Edge-Core ECS4120-28F, ECS4120-28F-I, ECS4120-28T, ECS4120-28P, ECS4120-52T Reference Manual

ECS4120-28F/28F-I
ECS4120-28T/28P
ECS4120-52T

28/52-Port Layer 2+
Gigabit Ethernet Switch

Software Release v1.0.2.25

CLI Reference Guide

www.edge-core.com

CLI Reference Guide

ECS4120-28T Gigabit Ethernet Switch

L2+ Gigabit Ethernet Switch
with 24 10/100/1000BASE-T (RJ-45) Ports,
and 4 Gigabit SFP Ports

ECS4120-28F Gigabit Ethernet Switch

L2+ Gigabit Ethernet Switch
with 20 100/1000 SFP Ports,
4 10/100/1000 BASE-T (RJ-45) / 100/1000 SFP Combo Ports,
4 10 Gigabit SFP+ Ports , and DC Power Supply

(Operating Temperature: 0

ECS4120-28F-I Gigabit Ethernet Switch

L2+ Gigabit Ethernet Switch
with 20 100/1000 SFP Ports,
4 10/100/1000 BASE-T (RJ-45) / 100/1000 SFP Combo Ports,
4 10 Gigabit SFP+ Ports, and DC Power Supply

(Operating Temperature: -10

°C – 50°C)

°C – 65°C)

ECS4120-28P Gigabit Ethernet Switch

L2+ Gigabit Ethernet Switch
with 24 10/100/1000BASE-T (RJ-45) 802.3 af/at PoE Ports,
and 4 10-Gigabit SFP+ Ports (PoE Power Budget: 370W)

ECS4120-52T Gigabit Ethernet Switch

L2+ Gigabit Ethernet Switch
with 48 10/100/1000BASE-T (RJ-45) Ports,
and 4 Gigabit SFP Ports

E092017-CS-R02

How to Use This Guide

This guide includes detailed information on the switch software, including how to
operate and use the management functions of the switch. To deploy this switch
effectively and ensure trouble-free operation, you should first read the relevant
sections in this guide so that you are familiar with all of its software features.

Who Should Read This

Guide?

How This Guide is

Organized

Related

Documentation

This guide is for network administrators who are responsible for operating and
maintaining network equipment. The guide assumes a basic working knowledge of
LANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).

This guide describes the switch’s command line interface (CLI). For more detailed
information on the switch’s key features refer to the Administrator’s Guide.

The guide includes these sections:

◆ Section I “Getting Started” — Includes information on connecting to the switch

and basic configuration procedures.

◆ Section II “Command Line Interface” — Includes all management options

available through the CLI.

◆ Section III “Ap pe nd ices” — Includes information on troubleshooting switch

management access.

This guide focuses on switch software configuration through the CLI.

For information on how to manage the switch through the Web management
interface, see the following guide:

Web Management Guide

Note:

For a general description of switch features, refer to “Introduction” in the

Web Management Guide.

For information on how to install the switch, see the following guide:

Quick Start Guide

– 3 –

How to Use This Guide

Conventions The following conventions are used throughout this guide to show information:

For all safety information and regulatory statements, see the following documents:

Quick Start Guide
Safety and Regulatory Information

Note:

Emphasizes important information or calls your attention to related features

or instructions.

Caution:

Alerts you to a potential hazard that could cause loss of data, or damage

the system or equipment.

Revision History This section summarizes the changes in each revision of this guide.

Revision Date Change Description

v1.0.2.25 09/2017 Added:

◆

ECS4120-28F-I

◆

"ip dhcp l2 relay" on page 841

◆

"ip dhcp l3 relay" on page 841

◆

"ip dhcp snooping information option tr101 board­id" on page 312

Updated:

◆

"ip dhcp snooping information option remote-id"
on page 311

◆

"ip dhcp snooping information option circuit-id" on
page 315

◆

"ip dhcp relay information option" on page 843

◆

"ip dhcp snooping max-number" on page 317

◆

"efm oam critical-link-event" on page 816

Removed:

◆

“Configuring Private VLANs”

v1.0.2.14 11/2016 Initial release

– 4 –

Contents

How to Use This Guide 3

Contents 5

Figures 37

Tables 39

Section I Getting Started 45

1 Initial Switch Configuration 47

Connecting to the Switch 47

Configuration Options 47

Connecting to the Console Port 48

Logging Onto the Command Line Interface 49

Setting Passwords 49

Remote Connections (Network Interface) 50

Configuring the Switch for Remote Management 51

Setting an IP Address 51

Enabling SNMP Management Access 57

Managing System Files 59

Upgrading the Operation Code 60

Saving or Restoring Configuration Settings 61

Automatic Installation of Operation Code and Configuration Settings 62

Downloading Operation Code from a File Server 62

Specifying a DHCP Client Identifier 65

Downloading a Configuration File Referenced by a DHCP Server 65

Setting the System Clock 67

Setting the Time Manually 68

Configuring SNTP 68

Configuring NTP 69

– 5 –

Contents

Section II Command Line Interface 71

2 Using the Command Line Interface 73

Accessing the CLI 73

Console Connection 73

Telnet Connection 73

Entering Commands 75

Keywords and Arguments 75

Minimum Abbreviation 75

Command Completion 75

Getting Help on Commands 76

Partial Keyword Lookup 78

Negating the Effect of Commands 78

Using Command History 78

Understanding Command Modes 78

Exec Commands 79

Configuration Commands 80

Command Line Processing 82

CLI Command Groups 83

3 General Commands 87

prompt 87

reload (Global Configuration) 88

enable 89

quit 90

show history 91

configure 91

disable 92

reload (Privileged Exec) 92

show reload 93

end 93

exit 93

4 System Management Commands 95

Device Designation 95

– 6 –

Contents

hostname 96

Banner Information 96

banner configure 97

banner configure company 98

banner configure dc-power-info 99

banner configure department 100

banner configure equipment-info 100

banner configure equipment-location 101

banner configure ip-lan 102

banner configure lp-number 102

banner configure manager-info 103

banner configure mux 104

banner configure note 104

show banner 105

System Status 105

show access-list tcam-utilization 106

show location-led status 107

show memory 107

show process cpu 108

show process cpu guard 108

show process cpu task 109

show running-config 110

show startup-config 112

show system 113

show tech-support 114

show users 115

show version 116

show watchdog 117

watchdog software 117

Fan Control 117

fan-speed force-full 118

Frame Size 118

jumbo frame 118

File Management 119

– 7 –

Contents

General Commands 121

boot system 121

copy 122

delete 125

dir 126

umount usbdisk 127

whichboot 128

Automatic Code Upgrade Commands 128

upgrade opcode auto 128

upgrade opcode path 129

upgrade opcode reload 130

show upgrade 131

TFTP Configuration Commands 131

ip tftp retry 131

ip tftp timeout 132

show ip tftp 132

Line 133

line 134

databits 134

exec-timeout 135

login 136

parity 137

password 137

password-thresh 138

silent-time 139

speed 140

stopbits 140

timeout login response 141

disconnect 142

terminal 142

show line 143

Event Logging 144

logging facility 144

logging history 145

logging host 146

– 8 –

Contents

logging on 146

logging trap 147

clear log 148

show log 148

show logging 149

SMTP Alerts 151

logging sendmail 151

logging sendmail host 151

logging sendmail level 152

logging sendmail destination-email 153

logging sendmail source-email 153

show logging sendmail 154

Time 154

SNTP Commands 155

sntp client 155

sntp poll 156

sntp server 157

show sntp 157

NTP Commands 158

ntp authenticate 158

ntp authentication-key 159

ntp client 160

ntp server 160

show ntp 161

Manual Configuration Commands 162

clock summer-time (date) 162

clock summer-time (predefined) 163

clock summer-time (recurring) 164

clock timezone 166

calendar set 166

show calendar 167

Time Range 168

time-range 168

absolute 169

periodic 170

– 9 –

Contents

show time-range 171

Switch Clustering 171

cluster 172

cluster commander 173

cluster ip-pool 174

cluster member 174

rcommand 175

show cluster 175

show cluster members 176

show cluster candidates 176

5 SNMP Commands 177

General SNMP Commands 179

snmp-server 179

snmp-server community 180

snmp-server contact 180

snmp-server location 181

show snmp 181

SNMP Target Host Commands 182

snmp-server enable traps 182

snmp-server host 184

snmp-server enable port-traps mac-notification 186

show snmp-server enable port-traps 186

SNMPv3 Commands 187

snmp-server engine-id 187

snmp-server group 188

snmp-server user 189

snmp-server view 191

show snmp engine-id 192

show snmp group 192

show snmp user 194

show snmp view 194

Notification Log Commands 195

nlm 195

snmp-server notify-filter 196

– 10 –

Contents

show nlm oper-status 197

show snmp notify-filter 198

Additional Trap Commands 198

memory 198

process cpu 199

process cpu guard 200

6 Remote Monitoring Commands 203

rmon alarm 204

rmon event 205

rmon collection history 206

rmon collection rmon1 207

show rmon alarms 208

show rmon events 208

show rmon history 209

show rmon statistics 209

7 Flow Sampling Commands 211

sflow owner 212

sflow polling instance 213

sflow sampling instance 214

show sflow 215

8 Authentication Commands 217

User Accounts and Privilege Levels 218

enable password 218

username 219

privilege 221

show privilege 221

Authentication Sequence 222

authentication enable 222

authentication login 223

RADIUS Client 224

radius-server acct-port 224

radius-server auth-port 225

radius-server host 225

– 11 –

Contents

radius-server key 226

radius-server retransmit 227

radius-server timeout 227

show radius-server 228

TACACS+ Client 228

tacacs-server host 229

tacacs-server key 229

tacacs-server port 230

tacacs-server retransmit 230

tacacs-server timeout 231

show tacacs-server 231

AAA 232

aaa accounting dot1x 232

aaa accounting exec 233

aaa accounting update 234

aaa authorization exec 235

aaa group server 236

server 236

accounting dot1x 237

accounting exec 237

authorization exec 238

show accounting 238

Web Server 239

ip http port 240

ip http server 240

ip http secure-port 241

ip http secure-server 241

Telnet Server 243

ip telnet max-sessions 243

ip telnet port 244

ip telnet server 244

telnet (client) 245

show ip telnet 245

Secure Shell 246

ip ssh authentication-retries 249

– 12 –

Contents

ip ssh server 249

ip ssh server-key size 250

ip ssh timeout 250

delete public-key 251

ip ssh crypto host-key generate 252

ip ssh crypto zeroize 252

ip ssh save host-key 253

show ip ssh 253

show public-key 254

show ssh 255

802.1X Port Authentication 255

General Commands 256

dot1x default 256

dot1x eapol-pass-through 257

dot1x system-auth-control 257

Authenticator Commands 258

dot1x intrusion-action 258

dot1x max-reauth-req 259

dot1x max-req 259

dot1x operation-mode 260

dot1x port-control 261

dot1x re-authentication 261

dot1x timeout quiet-period 262

dot1x timeout re-authperiod 262

dot1x timeout supp-timeout 263

dot1x timeout tx-period 263

dot1x re-authenticate 264

Information Display Commands 265

show dot1x 265

Management IP Filter 267

management 268

show management 269

PPPoE Intermediate Agent 270

pppoe intermediate-agent 270

pppoe intermediate-agent format-type 271

– 13 –

Contents

pppoe intermediate-agent port-enable 272

pppoe intermediate-agent port-format-type 272

pppoe intermediate-agent port-format-type remote-id 273

pppoe intermediate-agent trust 274

pppoe intermediate-agent vendor-tag strip 274

clear pppoe intermediate-agent statistics 275

show pppoe intermediate-agent info 275

show pppoe intermediate-agent statistics 276

9 General Security Measures 279

Port Security 280

mac-learning 280

port security 281

port security mac-address-as-permanent 283

show port security 283

Network Access (MAC Address Authentication) 285

network-access aging 286

network-access mac-filter 287

mac-authentication reauth-time 288

network-access dynamic-qos 288

network-access dynamic-vlan 289

network-access guest-vlan 290

network-access link-detection 291

network-access link-detection link-down 292

network-access link-detection link-up 292

network-access link-detection link-up-down 293

network-access max-mac-count 293

network-access mode mac-authentication 294

network-access port-mac-filter 295

mac-authentication intrusion-action 296

mac-authentication max-mac-count 296

clear network-access 297

show network-access 297

show network-access mac-address-table 298

show network-access mac-filter 299

– 14 –

Contents

Web Authentication 299

web-auth login-attempts 300

web-auth quiet-period 301

web-auth session-timeout 301

web-auth system-auth-control 302

web-auth 302

web-auth re-authenticate (Port) 303

web-auth re-authenticate (IP) 303

show web-auth 304

show web-auth interface 304

show web-auth summary 305

DHCPv4 Snooping 305

ip dhcp snooping 306

ip dhcp snooping information option 308

ip dhcp snooping information option encode no-subtype 309

ip dhcp snooping information option remote-id 311

ip dhcp snooping information option tr101 board-id 312

information policy 312

ip dhcp snooping limit rate 313

ip dhcp snooping verify mac address 314

ip dhcp snooping vlan 314

ip dhcp snooping information option circuit-id 315

ip dhcp snooping max-number 317

ip dhcp snooping trust 317

clear ip dhcp snooping binding 318

clear ip dhcp snooping database flash 319

ip dhcp snooping database flash 319

show ip dhcp snooping 320

show ip dhcp snooping binding 320

DHCPv6 Snooping 321

ipv6 dhcp snooping 321

ipv6 dhcp snooping option remote-id 324

ipv6 dhcp snooping option remote-id policy 325

ipv6 dhcp snooping vlan 326

ipv6 dhcp snooping max-binding 327

– 15 –

Contents

ipv6 dhcp snooping trust 327

clear ipv6 dhcp snooping binding 328

clear ipv6 dhcp snooping statistics 329

show ipv6 dhcp snooping 329

show ipv6 dhcp snooping binding 329

show ipv6 dhcp snooping statistics 330

IPv4 Source Guard 330

ip source-guard binding 331

ip source-guard 333

ip source-guard max-binding 334

ip source-guard mode 335

clear ip source-guard binding blocked 336

show ip source-guard 336

show ip source-guard binding 337

IPv6 Source Guard 338

ipv6 source-guard binding 338

ipv6 source-guard 340

ipv6 source-guard max-binding 341

show ipv6 source-guard 342

show ipv6 source-guard binding 343

ARP Inspection 343

ip arp inspection 344

ip arp inspection filter 345

ip arp inspection log-buffer logs 346

ip arp inspection validate 347

ip arp inspection vlan 348

ip arp inspection limit 349

ip arp inspection trust 349

show ip arp inspection configuration 350

show ip arp inspection interface 350

show ip arp inspection log 351

show ip arp inspection statistics 351

show ip arp inspection vlan 351

Denial of Service Protection 352

dos-protection land 352

– 16 –

Contents

dos-protection tcp-null-scan 353

dos-protection tcp-syn-fin-scan 353

dos-protection tcp-xmas-scan 354

show dos-protection 354

Port-based Traffic Segmentation 355

traffic-segmentation 355

traffic-segmentation session 356

traffic-segmentation uplink/downlink 357

traffic-segmentation uplink-to-uplink 358

show traffic-segmentation 359

10 Access Control Lists 361

IPv4 ACLs 361

access-list ip 362

permit, deny (Standard IP ACL) 363

permit, deny (Extended IPv4 ACL) 364

ip access-group 366

show ip access-group 367

show ip access-list 367

IPv6 ACLs 368

access-list ipv6 368

permit, deny (Standard IPv6 ACL) 369

permit, deny (Extended IPv6 ACL) 370

ipv6 access-group 371

show ipv6 access-list 372

show ipv6 access-group 372

MAC ACLs 373

access-list mac 373

permit, deny (MAC ACL) 374

mac access-group 376

show mac access-group 377

show mac access-list 377

ARP ACLs 378

access-list arp 378

permit, deny (ARP ACL) 379

– 17 –

Contents

show access-list arp 380

show arp access-list 380

ACL Information 381

clear access-list hardware counters 381

show access-group 382

show access-list 382

11 Interface Commands 385

Interface Configuration 387

interface 387

alias 387

capabilities 388

description 389

discard 390

flowcontrol 391

history 392

media-type 392

negotiation 393

shutdown 394

speed-duplex 395

switchport block 396

switchport mtu 397

clear counters 398

show discard 399

show interfaces brief 399

show interfaces counters 400

show interfaces history 404

show interfaces status 407

show interfaces switchport 408

Transceiver Threshold Configuration 410

transceiver-monitor 410

transceiver-threshold-auto 410

transceiver-threshold current 411

transceiver-threshold rx-power 412

transceiver-threshold temperature 413

– 18 –

Contents

transceiver-threshold tx-power 414

transceiver-threshold voltage 415

show interfaces transceiver 416

show interfaces transceiver-threshold 417

Cable Diagnostics 418

test cable-diagnostics 418

test loop internal 419

show cable-diagnostics 420

show loop internal 421

Power Savings 421

power-save 421

show power-save 423

12 Link Aggregation Commands 425

Manual Configuration Commands 427

port channel load-balance 427

channel-group 428

Dynamic Configuration Commands 429

lacp 429

lacp admin-key (Ethernet Interface) 430

lacp port-priority 431

lacp system-priority 432

lacp admin-key (Port Channel) 433

lacp timeout 434

Trunk Status Display Commands 435

show lacp 435

show port-channel load-balance 438

13 Power over Ethernet Commands 439

power mainpower maximum allocation 439

power inline 440

power inline maximum allocation 441

power inline priority 442

power inline time-range 443

show power inline status 443

show power inline time-range 444

– 19 –

Contents

show power mainpower 445

14 Port Mirroring Commands 447

Local Port Mirroring Commands 447

port monitor 447

show port monitor 449

RSPAN Mirroring Commands 449

rspan source 451

rspan destination 452

rspan remote vlan 453

no rspan session 454

show rspan 455

15 Congestion Control Commands 457

Rate Limit Commands 457

rate-limit 458

Storm Control Commands 459

switchport packet-rate 459

Automatic Traffic Control Commands 460

Threshold Commands 463

auto-traffic-control apply-timer 463

auto-traffic-control release-timer 464

auto-traffic-control 465

auto-traffic-control action 465

auto-traffic-control alarm-clear-threshold 466

auto-traffic-control alarm-fire-threshold 467

auto-traffic-control auto-control-release 468

auto-traffic-control control-release 469

SNMP Trap Commands 469

snmp-server enable port-traps atc broadcast-alarm-clear 469

snmp-server enable port-traps atc broadcast-alarm-fire 470

snmp-server enable port-traps atc broadcast-control-apply 470

snmp-server enable port-traps atc broadcast-control-release 471

snmp-server enable port-traps atc multicast-alarm-clear 471

snmp-server enable port-traps atc multicast-alarm-fire 472

snmp-server enable port-traps atc multicast-control-apply 472

– 20 –

Contents

snmp-server enable port-traps atc multicast-control-release 473

ATC Display Commands 473

show auto-traffic-control 473

show auto-traffic-control interface 474

16 Loopback Detection Commands 475

loopback-detection 476

loopback-detection action 476

loopback-detection recover-time 477

loopback-detection transmit-interval 478

loopback detection trap 478

loopback-detection release 479

show loopback-detection 479

17 UniDirectional Link Detection Commands 481

udld detection-interval 481

udld message-interval 482

udld recovery 483

udld recovery-interval 483

udld aggressive 484

udld port 485

show udld 486

18 Address Table Commands 489

mac-address-table aging-time 489

mac-address-table static 490

clear mac-address-table dynamic 491

show mac-address-table 491

show mac-address-table aging-time 492

show mac-address-table count 493

19 Spanning Tree Commands 495

spanning-tree 496

spanning-tree forward-time 497

spanning-tree hello-time 498

spanning-tree max-age 498

spanning-tree mode 499

– 21 –

Contents

spanning-tree pathcost method 500

spanning-tree priority 501

spanning-tree mst configuration 502

spanning-tree system-bpdu-flooding 502

spanning-tree transmission-limit 503

max-hops 503

mst priority 504

mst vlan 505

name 506

revision 506

spanning-tree bpdu-filter 507

spanning-tree bpdu-guard 508

spanning-tree cost 509

spanning-tree edge-port 510

spanning-tree link-type 511

spanning-tree loopback-detection 511

spanning-tree loopback-detection action 512

spanning-tree loopback-detection release-mode 513

spanning-tree loopback-detection trap 514

spanning-tree mst cost 514

spanning-tree mst port-priority 515

spanning-tree port-bpdu-flooding 516

spanning-tree port-priority 516

spanning-tree root-guard 517

spanning-tree spanning-disabled 518

spanning-tree tc-prop-stop 518

spanning-tree loopback-detection release 519

spanning-tree protocol-migration 520

show spanning-tree 520

show spanning-tree mst configuration 522

20 ERPS Commands 523

erps 525

erps domain 525

control-vlan 526

– 22 –

Contents

enable 527

guard-timer 528

holdoff-timer 528

major-domain 529

meg-level 530

mep-monitor 531

node-id 532

non-erps-dev-protect 533

non-revertive 534

propagate-tc 538

raps-def-mac 538

raps-without-vc 539

ring-port 541

rpl neighbor 542

rpl owner 542

version 543

wtr-timer 544

clear erps statistics 545

erps clear 545

erps forced-switch 546

erps manual-switch 548

show erps 549

21 VLAN Commands 555

GVRP and Bridge Extension Commands 556

bridge-ext gvrp 556

garp timer 557

switchport forbidden vlan 558

switchport gvrp 558

show bridge-ext 559

show garp timer 560

show gvrp configuration 561

Editing VLAN Groups 562

vlan database 562

vlan 563

– 23 –

Contents

Configuring VLAN Interfaces 564

interface vlan 564

switchport acceptable-frame-types 565

switchport allowed vlan 566

switchport ingress-filtering 567

switchport mode 568

switchport native vlan 569

vlan-trunking 569

Displaying VLAN Information 571

show vlan 571

Configuring IEEE 802.1Q Tunneling 572

dot1q-tunnel system-tunnel-control 573

switchport dot1q-tunnel mode 574

switchport dot1q-tunnel priority map 575

switchport dot1q-tunnel service match cvid 575

switchport dot1q-tunnel tpid 578

show dot1q-tunnel 579

Configuring L2PT Tunneling 580

l2protocol-tunnel tunnel-dmac 580

switchport l2protocol-tunnel 582

show l2protocol-tunnel 583

Configuring VLAN Translation 584

switchport vlan-translation 584

show vlan-translation 585

Configuring Protocol-based VLANs 586

protocol-vlan protocol-group (Configuring Groups) 587

protocol-vlan protocol-group (Configuring Interfaces) 588

show protocol-vlan protocol-group 589

show interfaces protocol-vlan protocol-group 589

Configuring IP Subnet VLANs 590

subnet-vlan 590

show subnet-vlan 591

Configuring MAC Based VLANs 592

mac-vlan 592

show mac-vlan 593

– 24 –

Contents

Configuring Voice VLANs 594

voice vlan 594

voice vlan aging 595

voice vlan mac-address 596

switchport voice vlan 597

switchport voice vlan priority 598

switchport voice vlan rule 598

switchport voice vlan security 599

show voice vlan 600

22 Class of Service Commands 601

Priority Commands (Layer 2) 601

queue mode 602

queue weight 603

switchport priority default 604

show queue mode 605

show queue weight 605

Priority Commands (Layer 3 and 4) 606

qos map phb-queue 607

qos map cos-dscp 608

qos map default-drop-precedence 609

qos map dscp-cos 610

qos map dscp-mutation 611

qos map ip-port-dscp 612

qos map ip-prec-dscp 613

qos map trust-mode 614

show qos map cos-dscp 615

show map default-drop-precedence 615

show map dscp-cos 616

show qos map dscp-mutation 617

show qos map ip-port-dscp 617

show qos map ip-prec-dscp 618

show qos map phb-queue 619

show qos map trust-mode 619

23 Quality of Service Commands 621

– 25 –

Contents

class-map 622

description 623

match 623

rename 625

policy-map 625

class 626

police flow 627

police srtcm-color 628

police trtcm-color 631

set cos 633

set ip dscp 634

set phb 634

service-policy 635

show class-map 636

show policy-map 636

show policy-map interface 637

24 Multicast Filtering Commands 639

IGMP Snooping 639

ip igmp snooping 641

ip igmp snooping priority 642

ip igmp snooping proxy-reporting 642

ip igmp snooping querier 643

ip igmp snooping router-alert-option-check 644

ip igmp snooping router-port-expire-time 644

ip igmp snooping tcn-flood 645

ip igmp snooping tcn-query-solicit 646

ip igmp snooping unregistered-data-flood 647

ip igmp snooping unsolicited-report-interval 647

ip igmp snooping version 648

ip igmp snooping version-exclusive 649

ip igmp snooping vlan general-query-suppression 649

ip igmp snooping vlan immediate-leave 650

ip igmp snooping vlan last-memb-query-count 651

ip igmp snooping vlan last-memb-query-intvl 652

– 26 –

Contents

ip igmp snooping vlan mrd 652

ip igmp snooping vlan proxy-address 653

ip igmp snooping vlan query-interval 655

ip igmp snooping vlan query-resp-intvl 655

ip igmp snooping vlan static 656

clear ip igmp snooping groups dynamic 657

clear ip igmp snooping statistics 657

show ip igmp snooping 657

show ip igmp snooping group 659

show ip igmp snooping mrouter 660

show ip igmp snooping statistics 660

Static Multicast Routing 663

ip igmp snooping vlan mrouter 663

IGMP Filtering and Throttling 664

ip igmp filter (Global Configuration) 665

ip igmp profile 666

permit, deny 666

range 667

ip igmp authentication 667

ip igmp filter (Interface Configuration) 669

ip igmp max-groups 670

ip igmp max-groups action 670

ip igmp query-drop 671

ip multicast-data-drop 671

show ip igmp authentication 672

show ip igmp filter 673

show ip igmp profile 673

show ip igmp query-drop 674

show ip igmp throttle interface 674

show ip multicast-data-drop 675

MLD Snooping 676

ipv6 mld snooping 677

ipv6 mld snooping querier 677

ipv6 mld snooping query-interval 678

ipv6 mld snooping query-max-response-time 679

– 27 –

Contents

ipv6 mld snooping proxy-reporting 679

ipv6 mld snooping robustness 680

ipv6 mld snooping router-port-expire-time 680

ipv6 mld snooping unknown-multicast mode 681

ipv6 mld snooping unsolicited-report-interval 682

ipv6 mld snooping version 682

ipv6 mld snooping vlan immediate-leave 683

ipv6 mld snooping vlan mrouter 683

ipv6 mld snooping vlan static 684

clear ipv6 mld snooping groups dynamic 685

clear ipv6 mld snooping statistics 685

show ipv6 mld snooping 686

show ipv6 mld snooping group 686

show ipv6 mld snooping group source-list 687

show ipv6 mld snooping mrouter 688

show ipv6 mld snooping statistics 688

MLD Filtering and Throttling 689

ipv6 mld filter (Global Configuration) 690

ipv6 mld profile 690

permit, deny 691

range 692

ipv6 mld filter (Interface Configuration) 692

ipv6 mld max-groups 693

ipv6 mld max-groups action 694

ipv6 mld query-drop 694

ipv6 multicast-data-drop 695

show ipv6 mld filter 695

show ipv6 mld profile 696

show ipv6 mld query-drop 696

show ipv6 mld throttle interface 697

MVR for IPv4 698

mvr 699

mvr associated-profile 699

mvr domain 700

mvr priority 701

– 28 –

Contents

mvr profile 701

mvr proxy-query-interval 702

mvr priority 703

mvr proxy-switching 703

mvr robustness-value 705

mvr source-port-mode dynamic 705

mvr upstream-source-ip 706

mvr vlan 707

mvr immediate-leave 708

mvr type 709

mvr vlan group 710

clear mvr groups dynamic 711

clear mvr statistics 711

show mvr 712

show mvr associated-profile 713

show mvr interface 713

show mvr members 714

show mvr profile 716

show mvr statistics 716

MVR for IPv6 722

mvr6 associated-profile 723

mvr6 domain 723

mvr6 priority 724

mvr6 profile 725

mvr6 proxy-query-interval 726

mvr6 proxy-switching 726

mvr6 robustness-value 727

mvr6 source-port-mode dynamic 728

mvr6 upstream-source-ip 729

mvr6 vlan 730

mvr6 immediate-leave 730

mvr6 type 731

mvr6 vlan group 732

clear mvr6 groups dynamic 734

clear mvr6 statistics 735

– 29 –

Contents

show mvr6 735

show mvr6 associated-profile 736

show mvr6 interface 737

show mvr6 members 738

show mvr6 profile 739

show mvr6 statistics 740

25 LLDP Commands 745

lldp 747

lldp holdtime-multiplier 747

lldp med-fast-start-count 748

lldp notification-interval 748

lldp refresh-interval 749

lldp reinit-delay 750

lldp tx-delay 750

lldp admin-status 751

lldp basic-tlv management-ip-address 751

lldp basic-tlv port-description 752

lldp basic-tlv system-capabilities 753

lldp basic-tlv system-description 753

lldp basic-tlv system-name 754

lldp dot1-tlv proto-ident 754

lldp dot1-tlv proto-vid 755

lldp dot1-tlv pvid 755

lldp dot1-tlv vlan-name 756

lldp dot3-tlv link-agg 756

lldp dot3-tlv mac-phy 757

lldp dot3-tlv max-frame 757

lldp dot3-tlv poe 758

lldp med-location civic-addr 758

lldp med-notification 760

lldp med-tlv ext-poe 761

lldp med-tlv inventory 761

lldp med-tlv location 762

lldp med-tlv med-cap 762

– 30 –

Contents

lldp med-tlv network-policy 763

lldp notification 763

show lldp config 764

show lldp info local-device 766

show lldp info remote-device 767

show lldp info statistics 769

show lldp info statistics 770

26 CFM Commands 773

Defining CFM Structures 776

ethernet cfm ais level 776

ethernet cfm ais ma 777

ethernet cfm ais period 778

ethernet cfm ais suppress alarm 778

ethernet cfm domain 779

ethernet cfm enable 781

ma index name 782

ma index name-format 783

ethernet cfm mep 784

ethernet cfm port-enable 785

clear ethernet cfm ais mpid 785

show ethernet cfm configuration 786

show ethernet cfm md 788

show ethernet cfm ma 788

show ethernet cfm maintenance-points local 789

show ethernet cfm maintenance-points local detail mep 790

show ethernet cfm maintenance-points remote detail 791

Continuity Check Operations 793

ethernet cfm cc ma interval 793

ethernet cfm cc enable 794

snmp-server enable traps ethernet cfm cc 795

mep archive-hold-time 796

clear ethernet cfm maintenance-points remote 796

clear ethernet cfm errors 797

show ethernet cfm errors 798

– 31 –

Contents

Cross Check Operations 799

ethernet cfm mep crosscheck start-delay 799

snmp-server enable traps ethernet cfm crosscheck 799

mep crosscheck mpid 800

ethernet cfm mep crosscheck 801

show ethernet cfm maintenance-points remote crosscheck 802

Link Trace Operations 802

ethernet cfm linktrace cache 802

ethernet cfm linktrace cache hold-time 803

ethernet cfm linktrace cache size 804

ethernet cfm linktrace 804

clear ethernet cfm linktrace-cache 806

show ethernet cfm linktrace-cache 806

Loopback Operations 807

ethernet cfm loopback 807

Fault Generator Operations 808

mep fault-notify alarm-time 808

mep fault-notify lowest-priority 809

mep fault-notify reset-time 810

show ethernet cfm fault-notify-generator 811

Delay Measure Operations 812

ethernet cfm delay-measure two-way 812

27 OAM Commands 815

efm oam 816

efm oam critical-link-event 816

efm oam link-monitor frame 817

efm oam link-monitor frame threshold 817

efm oam link-monitor frame window 818

efm oam mode 819

clear efm oam counters 819

clear efm oam event-log 820

efm oam remote-loopback 820

efm oam remote-loopback test 821

show efm oam counters interface 822

– 32 –

Contents

show efm oam event-log interface 823

show efm oam remote-loopback interface 824

show efm oam status interface 824

show efm oam status remote interface 825

28 Domain Name Service Commands 827

ip domain-list 828

ip domain-lookup 829

ip domain-name 830

ip host 830

ip name-server 831

ipv6 host 832

clear dns cache 833

clear host 833

show dns 833

show dns cache 834

show hosts 834

29 DHCP Commands 837

DHCP Client 837

DHCP for IPv4 837

ip dhcp client class-id 837

ip dhcp restart client 839

DHCP for IPv6 840

ipv6 dhcp client rapid-commit vlan 840

DHCP Relay Option 82 841

ip dhcp l2 relay 841

ip dhcp l3 relay 841

ip dhcp relay server 842

ip dhcp relay information option 843

ip dhcp relay information policy 846

show ip dhcp relay 846

30 IP Interface Commands 849

IPv4 Interface 849

Basic IPv4 Configuration 850

– 33 –

Contents

ip address 850

ip default-gateway 852

show ip interface 853

show ip traffic 854

traceroute 855

ping 856

ARP Configuration 857

arp 857

ip proxy-arp 858

arp timeout 859

clear arp-cache 860

show arp 860

IPv6 Interface 861

Interface Address Configuration and Utilities 862

ipv6 default-gateway 862

ipv6 address 863

ipv6 address autoconfig 864

ipv6 address eui-64 865

ipv6 address link-local 867

ipv6 enable 869

ipv6 mtu 870

show ipv6 default-gateway 871

show ipv6 interface 871

show ipv6 mtu 873

show ipv6 traffic 874

clear ipv6 traffic 878

ping6 878

traceroute6 880

Neighbor Discovery 881

ipv6 nd dad attempts 881

ipv6 nd ns-interval 883

ipv6 nd raguard 884

ipv6 nd reachable-time 885

clear ipv6 neighbors 886

show ipv6 nd raguard 886

– 34 –

Contents

show ipv6 neighbors 886

ND Snooping 888

ipv6 nd snooping 889

ipv6 nd snooping auto-detect 890

ipv6 nd snooping auto-detect retransmit count 891

ipv6 nd snooping auto-detect retransmit interval 891

ipv6 nd snooping prefix timeout 892

ipv6 nd snooping max-binding 893

ipv6 nd snooping trust 893

clear ipv6 nd snooping binding 894

clear ipv6 nd snooping prefix 894

show ipv6 nd snooping 895

show ipv6 nd snooping binding 895

show ipv6 nd snooping prefix 896

30 IP Routing Commands 897

Global Routing Configuration 897

IPv4 Commands 898

ip route 898

show ip route 899

show ip route database 900

show ip route summary 900

Section III Appendices 901

A Troubleshooting 903

Problems Accessing the Management Interface 903

Using System Logs 904

B License Information 905

The GNU General Public License 905

Glossary 909

CLI Commands 917

Index 927

– 35 –

Contents

– 36 –

Figures

Figure 1: Storm Control by Limiting the Traffic Rate 462

Figure 2: Storm Control by Shutting Down a Port 463

Figure 3: Non-ERPS Device Protection 533

Figure 4: Sub-ring with Virtual Channel 540

Figure 5: Sub-ring without Virtual Channel 540

Figure 6: Configuring VLAN Trunking 570

Figure 7: Mapping QinQ Service VLAN to Customer VLAN 576

Figure 8: Configuring VLAN Translation 585

– 37 –

Figures

– 38 –

Tables

Table 1: Options 60, 66 and 67 Statements 66

Table 2: Options 55 and 124 Statements 66

Table 3: General Command Modes 79

Table 4: Configuration Command Modes 81

Table 5: Keystroke Commands 82

Table 6: Command Group Index 83

Table 7: General Commands 87

Table 8: System Management Commands 95

Table 9: Device Designation Commands 95

Table 10: Banner Commands 96

Table 11: System Status Commands 105

Table 12: show process cpu guard - display description 109

Table 13: show system – display description 114

Table 14: show version – display description 116

Table 15: Fan Control Commands 117

Table 16: Frame Size Commands 118

Table 17: Flash/File Commands 120

Table 18: File Directory Information 126

Table 19: Line Commands 133

Table 20: Event Logging Commands 144

Table 21: Logging Levels 145

Table 22: show logging flash/ram - display description 150

Table 23: show logging trap - display description 150

Table 24: Event Logging Commands 151

Table 25: Time Commands 154

Table 26: Predefined Summer-Time Parameters 164

Table 27: Time Range Commands 168

Table 28: Switch Cluster Commands 171

Table 29: SNMP Commands 177

– 39 –

Tabl es

Table 30: show snmp engine-id - display description 192

Table 31: show snmp group - display description 193

Table 32: show snmp user - display description 194

Table 33: show snmp view - display description 195

Table 34: RMON Commands 203

Table 35: sFlow Commands 211

Table 36: Authentication Commands 217

Table 37: User Access Commands 218

Table 38: Default Login Settings 220

Table 39: Authentication Sequence Commands 222

Table 40: RADIUS Client Commands 224

Table 41: TACACS+ Client Commands 228

Table 42: AAA Commands 232

Table 43: Web Server Commands 239

Table 44: HTTPS System Support 242

Table 45: Telnet Server Commands 243

Table 46: Secure Shell Commands 246

Table 47: show ssh - display description 255

Table 48: 802.1X Port Authentication Commands 255

Table 49: Management IP Filter Commands 267

Table 50: PPPoE Intermediate Agent Commands 270

Table 51: show pppoe intermediate-agent statistics - display description 277

Table 52: General Security Commands 279

Table 53: Port Security Commands 280

Table 54: show port security - display description 284

Table 55: Network Access Commands 285

Table 56: Dynamic QoS Profiles 289

Table 57: Web Authentication 300

Table 58: DHCP Snooping Commands 305

Table 59: Option 82 information 310

Table 60: Option 82 information 316

Table 61: DHCP Snooping Commands 321

Table 62: IPv4 Source Guard Commands 330

Table 63: IPv6 Source Guard Commands 338

Table 64: ARP Inspection Commands 343

– 40 –

Tables

Table 65: DoS Protection Commands 352

Table 66: Commands for Configuring Traffic Segmentation 355

Table 67: Traffic Segmentation Forwarding 356

Table 68: Access Control List Commands 361

Table 69: IPv4 ACL Commands 361

Table 70: IPv6 ACL Commands 368

Table 71: MAC ACL Commands 373

Table 72: ARP ACL Commands 378

Table 73: ACL Information Commands 381

Table 74: Interface Commands 385

Table 75: show interfaces counters - display description 401

Table 76: show interfaces switchport - display description 409

Table 77: Link Aggregation Commands 425

Table 78: show lacp counters - display description 435

Table 79: show lacp internal - display description 436

Table 80: show lacp neighbors - display description 437

Table 81: show lacp sysid - display description 438

Table 82: PoE Commands 439

Table 83: Maximum Number of Ports Providing Simultaneous Power 441

Table 84: show power inline status - display description 444

Table 85: show power mainpower - display description 445

Table 86: Port Mirroring Commands 447

Table 87: Mirror Port Commands 447

Table 88: RSPAN Commands 449

Table 89: Congestion Control Commands 457

Table 90: Rate Limit Commands 457

Table 91: Rate Limit Commands 459

Table 92: ATC Commands 460

Table 93: Loopback Detection Commands 475

Table 94: UniDirectional Link Detection Commands 481

Table 95: show udld - display description 486

Table 96: Address Table Commands 489

Table 97: Spanning Tree Commands 495

Table 98: Recommended STA Path Cost Range 509

Table 99: Default STA Path Costs 509

– 41 –

Tabl es

Table 100: ERPS Commands 523

Table 101: ERPS Request/State Priority 547

Table 102: show erps - summary display description 550

Table 103: show erps domain - detailed display description 551

Table 104: show erps statistics - detailed display description 553

Table 105: VLAN Commands 555

Table 106: GVRP and Bridge Extension Commands 556

Table 107: show bridge-ext - display description 559

Table 108: Commands for Editing VLAN Groups 562

Table 109: Commands for Configuring VLAN Interfaces 564

Table 110: Commands for Displaying VLAN Information 571

Table 111: 802.1Q Tunneling Commands 572

Table 112: L2 Protocol Tunnel Commands 580

Table 113: VLAN Translation Commands 584

Table 114: Protocol-based VLAN Commands 586

Table 115: IP Subnet VLAN Commands 590

Table 116: MAC Based VLAN Commands 592

Table 117: Voice VLAN Commands 594

Table 118: Priority Commands 601

Table 119: Priority Commands (Layer 2) 601

Table 120: Priority Commands (Layer 3 and 4) 606

Table 121: Mapping Internal Per-hop Behavior to Hardware Queues 607

Table 122: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence 608

Table 123: Mapping Per-hop Behavior to Drop Precedence 609

Table 124: Mapping Internal PHB/Drop Precedence to CoS/CFI Values 610

Table 125: Default Mapping of DSCP Values to Internal PHB/Drop Values 611

Table 126: Default Mapping of IP Precedence to Internal PHB/Drop Values 613

Table 127: Quality of Service Commands 621

Table 128: Multicast Filtering Commands 639

Table 129: IGMP Snooping Commands 639

Table 130: show ip igmp snooping statistics input - display description 661

Table 131: show ip igmp snooping statistics output - display description 661

Table 132: show ip igmp snooping statistics vlan query - display description 662

Table 133: Static Multicast Interface Commands 663

Table 134: IGMP Filtering and Throttling Commands 664

– 42 –

Tables

Table 135: IGMP Authentication RADIUS Attribute Value Pairs 668

Table 136: MLD Snooping Commands 676

Table 137: MLD Filtering and Throttling Commands 689

Table 138: Multicast VLAN Registration for IPv4 Commands 698

Table 139: show mvr - display description 712

Table 140: show mvr interface - display description 714

Table 141: show mvr members - display description 716

Table 142: show mvr statistics input - display description 717

Table 143: show mvr statistics output - display description 718

Table 144: show mvr statistics query - display description 719

Table 145: show mvr statistics summary interface - display description 719

Table 146: show mvr statistics summary interface mvr vlan - description 721

Table 147: Multicast VLAN Registration for IPv6 Commands 722

Table 148: show mvr6 - display description 736

Table 149: show mvr6 interface - display description 737

Table 150: show mvr6 members - display description 739

Table 151: show mvr6 statistics input - display description 740

Table 152: show mvr6 statistics output - display description 741

Table 153: show mvr6 statistics summary interface - display description 742

Table 154: show mvr6 statistics summary interface mvr vlan - description 743

Table 155: LLDP Commands 745

Table 156: LLDP MED Location CA Types 759

Table 157: CFM Commands 773

Table 158: show ethernet cfm configuration traps - display description 787

Table 159: show ethernet cfm maintenance-points local detail mep - display 791

Table 160: show ethernet cfm maintenance-points remote detail - display 792

Table 161: show ethernet cfm errors - display description 798

Table 162: show ethernet cfm linktrace-cache - display description 806

Table 163: Remote MEP Priority Levels 810

Table 164: MEP Defect Descriptions 810

Table 165: show fault-notify-generator - display description 811

Table 166: OAM Commands 815

Table 167: Address Table Commands 827

Table 168: show dns cache - display description 834

Table 169: show hosts - display description 835

– 43 –

Tabl es

Table 170: DHCP Commands 837

Table 171: DHCP Client Commands 837

Table 172: Options 60, 66 and 67 Statements 838

Table 173: Options 55 and 124 Statements 838

Table 174: DHCP Relay Option 82 Commands 841

Table 175: IP Interface Commands 849

Table 176: IPv4 Interface Commands 849

Table 177: Basic IP Configuration Commands 850

Table 178: Address Resolution Protocol Commands 857

Table 179: IPv6 Configuration Commands 861

Table 180: show ipv6 interface - display description 872

Table 181: show ipv6 mtu - display description 873

Table 182: show ipv6 traffic - display description 875

Table 183: show ipv6 neighbors - display description 887

Table 184: ND Snooping Commands 888

Table 203: IP Routing Commands 897

Table 204: Global Routing Configuration Commands 897

Table 205: Troubleshooting Chart 903

– 44 –

Section I

Getting Started

This section provides an overview of the switch, and introduces some basic
concepts about network switches. It also describes the basic settings required to
access the management interface.

This section includes these chapters:

◆ "Initial Switch Configuration" on page 47

– 45 –

Section I

| Getting Started

– 46 –

1 Initial Switch Configuration

This chapter includes information on connecting to the switch and basic
configuration procedures.

Connecting to the Switch

The switch includes a built-in network management agent. The agent offers a
variety of management options, including SNMP, RMON and a web-based interface.
A PC may also be connected directly to the switch for configuration and monitoring
via a command line interface (CLI).

Note:

An IPv4 address for this switch is obtained via DHCP by default. To change

this address, see “Setting an IP Address” on page 51.

Configuration Options The switch’s HTTP web agent allows you to configure switch parameters, monitor

port connections, and display statistics using a standard web browser such as
Internet Explorer 11, Mozilla Firefox 52, or Google Chrome 57, or more recent
versions. The switch’s web management interface can be accessed from any
computer attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial
console port on the switch, or remotely by a Telnet connection over the network.

The switch’s management agent also supports SNMP (Simple Network
Management Protocol). This SNMP agent permits the switch to be managed from
any system in the network using network management software.

The switch’s web interface, console interface, and SNMP agent allow you to
perform the following management functions:

◆ Set user names and passwords

◆ Set an IP interface for any VLAN

◆ Configure SNMP parameters

◆ Enable/disable any port

◆ Set the speed/duplex mode for any port

◆ Configure the bandwidth of any port by limiting input or output rates

– 47 –

Chapter 1

Connecting to the Switch

| Initial Switch Configuration

◆ Control port access through IEEE 802.1X security or static address filtering

◆ Filter packets using Access Control Lists (ACLs)

◆ Configure up to 4094 IEEE 802.1Q VLANs

◆ Enable GVRP automatic VLAN registration

◆ Configure IP routing for unicast or multicast traffic

◆ Configure router redundancy

◆ Configure IGMP multicast filtering

◆ Upload and download system firmware or configuration files via HTTP (using

the web interface) or FTP/TFTP (using the command line or web interface)

◆ Configure Spanning Tree parameters

◆ Configure Class of Service (CoS) priority queuing

◆ Configure static or LACP trunks (up to 8)

◆ Enable port mirroring

Connecting to the

Console Port

◆ Set storm control on any port for excessive broadcast, multicast, or unknown

unicast traffic

◆ Display system information and statistics

The switch provides an RS-232 serial port that enables a connection to a PC or
terminal for monitoring and configuring the switch. A null-modem console cable is
provided with the switch.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program
to the switch. You can use the console cable provided with this package, or use a
null-modem cable that complies with the wiring assignments shown in the
Installation Guide.

To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC running

terminal emulation software, and tighten the captive retaining screws on the
DB-9 connector.

2. Connect the other end of the cable to the RS-45 serial port on the switch.

3. Make sure the terminal emulation software is set as follows:

■

Select the appropriate serial port (COM port 1 or COM port 2).

■

Set the baud rate to 115200 bps.

■

Set the data format to 8 data bits, 1 stop bit, and no parity.

■

Set flow control to none.

■

Set the emulation mode to VT100.

■

When using HyperTerminal, select Terminal keys, not Windows keys.

– 48 –

Chapter 1

| Initial Switch Configuration

Connecting to the Switch

4. Power on the switch.

After the system completes the boot cycle, the logon screen appears.

Logging Onto the

Command Line

Interface

The CLI program provides two different command levels — normal access level
(Normal Exec) and privileged access level (Privileged Exec). The commands
available at the Normal Exec level are a limited subset of those available at the
Privileged Exec level and allow you to only display information and use basic
utilities. To fully configure the switch parameters, you must access the CLI at the
Privileged Exec level.

Access to both CLI levels are controlled by user names and passwords. The switch
has a default user name and password for each level. To log into the CLI at the
Privileged Exec level using the default user name and password, perform these
steps:

1. To initiate your console connection, press <Enter>. The “User Access

Verification” procedure starts.

2. At the User Name prompt, enter “admin.”

3. At the Password prompt, also enter “admin.” (The password characters are not

displayed on the console screen.)

4. The session is opened and the CLI displays the “Console#” prompt indicating

you have access at the Privileged Exec level.

Setting Passwords If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record
them and put them in a safe place.

Passwords can consist of up to 32 alphanumeric characters and are case sensitive.
To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name and password “admin”

to access the Privileged Exec level.

2. Type “configure” and press <Enter>.

3. Type “username guest password 0 password,” for the Normal Exec level, where

password is your new password. Press <Enter>.

4. Type “username admin password 0 password,” for the Privileged Exec level,

where password is your new password. Press <Enter>.

– 49 –

Chapter 1

Connecting to the Switch

| Initial Switch Configuration

Username: admin
Password:

CLI session with the ECS4120-28T* is opened.
To end the CLI session, enter [Exit].

Console#configure
Console(config)#username guest password 0 [password]
Console(config)#username admin password 0 [password]
Console(config)#

* This manual covers the ECS4120-28T/52T Gigabit Ethernet switches, the

ECS4120-28F/28F-I Gigabit Ethernet fiber switch, and the ECS4120-28P Gigabit
Ethernet PoE switch. Other than the difference in port types, and support for
PoE (ECS4120-28P), there are no significant differences. Therefore most of the
screen display examples are based on the ECS4120-28T.

Remote Connections

(Network Interface)

Prior to accessing the switch’s onboard agent via a network connection, you must
first configure the switch’s network interface with a valid IPv4 or IPv6 address.

The default network interface is VLAN 1 which includes ports 1-28/52. When
configuring the network interface, the IP address, subnet mask, and default
gateway may all be set using a console connection, or DHCP protocol as described
in the following sections.

An IPv4 address for the primary network interface is obtained via DHCP by default.
To manually configure this address or enable dynamic address assignment via
DHCP, see “Setting an IP Address” on page 51.

After configuring the switch’s IP parameters, you can access the onboard
configuration program from anywhere within the attached network. The onboard
configuration program can be accessed using Telnet or SSH from any computer
attached to the network. The switch can also be managed by any computer using a
web browser (Internet Explorer 11, Mozilla Firefox 52, or Google Chrome 57, or
more recent versions).

Note:

This switch supports eight Telnet sessions or SSH sessions.

The onboard program only provides access to basic configuration functions. To
access the full range of SNMP management functions, you must use SNMP-based
network management software.

– 50 –

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

Configuring the Switch for Remote Management

The switch can be managed through the operational network, known as in-band
management. Because in-band management traffic is mixed in with operational
network traffic, it is subject to all of the filtering rules usually applied to a standard
network ports such as ACLs and VLAN tagging. In-band network management can
be accessed via a connection to any network port (1-28/52).

Setting an IP Address You must establish IP address information for the switch to obtain management

access through the network. This can be done in either of the following ways:

◆ Manual — You have to input the information, including IP address and subnet

mask. If your management station is not in the same IP subnet as the switch,
you will also need to specify the default gateway router.

◆ Dynamic — The switch can send IPv4 configuration requests to BOOTP or

DHCP address allocation servers on the network, or can automatically generate
a unique IPv6 host address based on the local subnet address prefix received in
router advertisement messages. An IPv6 link local address for use in a local
network can also be dynamically generated as described in “Obtaining an IPv6

Address” on page 55.

The current software supports DHCP for IPv6, so an IPv6 global unicast address
for use in a network containing more than one subnet can be obtained through
the DHCPv6 server, or manually configured as described in “As sign ing an IP v6

Address” on page 52.

Manual Configuration

You can manually assign an IP address to the switch. You may also need to specify a
default gateway that resides between this device and management stations that
exist on another network segment. Valid IPv4 addresses consist of four decimal
numbers, 0 to 255, separated by periods. Anything outside this format will not be
accepted by the CLI program.

Note:

The IPv4 address for VLAN 1 is obtained via DHCP by default.

Assigning an IPv4 Address

Before you can assign an IP address to the switch, you must obtain the following
information from your network administrator:

◆ IP address for the switch

◆ Network mask for this network

◆ Default gateway for the network

– 51 –

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

To assign an IPv4 address to the switch, complete the following steps

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP

address and “netmask” is the network mask for the network. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the default gateway for the network to which the switch

belongs, type “ip default-gateway gateway,” where “gateway” is the IP address
of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.5 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 192.168.1.254

Assigning an IPv6 Address

This section describes how to configure a “link local” address for connectivity
within the local subnet only, and also how to configure a “global unicast” address,
including a network prefix for use on a multi-segment network and the host
portion of the address.

An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One
double colon may be used to indicate the appropriate number of zeros required to
fill the undefined fields. For detailed information on the other ways to assign IPv6
addresses, see “IPv6 Interface” on page 861.

Link Local Address — All link-local addresses must be configured with a prefix in
the range of FE80~FEBF. Remember that this address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet only. Also, if
the switch detects that the address you configured conflicts with that in use by
another device on the subnet, it will stop using the address in question, and
automatically generate a link local address that does not conflict with any other
devices on the local subnet.

To configure an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimal

values for the ipv6-address similar to that shown in the example, followed by
the “link-local” command parameter. Then press <Enter>.

– 52 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

Console(config)#interface vlan 1
Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700 link-local
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):
(None)
Joined group address(es):
ff02::2
ff02::1:ff00:0
ff02::1:ff11:6700
ff02::1:2
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 1.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Address for Multi-segment Network — Before you can assign an IPv6 address to the
switch that will be used to connect to a multi-segment network, you must obtain
the following information from your network administrator:

◆ Prefix for this network

◆ IP address for the switch

◆ Default gateway for the network

For networks that encompass several different subnets, you must define the full
address, including a network prefix and the host address for the switch. You can
specify either the full IPv6 address, or the IPv6 address and prefix length. The prefix
length for an IPv6 network is the number of bits (from the left) of the prefix that
form the network address, and is expressed as a decimal number. For example, all
IPv6 addresses that start with the first byte of 73 (hexadecimal) could be expressed
as 73:0:0:0:0:0:0:0/8 or 73::/8.

To generate an IPv6 global unicast address for the switch, complete the following
steps:

1. From the global configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. From the interface prompt, type “ipv6 address ipv6-address” or “ipv6 address

ipv6-address/prefix-length,” where “prefix-length” indicates the address bits

used to form the network portion of the address. (The network address starts
from the left of the prefix and should encompass some of the ipv6-address
bits.) The remaining bits are assigned to the host interface. Press <Enter>.

– 53 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the IPv6 default gateway for the network to which the

switch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the
IPv6 address of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:DB8:2222:7272::/64
Console(config-if)#exit
Console(config)#ipv6 default-gateway 2001:DB8:2222:7272::254
Console(config)end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):
2001:db8:2222:7272::/64, subnet is 2001:db8:2222:7272::/64
Joined group address(es):
ff02::1:ff00:0
ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 1.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#show ipv6 default-gateway
ipv6 default gateway: 2001:DB8:2222:7272::254
Console#

Dynamic Configuration

Obtaining an IPv4 Address

If you select the “bootp” or “dhcp” option, the system will immediately start
broadcasting service requests. IP will be enabled but will not function until a
BOOTP or DHCP reply has been received. Requests are broadcast every few minutes
using exponential backoff until IP configuration information is obtained from a
BOOTP or DHCP server. BOOTP and DHCP values can include the IP address, subnet
mask, and default gateway. If the DHCP/BOOTP server is slow to respond, you may
need to use the “ip dhcp restart client” command to re-start broadcasting service
requests.

Note that the “ip dhcp restart client” command can also be used to start
broadcasting service requests for all VLANs configured to obtain address
assignments through BOOTP or DHCP. It may be necessary to use this command
when DHCP is configured on a VLAN, and the member ports which were previously
shut down are now enabled.

If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the
switch will start broadcasting service requests as soon as it is powered on.

– 54 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

To automatically configure the switch by communicating with BOOTP or DHCP
address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following

commands:

■

To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.

■

To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.

4. Wait a few minutes, and then check the IP configuration settings by typing the

“show ip interface” command. Press <Enter>.

5. Then save your configuration changes by typing “copy running-config startup-

config.” Enter the startup file name and press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address dhcp
Console(config-if)#end
Console#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is 00-E0-0C-00-00-FB
Index: 1001, MTU: 1500
Address Mode is DHCP
IP Address: 192.168.0.2 Mask: 255.255.255.0
Proxy ARP is disabled
Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.

\Write to FLASH finish.
Success.

Obtaining an IPv6 Address

Link Local Address — There are several ways to configure IPv6 addresses. The
simplest method is to automatically generate a “link local” address (identified by an
address prefix in the range of FE80~FEBF). This address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet.

To generate an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 enable” and press <Enter>.

– 55 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

Console(config)#interface vlan 1
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled
Link-local address:
FE80::260:3EFF:FE11:6700/64
Global unicast address(es):
2001:DB8:2222:7272::/64, subnet is 2001:DB8:2222:7272::/64
Joined group address(es):
FF02::1:FF00:0
FF02::1:FF11:6700
FF02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 1.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Address for Multi-segment Network — To generate an IPv6 address that can be
used in a network containing more than one subnet, the switch can be configured
to automatically generate a unique host address based on the local subnet address
prefix received in router advertisement messages, and subsequently from a
DHCPv6 server. (For more information, see the description for the “Restart DHCPv6”
parameter in the System Reference Guide

To dynamically generate an IPv6 host address for the switch, complete the
following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. From the interface prompt, type “ipv6 address autoconfig” and press <Enter>.

3. Type “ipv6 enable” and press <Enter> to enable IPv6 on an interface that has

not been configured with an explicit IPv6 address.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address autoconfig
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::2e0:cff:fe00:fd%1/64
Global unicast address(es):
2001:db8:2222:7272:2E0:cff:fe00:fd/64, subnet is 2001:db8:2222:7272::/

64[AUTOCONFIG]

valid lifetime 2591978 preferred lifetime 604778

– 56 –

Joined group address(es):
ff02::1:ff00:fd
ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Enabling SNMP Management Access

The switch can be configured to accept management commands from Simple
Network Management Protocol (SNMP) applications. You can configure the switch
to respond to SNMP requests or generate SNMP traps.

Chapter 1

| Initial Switch Configuration

Enabling SNMP Management Access

When SNMP management stations send requests to the switch (either to return
information or to set a parameter), the switch provides the requested data or sets
the specified parameter. The switch can also be configured to send information to
SNMP managers (without being requested by the managers) through trap
messages, which inform the manager that certain events have occurred.

The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients.
To provide management access for version 1 or 2c clients, you must specify a
community string. The switch provides a default MIB View (i.e., an SNMPv3
construct) for the default “public” community string that provides read access to
the entire MIB tree, and a default view for the “private” community string that
provides read/write access to the entire MIB tree. However, you may assign new
views to version 1 or 2c community strings that suit your specific security
requirements (see snmp-server view command).

Community Strings (for SNMP version 1 and 2c clients)

Community strings are used to control management access to SNMP version 1 and
2c stations, as well as to authorize SNMP stations to receive trap messages from the
switch. You therefore need to assign community strings to specified users, and set
the access level.

The default strings are:

◆ public - with read-only access. Authorized management stations are only able

to retrieve MIB objects.

◆ private - with read/write access. Authorized management stations are able to

both retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is
recommended that you change the default community strings.

– 57 –

Chapter 1

Enabling SNMP Management Access

| Initial Switch Configuration

To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type “snmp-

2. To remove an existing string, simply type “no snmp-server community string,”

Console(config)#snmp-server community admin rw
Console(config)#snmp-server community private
Console(config)#

Note:

recommend that you delete both of the default community strings. If there are no
community strings, then SNMP management access from SNMP v1 and v2c clients
is disabled.

server community string mode,” where “string” is the community access string
and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the
default mode is read only.)

where “string” is the community access string to remove. Press <Enter>.

If you do not intend to support access to SNMP version 1 and 2c clients, we

Trap Receivers

You can also specify SNMP stations that are to receive traps from the switch. To
configure a trap receiver, use the “snmp-server host” command. From the
Privileged Exec level global configuration mode prompt, type:

“snmp-server host host-address community-string [version {1 | 2c | 3 {auth |

noauth | priv}}]”

where “host-address” is the IP address for the trap receiver, “community-string”
specifies access rights for a version 1/2c host, or is the user name of a version 3 host,
“version” indicates the SNMP client version, and “auth | noauth | priv” means that
authentication, no authentication, or authentication and privacy is used for v3
clients. Then press <Enter>. For a more detailed description of these parameters,
see the snmp-server host command. The following example creates a trap host for
each type of SNMP client.

Console(config)#snmp-server host 10.1.19.23 batman
Console(config)#snmp-server host 10.1.19.98 robin version 2c
Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth
Console(config)#

Configuring Access for SNMP Version 3 Clients

To configure management access for SNMPv3 clients, you need to first create a
view that defines the portions of MIB that the client can read or write, assign the
view to a group, and then assign the user to a group. The following example creates
one view called “mib-2” that includes the entire MIB-2 tree branch, and then

– 58 –

Chapter 1

| Initial Switch Configuration

Managing System Files

another view that includes the IEEE 802.1d bridge MIB. It assigns these respective
read and read/write views to a group call “r&d” and specifies group authentication
via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that
MD5 will be used for authentication, provides the password “greenpeace” for
authentication, and the password “einstien” for encryption.

Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included
Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included
Console(config)#snmp-server group r&d v3 auth mib-2 802.1d
Console(config)#snmp-server user steve group r&d v3 auth md5 greenpeace priv

des56 einstien

Console(config)#

For a more detailed explanation on how to configure the switch for access from
SNMP v3 clients, refer to “Simple Network Management Protocol” in the Web
Management Guide, or refer to the specific CLI commands for SNMP starting on

page 187 in this guide.

Managing System Files

The switch’s flash memory supports three types of system files that can be
managed by the CLI program, the web interface, or SNMP. The switch’s file system
allows files to be uploaded and downloaded, copied, deleted, and set as a start-up
file.

The types of files are:

◆ Configuration — This file type stores system configuration information and is

◆ Operation Code — System software that is executed after boot-up, also

created when configuration settings are saved. Saved configuration files can be
selected as a system start-up file or can be uploaded via FTP/TFTP to a server
for backup. The file named “Factory_Default_Config.cfg” contains all the system
default settings and cannot be deleted from the system. If the system is booted
with the factory default settings, the switch will also create a file named
“startup1.cfg” that contains system settings for switch initialization, including
information about the unit identifier, and MAC address for the switch. The
configuration settings from the factory defaults configuration file are copied to
this file, which is then used to boot the switch. See “Saving or Restoring

Configuration Settings” on page 61 for more information.

known as run-time code. This code runs the switch operations and provides the
CLI and web management interfaces.

◆ Diagnostic Code — Software that is run during system boot-up, also known as

POST (Power On Self-Test).

– 59 –

Chapter 1

| Initial Switch Configuration

Managing System Files

Note:

The Boot ROM and Loader cannot be uploaded or downloaded from the
FTP/TFTP server. You must follow the instructions in the release notes for new
firmware, or contact your distributor for help.

Due to the size limit of the flash memory, the switch supports only two operation
code files. However, you can have as many diagnostic code files and configuration
files as available flash memory space allows. The switch has a total of 512 MB of
flash memory for system files.

In the system flash memory, one file of each type must be set as the start-up file.
During a system boot, the diagnostic and operation code files set as the start-up file
are run, and then the start-up configuration file is loaded.

Note that configuration files should be downloaded using a file name that reflects
the contents or usage of the file settings. If you download directly to the running­config, the system will reboot, and the settings will have to be copied from the
running-config to a permanent file.

Upgrading the

Operation Code

The following example shows how to download new firmware to the switch and
activate it. The TFTP server could be any standards-compliant server running on
Windows or Linux. When downloading from an FTP server, the logon interface will
prompt for a user name and password configured on the remote server. Note that
“anonymous” is set as the default user name.

File names on the switch are case-sensitive. The destination file name should not
contain slashes (\ or /), and the maximum length for file names is 32 characters for
files on the switch or 128 characters for files on the server. (Valid characters: A-Z,
a-z, 0-9, “.”, “-”)

Console#copy tftp file
TFTP server ip address: 10.1.0.19
Choose file type:

1. config: 2. opcode: 2
Source file name: m360.bix
Destination file name: m360.bix
\Write to FLASH Programming.

-Write to FLASH finish.
Success.
Console#config
Console(config)#boot system opcode: m360.bix
Console(config)#exit
Console#dir

File Name Type Startup Modified Time Size (bytes)

------------------------------ ------- ------- ------------------- -----------­ Unit 1:
ecs4120-run-v1.0.2.21.bix OpCode Y 2016-12-15 07:16:54 19216980
Factory_Default_Config.cfg Config N 2015-08-07 03:59:12 455
startup1.cfg Config Y 2015-08-07 03:59:29 1537

------------------------------------------------------------------------------­ Free space for compressed user config files: 30281728
Total space: 256 MB

Console#

– 60 –

Chapter 1

| Initial Switch Configuration

Managing System Files

Saving or Restoring

Configuration

Settings

Configuration commands only modify the running configuration file and are not
saved when the switch is rebooted. To save all your configuration changes in
nonvolatile storage, you must copy the running configuration file to the start-up
configuration file using the “copy” command.

New startup configuration files must have a name specified. File names on the
switch are case-sensitive, can be from 1 to 31 characters, must not contain slashes
(\ or /), and the leading letter of the file name must not be a period (.). (Valid
characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

There can be more than one user-defined configuration file saved in the switch’s
flash memory, but only one is designated as the “startup” file that is loaded when
the switch boots. The copy running-config startup-config command always sets
the new file as the startup file. To select a previously saved configuration file, use
the boot system config:<filename> command.

The maximum number of saved configuration files depends on available flash
memory. The amount of available flash memory can be checked by using the dir
command.

To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config startup-

config” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.

Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.

\Write to FLASH finish.
Success.

Console#

To restore configuration settings from a backup server, enter the following
command:

1. From the Privileged Exec mode prompt, type “copy tftp startup-config” and

press <Enter>.

2. Enter the address of the TFTP server. Press <Enter>.

3. Enter the name of the startup file stored on the server. Press <Enter>.

4. Enter the name for the startup file on the switch. Press <Enter>.

– 61 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

Console#copy tftp startup-config
TFTP server IP address: 192.168.0.4
Source configuration file name: startup-rd.cfg
Startup configuration file name [startup1.cfg]:

Success.
Console#

Automatic Installation of Operation Code and Configuration Settings

Downloading

Operation Code from

a File Server

Automatic Operation Code Upgrade can automatically download an operation
code file when a file newer than the currently installed one is discovered on the file
server. After the file is transferred from the server and successfully written to the file
system, it is automatically set as the startup file, and the switch is rebooted.

Usage Guidelines

◆ If this feature is enabled, the switch searches the defined URL once during the

bootup sequence.

◆ FTP (port 21) and TFTP (port 69) are both supported. Note that the TCP/UDP

port bindings cannot be modified to support servers listening on non-standard
ports.

◆ The host portion of the upgrade file location URL must be a valid IPv4 IP

address. DNS host names are not recognized. Valid IP addresses consist of four
numbers, 0 to 255, separated by periods.

◆ The path to the directory must also be defined. If the file is stored in the root

directory for the FTP/TFTP service, then use the “/” to indicate this (e.g., ftp://

192.168.0.1/).

◆ The file name must not be included in the upgrade file location URL. The file

name of the code stored on the remote server must be ECS4120-Series.bix
(using lower case letters as indicated).

◆ The FTP connection is made with PASV mode enabled. PASV mode is needed to

traverse some fire walls, even if FTP traffic is not blocked. PASV mode cannot be
disabled.

◆ The switch-based search function is case-insensitive in that it will accept a file

name in upper or lower case (i.e., the switch will accept ECS4120-Series.BIX from
the server even though ECS4120-Series.bix was requested). However, keep in
mind that the file systems of many operating systems such as Unix and most
Unix-like systems (FreeBSD, NetBSD, OpenBSD, and most Linux distributions,
etc.) are case-sensitive, meaning that two files in the same directory, ecs4120-
series.bix and ECS4120-Series.BIX are considered to be unique files. Thus, if the

– 62 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

upgrade file is stored as ECS4120-Series.BIX (or even ECS4120-series.bix) on a
case-sensitive server, then the switch (requesting ECS4120-serieS.bix) will not be
upgraded because the server does not recognize the requested file name and
the stored file name as being equal. A notable exception in the list of case­sensitive Unix-like operating systems is Mac OS X, which by default is case­insensitive. Please check the documentation for your server’s operating system
if you are unsure of its file system’s behavior.

◆ Note that the switch itself does not distinguish between upper and lower-case

file names, and only checks to see if the file stored on the server is more recent
than the current runtime image.

◆ If two operation code image files are already stored on the switch’s file system,

then the non-startup image is deleted before the upgrade image is transferred.

◆ The automatic upgrade process will take place in the background without

impeding normal operations (data switching, etc.) of the switch.

◆ During the automatic search and transfer process, the administrator cannot

transfer or update another operation code image, configuration file, public key,
or HTTPS certificate (i.e., no other concurrent file management operations are
possible).

◆ The upgrade operation code image is set as the startup image after it has been

successfully written to the file system.

◆ The switch will send an SNMP trap and make a log entry upon all upgrade

successes and failures.

◆ The switch will immediately restart after the upgrade file is successfully written

to the file system and set as the startup image.

To enable automatic upgrade, enter the following commands:

1. Specify the TFTP or FTP server to check for new operation code.

■

When specifying a TFTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:

tftp://192.168.0.1[/filedir]/

■

When specifying an FTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:

ftp://[username[:password@]]192.168.0.1[/filedir]/

If the user name is omitted, “anonymous” will be used for the connection. If
the password is omitted a null string (“”) will be used for the connection.

– 63 –

Chapter 1

| Initial Switch Configuration

Automatic Installation of Operation Code and Configuration Settings

This shows how to specify a TFTP server where new code is stored.

Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#

This shows how to specify an FTP server where new code is stored.

Console(config)#upgrade opcode path ftp://admin:billy@192.168.0.1/sm24/
Console(config)#

2. Set the switch to automatically reboot and load the new code after the opcode

upgrade is completed.

Console(config)#upgrade opcode reload
Console(config)#

3. Set the switch to automatically upgrade the current operational code when a

new version is detected on the server. When the switch starts up and automatic
image upgrade is enabled by this command, the switch will follow these steps
when it boots up:

a. It will search for a new version of the image at the location specified by

upgrade opcode path command. The name for the new image stored on

the TFTP server must be ECS4120-Series.bix. If the switch detects a code
version newer than the one currently in use, it will download the new
image. If two code images are already stored in the switch, the image not
set to start up the system will be overwritten by the new version.

b. After the image has been downloaded, the switch will send a trap message

to log whether or not the upgrade operation was successful.

c. It sets the new version as the startup image.

d. It then restarts the system to start using the new image.

Console(config)#upgrade opcode auto
Console(config)#

4. Display the automatic upgrade settings.

Console#show upgrade
Auto Image Upgrade Global Settings:
Status : Enabled
Reload Status : Enabled
Path :
File Name : ECS4120-Series.bix
Console#

– 64 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

Specifying a DHCP

Client Identifier

DHCP servers index their database of address bindings using the client’s Media
Access Control (MAC) Address or a unique client identifier. The client identifier is
used to identify the vendor class and configuration of the switch to the DHCP
server, which then uses this information to decide on how to service the client or
the type of information to return.

DHCP client Identifier (Option 60) is used by DHCP clients to specify their unique
identifier. The client identifier is optional and can be specified while configuring
DHCP on the primary network interface. DHCP Option 60 is disabled by default.

The general framework for this DHCP option is set out in RFC 2132 (Option 60). This
information is used to convey configuration settings or other identification
information about a client, but the specific string to use should be supplied by your
service provider or network administrator. Options 60 (vendor-class-identifier), 66
(tftp-server-name) and 67 (bootfile-name) statements can be added to the server
daemon’s configuration file as described in the following section.

If the DHCP server has an index entry for a switch requesting service, it should reply
with the TFTP server name and boot file name. Note that the vendor class identifier
can be formatted in either text or hexadecimal, but the format used by both the
client and server must be the same.

Downloading a

Configuration File

Referenced by a DHCP

Server

Console(config)#interface vlan 2
Console(config-if)#ip dhcp client class-id hex 0000e8666572
Console(config-if)#

Information passed on to the switch from a DHCP server may also include a
configuration file to be downloaded and the TFTP servers where that file can be
accessed. If the Factory Default Configuration file is used to provision the switch at
startup, in addition to requesting IP configuration settings from the DHCP server, it
will also ask for the name of a bootup configuration file and TFTP servers where
that file is stored.

If the switch receives information that allows it to download the remote bootup file,
it will save this file to a local buffer, and then restart the provision process.

Note the following DHCP client behavior:

◆ The bootup configuration file received from a TFTP server is stored on the

switch with the original file name. If this file name already exists in the switch,
the file is overwritten.

◆ If the name of the bootup configuration file is the same as the Factory Default

Configuration file, the download procedure will be terminated, and the switch
will not send any further DHCP client requests.

– 65 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

◆ If the switch fails to download the bootup configuration file based on

information passed by the DHCP server, it will not send any further DHCP client
requests.

◆ If the switch does not receive a DHCP response prior to completing the bootup

process, it will continue to send a DHCP client request once a minute. These
requests will only be terminated if the switch’s address is manually configured,
but will resume if the address mode is set back to DHCP.

To successfully transmit a bootup configuration file to the switch, the DHCP
daemon (using a Linux based system for this example) must be configured with the
following information:

◆ Options 60, 66 and 67 statements can be added to the daemon’s configuration

file.

Table 1: Options 60, 66 and 67 Statements

Option

Keyword Parameter

60 vendor-class-identifier a string indicating the vendor class identifier

66 tftp-server-name a string indicating the tftp server name

67 bootfile-name a string indicating the bootfile name

◆ By default, DHCP option 66/67 parameters are not carried in a DHCP server

Statement

reply. To ask for a DHCP reply with option 66/67 information, the DHCP client
request sent by this switch includes a “parameter request list” asking for this
information. Besides these items, the client request also includes a “vendor
class identifier” that allows the DHCP server to identify the device, and select
the appropriate configuration file for download. This information is included in
Option 55 and 124.

Table 2: Options 55 and 124 Statements

Option

Keyword Parameter

55 dhcp-parameter-request-list a list of parameters, separated by a comma ', '

124 vendor-class-identifier a string indicating the vendor class identifier

Statement

The following configuration example is provided for a Linux-based DHCP daemon
(dhcpd.conf file). In the “Vendor class” section, the server will always send Option
66 and 67 to tell the switch to download the “test” configuration file from server

192.168.255.101.

ddns-update-style ad-hoc;

default-lease-time 600;
max-lease-time 7200;

– 66 –

Chapter 1

log-facility local7;

server-name "Server1";
Server-identifier 192.168.255.250;
#option 66, 67
option space dynamicProvision code width 1 length 1 hash size 2;
option dynamicProvision.tftp-server-name code 66 = text;
option dynamicProvision.bootfile-name code 67 = text;

subnet 192.168.255.0 netmask 255.255.255.0 {
range 192.168.255.160 192.168.255.200;
option routers 192.168.255.101;
option tftp-server-name "192.168.255.100"; #Default Option 66
option bootfile-name "bootfile"; #Default Option 67
}

class "Option66,67_1" { #DHCP Option 60 Vendor class two
match if option vendor-class-identifier = "ECS4120-Series.cfg";
option tftp-server-name "192.168.255.101";
option bootfile-name "test";
}

| Initial Switch Configuration

Setting the System Clock

Note:

file.

Setting the System Clock

Simple Network Time Protocol (SNTP) or Network Time Protocol (NTP) can be used
to set the switch’s internal clock based on periodic updates from a time server.
Maintaining an accurate time on the switch enables the system log to record
meaningful dates and times for event entries. You can also manually set the clock. If
the clock is not set manually or via SNTP or NTP, the switch will only record the time
from the factory default set at the last bootup.

When the SNTP client is enabled, the switch periodically sends a request for a time
update to a configured time server. You can configure up to three time server IP
addresses. The switch will attempt to poll each server in the configured sequence.

The switch also supports the following time settings:

◆ Time Zone – You can specify the offset from Coordinated Universal Time (UTC),

Use “ECS4120-Series.cfg” for the vendor-class-identifier in the dhcpd.conf

also known as Greenwich Mean Time (GMT).

◆ Summer Time/Daylight Saving Time (DST) – In some regions, the time shifts by

one hour in the fall and spring. The switch supports manual entry for one-time
or recurring clock shifts.

– 67 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

Setting the Time

Manually

To manually set the clock to 14:11:36, April 1st, 2013, enter this command.

Console#calendar set 14 11 36 1 April 2013
Console#

To set the time zone, enter a command similar to the following.

Console(config)#clock timezone Japan hours 8 after-UTC
Console(config)#

To set the time shift for summer time, enter a command similar to the following.

Console(config)#clock summer-time SUMMER date 2 april 2013 0 0 30 june 2013 0

0

Console(config)#

To display the clock configuration settings, enter the following command.

Console#show calendar
Current Time : Apr 2 15:56:12 2013
Time Zone : UTC, 08:00
Summer Time : SUMMER, offset 60 minutes
Apr 2 2013 00:00 to Jun 30 2013 00:00
Summer Time in Effect : Yes
Console#

Configuring SNTP Setting the clock based on an SNTP server can provide more accurate clock

synchronization across network switches than manually-configured time. To
configure SNTP, set the switch as an SNTP client, and then set the polling interval,
and specify a time server as shown in the following example.

Console(config)#sntp client
Console(config)#sntp poll 60
Console(config)#sntp server 10.1.0.19
Console(config)#exit
Console#show sntp
Current Time : Apr 2 16:06:07 2013
Poll Interval : 60 seconds
Current Mode : Unicast
SNTP Status : Enabled
SNTP Server : 10.1.0.19
Current Server : 10.1.0.19
Console#

– 68 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

Configuring NTP Requesting the time from a an NTP server is the most secure method. You can

enable NTP authentication to ensure that reliable updates are received from only
authorized NTP servers. The authentication keys and their associated key number
must be centrally managed and manually distributed to NTP servers and clients.
The key numbers and key values must match on both the server and client.

When more than one time server is configured, the client will poll all of the time
servers, and compare the responses to determine the most reliable and accurate
time update for the switch.

To configure NTP time synchronization, enter commands similar to the following.

Console(config)#ntp client
Console(config)#ntp authentication-key 45 md5 thisiskey45
Console(config)#ntp authenticate
Console(config)#ntp server 192.168.3.20
Console(config)#ntp server 192.168.3.21
Console(config)#ntp server 192.168.5.23 key 19
Console(config)#exit
Console#show ntp
Current Time : Apr 29 13:57:32 2011
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.0.88 Port: 123
Last Update Time : Mar 12 02:41:01 2013 UTC
NTP Server 192.168.0.88 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.4.22 version 3 key 19
NTP Authentication Key 19 md5 42V68751663T6K11P2J307210R885

Current Time : Apr 2 16:28:34 2013
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.5.23 Port: 0
Last Update Time : Apr 2 16:00:00 2013 UTC
NTP Server 192.168.3.20 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.5.23 version 3 key 19
NTP Authentication Key 45 md5 2662T75S5658RU5424180034777
Console#

– 69 –

Chapter 1

Setting the System Clock

| Initial Switch Configuration

– 70 –

Section II

Command Line Interface

This section provides a detailed description of the Command Line Interface, along
with examples for all of the commands.

This section includes these chapters:

◆ “Using the Command Line Interface” on page 73

◆ “General Commands” on page 87

◆ “System Management Commands” on page 95

◆ “SNMP Commands” on page 177

◆ “Remote Monitoring Commands” on page 203

◆ “Flow Sampling Commands” on page 211

◆ “Authentication Commands” on page 217

◆ “General Security Measures” on page 279

◆ “Access Control Lists” on page 361

◆ “Interface Commands” on page 385

◆ “Link Aggregation Commands” on page 425

◆ “Power over Ethernet Commands” on page 439

◆ “Port Mirroring Commands” on page 447

◆ “Congestion Control Commands” on page 457

◆ “Loopback Detection Commands” on page 475

◆ “UniDirectional Link Detection Commands” on page 481

◆ “Address Table Commands” on page 489

– 71 –

Section II

| Command Line Interface

◆ “Spanning Tree Commands” on page 495

◆ “VLAN Commands” on page 555

◆ “ERPS Commands” on page 523

◆ “Class of Service Commands” on page 601

◆ “Quality of Service Commands” on page 621

◆ “Multicast Filtering Commands” on page 639

◆ “LLDP Commands” on page 745

◆ “CFM Commands” on page 773

◆ “OAM Commands” on page 815

◆ “Domain Name Service Commands” on page 827

◆ “DHCP Commands” on page 837

◆ “IP Interface Commands” on page 849

– 72 –

2 Using the Command Line

Interface

This chapter describes how to use the Command Line Interface (CLI).

Accessing the CLI

When accessing the management interface for the switch over a direct connection
to the server’s console port, or via a Telnet or Secure Shell connection (SSH), the
switch can be managed by entering command keywords and parameters at the
prompt. Using the switch's command-line interface (CLI) is very similar to entering
commands on a UNIX system.

Console Connection To access the switch through the console port, perform these steps:

1. At the console prompt, enter the user name and password. (The default user

names are “admin” and “guest” with corresponding passwords of “admin” and
“guest.”) When the administrator user name and password is entered, the CLI
displays the “Console#” prompt and enters privileged access mode
(i.e., Privileged Exec). But when the guest user name and password is entered,
the CLI displays the “Console>” prompt and enters normal access mode
(i.e., Normal Exec).

2. Enter the necessary commands to complete your desired tasks.

3. When finished, exit the session with the “quit” or “exit” command.

After connecting to the system through the console port, the login screen displays:

User Access Verification
Username: admin
Password:
CLI session with the ECS4120-28T is opened.
To end the CLI session, enter [Exit].
Console#

Telnet Connection Telnet operates over the IP transport protocol. In this environment, your

management station and any network device you want to manage over the
network must have a valid IP address. Valid IP addresses consist of four numbers, 0
to 255, separated by periods. Each address consists of a network portion and host

– 73 –

Chapter 2

Accessing the CLI

| Using the Command Line Interface

portion. For example, the IP address assigned to this switch, 10.1.0.1, consists of a
network portion (10.1.0) and a host portion (1).

Note:

The IP address for this switch is obtained via DHCP by default.

To access the switch through a Telnet session, you must first set the IP address for
the Master unit, and set the default gateway if you are managing the switch from a
different IP subnet. For example,

Console(config)#interface vlan 1
Console(config-if)#ip address 10.1.0.254 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 10.1.0.254
Console(config)#

If your corporate network is connected to another network outside your office or to
the Internet, you need to apply for a registered IP address. However, if you are
attached to an isolated network, then you can use any IP address that matches the
network segment to which you are attached.

After you configure the switch with an IP address, you can open a Telnet session by
performing these steps:

1. From the remote host, enter the Telnet command and the IP address of the

device you want to access.

2. At the prompt, enter the user name and system password. The CLI will display

the “Vty-n#” prompt for the administrator to show that you are using privileged
access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you
are using normal access mode (i.e., Normal Exec), where n indicates the number
of the current Telnet session.

3. Enter the necessary commands to complete your desired tasks.

4. When finished, exit the session with the “quit” or “exit” command.

After entering the Telnet command, the login screen displays:

Username: admin
Password:

CLI session with the ECS4120-28T is opened.
To end the CLI session, enter [Exit].

Vty-0#

Note:

You can open up to eight sessions to the device via Telnet or SSH.

– 74 –

Entering Commands

Chapter 2

| Using the Command Line Interface

This section describes how to enter CLI commands.

Entering Commands

Keywords and

Arguments

A CLI command is a series of keywords and arguments. Keywords identify a
command, and arguments specify configuration parameters. For example, in the
command “show interfaces status ethernet 1/5,” show interfaces and status are
keywords, ethernet is an argument that specifies the interface type, and 1/5
specifies the unit/port.

You can enter commands as follows:

◆ To enter a simple command, enter the command keyword.

◆ To enter multiple commands, enter each command in the required order. For

example, to enable Privileged Exec command mode, and display the startup
configuration, enter:

Console>enable
Console#show startup-config

◆ To enter commands that require parameters, enter the required parameters

after the command keyword. For example, to set a password for the
administrator, enter:

Console(config)#username admin password 0 smith

Minimum

Abbreviation

Command

Completion

The CLI will accept a minimum number of characters that uniquely identify a
command. For example, the command “configure” can be entered as con. If an
entry is ambiguous, the system will prompt for further input.

If you terminate input with a Tab key, the CLI will print the remaining characters of a
partial keyword up to the point of ambiguity. In the “logging history” example,
typing log followed by a tab will result in printing the command up to “logging.”

– 75 –

Chapter 2

| Using the Command Line Interface

Entering Commands

Getting Help on

Commands

You can display a brief description of the help system by entering the help
command. You can also display command syntax by using the “?” character to list
keywords or parameters.

Showing Commands

If you enter a “?” at the command prompt, the system will display the first level of
keywords or command groups. You can also display a list of valid keywords for a
specific command. For example, the command “show ?” displays a list of possible
show commands:

Console#show ?
access-group Access groups
access-list Access lists
accounting Uses an accounting list with this name
arp Information of ARP cache
authorization Enables EXEC accounting
auto-traffic-control Auto traffic control information
banner Banner info
bridge-ext Bridge extension information
cable-diagnostics Shows the information of cable diagnostics
calendar Date and time information
class-map Displays class maps
cluster Display cluster
debug State of each debugging option
discard Discard packet
dns DNS information
dos-protection Shows the system dos-protection summary information
dot1q-tunnel dot1q-tunnel
dot1x 802.1X content
efm Ethernet First Mile feature
erps Displays ERPS configuration
ethernet Shows Metro Ethernet information
garp GARP properties
gvrp GVRP interface information
history Shows history information
hosts Host information
interfaces Shows interface information
ip IP information
ipv6 IPv6 information
l2protocol-tunnel Layer 2 protocol tunneling configuration
lacp LACP statistics
line TTY line information
lldp LLDP
log Log records
logging Logging setting
loop Shows the information of loopback
loopback-detection Shows loopback detection information
mac MAC access list
mac-address-table Configuration of the address table
mac-vlan MAC-based VLAN information
management Shows management information
memory Memory utilization
mvr Multicast vlan registration
mvr6 IPv6 Multicast VLAN registration
network-access Shows the entries of the secure port.
nlm Show notification log
ntp Network Time Protocol configuration
policy-map Displays policy maps
port Port characteristics
port-channel Port channel information

– 76 –

Chapter 2

| Using the Command Line Interface

Entering Commands

power Shows power
power-save Shows the power saving information
pppoe Displays PPPoE configuration
privilege Shows current privilege level
process Device process
protocol-vlan Protocol-VLAN information
public-key Public key information
qos Quality of Service
queue Priority queue information
radius-server RADIUS server information
reload Shows the reload settings
rmon Remote Monitoring Protocol
rspan Display status of the current RSPAN configuration
running-config Information on the running configuration
sflow Shows the sflow information
snmp Simple Network Management Protocol configuration and

snmp-server Displays SNMP server configuration
sntp Simple Network Time Protocol configuration
spanning-tree Spanning-tree configuration
ssh Secure shell server connections
startup-config Startup system configuration
subnet-vlan IP subnet-based VLAN information
system System information
tacacs-server TACACS server information
tech-support Technical information
time-range Time range
traffic-segmentation Traffic segmentation information
udld Displays UDLD information
upgrade Shows upgrade information
users Information about users logged in
version System hardware and software versions
vlan Shows virtual LAN settings
vlan-translation VLAN translation information
voice Shows the voice VLAN information
watchdog Displays watchdog status
web-auth Shows web authentication configuration
Console#show

statistics

The command “show interfaces ?” will display the following information:

Console#show interfaces ?
brief Brief interface description
counters Interface counters information
history Historical sample of interface counters information
protocol-vlan Protocol-VLAN information
status Shows interface status
switchport Shows interface switchport information
transceiver Interface of transceiver information
transceiver-threshold Interface of transceiver-threshold information
Console#

Show commands which display more than one page of information (e.g., show
running-config) pause and require you to press the [Space] bar to continue

displaying one more page, the [Enter] key to display one more line, or the [a] key to
display the rest of the information without stopping. You can press any other key to
terminate the display.

– 77 –

Chapter 2

Entering Commands

| Using the Command Line Interface

Partial Keyword

Lookup

Negating the Effect of

Commands

Using Command

History

If you terminate a partial keyword with a question mark, alternatives that match the
initial letters are provided. (Remember not to leave a space between the command
and question mark.) For example “s?” shows all the keywords starting with “s.”

Console#show s?
sflow snmp snmp-server sntp spanning-tree
ssh startup-config subnet-vlan system
Console#show s

For many configuration commands you can enter the prefix keyword “no” to cancel
the effect of a command or reset the configuration to the default value. For
example, the logging command will log system messages to a host server. To
disable logging, specify the no logging command. This guide describes the
negation effect for all applicable commands.

The CLI maintains a history of commands that have been entered. You can scroll
back through the history of commands by pressing the up arrow key. Any
command displayed in the history list can be executed again, or first modified and
then executed.

Using the show history command displays a longer list of recently executed
commands.

Understanding

Command Modes

The command set is divided into Exec and Configuration classes. Exec commands
generally display information on system status or clear statistical counters.
Configuration commands, on the other hand, modify interface parameters or
enable certain switching functions. These classes are further divided into different
modes. Available commands depend on the selected mode. You can always enter a
question mark “?” at the prompt to display a list of the commands available for the
current mode. The command classes and associated modes are displayed in the
following table:

– 78 –

Chapter 2

| Using the Command Line Interface

Entering Commands

Table 3: General Command Modes

Class Mode

Exec Normal

Privileged

Configuration

* You must be in Privileged Exec mode to access the Global configuration mode.

You must be in Global Configuration mode to access any of the other configuration modes.

Global

*

Access Control List
CFM
Class Map
ERPS
IGMP Profile
Interface
Line
Multiple Spanning Tree
Policy Map
Time Range
VLAN Database

Exec Commands When you open a new console session on the switch with the user name and

password “guest,” the system enters the Normal Exec command mode (or guest
mode), displaying the “Console>” command prompt. Only a limited number of the
commands are available in this mode. You can access all commands only from the
Privileged Exec command mode (or administrator mode). To access Privilege Exec
mode, open a new console session with the user name and password “admin.” The
system will now display the “Console#” command prompt. You can also enter
Privileged Exec mode from within Normal Exec mode, by entering the enable
command, followed by the privileged level password “super.”

To enter Privileged Exec mode, enter the following user names and passwords:

Username: admin
Password: [admin login password]

CLI session with the ECS4120-28T is opened.
To end the CLI session, enter [Exit].

Console#

Username: guest
Password: [guest login password]

CLI session with the ECS4120-28T is opened.
To end the CLI session, enter [Exit].

Console>enable
Password: [privileged level password]
Console#

– 79 –

Chapter 2

Entering Commands

| Using the Command Line Interface

Configuration

Commands

Configuration commands are privileged level commands used to modify switch
settings. These commands modify the running configuration only and are not
saved when the switch is rebooted. To store the running configuration in non­volatile storage, use the copy running-config startup-config command.

The configuration commands are organized into different modes:

◆ Global Configuration - These commands modify the system level configuration,

and include commands such as hostname and snmp-server community.

◆ Access Control List Configuration - These commands are used for packet

filtering.

◆ CFM Configuration - Configures connectivity monitoring using continuity

check messages, fault verification through loopback messages, and fault
isolation by examining end-to-end connections between Provider Edge
devices or between Customer Edge devices.

◆ Class Map Configuration - Creates a DiffServ class map for a specified traffic

type.

◆ ERPS Configuration – These commands configure Ethernet Ring Protection

Switching for increased availability of Ethernet rings commonly used in service
provider networks.

◆ IGMP Profile - Sets a profile group and enters IGMP filter profile configuration

mode.

◆ Interface Configuration - These commands modify the port configuration such

as speed-duplex and negotiation.

◆ Line Configuration - These commands modify the console port and Telnet

configuration, and include command such as parity and databits.

◆ Multiple Spanning Tree Configuration - These commands configure settings for

the selected multiple spanning tree instance.

◆ Policy Map Configuration - Creates a DiffServ policy map for multiple interfaces.

◆ Time Range - Sets a time range for use by other functions, such as Access

Control Lists.

◆ VLAN Configuration - Includes the command to create VLAN groups.

– 80 –

Chapter 2

| Using the Command Line Interface

Entering Commands

To enter the Global Configuration mode, enter the command configure in
Privileged Exec mode. The system prompt will change to “Console(config)#” which
gives you access privilege to all Global Configuration commands.

Console#configure
Console(config)#

To enter the other modes, at the configuration prompt type one of the following
commands. Use the exit or end command to return to the Privileged Exec mode.

Table 4: Configuration Command Modes

Mode Command Prompt Page

Access
Control List

CFM ethernet cfm domain Console(config-ether-cfm) 779

Class Map class-map Console(config-cmap) 622

ERPS erps domain Console(config-erps) 525

Interface interface {ethernet port | port-channel id|

Line line {console | vty} Console(config-line) 134

MSTP spanning-tree mst-configuration Console(config-mstp) 502

Policy Map policy-map Console(config-pmap) 625

Time Range time-range Console(config-time-range) 168

VLAN vlan database Console(config-vlan) 562

access-list arp
access-list ip standard
access-list ip extended
access-list ipv6 standard
access-list ipv6 extended
access-list mac

vlan id}

Console(config-arp-acl)
Console(config-std-acl)
Console(config-ext-acl)
Console(config-std-ipv6-acl)
Console(config-ext-ipv6-acl)
Console(config-mac-acl)

Console(config-if ) 387

378
362
362
368
368
373

– 81 –

Chapter 2

| Using the Command Line Interface

Entering Commands

For example, you can use the following commands to enter interface configuration
mode, and then return to Privileged Exec mode

Console(config)#interface ethernet 1/5
.
.
.

Console(config-if)#exit
Console(config)#

Command Line

Processing

Commands are not case sensitive. You can abbreviate commands and parameters
as long as they contain enough letters to differentiate them from any other
currently available commands or parameters. You can use the Tab key to complete
partial commands, or enter a partial command followed by the “?” character to
display a list of possible matches. You can also use the following editing keystrokes
for command-line processing:

Table 5: Keystroke Commands

Keystroke Func tion

Ctrl-A Shifts cursor to start of command line.

Ctrl-B Shifts cursor to the left one character.

Ctrl-C Terminates the current task and displays the command prompt.

Ctrl-E Shifts cursor to end of command line.

Ctrl-F Shifts cursor to the right one character.

Ctrl-K Deletes all characters from the cursor to the end of the line.

Ctrl-L Repeats current command line on a new line.

Ctrl-N Enters the next command line in the history buffer.

Ctrl-P Enters the last command.

Ctrl-R Repeats current command line on a new line.

Ctrl-U Deletes from the cursor to the beginning of the line.

Ctrl-W Deletes the last word typed.

Esc-B Moves the cursor back one word.

Esc-D Deletes from the cursor to the end of the word.

Esc-F Moves the cursor forward one word.

Delete key or
backspace key

Erases a mistake when entering a command.

– 82 –

CLI Command Groups

Chapter 2

| Using the Command Line Interface

CLI Command Groups

The system commands can be broken down into the functional groups shown

.

below

Table 6: Command Group Index

Command Group Description Page

General Basic commands for entering privileged access mode,

System Management Display and setting of system information, basic modes of

Simple Network
Management Protocol

Remote Monitoring Supports statistics, history, alarm and event groups 203

Flow Sampling Samples traffic flows, and forwards data to designated

User Authentication Configures user names and passwords, logon access using

General Security Measures Segregates traffic for clients attached to common data ports;

Access Control List Provides filtering for IPv4 frames (based on address, protocol,

restarting the system, or quitting the CLI

operation, maximum frame size, file management, console
port and telnet settings, system logs, SMTP alerts, the system
clock, and switch clustering

Activates authentication failure traps; configures community
access strings, and trap receivers

collector

local or remote authentication, management access through
the web server, Telnet server and Secure Shell; as well as port
security, IEEE 802.1X port access control, restricted access
based on specified IP addresses, and PPPoE Intermediate
Agent

and prevents unauthorized access by configuring valid static
or dynamic addresses, web authentication, MAC address
authentication, filtering DHCP requests and replies, and
discarding invalid ARP responses

TCP/UDP port number or TCP control code), IPv6 frames
(based on address, or non-IP frames (based on MAC address or
Ethernet type)

87

95

177

211

217

279

361

Interface Configures the connection parameters for all Ethernet ports,

Link Aggregation Statically groups multiple ports into a single logical trunk;

Power over Ethernet

Mirror Port Mirrors data to another port for analysis without affecting the

Congestion Control Sets the input/output rate limits, traffic storm thresholds, and

UniDirectional Link
Detection

Address Table Configures the address table for filtering specified addresses,

Spanning Tree Configures Spanning Tree settings for the switch 495

*

aggregated links, and VLANs

configures Link Aggregation Control Protocol for port trunks

Configures power output for connected devices 439

data passing through or the performance of the monitored
port

thresholds for broadcast and multicast storms which can be
used to trigger configured rate limits or to shut down a port.

Detect and disables unidirectional links 481

displays current entries, clears the table, or sets the aging time

385

425

447

457

489

– 83 –

Chapter 2

| Using the Command Line Interface

CLI Command Groups

Table 6: Command Group Index (Continued)

Command Group Description Page

ERPS Configures Ethernet Ring Protection Switching for increased

ERPS Configures Ethernet Ring Protection Switching for increased

VLANs Configures VLAN settings, and defines port membership for

Class of Service Sets port priority for untagged frames, selects strict priority or

Quality of Service Configures Differentiated Services 621

Multicast Filtering Configures IGMP multicast filtering, query, profile, and proxy

Link Layer Discovery
Protocol

Connectivity Fault
Management

availability of Ethernet rings commonly used in service
provider networks

availability of Ethernet rings commonly used in service
provider networks

VLAN groups; also enables or configures protocol VLANs,
voice VLANs, and QinQ tunneling

weighted round robin, relative weight for each priority queue,
also sets priority for TCP/UDP traffic types, IP precedence, and
DSCP

parameters; specifies ports attached to a multicast router ; also
configures multicast VLAN registration, and IPv6 MLD
snooping

Configures LLDP settings to enable information discovery
about neighbor devices

Configures connectivity monitoring using continuity check
messages, fault verification through loopback messages, and
fault isolation by examining end-to-end connections
between Provider Edge devices or between Customer Edge
devices

523

1257

555

601

639

745

773

OAM Configures Operations, Administration and Maintenance

Domain Name Service Configures DNS services. 827

Dynamic Host
Configuration Protocol

IP Interface Configures IP address for the switch interfaces; also

IP Routing Configures static routing 897

Debug Displays debugging information for all key functions

* ECS4120-28P

remote management tools required to monitor and maintain
the links to subscriber CPEs

Configures DHCP client and relay functions 837

configures ARP parameters

These commands are not described in this manual.
Please refer to the prompt messages included in the CLI interface.

815

849

The access mode shown in the following tables is indicated by these abbreviations:

ACL (Access Control List Configuration)
CFM (Connectivity Fault Management Configuration)
CM (Class Map Configuration)
ERPS (Ethernet Ring Protection Switching Configuration)
GC (Global Configuration)
IC (Interface Configuration)

– 84 –

IPC (IGMP Profile Configuration)
LC (Line Configuration)
MST (Multiple Spanning Tree)
NE (Normal Exec)
PE (Privileged Exec)
PM (Policy Map Configuration)
VC (VLAN Database Configuration)

Chapter 2

| Using the Command Line Interface

CLI Command Groups

– 85 –

Chapter 2

CLI Command Groups

| Using the Command Line Interface

– 86 –

3 General Commands

The general commands are used to control the command access mode,
configuration mode, and other basic functions.

Table 7: General Comm a n ds

Command Function Mode

prompt Customizes the CLI prompt GC

reload Restarts the system at a specified time, after a specified delay, or at a

periodic interval

enable Activates privileged mode NE

quit Exits a CLI session NE, PE

show history Shows the command history buffer NE, PE

configure Activates global configuration mode PE

disable Returns to normal mode from privileged mode PE

reload Restarts the system immediately PE

show reload Displays the current reload settings, and the time at which next

scheduled reload will take place

end Returns to Privileged Exec mode any config.

exit Returns to the previous configuration mode, or exits the CLI any mode

help Shows how to use help any mode

? Shows options for command completion (context sensitive) any mode

GC

PE

mode

prompt This command customizes the CLI prompt. Use the no form to restore the default

prompt.

Syntax

prompt string

no prompt

string - Any alphanumeric string to use for the CLI prompt.
(Maximum length: 32 characters)

Default Setting

Console

– 87 –

Chapter 3

| General Commands

Command Mode

Global Configuration

Command Usage

This command and the hostname command can be used to set the command line
prompt as shown in the example below. Using the no form of either command will
restore the default command line prompt.

Example

Console(config)#prompt RD2
RD2(config)#

reload (Global

Configuration)

This command restarts the system at a specified time, after a specified delay, or at a
periodic interval. You can reboot the system immediately, or you can configure the
switch to reset after a specified amount of time. Use the cancel option to remove a
configured setting.

Syntax

reload {at hour minute [{month day | day month} [year]] |

in {hour hours | minute minutes | hour hours minute minutes} |
regularly
monthly day-of-month

hour minute [period {daily

}] |

cancel [at | in | regularly]}

|

weekly day-of-week

|

reload at - A specified time at which to reload the switch.

hour - The hour at which to reload. (Range: 0-23)

minute - The minute at which to reload. (Range: 0-59)

month - The month at which to reload. (january ... december)

day - The day of the month at which to reload. (Range: 1-31)

year - The year at which to reload. (Range: 1970-2037)

reload in - An interval after which to reload the switch.

hours - The number of hours, combined with the minutes, before the
switch resets. (Range: 0-576)

minutes - The number of minutes, combined with the hours, before the
switch resets. (Range: 0-59)

reload

regularly

- A periodic interval at which to reload the switch.

hour - The hour at which to reload. (Range: 0-23)

minute - The minute at which to reload. (Range: 0-59)

day-of-week - Day of the week at which to reload.

(Range: monday ... saturday)

day-of-month

- Day of the month at which to reload. (Range: 1-31)

reload cancel - Cancels the specified reload option.

– 88 –

Chapter 3

| General Commands

Default Setting

None

Command Mode

Global Configuration

Command Usage

◆ This command resets the entire system.

◆ Any combination of reload options may be specified. If the same option is re-

specified, the previous setting will be overwritten.

◆ When the system is restarted, it will always run the Power-On Self-Test. It will

also retain all configuration information stored in non-volatile memory by the

copy running-config startup-config command (See “copy” on page 122).

Example

This example shows how to reset the switch after 30 minutes:

Console(config)#reload in minute 30
***
*** --- Rebooting at January 1 02:10:43 2015 --­***

Are you sure to reboot the system at the specified time? <y/n>

enable This command activates Privileged Exec mode. In privileged mode, additional

commands are available, and certain commands display additional information.
See “Understanding Command Modes” on page 78.

Syntax

enable [level]

level - Privilege level to log into the device.

The device has two predefined privilege levels: 0: Normal Exec,
15: Privileged Exec. Enter level 15 to access Privileged Exec mode.

Default Setting

Level 15

Command Mode

Normal Exec

Command Usage

◆ “super” is the default password required to change the command mode from

Normal Exec to Privileged Exec. (To set this password, see the enable password
command.)

– 89 –

Chapter 3

| General Commands

◆ The “#” character is appended to the end of the prompt to indicate that the

system is in privileged access mode.

Example

Console>enable
Password: [privileged level password]
Console#

Related Commands

disable (92)
enable password (218)

quit This command exits the configuration program.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

The quit and exit commands can both exit the configuration program.

Example

This example shows how to quit a CLI session:

Console#quit
% CLI exit session

***************************************************************

WARNING - MONITORED ACTIONS AND ACCESSES

Station's information:

Floor / Row / Rack / Sub-Rack
/ / /
DC power supply:
Power Source A: Floor / Row / Rack / Electrical circuit
/ / /

Number of LP:
Position MUX:
IP LAN:
Note:
***************************************************************

Username:

– 90 –

Chapter 3

| General Commands

show history This command shows the contents of the command history buffer.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

The history buffer size is fixed at 10 Execution commands and 10 Configuration
commands.

Example

In this example, the show history command lists the contents of the command
history buffer:

Console#show history
Execution command history:
2 config
1 show history

Configuration command history:
4 interface vlan 1
3 exit
2 interface vlan 1
1 end

Console#

The ! command repeats commands from the Execution command history buffer
when you are in Normal Exec or Privileged Exec Mode, and commands from the
Configuration command history buffer when you are in any of the configuration
modes. In this example, the !2 command repeats the second command in the
Execution history buffer (config).

Console#!2
Console#config
Console(config)#

configure This command activates Global Configuration mode. You must enter this mode to

modify any settings on the switch. You must also enter Global Configuration mode
prior to enabling some of the other configuration modes, such as Interface
Configuration, Line Configuration, and VLAN Database Configuration. See

“Understanding Command Modes” on page 78.

Default Setting

None

– 91 –

Chapter 3

| General Commands

Command Mode

Privileged Exec

Example

Console#configure
Console(config)#

Related Commands

end (93)

disable This command returns to Normal Exec mode from privileged mode. In normal

access mode, you can only display basic information on the switch's configuration
or Ethernet statistics. To gain access to all commands, you must use the privileged
mode. See “Understanding Command Modes” on page 78.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

The “>” character is appended to the end of the prompt to indicate that the system
is in normal access mode.

Example

Console#disable
Console>

Related Commands

enable (89)

reload (Privileged Exec) This command restarts the system.

Note:

When the system is restarted, it will always run the Power-On Self-Test. It will
also retain all configuration information stored in non-volatile memory by the copy
running-config startup-config command.

Default Setting

None

Command Mode

Privileged Exec

– 92 –

Chapter 3

| General Commands

Command Usage

This command resets the entire system.

Example

This example shows how to reset the switch:

Console#reload
System will be restarted, continue <y/n>? y

show reload This command displays the current reload settings, and the time at which next

scheduled reload will take place.

Command Mode

Privileged Exec

Example

Console#show reload
Reloading switch in time: 0 hours 29 minutes.

The switch will be rebooted at January 1 02:11:50 2015.
Remaining Time: 0 days, 0 hours, 29 minutes, 52 seconds.
Console#

end This command returns to Privileged Exec mode.

Default Setting

None

Command Mode

Global Configuration, Interface Configuration, Line Configuration, VLAN Database
Configuration, and Multiple Spanning Tree Configuration.

Example

This example shows how to return to the Privileged Exec mode from the Interface
Configuration mode:

Console(config-if)#end
Console#

exit This command returns to the previous configuration mode or exits the

configuration program.

Default Setting

None

– 93 –

Chapter 3

| General Commands

Command Mode

Any

Example

This example shows how to return to the Privileged Exec mode from the Global
Configuration mode, and then quit the CLI session:

Console(config)#exit
% CLI exit session

***************************************************************

WARNING - MONITORED ACTIONS AND ACCESSES

Station's information:

Floor / Row / Rack / Sub-Rack
/ / /
DC power supply:
Power Source A: Floor / Row / Rack / Electrical circuit
/ / /

Number of LP:
Position MUX:
IP LAN:
Note:
***************************************************************

– 94 –

4 System Management

Commands

The system management commands are used to control system logs, passwords,
user names, management options, and display or configure a variety of other
system information.

Table 8: System Management Commands

Command Group Func tion

Device Designation Configures information that uniquely identifies this switch

Banner Information Configures administrative contact, device identification and location

Device Designation

System Status Displays system configuration, active managers, and version

information

Fan Control Forces fans to full speed

Frame Size Enables support for jumbo frames

File Management Manages code image or switch configuration files

Line Sets communication parameters for the serial port, including baud rate

and console time-out

Event Logging Controls logging of error messages

SMTP Alerts Configures SMTP email alerts

Time (System Clock) Sets the system clock automatically via NTP/SNTP server or manually

Time Range Sets a time range for use by other functions, such as Access Control Lists

Switch Clustering Configures management of multiple devices via a single IP address

This section describes commands used to configure information that uniquely
identifies the switch.

Table 9: Device Designation Commands

Command Func tion Mode

hostname Specifies the host name for the switch GC

snmp-server contact Sets the system contact string GC

snmp-server location Sets the system location string GC

– 95 –

Chapter 4

Banner Information

| System Management Commands

hostname This command specifies or modifies the host name for this device. Use the no form

to restore the default host name.

Syntax

hostname name

no hostname

name - The name of this host. (Maximum length: 255 characters)

Default Setting

None

Command Mode

Global Configuration

Command Usage

◆ The host name specified by this command is displayed by the show system

command and on the Show > System web page.

Banner Information

◆ This command and the prompt command can be used to set the command line

prompt as shown in the example below. Using the no form of either command
will restore the default command line prompt.

Example

Console(config)#hostname RD#1
Console(config)#

These commands are used to configure and manage administrative information
about the switch, its exact data center location, details of the electrical and network
circuits that supply the switch, as well as contact information for the network
administrator and system manager. This information is only available via the CLI
and is automatically displayed before login as soon as a console or telnet
connection has been established.

Table 10: Banner Commands

Command Func tion Mode

banner configure Configures the banner information that is displayed before

banner configure company Configures the Company information that is displayed by

banner configure
dc-power-info

login

banner

Configures the DC Power information that is displayed by
banner

– 96 –

GC

GC

GC

Chapter 4

| System Management Commands

Banner Information

Table 10: Banner Commands (Continued)

Command Func tion Mode

banner configure
department

banner configure
equipment-info

banner configure
equipment-location

banner configure ip-lan Configures the IP and LAN information that is displayed by

banner configure
lp-number

banner configure
manager-info

banner configure mux Configures the MUX information that is displayed by

banner configure note Configures miscellaneous information that is displayed by

show banner Displays all banner information NE, PE

Configures the Department information that is displayed
by banner

Configures the Equipment information that is displayed by
banner

Configures the Equipment Location information that is
displayed by banner

banner

Configures the LP Number information that is displayed by
banner

Configures the Manager contact information that is
displayed by banner

banner

banner under the Notes heading

GC

GC

GC

GC

GC

GC

GC

GC

banner configure This command is used to interactively specify administrative information for this

device.

Syntax

banner configure

Default Setting

None

Command Mode

Global Configuration

Command Usage

The administrator can batch-input all details for the switch with one command.
When the administrator finishes typing the company name and presses the enter
key, the script prompts for the next piece of information, and so on, until all
information has been entered. Pressing enter without inputting information at any
prompt during the script’s operation will leave the field empty. Spaces can be used
during script mode because pressing the enter key signifies the end of data input.
The delete and left-arrow keys terminate the script. The use of the backspace key
during script mode is not supported. If, for example, a mistake is made in the
company name, it can be corrected with the banner configure company
command.

– 97 –

Chapter 4

| System Management Commands

Banner Information

Example

Console(config)#banner configure

Company: Edge-Core Networks
Responsible department: R&D Dept
Name and telephone to Contact the management people
Manager1 name: Sr. Network Admin
phone number: 123-555-1212
Manager2 name: Jr. Network Admin
phone number: 123-555-1213
Manager3 name: Night-shift Net Admin / Janitor
phone number: 123-555-1214
The physical location of the equipment.
City and street address: 12 Straight St. Motown, Zimbabwe
Information about this equipment:
Manufacturer: Edge-Core Networks
ID: 123_unique_id_number
Floor: 2
Row: 7
Rack: 29
Shelf in this rack: 8
Information about DC power supply.
Floor: 2
Row: 7
Rack: 25
Electrical circuit: : ec-177743209-xb
Number of LP:12
Position of the equipment in the MUX:1/23
IP LAN:192.168.1.1
Note: This is a random note about this managed switch and can contain

miscellaneous information.

Console(config)#

banner configure

company

This command is used to configure company information displayed in the banner.
Use the no form to remove the company name from the banner display.

Syntax

banner configure company name

no banner configure company

name - The name of the company. (Maximum length: 32 characters)

Default Setting

None

Command Mode

Global Configuration

Command Usage

Input strings cannot contain spaces. The banner configure company command
interprets spaces as data input boundaries. The use of underscores ( _ ) or other
unobtrusive non-letter characters is suggested for situations where white space is
necessary for clarity.

– 98 –

Chapter 4

Example

Console(config)#banner configure company Big-Ben
Console(config)#

| System Management Commands

Banner Information

banner configure

dc-power-info

This command is use to configure DC power information displayed in the banner.
Use the no form to restore the default setting.

Syntax

banner configure dc-power-info floor floor-id row row-id rack rack-id
electrical-circuit ec-id

no banner configure dc-power-info [floor | row | rack | electrical-circuit]

floor-id - The floor number.

row-id - The row number.

rack-id - The rack number.

ec-id - The electrical circuit ID.

Maximum length of each parameter: 32 characters

Default Setting

None

Command Mode

Global Configuration

Command Usage

Input strings cannot contain spaces. The banner configure dc-power-info command interprets spaces as data input boundaries. The use of underscores ( _ ) or other unobtrusive non-letter characters is suggested for situations where white space is necessary for clarity.

Example

Console(config)#banner configure dc-power-info floor 3 row 15 rack 24

electrical-circuit 48v-id_3.15.24.2

Console(config)#

– 99 –

Chapter 4

Banner Information

| System Management Commands

banner configure

department

This command is used to configure the department information displayed in the
banner. Use the no form to restore the default setting.

Syntax

banner configure department dept-name

no banner configure department

dept-name - The name of the department.
(Maximum length: 32 characters)

Default Setting

None

Command Mode

Global Configuration

Command Usage

Input strings cannot contain spaces. The banner configure department
command interprets spaces as data input boundaries. The use of underscores ( _ )
or other unobtrusive non-letter characters is suggested for situations where white
space is necessary for clarity.

banner configure

equipment-info

Example

Console(config)#banner configure department R&D
Console(config)#

This command is used to configure the equipment information displayed in the
banner. Use the no form to restore the default setting.

Syntax

banner configure equipment-info manufacturer-id mfr-id floor floor-id
row row-id rack rack-id shelf-rack sr-id manufacturer mfr-name

no banner configure equipment-info [floor | manufacturer | manufacturer-
id | rack | row | shelf-rack]

mfr-id - The name of the device model number.

floor-id - The floor number.

row-id - The row number.

rack-id - The rack number.

sr-id - The shelf number in the rack.

mfr-name - The name of the device manufacturer.

Maximum length of each parameter: 32 characters

– 100 –