. The flashing
can be disabled by clicking on the Disable Save Icon Blinking button on the Copy/Save
Configuration page
Out-Of-Band Port
When the device auto-discovers a connected device, such as an IP phone (see What is a
Smartport), and it configures the port appropriately for the device. These configuration
commands are written to the Running Configuration file. This causes the Save icon to begin
blinking when the you log on, even though you did not make any configuration changes.
When you click Save, the Copy/Save Configuration page appears. Save the Running
Configuration file by copying it to the Startup Configuration file. After this save, the red X icon
and the Save application link are no longer displayed.
To logout, click Logout in the top right corner of any page. The system logs out of the device.
When a timeout occurs or you intentionally log out of the system, a message is displayed and
the Login page appears, with a message indicating the logged-out state. After you log in, the
application returns to the initial page.
The initial page displayed depends on the “Do not show this page on startup” option in the
Getting Started page. If you did not select this option, the initial page is the Getting Started
page. If you did select this option, the initial page is the System Summary page.
NOTE OOB is only supported on SG350XG and SG550XG devices.
The switch supports an Out-of-Band (OOB) port. This port is used for the management
network. The out-of-band and the in-band ports share the same IP routing table, therefore you
cannot use the same subnet on both in-band and out-of-band interfaces.
The OOB port is assigned an MAC address which is different from the base MAC
address and the addresses of the in-band ports. This MAC address is used as the
source MAC address in all frames (including IP frames) sent by the switch on the
OOB port.
The IP address assigned to this port cannot be assigned to the in-band ports at the same time.
In addition, the IP address assigned to the OOB port must not belong to any IP subnet
configured at the in-band interfaces of the devices.
By default, the OOB port is configured with the default IP address 192.168.1.254. This default
IP address is used when no other address was assigned (dynamically or statically). This sub net
is a reserved one and cannot be assigned on the in-band interfaces.
Bridging
Bridging between the OOB port and the in-band Layer 2 interfaces is not
supported. The OOB port cannot be a member of VLAN or LAG, and the bridge’s
protocols (for example, STP, GVRP, etc.) cannot be enabled on the OOB port.
Only untagged traffic is supported on the OOB port.
Port Configuration
The following Ethernet configuration is supported for the OOB port:
•Speed (10/100/1000)
•Duplex
•Auto-negotiation
DHCP Client
DHCP client (IPv4 and IPv6) is en abled by default on th e OOB port and on the default VLAN.
Only one IPv4 address can be defined on the OOB port.
The default static IP address is set only on the OOB.
IP Applications
All IP applications, such as telnet, SSH, except for the following ones are supported on the
OOB port:
•ARP Proxy
•Routing protocols
•Relay applications (DHCP, DHCPv6 and UDP)
USB Port
QoS & ACL
QoS and ACL are not supported on the OOB port (so all TCAM-based features like DOS
Attack Prevention are also not supported).
Only Management ACLs are supported.
Stack Support
The OOB port name is always mapped to the physical OOB port of master unit. The physical
OOB ports of slaves are not functional and will not establish a link when connected to a
neighbor device or PC.
The USB port can be used for connecting external storage (disk-on-key) devices. It can hold
configuration, SYSLOG and image files. In a stack, only the master’s USB port is active. The
USB port fully supports the F AT32 file system, and provides partial support (read only) for the
NTFS file system.
Both relative path or fully qualified paths can be used.
The system supports the following user actions on the USB port through the GUI:
•Delete, rename and display the contents of USB files
Basic or Advanced Display Mode
The product supports many features, and therefore the WEB GUI includes hundreds of
configuration and display pages. These pages are divided into the following display modes:
•Basic—Basic subset of configuration options are available. If you are missing some
configuration option, select the Advanced mode in the device header.
•Advanced—Full set of configuration options are available.
Navigate from one mode to another, as shown below:
1
When the user switches from basic to advanced, the browser reloads the page. However, after
reload, the user stays on the same page.
When the user switches from advanced to basic, the browser reloads the page. If the page
exists also on the basic mode, the user stays on the same page. If the page does not exist in the
basic mode, the browser will load the first page of the folder which was used by the user . If the
folder does not exist, the Getting Started page will be displayed.
If there is advanced configuration, and the page is loaded in basic mode, a page-level message
will be displayed to the user (e.g. there are 2 radius server configured but in basic mode only a
single server can be displayed, or there is 802.1X port authentication with time range
configured but time range is not visible in basic mode).
When switching from one mode to another, any configuration which was made on the page
(without Apply) is deleted.
There are two hot links on the Getting Started page that take you to Cisco web pages for more
information. Clicking on the Support link takes you to the device product support page, and
clicking on the Forums link takes you to the Support Community page.
This section describes the features of the web-based switch configuration utility.
Application Header
The Application Header appears on every page. It provides the following application links:
Getting Started
Window Navigation
Application Link
Name
UsernameDisplays the name of the user logged on to the device. The default
Description
A flashing red X icon displayed to the left of the Save application
link indicates that Running Configuration changes have been made
that have not yet been saved to the Startup Configuration file. The
flashing of the red X can be disabled on the Copy/Save
Configuration page.
Click Save to display the Copy/Save Configuration page. Save the
Running Configuration file by copying it to the Startup
Configuration file type on the device. After this save, the red X
icon and the Save application link are no longer displayed. When
the device is rebooted, it copies the Startup Configuration file type
to the Running Configuration and sets the device parameters
according to the data in the Running Configuration.
username is cisco. (The default password is cisco).
Language MenuThis menu provides the following options:
LogoutClick to log out of the web-based switch configuration utility.
Description
•Select a language: Select one of the languages that appear
in the menu. This language will be the web-based
configuration utility language.
•Download Language: Add a new language to the device.
•Delete Language: Deletes the second language on the
device. The first language (English) cannot be deleted.
•Debug: Used for translation purposes. If you select this
option, all web-based configuration utility labels disappear
and in their place are the IDs of the strings that correspond
to the IDs in the language file.
NOTE T o upgrade a language file, use the Upgrade/Backup
Firmware/Language page.
AboutClick to display the device name and device version number.
HelpClick to display the online help.
The SYSLOG Alert Status icon appears when a SYSLOG message,
above the critical severity level, is logged. Click the icon to open
the RAM Memory page. After you access this page, the SYSLOG
Alert Status icon is no longer displayed. To display the page when
there is not an active SYSLOG message, Click Status and Statistics > View Log > RAM Memory.
The following table describes the commonly-used buttons that appear on various pages in the
system.
Button NameDescription
Use the pull-down menu to configure the number of entries per
page.
Indicates a mandatory field.
AddClick to display the related Add page and add an entry to a table.
Enter the information and click Apply to save it to the Running
Configuration. Click Close to return to the main page. Click Save
to display the Copy/Save Configuration page and save the Running
Configuration to the Startup Configuration file type on the device.
ApplyClick to apply changes to the Running Configuration on the device.
If the device is rebooted, the Running Configuration is lost, unless
it is saved to the Startup Configuration file type or another file
type. Click Save to display the Copy/Save Configuration page and
save the Running Configuration to the Startup Configuration file
type on the device.
CancelClick to reset changes made on the page.
Clear FilterClick to clear filter to select information displayed.
Clear All Interfaces
Counters
Clear Interface
Counters
Clear LogsClears log files.
Clear TableClears table entries.
CloseReturns to main page. If any changes were not applied to the
Click to clear the statistic counters for all interfaces.
Click to clear the statistic counters for the selected interface.
Copy SettingsA table typically contains one or more entries containing
configuration settings. Instead of modifying each entry
individually, it is possible to modify one entry and then copy the
selected entry to multiple entries, as described below:
1. Select the entry to be copied. Click Copy Settings to display the
popup.
2. Enter the destination entry numbers in the to field.
3. Click Apply to save the changes and click Close to return to the
main page.
DeleteAfter selecting an entry in the table, click Delete to remove.
DetailsClick to display the details associated with the entry selected.
Search Facility
EditSelect the entry and click Edit. The Edit page appears, and the
entry can be modified.
1. Click Apply to save the changes to the Running Configuration.
2. Click Close to return to the main page.
GoEnter the query filtering criteria and click Go. The results are
displayed on the page.
RefreshClick Refresh to refresh the counter values.
TestClick Test to perform the related tests.
Restore DefaultsClick Restore Defaults to restore factory defaults.
The search function helps the user to locate relevant GUI pages.
The search result for a keyword includes links to the relevant pages, and also links to the
To access the search function, enter a key word and click on the magnifying glass icon. The
following is an example of the results when searching for the keyword: CDP:
If you are in Basic mode, links to pages in Advanced mode are displayed but not available.
The dashboard is a collection of 8 squares, initially empty, that can be populated by various
types of information
You can select a number of modules from the available modules and place them in this grid.
You can also customize settings of the currently-displayed modules.
When the dashboard loads, the modules you selected for the dashboard are loaded in their
locations in the grid. The data in the modules is updated periodically , in intervals depending on
the module type. These intervals are configurable for some modules.
This following topics are covered in this chapter:
•Grid Management
Grid Management
•System Health
•Resource Utilization
•Identification
•Port Utilization
•PoE Utilization
•Latest Logs
•Suspended Interfaces
•Stack T opology
•Traffic Errors
The dashboard consists of multiple modules, but only a subset of the modules can be viewed at
the same time.
When you open the dashboard, a wire frame view of the grid is displayed, as shown below
(only 2 squares are shown in the following screen capture):
To display modules that are not currently being displayed, click on Customize on the upper-
right of the dashboard, as shown below:
Add modules to the grid by selecting a module from the list of modules on the right and
dragging and dropping it to any space in the grid.
The modules are divided into the following groups:
•Small Modules are modules that take up a single square
•Large Modules take up two squares.
If you drag a module into a space currently occupied, the new module replaces the previous
one.
You can re-arrange the placement of the modules in the grid by dragging a module from one
occupied grid position to another position. The module can be dropped in an unoccupied spot,
or in a spot occupied by a module of the same size. If the selected spot is occupied, the
modules switch places.
Only when you click Done (in the right-hand corner), are the modules populated by the
relevant information, as shown below:
The title bar of each module in the dashboard displays the title of the module and three
buttons:
These button perform the following:
System Health
•Pencil — Opens configuration options (depending on the module).
•Refresh — Refreshes the information.
•X — Removes the module from the dashboard.
This module displays information about device temperature (when such information is
available) for a standalone device or for each device in the stack, as shown below:
The following icons are shown:
•Fan Status—Yellow if one fan failed and is backed up by the redundant fan; Green if
•System Contact—Enter the name of a contact person.
•T otal Available Power—Amount of power available to the device.
•Current Power Consumption—Amount of power consumed by the device.
The following configuration options (right-hand corner) are available:
•Refresh Time—Select one of the options displayed.
•System Settings—Click to open System Settings.
•System Summary—Click to open System Summary.
This modules displays the ports on the device in either device or chart view. The view is
selected in the configuration options (pencil icon in upper-right corner).
•Display Mode—Device View
Displays the device. Hovering over a port displays information about it.