Edge-Core ECS4620-28T, ECS4620, ECS4620-52P-2AC, ECS4620-52T, ECS4620-52P Cli Reference Manual

ECS4620 Series
28/52-Port Layer 3
Stackable GE Switch

Software Release v1.2.2.26

CLI Reference Guide

www.edge-core.com

CLI Reference Guide

ECS4620-28T Stackable GE Switch

Layer 3 Stackable Gigabit Ethernet Switch
with 24 10/100/1000BASE-T (RJ-45) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-28P Stackable GE PoE Switch

Layer 3 Stackable Gigabit Ethernet PoE Switch
with 24 10/100/1000BASE-T (RJ-45) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-28F Stackable GE Fiber Switch

Layer 3 Stackable Gigabit Ethernet Fiber Switch
with 22 SFP Ports,
2 10/100/1000BASE-T (RJ-45/SFP) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-28T-DC Stackable GE Switch

Layer 3 Stackable Gigabit Ethernet Switch
with 24 10/100/1000BASE-T (RJ-45) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-52T Stackable GE Switch

Layer 3 Stackable Gigabit Ethernet Switch
with 48 10/100/1000BASE-T (RJ-45) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-52P Stackable GE PoE Switch

Layer 3 Stackable Gigabit Ethernet PoE Switch
with 48 10/100/1000BASE-T (RJ-45) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-52P-2AC Stackable GE PoE Switch

Layer 3 Stackable Gigabit Ethernet PoE Switch
with 48 10/100/1000BASE-T (RJ-45) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports
(Dual AC/DC power inputs)

ECS4620-28F-DC Stackable GE Fiber Switch

Layer 3 Stackable Gigabit Ethernet Fiber Switch
with 22 SFP Ports,
2 10/100/1000BASE-T (RJ-45/SFP) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports

ECS4620-28F-2AC Stackable GE Fiber Switch

Layer 3 Stackable Gigabit Ethernet Fiber Switch
with 22 SFP Ports,
2 10/100/1000BASE-T (RJ-45/SFP) Ports,
2 10-Gigabit SFP+ Ports,
and Optional Module with 2 10-Gigabit SFP+ Ports
(Dual AC/DC power inputs)

E022019-CS-R06

How to Use This Guide

This guide includes detailed information on the switch software, including how to
operate and use the management functions of the switch. To deploy this switch
effectively and ensure trouble-free operation, you should first read the relevant
sections in this guide so that you are familiar with all of its software features.

Who Should Read This

Guide?

How This Guide is

Organized

Related

Documentation

This guide is for network administrators who are responsible for operating and
maintaining network equipment. The guide assumes a basic working knowledge of
LANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).

This guide describes the switch’s command line interface (CLI). For more detailed
information on the switch’s key features or information about the web browser
management interface refer to the Web Management Guide.

The guide includes these sections:

◆ Section I “Getting Started” — Includes information on initial configuration.

◆ Section II “Command Line Interface” — Includes all management options

available through the CLI.

◆ Section III “Ap pe ndi ces” — Includes information on troubleshooting switch

management access.

This guide focuses on switch software configuration through the CLI.

For information on how to manage the switch through the Web management
interface, see the following guide:

Web Management Guide

For information on how to install the switch, see the following guide:

Installation Guide

For all safety information and regulatory statements, see the following documents:

Quick Start Guide
Safety and Regulatory Information

– 3 –

How to Use This Guide

Conventions The following conventions are used throughout this guide to show information:

Note:

Emphasizes important information or calls your attention to related features

or instructions.

Caution:

Alerts you to a potential hazard that could cause loss of data, or damage

the system or equipment.

Documentation

Notice

This documentation is provided for general information purposes only. If any
product feature details in this documentation conflict with the product datasheet,
refer to the datasheet for the latest information.

Revision History This section summarizes the changes in each revision of this guide.

February 2019 Revision

This is the sixth version of this guide. This guide is valid for software release
v1.2.2.26. It contains the following changes:

◆ Added documentation notice.

November 2016 Revision

This is the fifth version of this guide. This guide is valid for software release
v1.2.2.26. It contains the following changes:

◆ Added information for ECS4620-52T-2AC and ECS4620-52P-2AC.

◆ Added "show process cpu guard" on page 130.

◆ Added SFTP option to "copy" on page 142.

◆ Updated syntax for "snmp-server user" on page 215.

◆ Added "show authorization" on page 267.

◆ Added "telnet (client)" on page 274.

◆ Updated Command Usage for "dot1x default" on page 285.

◆ Updated syntax for "ip dhcp snooping information option circuit-id" on

page 347.

◆ Updated syntax for "clear ip dhcp snooping binding" on page 349.

◆ Updated Command Usage for "ip source-guard max-binding" on page 365.

– 4 –

How to Use This Guide

◆ Added Command Usage for "show interfaces brief" on page 433.

◆ Updated syntax for "show port monitor" on page 475.

◆ Updated Command Usage for "spanning-tree bpdu-filter" on page 536.

◆ Updated Command Usage for "spanning-tree bpdu-guard" on page 537.

◆ Added Command Usage to "spanning-tree spanning-disabled" on page 547.

◆ Updated syntax for "switchport allowed vlan" on page 595.

◆ Added "switchport dot1q-tunnel priority map" on page 604.

◆ Updated syntax for "show l2protocol-tunnel" on page 613.

◆ Updated syntax for "show protocol-vlan protocol-group" on page 618.

◆ Updated syntax for "class-map" on page 646.

◆ Updated syntax for "show policy-map interface" on page 663.

◆ Added "ipv6 mld snooping proxy-reporting" on page 703.

◆ Added "ipv6 mld snooping unsolicited-report-interval" on page 708.

◆ Updated syntax for "ipv6 mld snooping vlan immediate-leave" on page 709.

◆ Updated syntax for "show ipv6 mld snooping" on page 712.

◆ Updated syntax for "show ipv6 mld snooping group source-list" on page 713.

◆ Added "show ipv6 mld snooping statistics" on page 715.

◆ Updated Command Usage for "ipv6 nd reachable-time" on page 949.

◆ Updated syntax for "vrrp authentication" on page 966, "vrrp ip" on page 966,

"vrrp preempt" on page 967, "vrrp priority" on page 968, and "vrrp timers
advertise" on page 969.

◆ Updated syntax for "ipv6 route" on page 981.

◆ Updated syntax for "show ipv6 route" on page 983.

◆ Updated syntax for "redistribute" on page 1011.

◆ Updated syntax for "redistribute" on page 1053.

– 5 –

How to Use This Guide

December 2014 Revision

This is the fourth version of this guide. This guide is valid for software release
v1.2.2.0. It contains the following changes:

◆ Added information for ECS4620-28F-DC.

July 2014 Revision

This is the third version of this guide. This guide is valid for software release v1.2.2.0.
It contains the following changes:

◆ Added information for ECS4620-28T-DC.

◆ Updated usage information for the command "mac-learning" on page 312.

◆ Updated syntax and usage information for the command "ip source-guard

binding" on page 362.

◆ Updated usage information for the command "ip source-guard mode" on

page 366.

◆ Added the command "loopback-detection action" on page 502.

April 2014 Revision

This is the second version of this guide. This guide is valid for software release
v1.2.1.3. It contains the following changes:

◆ Added information for ECS4620-28F, ECS4620-28T, and ECS4620-28P.

◆ Extended configurable VLAN range from 1-4093 to 1-4094.

◆ Added "Stack Operations" on page 69.

◆ Added the command "show process cpu task" on page 130.

◆ Added "Stacking" on page 198.

◆ Updated syntax for "snmp-server enable traps" on page 208.

◆ Added the commands "snmp-server enable port-traps mac-notification" on

page 212 and "show snmp-server enable port-traps" on page 212.

◆ Updated command usage section for the command "pppoe

intermediate-agent port-format-type" on page 305.

◆ Added the command "pppoe intermediate-agent port-format-type remote-id-

delimiter" on page 306.

◆ Added the command "mac-learning" on page 312.

– 6 –

How to Use This Guide

◆ Updated command usage section for the command "port security" on

page 313.

◆ Added the command "port security mac-address-as-permanent" on page 315.

◆ Added the commands "ip dhcp snooping information option encode no-

subtype" on page 342, "ip dhcp snooping information option remote-id" on
page 343, and "ip dhcp snooping information option tr101 board-id" on
page 344.

◆ Added the commands "ipv6 dhcp snooping option remote-id" on page 355,

and "ipv6 dhcp snooping option remote-id policy" on page 356.

◆ Updated syntax for the command "ip source-guard binding" on page 362 and

"ip source-guard max-binding" on page 365, and "show ip source-guard
binding" on page 368.

◆ Added the commands "ip source-guard mode" on page 366 and "clear ip

source-guard binding blocked" on page 367.

◆ Updated syntax for the command "media-type" on page 429.

◆ Updated range for the commands "transceiver-threshold current" on page 442,

"transceiver-threshold rx-power" on page 443, "transceiver-threshold
temperature" on page 444, "transceiver-threshold tx-power" on page 445, and
"transceiver-threshold voltage" on page 446.

◆ Added the command "show interfaces transceiver-threshold" on page 448.

◆ Updated command usage section for the command "power inline maximum

allocation" on page 468.

◆ Updated syntax for the command "auto-traffic-control control-release" on

page 495.

◆ Added the command "loopback-detection action" on page 502.

◆ Removed the command “loopback-detection mode.”

◆ Added the command "loopback detection trap" on page 504.

◆ Added the commands "udld detection-interval" on page 507, "udld recovery"

on page 509, and "udld recovery-interval" on page 509.

◆ Updated range for the command "mac-address-table aging-time" on page 515.

◆ Added the commands "spanning-tree tc-prop" on page 531, "spanning-tree

tc-prop-stop" on page 547, and "show spanning-tree tc-prop" on page 552.

◆ Updated syntax for the command "mac-vlan" on page 622.

– 7 –

How to Use This Guide

◆ Updated syntax for the commands "show qos map cos-dscp" on page 641,

"show qos map dscp-mutation" on page 641, and "show qos map phb-queue"
on page 642.

◆ Added the commands "clear ip igmp snooping groups dynamic" on page 683,

and "clear ip igmp snooping statistics" on page 683.

◆ Updated command usage section for the command "ip igmp authentication"

on page 693.

◆ Added the commands "clear ipv6 mld snooping groups dynamic" on page 711

and "clear ipv6 mld snooping statistics" on page 712.

◆ Updated range for the command "mvr priority" on page 730.

◆ Added the commands "clear mrv groups dynamic" on page 739 and "clear mrv

statistics" on page 739.

◆ Updated syntax for the command "show mvr members" on page 743 and

"show mvr statistics" on page 745.

◆ Added the command "mvr6 priority" on page 751.

◆ Added the command "clear efm oam event-log" on page 866.

◆ Updated syntax for the commands "ip route" on page 976 and "show ip route"

on page 978.

◆ Added BGP to the parameter list for the RIP command "redistribute" on

page 991.

◆ Added BGP to the parameter list for the OSPFv2 command "redistribute" on

page 1011.

◆ Added the command "area authentication" on page 1014.

◆ Added the command "neighbor password" on page 1126.

December 2013 Revision

This is the first version of this guide. This guide is valid for software release v1.1.1.1.

– 8 –

Contents

How to Use This Guide 3

Contents 9

Figures 53

Tables 55

Section I Getting Started 63

1 Initial Switch Configuration 65

Connecting to the Switch 65

Configuration Options 65

Connecting to the Console Port 66

Logging Onto the Command Line Interface 67

Setting Passwords 67

Remote Connections 68

Stack Operations 69

Selecting the Stack Master 69

Selecting the Backup Unit 70

Recovering from Stack Failure or Topology Change 70

Renumbering the Stack 71

Ensuring Consistent Code is Used Across the Stack 71

Configuring the Switch for Remote Management 72

Using the Network Interface 72

Setting an IP Address 72

Enabling SNMP Management Access 78

Managing System Files 80

Upgrading the Operation Code 81

Saving or Restoring Configuration Settings 81

Automatic Installation of Operation Code and Configuration Settings 83

– 9 –

Contents

Downloading Operation Code from a File Server 83

Specifying a DHCP Client Identifier 86

Downloading a Configuration File and Other Parameters from a DHCP Server 87

Setting the System Clock 89

Setting the Time Manually 89

Configuring SNTP 90

Configuring NTP 90

Section II Command Line Interface 93

2 Using the Command Line Interface 95

Accessing the CLI 95

Console Connection 95

Telnet Connection 96

Entering Commands 97

Keywords and Arguments 97

Minimum Abbreviation 97

Command Completion 97

Getting Help on Commands 98

Partial Keyword Lookup 100

Negating the Effect of Commands 100

Using Command History 100

Understanding Command Modes 100

Exec Commands 101

Configuration Commands 102

Command Line Processing 104

Showing Status Information 105

CLI Command Groups 105

3 General Commands 109

prompt 109

reload (Global Configuration) 110

enable 111

quit 112

show history 112

– 10 –

Contents

configure 113

disable 114

reload (Privileged Exec) 114

show reload 115

end 115

exit 115

4 System Management Commands 117

Device Designation 117

hostname 118

Banner Information 118

banner configure 119

banner configure company 120

banner configure dc-power-info 121

banner configure department 121

banner configure equipment-info 122

banner configure equipment-location 123

banner configure ip-lan 123

banner configure lp-number 124

banner configure manager-info 125

banner configure mux 125

banner configure note 126

show banner 127

System Status 127

show access-list tcam-utilization 128

show memory 128

show process cpu 129

show process cpu guard 130

show process cpu task 130

show running-config 131

show startup-config 133

show system 134

show tech-support 135

show users 136

show version 137

– 11 –

Contents

show watchdog 138

watchdog software 138

Fan Control 138

fan-speed force-full 138

Frame Size 139

jumbo frame 139

File Management 140

General Commands 141

boot system 141

copy 142

delete 146

dir 147

whichboot 149

Automatic Code Upgrade Commands 149

upgrade opcode auto 149

upgrade opcode path 150

upgrade opcode reload 151

show upgrade 152

TFTP Configuration Commands 152

ip tftp retry 152

ip tftp timeout 153

show ip tftp 153

Line 154

line 155

databits 155

exec-timeout 156

login 157

parity 158

password 158

password-thresh 159

silent-time 160

speed 161

stopbits 161

timeout login response 162

disconnect 162

– 12 –

Contents

terminal 163

show line 164

Event Logging 165

logging facility 165

logging history 166

logging host 167

logging on 167

logging trap 168

clear log 169

show log 169

show logging 170

SMTP Alerts 172

logging sendmail 172

logging sendmail destination-email 172

logging sendmail host 173

logging sendmail level 174

logging sendmail source-email 174

show logging sendmail 175

Time 175

SNTP Commands 176

sntp client 176

sntp poll 177

sntp server 178

show sntp 178

NTP Commands 179

ntp authenticate 179

ntp authentication-key 180

ntp client 181

ntp server 181

show ntp 182

Manual Configuration Commands 183

clock summer-time (date) 183

clock summer-time (predefined) 184

clock summer-time (recurring) 185

clock timezone 187

– 13 –

Contents

calendar set 188

show calendar 188

Time Range 189

time-range 189

absolute 190

periodic 191

show time-range 192

Switch Clustering 192

cluster 193

cluster commander 194

cluster ip-pool 195

cluster member 195

rcommand 196

show cluster 197

show cluster members 197

show cluster candidates 197

Stacking 198

switch all renumber 198

switch master button 199

switch stacking button 200

show switch master button 200

show switch stacking button 201

show switch stacking interfaces 201

5 SNMP Commands 203

General SNMP Commands 205

snmp-server 205

snmp-server community 205

snmp-server contact 206

snmp-server location 207

show snmp 207

SNMP Target Host Commands 208

snmp-server enable traps 208

snmp-server host 210

snmp-server enable port-traps mac-notification 212

– 14 –

Contents

show snmp-server enable port-traps 212

SNMPv3 Commands 213

snmp-server engine-id 213

snmp-server group 214

snmp-server user 215

snmp-server view 217

show snmp engine-id 218

show snmp group 219

show snmp user 220

show snmp view 221

Notification Log Commands 221

nlm 221

snmp-server notify-filter 222

show nlm oper-status 223

show snmp notify-filter 224

Additional Trap Commands 224

memory 224

process cpu 225

process cpu guard 226

6 Remote Monitoring Commands 229

rmon alarm 230

rmon event 231

rmon collection history 232

rmon collection rmon1 233

show rmon alarms 234

show rmon events 234

show rmon history 234

show rmon statistics 235

7 Flow Sampling Commands 237

sflow owner 237

sflow polling instance 239

sflow sampling instance 240

show sflow 241

– 15 –

Contents

8 Authentication Commands 243

User Accounts and Privilege Levels 244

enable password 244

username 245

privilege 246

show privilege 247

Authentication Sequence 248

authentication enable 248

authentication login 249

RADIUS Client 250

radius-server acct-port 250

radius-server auth-port 251

radius-server host 251

radius-server key 252

radius-server retransmit 253

radius-server timeout 253

show radius-server 254

TACACS+ Client 254

tacacs-server host 255

tacacs-server key 255

tacacs-server port 256

tacacs-server retransmit 256

tacacs-server timeout 257

show tacacs-server 257

AAA 258

aaa accounting commands 258

aaa accounting dot1x 259

aaa accounting exec 260

aaa accounting update 261

aaa authorization exec 262

aaa group server 263

server 263

accounting dot1x 264

accounting commands 264

– 16 –

Contents

accounting exec 265

authorization exec 265

show accounting 266

show authorization 267

Web Server 268

ip http authentication 268

ip http port 269

ip http secure-port 269

ip http secure-server 270

ip http server 271

Telnet Server 272

ip telnet max-sessions 272

ip telnet port 273

ip telnet server 273

telnet (client) 274

show ip telnet 274

Secure Shell 275

ip ssh authentication-retries 278

ip ssh server 278

ip ssh server-key size 279

ip ssh timeout 279

delete public-key 280

ip ssh crypto host-key generate 281

ip ssh crypto zeroize 281

ip ssh save host-key 282

show ip ssh 282

show public-key 283

show ssh 284

802.1X Port Authentication 284

General Commands 285

dot1x default 285

dot1x eapol-pass-through 286

dot1x system-auth-control 287

Authenticator Commands 287

dot1x intrusion-action 287

– 17 –

Contents

dot1x max-reauth-req 288

dot1x max-req 288

dot1x operation-mode 289

dot1x port-control 290

dot1x re-authentication 290

dot1x timeout quiet-period 291

dot1x timeout re-authperiod 291

dot1x timeout supp-timeout 292

dot1x timeout tx-period 293

dot1x re-authenticate 293

Supplicant Commands 294

dot1x identity profile 294

dot1x max-start 294

dot1x pae supplicant 295

dot1x timeout auth-period 296

dot1x timeout held-period 296

dot1x timeout start-period 297

Information Display Commands 297

show dot1x 297

Management IP Filter 300

management 300

show management 301

PPPoE Intermediate Agent 302

pppoe intermediate-agent 303

pppoe intermediate-agent format-type 303

pppoe intermediate-agent port-enable 304

pppoe intermediate-agent port-format-type 305

pppoe intermediate-agent port-format-type remote-id-delimiter 306

pppoe intermediate-agent trust 306

pppoe intermediate-agent vendor-tag strip 307

clear pppoe intermediate-agent statistics 307

show pppoe intermediate-agent info 308

show pppoe intermediate-agent statistics 309

9 General Security Measures 311

– 18 –

Contents

Port Security 312

mac-learning 312

port security 313

port security mac-address-as-permanent 315

show port security 315

Network Access (MAC Address Authentication) 317

network-access aging 318

network-access mac-filter 319

mac-authentication reauth-time 320

network-access dynamic-qos 320

network-access dynamic-vlan 321

network-access guest-vlan 322

network-access link-detection 323

network-access link-detection link-down 324

network-access link-detection link-up 324

network-access link-detection link-up-down 325

network-access max-mac-count 325

network-access mode mac-authentication 326

network-access port-mac-filter 327

mac-authentication intrusion-action 328

mac-authentication max-mac-count 328

clear network-access 329

show network-access 329

show network-access mac-address-table 330

show network-access mac-filter 331

Web Authentication 332

web-auth login-attempts 333

web-auth quiet-period 333

web-auth session-timeout 334

web-auth system-auth-control 334

web-auth 335

web-auth re-authenticate (Port) 335

web-auth re-authenticate (IP) 336

show web-auth 336

show web-auth interface 337

– 19 –

Contents

show web-auth summary 337

DHCPv4 Snooping 338

ip dhcp snooping 339

ip dhcp snooping information option 341

ip dhcp snooping information option encode no-subtype 342

ip dhcp snooping information option remote-id 343

ip dhcp snooping information option tr101 board-id 344

ip dhcp snooping information policy 344

ip dhcp snooping limit rate 345

ip dhcp snooping verify mac-address 345

ip dhcp snooping vlan 346

ip dhcp snooping information option circuit-id 347

ip dhcp snooping trust 348

clear ip dhcp snooping binding 349

clear ip dhcp snooping database flash 350

ip dhcp snooping database flash 350

show ip dhcp snooping 351

show ip dhcp snooping binding 351

DHCPv6 Snooping 351

ipv6 dhcp snooping 352

ipv6 dhcp snooping option remote-id 355

ipv6 dhcp snooping option remote-id policy 356

ipv6 dhcp snooping vlan 357

ipv6 dhcp snooping max-binding 358

ipv6 dhcp snooping trust 358

clear ipv6 dhcp snooping binding 359

clear ipv6 dhcp snooping statistics 360

show ipv6 dhcp snooping 360

show ipv6 dhcp snooping binding 360

show ipv6 dhcp snooping statistics 361

IPv4 Source Guard 361

ip source-guard binding 362

ip source-guard 364

ip source-guard max-binding 365

ip source-guard mode 366

– 20 –

Contents

clear ip source-guard binding blocked 367

show ip source-guard 367

show ip source-guard binding 368

IPv6 Source Guard 369

ipv6 source-guard binding 369

ipv6 source-guard 371

ipv6 source-guard max-binding 372

show ipv6 source-guard 373

show ipv6 source-guard binding 374

ARP Inspection 374

ip arp inspection 375

ip arp inspection filter 376

ip arp inspection log-buffer logs 377

ip arp inspection validate 378

ip arp inspection vlan 379

ip arp inspection limit 380

ip arp inspection trust 380

show ip arp inspection configuration 381

show ip arp inspection interface 381

show ip arp inspection log 382

show ip arp inspection statistics 382

show ip arp inspection vlan 382

Denial of Service Protection 383

dos-protection echo-chargen 384

dos-protection smurf 384

dos-protection tcp-flooding 385

dos-protection tcp-null-scan 385

dos-protection tcp-syn-fin-scan 386

dos-protection tcp-udp-port-zero 386

dos-protection tcp-xmas-scan 387

dos-protection udp-flooding 387

dos-protection win-nuke 388

show dos-protection 388

Port-based Traffic Segmentation 389

traffic-segmentation 389

– 21 –

Contents

traffic-segmentation session 390

traffic-segmentation uplink/downlink 391

traffic-segmentation uplink-to-uplink 392

show traffic-segmentation 393

10 Access Control Lists 395

IPv4 ACLs 395

access-list ip 396

ip access-group (Global Configuration) 397

permit, deny (Standard IP ACL) 398

permit, deny (Extended IPv4 ACL) 399

ip access-group (Interface Configuration) 401

show ip access-group 402

show ip access-list 402

IPv6 ACLs 403

access-list ipv6 403

ipv6 access-group (Global Configuration) 404

permit, deny (Standard IPv6 ACL) 405

permit, deny (Extended IPv6 ACL) 406

ipv6 access-group (Interface Configuration) 408

show ipv6 access-group 409

show ipv6 access-list 409

MAC ACLs 410

access-list mac 410

mac access-group (Global Configuration) 411

permit, deny (MAC ACL) 412

mac access-group (Interface Configuration) 415

show mac access-group 416

show mac access-list 416

ARP ACLs 417

access-list arp 417

permit, deny (ARP ACL) 418

show access-list arp 419

ACL Information 420

clear access-list hardware counters 420

– 22 –

Contents

show access-group 421

show access-list 421

11 Interface Commands 423

Interface Configuration 424

interface 424

alias 425

capabilities 426

description 427

discard 427

flowcontrol 428

media-type 429

negotiation 430

shutdown 431

speed-duplex 431

clear counters 432

show discard 433

show interfaces brief 433

show interfaces counters 434

show interfaces status 438

show interfaces switchport 439

Transceiver Threshold Configuration 441

transceiver-monitor 441

transceiver-threshold-auto 441

transceiver-threshold current 442

transceiver-threshold rx-power 443

transceiver-threshold temperature 444

transceiver-threshold tx-power 445

transceiver-threshold voltage 446

show interfaces transceiver 447

show interfaces transceiver-threshold 448

Cable Diagnostics 449

test cable-diagnostics 449

show cable-diagnostics 450

– 23 –

Contents

Power Savings 451

power-save 451

show power-save 452

12 Link Aggregation Commands 453

Manual Configuration Commands 454

port channel load-balance 454

channel-group 456

Dynamic Configuration Commands 457

lacp 457

lacp admin-key (Ethernet Interface) 458

lacp port-priority 459

lacp system-priority 460

lacp admin-key (Port Channel) 461

lacp timeout 462

Trunk Status Display Commands 463

show lacp 463

show port-channel load-balance 466

13 Power over Ethernet Commands 467

power inline 467

power inline maximum allocation 468

power inline priority 469

show power inline status 470

show power mainpower 471

14 Port Mirroring Commands 473

Local Port Mirroring Commands 473

port monitor 473

show port monitor 475

RSPAN Mirroring Commands 476

rspan source 478

rspan destination 479

rspan remote vlan 480

no rspan session 481

show rspan 482

– 24 –

Contents

15 Congestion Control Commands 483

Rate Limit Commands 483

rate-limit 484

Storm Control Commands 485

switchport packet-rate 485

Automatic Traffic Control Commands 486

Threshold Commands 489

auto-traffic-control apply-timer 489

auto-traffic-control release-timer 490

auto-traffic-control 491

auto-traffic-control action 491

auto-traffic-control alarm-clear-threshold 492

auto-traffic-control alarm-fire-threshold 493

auto-traffic-control auto-control-release 494

auto-traffic-control control-release 495

SNMP Trap Commands 495

snmp-server enable port-traps atc broadcast-alarm-clear 495

snmp-server enable port-traps atc broadcast-alarm-fire 496

snmp-server enable port-traps atc broadcast-control-apply 496

snmp-server enable port-traps atc broadcast-control-release 497

snmp-server enable port-traps atc multicast-alarm-clear 497

snmp-server enable port-traps atc multicast-alarm-fire 498

snmp-server enable port-traps atc multicast-control-apply 498

snmp-server enable port-traps atc multicast-control-release 499

ATC Display Commands 499

show auto-traffic-control 499

show auto-traffic-control interface 500

16 Loopback Detection Commands 501

loopback-detection 502

loopback-detection action 502

loopback-detection recover-time 503

loopback-detection transmit-interval 504

loopback detection trap 504

loopback-detection release 505

– 25 –

Contents

show loopback-detection 506

17 UniDirectional Link Detection Commands 507

udld detection-interval 507

udld message-interval 508

udld recovery 509

udld recovery-interval 509

udld aggressive 510

udld port 511

show udld 512

18 Address Table Commands 515

mac-address-table aging-time 515

mac-address-table hash-lookup-depth 516

mac-address-table static 517

clear collision-mac-address-table 518

clear mac-address-table dynamic 518

show collision-mac-address-table 518

show mac-address-table 519

show mac-address-table aging-time 520

show mac-address-table count 520

show mac-address-table hash-lookup-depth 521

19 Spanning Tree Commands 523

spanning-tree 524

spanning-tree cisco-prestandard 525

spanning-tree forward-time 526

spanning-tree hello-time 526

spanning-tree max-age 527

spanning-tree mode 528

spanning-tree mst configuration 529

spanning-tree pathcost method 529

spanning-tree priority 530

spanning-tree system-bpdu-flooding 531

spanning-tree tc-prop 531

spanning-tree transmission-limit 532

– 26 –

Contents

max-hops 532

mst priority 533

mst vlan 534

name 535

revision 535

spanning-tree bpdu-filter 536

spanning-tree bpdu-guard 537

spanning-tree cost 538

spanning-tree edge-port 539

spanning-tree link-type 540

spanning-tree loopback-detection 540

spanning-tree loopback-detection action 541

spanning-tree loopback-detection release-mode 542

spanning-tree loopback-detection trap 543

spanning-tree mst cost 543

spanning-tree mst port-priority 544

spanning-tree port-bpdu-flooding 545

spanning-tree port-priority 545

spanning-tree root-guard 546

spanning-tree spanning-disabled 547

spanning-tree tc-prop-stop 547

spanning-tree loopback-detection release 548

spanning-tree protocol-migration 549

show spanning-tree 550

show spanning-tree mst configuration 552

show spanning-tree tc-prop 552

20 ERPS Commands 553

erps 555

erps domain 556

control-vlan 556

enable 557

guard-timer 558

holdoff-timer 559

major-domain 559

– 27 –

Contents

meg-level 560

mep-monitor 561

node-id 562

non-erps-dev-protect 562

non-revertive 564

propagate-tc 567

raps-def-mac 568

raps-without-vc 569

ring-port 571

rpl neighbor 572

rpl owner 572

version 573

wtr-timer 574

clear erps statistics 575

erps clear 575

erps forced-switch 576

erps manual-switch 578

show erps 579

21 VLAN Commands 585

GVRP and Bridge Extension Commands 586

bridge-ext gvrp 586

garp timer 587

switchport forbidden vlan 588

switchport gvrp 588

show bridge-ext 589

show garp timer 590

show gvrp configuration 591

Editing VLAN Groups 591

vlan database 591

vlan 592

Configuring VLAN Interfaces 593

interface vlan 594

switchport acceptable-frame-types 595

switchport allowed vlan 595

– 28 –

Contents

switchport ingress-filtering 597

switchport mode 598

switchport native vlan 598

vlan-trunking 599

Displaying VLAN Information 601

show vlan 601

Configuring IEEE 802.1Q Tunneling 602

dot1q-tunnel system-tunnel-control 603

switchport dot1q-tunnel mode 604

switchport dot1q-tunnel priority map 604

switchport dot1q-tunnel service match cvid 605

switchport dot1q-tunnel tpid 607

show dot1q-tunnel 608

Configuring L2PT Tunneling 609

l2protocol-tunnel tunnel-dmac 609

switchport l2protocol-tunnel 612

show l2protocol-tunnel 613

Configuring VLAN Translation 613

switchport vlan-translation 614

show vlan-translation 615

Configuring Protocol-based VLANs 616

protocol-vlan protocol-group (Configuring Groups) 617

protocol-vlan protocol-group (Configuring Interfaces) 617

show protocol-vlan protocol-group 618

show interfaces protocol-vlan protocol-group 619

Configuring IP Subnet VLANs 620

subnet-vlan 620

show subnet-vlan 621

Configuring MAC Based VLANs 622

mac-vlan 622

show mac-vlan 623

Configuring Voice VLANs 624

voice vlan 624

voice vlan aging 625

voice vlan mac-address 626

– 29 –

Contents

switchport voice vlan 627

switchport voice vlan priority 628

switchport voice vlan rule 628

switchport voice vlan security 629

show voice vlan 630

22 Class of Service Commands 631

Priority Commands (Layer 2) 631

queue mode 632

queue weight 633

switchport priority default 634

show queue mode 635

show queue weight 635

Priority Commands (Layer 3 and 4) 636

qos map cos-dscp 636

qos map dscp-mutation 638

qos map phb-queue 639

qos map trust-mode 640

show qos map cos-dscp 641

show qos map dscp-mutation 641

show qos map phb-queue 642

show qos map trust-mode 643

23 Quality of Service Commands 645

class-map 646

description 647

match 648

rename 649

policy-map 650

class 650

police flow 652

police srtcm-color 653

police trtcm-color 656

set cos 658

set ip dscp 659

set phb 660

– 30 –

Contents

service-policy 661

show class-map 661

show policy-map 662

show policy-map interface 663

24 Multicast Filtering Commands 665

IGMP Snooping 666

ip igmp snooping 667

ip igmp snooping priority 668

ip igmp snooping proxy-reporting 669

ip igmp snooping querier 669

ip igmp snooping router-alert-option-check 670

ip igmp snooping router-port-expire-time 671

ip igmp snooping tcn-flood 671

ip igmp snooping tcn-query-solicit 672

ip igmp snooping unregistered-data-flood 673

ip igmp snooping unsolicited-report-interval 674

ip igmp snooping version 674

ip igmp snooping version-exclusive 675

ip igmp snooping vlan general-query-suppression 676

ip igmp snooping vlan immediate-leave 676

ip igmp snooping vlan last-memb-query-count 677

ip igmp snooping vlan last-memb-query-intvl 678

ip igmp snooping vlan mrd 679

ip igmp snooping vlan proxy-address 680

ip igmp snooping vlan query-interval 681

ip igmp snooping vlan query-resp-intvl 682

ip igmp snooping vlan static 682

clear ip igmp snooping groups dynamic 683

clear ip igmp snooping statistics 683

show ip igmp snooping 684

show ip igmp snooping group 685

show ip igmp snooping mrouter 686

show ip igmp snooping statistics 686

Static Multicast Routing 689

– 31 –

Contents

ip igmp snooping vlan mrouter 689

IGMP Filtering and Throttling 690

ip igmp filter (Global Configuration) 691

ip igmp profile 692

permit, deny 692

range 693

ip igmp authentication 693

ip igmp filter (Interface Configuration) 695

ip igmp max-groups 696

ip igmp max-groups action 696

ip igmp query-drop 697

ip multicast-data-drop 697

show ip igmp authentication 698

show ip igmp filter 699

show ip igmp profile 699

show ip igmp query-drop 700

show ip igmp throttle interface 700

show ip multicast-data-drop 701

MLD Snooping 702

ipv6 mld snooping 703

ipv6 mld snooping proxy-reporting 703

ipv6 mld snooping querier 704

ipv6 mld snooping query-interval 705

ipv6 mld snooping query-max-response-time 705

ipv6 mld snooping robustness 706

ipv6 mld snooping router-port-expire-time 706

ipv6 mld snooping unknown-multicast mode 707

ipv6 mld snooping unsolicited-report-interval 708

ipv6 mld snooping version 708

ipv6 mld snooping vlan immediate-leave 709

ipv6 mld snooping vlan mrouter 710

ipv6 mld snooping vlan static 711

clear ipv6 mld snooping groups dynamic 711

clear ipv6 mld snooping statistics 712

show ipv6 mld snooping 712

– 32 –

Contents

show ipv6 mld snooping group 713

show ipv6 mld snooping group source-list 713

show ipv6 mld snooping mrouter 714

show ipv6 mld snooping statistics 715

MLD Filtering and Throttling 719

ipv6 mld filter (Global Configuration) 719

ipv6 mld profile 720

permit, deny 721

range 721

ipv6 mld filter (Interface Configuration) 722

ipv6 mld max-groups 722

ipv6 mld max-groups action 723

ipv6 mld query-drop 724

ipv6 multicast-data-drop 724

show ipv6 mld filter 725

show ipv6 mld profile 725

show ipv6 mld query-drop 726

show ipv6 mld throttle interface 726

MVR for IPv4 727

mvr 728

mvr associated-profile 729

mvr domain 729

mvr priority 730

mvr profile 731

mvr proxy-query-interval 732

mvr proxy-switching 732

mvr robustness-value 733

mvr source-port-mode dynamic 734

mvr upstream-source-ip 735

mvr vlan 735

mvr immediate-leave 736

mvr type 737

mvr vlan group 738

clear mrv groups dynamic 739

clear mrv statistics 739

– 33 –

Contents

show mvr 740

show mvr associated-profile 741

show mvr interface 742

show mvr members 743

show mvr profile 745

show mvr statistics 745

MVR for IPv6 749

mvr6 associated-profile 750

mvr6 domain 751

mvr6 priority 751

mvr6 profile 752

mvr6 proxy-query-interval 753

mvr6 proxy-switching 753

mvr6 robustness-value 755

mvr6 source-port-mode dynamic 755

mvr6 upstream-source-ip 756

mvr6 vlan 757

mvr6 immediate-leave 757

mvr6 type 758

mvr6 vlan group 759

clear mvr6 groups dynamic 760

clear mvr6 statistics 761

show mvr6 761

show mvr6 associated-profile 763

show mvr6 interface 763

show mvr6 members 764

show mvr6 profile 765

show mvr6 statistics 766

IGMP (Layer 3) 768

ip igmp 769

ip igmp last-member-query-interval 770

ip igmp max-resp-interval 770

ip igmp query-interval 771

ip igmp robustval 772

ip igmp static-group 773

– 34 –

Contents

ip igmp version 774

clear ip igmp group 774

show ip igmp groups 775

show ip igmp interface 777

IGMP Proxy Routing 778

ip igmp proxy 778

ip igmp proxy unsolicited-report-interval 780

MLD (Layer 3) 780

ipv6 mld 781

ipv6 mld last-member-query-response-interval 781

ipv6 mld max-resp-interval 782

ipv6 mld query-interval 783

ipv6 mld robustval 784

ipv6 mld static-group 784

ipv6 mld version 785

clear ipv6 mld group 786

show ipv6 mld groups 787

show ipv6 mld interface 788

MLD Proxy Routing 789

ipv6 mld proxy 789

ipv6 mld proxy unsolicited-report-interval 791

25 LLDP Commands 793

lldp 795

lldp holdtime-multiplier 795

lldp med-fast-start-count 796

lldp notification-interval 796

lldp refresh-interval 797

lldp reinit-delay 797

lldp tx-delay 798

lldp admin-status 799

lldp basic-tlv management-ip-address 799

lldp basic-tlv port-description 800

lldp basic-tlv system-capabilities 800

lldp basic-tlv system-description 801

– 35 –

Contents

lldp basic-tlv system-name 801

lldp dot1-tlv proto-ident 802

lldp dot1-tlv proto-vid 802

lldp dot1-tlv pvid 803

lldp dot1-tlv vlan-name 803

lldp dot3-tlv link-agg 804

lldp dot3-tlv mac-phy 804

lldp dot3-tlv max-frame 805

lldp dot3-tlv poe 805

lldp med-location civic-addr 806

lldp med-notification 808

lldp med-tlv ext-poe 808

lldp med-tlv inventory 809

lldp med-tlv location 809

lldp med-tlv med-cap 810

lldp med-tlv network-policy 810

lldp notification 811

show lldp config 812

show lldp info local-device 813

show lldp info remote-device 814

show lldp info statistics 816

26 CFM Commands 819

Defining CFM Structures 822

ethernet cfm ais level 822

ethernet cfm ais ma 823

ethernet cfm ais period 824

ethernet cfm ais suppress alarm 824

ethernet cfm domain 825

ethernet cfm enable 827

ma index name 828

ma index name-format 829

ethernet cfm mep 830

ethernet cfm port-enable 831

clear ethernet cfm ais mpid 831

– 36 –

Contents

show ethernet cfm configuration 832

show ethernet cfm md 834

show ethernet cfm ma 834

show ethernet cfm maintenance-points local 835

show ethernet cfm maintenance-points local detail mep 836

show ethernet cfm maintenance-points remote detail 837

Continuity Check Operations 839

ethernet cfm cc ma interval 839

ethernet cfm cc enable 840

snmp-server enable traps ethernet cfm cc 841

mep archive-hold-time 842

clear ethernet cfm maintenance-points remote 842

clear ethernet cfm errors 843

show ethernet cfm errors 844

Cross Check Operations 845

ethernet cfm mep crosscheck start-delay 845

snmp-server enable traps ethernet cfm crosscheck 845

mep crosscheck mpid 846

ethernet cfm mep crosscheck 847

show ethernet cfm maintenance-points remote crosscheck 848

Link Trace Operations 848

ethernet cfm linktrace cache 848

ethernet cfm linktrace cache hold-time 849

ethernet cfm linktrace cache size 850

ethernet cfm linktrace 850

clear ethernet cfm linktrace-cache 852

show ethernet cfm linktrace-cache 852

Loopback Operations 853

ethernet cfm loopback 853

Fault Generator Operations 854

mep fault-notify alarm-time 854

mep fault-notify lowest-priority 855

mep fault-notify reset-time 856

show ethernet cfm fault-notify-generator 857

– 37 –

Contents

Delay Measure Operations 858

ethernet cfm delay-measure two-way 858

27 OAM Commands 861

efm oam 862

efm oam critical-link-event 862

efm oam link-monitor frame 863

efm oam link-monitor frame threshold 864

efm oam link-monitor frame window 864

efm oam mode 865

clear efm oam counters 866

clear efm oam event-log 866

efm oam remote-loopback 867

efm oam remote-loopback test 868

show efm oam counters interface 869

show efm oam event-log interface 869

show efm oam remote-loopback interface 871

show efm oam status interface 871

show efm oam status remote interface 872

28 Domain Name Service Commands 873

ip domain-list 873

ip domain-lookup 874

ip domain-name 875

ip host 876

ip name-server 877

ipv6 host 878

clear dns cache 878

clear host 879

show dns 879

show dns cache 880

show hosts 880

29 DHCP Commands 883

DHCP Client 883

– 38 –

Contents

DHCP for IPv4 884

ip dhcp client class-id 884

ip dhcp restart client 885

DHCP for IPv6 886

ipv6 dhcp client rapid-commit vlan 886

show ipv6 dhcp duid 887

show ipv6 dhcp vlan 887

DHCP Relay 888

DHCP Relay for IPv4 888

ip dhcp relay server 888

ip dhcp restart relay 889

DHCP Relay for IPv6 890

ipv6 dhcp relay destination 890

show ipv6 dhcp relay destination 891

DHCP Server 892

ip dhcp excluded-address 893

ip dhcp pool 893

service dhcp 894

bootfile 894

client-identifier 895

default-router 896

dns-server 896

domain-name 897

hardware-address 897

host 898

lease 899

netbios-name-server 900

netbios-node-type 901

network 901

next-server 902

clear ip dhcp binding 903

show ip dhcp 903

show ip dhcp binding 904

show ip dhcp pool 904

– 39 –

Contents

30 IP Interface Commands 907

IPv4 Interface 907

Basic IPv4 Configuration 908

ip address 908

ip default-gateway 910

show ip interface 911

show ip traffic 912

traceroute 913

ping 914

ARP Configuration 915

arp 915

arp timeout 916

ip proxy-arp 917

clear arp-cache 918

show arp 918

UDP Helper Configuration 919

ip forward-protocol udp 919

ip helper 920

ip helper-address 921

show ip helper 922

IPv6 Interface 922

Interface Address Configuration and Utilities 924

ipv6 default-gateway 924

ipv6 address 925

ipv6 address eui-64 926

ipv6 address link-local 928

ipv6 enable 929

ipv6 mtu 930

show ipv6 interface 932

show ipv6 mtu 934

show ipv6 traffic 934

clear ipv6 traffic 939

ping6 939

traceroute6 940

– 40 –

Contents

Neighbor Discovery 942

ipv6 hop-limit 942

ipv6 neighbor 942

ipv6 nd dad attempts 944

ipv6 nd managed-config-flag 945

ipv6 nd other-config-flag 946

ipv6 nd ns-interval 947

ipv6 nd raguard 948

ipv6 nd reachable-time 949

ipv6 nd prefix 949

ipv6 nd ra interval 951

ipv6 nd ra lifetime 952

ipv6 nd ra router-preference 952

ipv6 nd ra suppress 953

clear ipv6 neighbors 954

show ipv6 nd raguard 954

show ipv6 neighbors 954

ND Snooping 956

ipv6 nd snooping 957

ipv6 nd snooping auto-detect 958

ipv6 nd snooping auto-detect retransmit count 959

ipv6 nd snooping auto-detect retransmit interval 959

ipv6 nd snooping prefix timeout 960

ipv6 nd snooping max-binding 961

ipv6 nd snooping trust 961

clear ipv6 nd snooping binding 962

clear ipv6 nd snooping prefix 962

show ipv6 nd snooping 962

show ipv6 nd snooping binding 963

show ipv6 nd snooping prefix 963

31 VRRP Commands 965

vrrp authentication 966

vrrp ip 966

vrrp preempt 967

– 41 –

Contents

vrrp priority 968

vrrp timers advertise 969

show vrrp 970

show vrrp interface 972

show vrrp interface counters 973

show vrrp router counters 974

50 IP Routing Commands 975

Global Routing Configuration 975

IPv4 Commands 976

ip route 976

maximum-paths 977

show ip host-route 978

show ip route 978

show ip route database 979

show ip route summary 980

show ip traffic 980

IPv6 Commands 981

ipv6 route 981

show ipv6 route 983

Routing Information Protocol (RIP) 984

router rip 985

default-information originate 986

default-metric 986

distance 987

maximum-prefix 988

neighbor 988

network 989

passive-interface 990

redistribute 991

timers basic 992

version 993

ip rip authentication mode 994

ip rip authentication string 995

ip rip receive version 996

– 42 –

Contents

ip rip receive-packet 996

ip rip send version 997

ip rip send-packet 998

ip rip split-horizon 999

clear ip rip route 999

show ip protocols rip 1000

show ip rip 1001

Open Shortest Path First (OSPFv2) 1002

General Configuration 1003

router ospf 1003

compatible rfc1583 1004

default-information originate 1005

router-id 1006

timers spf 1007

clear ip ospf process 1008

Route Metrics and Summaries 1008

area default-cost 1008

area range 1009

auto-cost reference-bandwidth 1010

default-metric 1011

redistribute 1011

summary-address 1013

Area Configuration 1014

area authentication 1014

area nssa 1015

area stub 1017

area virtual-link 1018

network area 1020

Interface Configuration 1021

ip ospf authentication 1021

ip ospf authentication-key 1023

ip ospf cost 1024

ip ospf dead-interval 1025

ip ospf hello-interval 1025

ip ospf message-digest-key 1026

– 43 –

Contents

ip ospf priority 1027

ip ospf retransmit-interval 1028

ip ospf transmit-delay 1029

passive-interface 1030

Display Information 1030

show ip ospf 1030

show ip ospf border-routers 1032

show ip ospf database 1033

show ip ospf interface 1039

show ip ospf neighbor 1041

show ip ospf route 1042

show ip ospf virtual-links 1042

show ip protocols ospf 1043

Open Shortest Path First (OSPFv3) 1044

General Configuration 1046

router ipv6 ospf 1046

abr-type 1047

max-current-dd 1048

router-id 1049

timers spf 1050

Route Metrics and Summaries 1050

area default-cost 1050

area range 1051

default-metric 1052

redistribute 1053

Area Configuration 1054

area stub 1054

area virtual-link 1055

ipv6 router ospf area 1057

ipv6 router ospf tag area 1058

Interface Configuration 1059

ipv6 ospf cost 1059

ipv6 ospf dead-interval 1060

ipv6 ospf hello-interval 1061

ipv6 ospf priority 1061

– 44 –

Contents

ipv6 ospf retransmit-interval 1062

ipv6 ospf transmit-delay 1063

passive-interface 1064

Display Information 1065

show ipv6 ospf 1065

show ipv6 ospf database 1066

show ipv6 ospf interface 1067

show ipv6 ospf neighbor 1068

show ipv6 ospf route 1069

show ipv6 ospf virtual-links 1070

Border Gateway Protocol (BGPv4) 1071

BGP Overview 1071

External and Internal BGP 1071

BGP Routing Basics 1073

Internal BGP Scalability 1076

Route Flap Dampening 1081

BGP Command List 1082

General Configuration 1085

router bgp 1085

ip as-path access-list 1086

ip community-list 1087

ip extcommunity-list 1089

ip prefix-list 1091

aggregate-address 1093

bgp client-to-client reflection 1094

bgp cluster-id 1095

bgp confederation identifier 1096

bgp confederation peer 1097

bgp dampening 1098

bgp enforce-first-as 1099

bgp fast-external-failover 1099

bgp log-neighbor-changes 1100

bgp network import-check 1100

bgp router-id 1101

bgp scan-time 1101

– 45 –

Contents

network 1102

redistribute 1103

timers bgp 1104

clear ip bgp 1105

clear ip bgp dampening 1106

Route Metrics and Selection 1107

bgp always-compare-med 1107

bgp bestpath as-path ignore 1107

bgp bestpath compare-confed-aspath 1108

bgp bestpath compare-routerid 1108

bgp bestpath med 1109

bgp default local-preference 1110

bgp deterministic-med 1110

distance 1111

distance bgp 1112

Neighbor Configuration 1113

neighbor activate 1113

neighbor advertisement-interval 1114

neighbor allowas-in 1114

neighbor attribute-unchanged 1115

neighbor capability dynamic 1116

neighbor capability orf prefix-list 1116

neighbor default-originate 1117

neighbor description 1118

neighbor distribute-list 1118

neighbor dont-capability-negotiate 1119

neighbor ebgp-multihop 1120

neighbor enforce-multihop 1121

neighbor filter-list 1121

neighbor interface 1122

neighbor maximum-prefix 1123

neighbor next-hop-self 1124

neighbor override-capability 1124

neighbor passive 1125

neighbor password 1126

– 46 –

Contents

neighbor peer-group (Creating) 1126

neighbor peer-group (Group Members) 1127

neighbor port 1128

neighbor prefix-list 1128

neighbor remote-as 1129

neighbor remove-private-as 1130

neighbor route-map 1131

neighbor route-reflector-client 1131

neighbor route-server-client 1132

neighbor send-community 1133

neighbor shutdown 1134

neighbor soft-reconfiguration inbound 1134

neighbor strict-capability-match 1135

neighbor timers 1136

neighbor timers connect 1137

neighbor unsuppress-map 1137

neighbor update-source 1138

neighbor weight 1139

Display Information 1139

show ip bgp 1139

show ip bgp attribute-info 1141

show ip bgp cidr-only 1141

show ip bgp community 1142

show ip bgp community-info 1143

show ip bgp community-list 1143

show ip bgp dampening 1144

show ip bgp filter-list 1145

show ip bgp neighbors 1146

show ip bgp paths 1147

show ip bgp prefix-list 1148

show ip bgp regexp 1148

show ip bgp route-map 1149

show ip bgp scan 1149

show ip bgp summary 1150

show ip community-list 1150

– 47 –

Contents

show ip extcommunity-list 1151

show ip prefix-list 1151

show ip prefix-list detail 1152

show ip prefix-list summary 1152

Policy-based Routing for BGP 1153

route-map 1155

call 1156

continue 1156

description 1157

match as-path 1157

match community 1158

match extcommunity 1159

match ip address 1159

match ip next-hop 1160

match ip route-source 1160

match metric 1161

match origin 1161

match pathlimit as 1162

match peer 1163

on-match 1163

set aggregator as 1164

set as-path 1164

set atomic-aggregate 1165

set comm-list delete 1166

set community 1166

set extcommunity 1168

set ip next-hop 1169

set local-preference 1170

set metric 1170

set origin 1171

set originator-id 1172

set pathlimit ttl 1172

set weight 1173

show route-map 1173

– 48 –

Contents

51 Multicast Routing Commands 1175

General Multicast Routing 1175

IPv4 Commands 1175

ip multicast-routing 1175

show ip mroute 1176

IPv6 Commands 1178

ipv6 multicast-routing 1178

show ipv6 mroute 1179

Static Multicast Routing 1181

ip igmp snooping vlan mrouter 1181

show ip igmp snooping mrouter 1182

PIM Multicast Routing 1183

IPv4 PIM Commands 1183

PIM Shared Mode Commands 1184

router pim 1184

ip pim 1185

ip pim hello-holdtime 1186

ip pim hello-interval 1187

ip pim join-prune-holdtime 1187

ip pim lan-prune-delay 1188

ip pim override-interval 1189

ip pim propagation-delay 1190

ip pim trigger-hello-delay 1190

show ip pim interface 1191

show ip pim neighbor 1192

PIM-DM Commands 1192

ip pim graft-retry-interval 1192

ip pim max-graft-retries 1193

ip pim state-refresh origination-interval 1193

PIM-SM Commands 1194

ip pim bsr-candidate 1194

ip pim register-rate-limit 1196

ip pim register-source 1196

ip pim rp-address 1197

ip pim rp-candidate 1199

– 49 –

Contents

ip pim spt-threshold 1200

ip pim dr-priority 1201

ip pim join-prune-interval 1202

clear ip pim bsr rp-set 1203

show ip pim bsr-router 1204

show ip pim rp mapping 1205

show ip pim rp-hash 1206

IPv6 PIM Commands 1206

PIM6 Shared Mode Commands 1207

router pim6 1207

ipv6 pim 1208

ipv6 pim hello-holdtime 1209

ipv6 pim hello-interval 1210

ipv6 pim join-prune-holdtime 1210

ipv6 pim lan-prune-delay 1211

ipv6 pim override-interval 1212

ipv6 pim propagation-delay 1213

ipv6 pim trigger-hello-delay 1213

show ipv6 pim interface 1214

show ipv6 pim neighbor 1215

PIM6-DM Commands 1215

ipv6 pim graft-retry-interval 1215

ipv6 pim max-graft-retries 1216

ipv6 pim state-refresh origination-interval 1217

PIM6-SM Commands 1218

ipv6 pim bsr-candidate 1218

ipv6 pim register-rate-limit 1219

ipv6 pim register-source 1220

ipv6 pim rp-address 1220

ipv6 pim rp-candidate 1222

ipv6 pim spt-threshold 1223

ipv6 pim dr-priority 1224

ipv6 pim join-prune-interval 1225

clear ipv6 pim bsr rp-set 1226

show ipv6 pim bsr-router 1227

– 50 –

Contents

show ipv6 pim rp mapping 1228

show ipv6 pim rp-hash 1229

Section III Appendices 1231

A Troubleshooting 1233

Problems Accessing the Management Interface 1233

Using System Logs 1234

B License Information 1235

The GNU General Public License 1235

Glossary 1239

CLI Command List 1247

– 51 –

Contents

– 52 –

Figures

Figure 1: Storm Control by Limiting the Traffic Rate 488

Figure 2: Storm Control by Shutting Down a Port 489

Figure 3: Non-ERPS Device Protection 563

Figure 4: Sub-ring with Virtual Channel 570

Figure 5: Sub-ring without Virtual Channel 570

Figure 6: Configuring VLAN Trunking 600

Figure 7: Mapping QinQ Service VLAN to Customer VLAN 606

Figure 8: Configuring VLAN Translation 614

Figure 1: Connections for Internal and External BGP 1072

Figure 2: Connections for Single Route Reflector 1077

Figure 3: Connections for Multiple Route Reflectors 1077

Figure 4: Connections for BGP Confederation 1079

Figure 5: Connections for Route Server 1080

– 53 –

Figures

– 54 –

Tables

Table 1: Options 60, 66 and 67 Statements 88

Table 2: Options 55 and 124 Statements 88

Table 3: General Command Modes 101

Table 4: Configuration Command Modes 103

Table 5: Keystroke Commands 104

Table 6: Command Group Index 105

Table 7: General Commands 109

Table 8: System Management Commands 117

Table 9: Device Designation Commands 117

Table 10: Banner Commands 118

Table 11: System Status Commands 127

Table 12: show system – display description 134

Table 13: show version – display description 137

Table 14: Fan Control Commands 138

Table 15: Frame Size Commands 139

Table 16: Flash/File Commands 140

Table 17: File Directory Information 148

Table 18: Line Commands 154

Table 19: Event Logging Commands 165

Table 20: Logging Levels 166

Table 21: show logging flash/ram - display description 171

Table 22: show logging trap - display description 171

Table 23: Event Logging Commands 172

Table 24: Time Commands 175

Table 25: Predefined Summer-Time Parameters 185

Table 26: Time Range Commands 189

Table 27: Switch Cluster Commands 192

Table 28: Stacking Commands 198

Table 29: SNMP Commands 203

– 55 –

Tabl es

Table 30: show snmp engine-id - display description 218

Table 31: show snmp group - display description 219

Table 32: show snmp user - display description 220

Table 33: show snmp view - display description 221

Table 34: RMON Commands 229

Table 35: sFlow Commands 237

Table 36: Authentication Commands 243

Table 37: User Access Commands 244

Table 38: Default Login Settings 246

Table 39: Authentication Sequence Commands 248

Table 40: RADIUS Client Commands 250

Table 41: TACACS+ Client Commands 254

Table 42: AAA Commands 258

Table 43: Web Server Commands 268

Table 44: HTTPS System Support 271

Table 45: Telnet Server Commands 272

Table 46: Secure Shell Commands 275

Table 47: show ssh - display description 284

Table 48: 802.1X Port Authentication Commands 284

Table 49: Management IP Filter Commands 300

Table 50: PPPoE Intermediate Agent Commands 302

Table 51: show pppoe intermediate-agent statistics - display description 309

Table 52: General Security Commands 311

Table 53: Port Security Commands 312

Table 54: show port security - display description 316

Table 55: Network Access Commands 317

Table 56: Dynamic QoS Profiles 321

Table 57: Web Authentication 332

Table 58: DHCP Snooping Commands 338

Table 59: Option 82 information 348

Table 60: DHCP Snooping Commands 352

Table 61: IPv4 Source Guard Commands 361

Table 62: IPv6 Source Guard Commands 369

Table 63: ARP Inspection Commands 374

Table 64: DoS Protection Commands 383

– 56 –

Tables

Table 65: Commands for Configuring Traffic Segmentation 389

Table 66: Traffic Segmentation Forwarding 390

Table 67: Access Control List Commands 395

Table 68: IPv4 ACL Commands 395

Table 69: IPv6 ACL Commands 403

Table 70: MAC ACL Commands 410

Table 71: ARP ACL Commands 417

Table 72: ACL Information Commands 420

Table 73: Interface Commands 423

Table 74: show interfaces counters - display description 435

Table 75: show interfaces switchport - display description 440

Table 76: Link Aggregation Commands 453

Table 77: show lacp counters - display description 463

Table 78: show lacp internal - display description 464

Table 79: show lacp neighbors - display description 465

Table 80: show lacp sysid - display description 466

Table 81: PoE Commands 467

Table 82: show power inline status - display description 470

Table 83: show power mainpower - display description 471

Table 84: Port Mirroring Commands 473

Table 85: Mirror Port Commands 473

Table 86: RSPAN Commands 476

Table 87: Congestion Control Commands 483

Table 88: Rate Limit Commands 483

Table 89: Storm Control Commands 485

Table 90: ATC Commands 486

Table 91: Loopback Detection Commands 501

Table 92: UniDirectional Link Detection Commands 507

Table 93: show udld - display description 512

Table 94: Address Table Commands 515

Table 95: Spanning Tree Commands 523

Table 96: Recommended STA Path Cost Range 538

Table 97: Default STA Path Costs 538

Table 98: ERPS Commands 553

Table 99: ERPS Request/State Priority 577

– 57 –

Tabl es

Table 100: show erps - summary display description 580

Table 101: show erps domain - detailed display description 581

Table 102: show erps statistics - detailed display description 583

Table 103: VLAN Commands 585

Table 104: GVRP and Bridge Extension Commands 586

Table 105: show bridge-ext - display description 589

Table 106: Commands for Editing VLAN Groups 591

Table 107: Commands for Configuring VLAN Interfaces 593

Table 108: Commands for Displaying VLAN Information 601

Table 109: 802.1Q Tunneling Commands 602

Table 110: L2 Protocol Tunnel Commands 609

Table 111: VLAN Translation Commands 613

Table 112: Protocol-based VLAN Commands 616

Table 113: IP Subnet VLAN Commands 620

Table 114: MAC Based VLAN Commands 622

Table 115: Voice VLAN Commands 624

Table 116: Priority Commands 631

Table 117: Priority Commands (Layer 2) 631

Table 118: Priority Commands (Layer 3 and 4) 636

Table 119: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence 637

Table 120: Default Mapping of DSCP Values to Internal PHB/Drop Values 638

Table 121: Mapping Internal Per-hop Behavior to Hardware Queues 639

Table 122: Quality of Service Commands 645

Table 123: Multicast Filtering Commands 665

Table 124: IGMP Snooping Commands 666

Table 125: show ip igmp snooping statistics input - display description 687

Table 126: show ip igmp snooping statistics output - display description 688

Table 127: show ip igmp snooping statistics vlan query - display description 688

Table 128: Static Multicast Interface Commands 689

Table 129: IGMP Filtering and Throttling Commands 690

Table 130: IGMP Authentication RADIUS Attribute Value Pairs 694

Table 131: MLD Snooping Commands 702

Table 132: show ipv6 MLD snooping statistics input - display description 715

Table 133: show ipv6 MLD snooping statistics output - display description 716

Table 134: show ipv6 MLD snooping statistics query - display description 717

– 58 –

Tables

Table 135: show ipv6 MLD snooping statistics summary - display description 718

Table 136: MLD Filtering and Throttling Commands 719

Table 137: Multicast VLAN Registration for IPv4 Commands 727

Table 138: show mvr - display description 741

Table 139: show mvr interface - display description 742

Table 140: show mvr members - display description 744

Table 141: show mvr statistics input - display description 746

Table 142: show mvr statistics output - display description 746

Table 143: show mvr statistics query - display description 747

Table 144: show mvr statistics summary interface - display description 748

Table 145: Multicast VLAN Registration for IPv6 Commands 749

Table 146: show mvr6 - display description 762

Table 147: show mvr6 interface - display description 764

Table 148: show mvr6 members - display description 765

Table 149: show mvr6 statistics input - display description 766

Table 150: show mvr6 statistics output - display description 767

Table 151: show mvr6 statistics query - display description 768

Table 152: IGMP Commands (Layer 3) 768

Table 153: show ip igmp groups - display description 776

Table 154: show ip igmp groups detail - display description 776

Table 155: IGMP Proxy Commands 778

Table 156: MLD Commands (Layer 3) 780

Table 157: show ipv6 mld groups - display description 787

Table 158: IGMP Proxy Commands 789

Table 159: LLDP Commands 793

Table 160: LLDP MED Location CA Types 807

Table 161: CFM Commands 819

Table 162: show ethernet cfm configuration traps - display description 833

Table 163: show ethernet cfm maintenance-points local detail mep - display 837

Table 164: show ethernet cfm maintenance-points remote detail - display 838

Table 165: show ethernet cfm errors - display description 844

Table 166: show ethernet cfm linktrace-cache - display description 852

Table 167: Remote MEP Priority Levels 856

Table 168: MEP Defect Descriptions 856

Table 169: show fault-notify-generator - display description 857

– 59 –

Tabl es

Table 170: OAM Commands 861

Table 171: DNS Commands 873

Table 172: show dns cache - display description 880

Table 173: show hosts - display description 881

Table 174: DHCP Commands 883

Table 175: DHCP Client Commands 883

Table 176: Options 60, 66 and 67 Statements 884

Table 177: Options 55 and 124 Statements 885

Table 178: DHCP Relay Option 82 Commands 888

Table 179: DHCP Server Commands 892

Table 180: IP Interface Commands 907

Table 181: IPv4 Interface Commands 907

Table 182: Basic IP Configuration Commands 908

Table 183: Address Resolution Protocol Commands 915

Table 184: UDP Helper Commands 919

Table 185: IPv6 Configuration Commands 922

Table 186: show ipv6 interface - display description 933

Table 187: show ipv6 mtu - display description 934

Table 188: show ipv6 traffic - display description 936

Table 189: show ipv6 neighbors - display description 955

Table 190: ND Snooping Commands 956

Table 191: VRRP Commands 965

Table 192: show vrrp - display description 971

Table 193: show vrrp brief - display description 971

Table 194: show vrrp interface counters - display description 973

Table 1: IP Routing Commands 975

Table 2: Global Routing Configuration Commands 975

Table 3: show ip host-route - display description 978

Table 4: Routing Information Protocol Commands 984

Table 5: Open Shortest Path First Commands 1002

Table 6: show ip ospf - display description 1031

Table 7: show ip ospf database - display description 1034

Table 8: show ip ospf database summary - display description 1035

Table 9: show ip ospf database external - display description 1036

Table 10: show ip ospf database network - display description 1037

– 60 –

Tables

Table 11: show ip ospf database router - display description 1038

Table 12: show ip ospf database summary - display description 1039

Table 13: show ip ospf interface - display description 1040

Table 14: show ip ospf neighbor - display description 1041

Table 15: show ip ospf virtual-links - display description 1043

Table 16: show ip protocols ospf - display description 1043

Table 17: Open Shortest Path First Commands (Version 3) 1044

Table 18: show ip ospf - display description 1065

Table 19: show ip ospf database - display description 1067

Table 20: show ip ospf interface - display description 1068

Table 21: show ipv6 ospf neighbor - display description 1069

Table 22: show ipv6 ospf virtual-links - display description 1070

Table 23: Border Gateway Protocol Commands – Version 4 1082

Table 24: show ip bgp - display description 1140

Table 25: show ip bgp community-info - display description 1143

Table 26: show ip bgp dampening parameters- display description 1145

Table 27: show ip bgp - display description 1147

Table 28: show ip bgp paths - display description 1148

Table 29: Policy-based Routing Configuration Commands 1153

Table 30: Multicast Routing Commands 1175

Table 31: General Multicast Routing Commands 1175

Table 32: show ip mroute - display description 1177

Table 33: show ip mroute - display description 1180

Table 34: Static Multicast Routing Commands 1181

Table 35: IPv4 and IPv6 PIM Commands 1183

Table 36: PIM-DM and PIM-SM Multicast Routing Commands 1183

Table 37: show ip pim neighbor - display description 1192

Table 38: show ip pim bsr-router - display description 1204

Table 39: show ip pim rp mapping - display description 1205

Table 40: show ip pim rp-hash - display description 1206

Table 41: PIM-DM and PIM-SM Multicast Routing Commands 1206

Table 42: show ipv6 pim neighbor - display description 1215

Table 43: show ip pim bsr-router - display description 1227

Table 44: show ip pim rp mapping - display description 1228

Table 45: show ip pim rp-hash - display description 1229

– 61 –

Tabl es

Table 46: Troubleshooting Chart 1233

– 62 –

Section I

Getting Started

This section describes how to configure the switch for management access through
the web interface or SNMP.

This section includes these chapters:

◆ "Initial Switch Configuration" on page 65

– 63 –

Section I

| Getting Started

– 64 –

1 Initial Switch Configuration

This chapter includes information on connecting to the switch and basic
configuration procedures.

Connecting to the Switch

The switch includes a built-in network management agent. The agent offers a
variety of management options, including SNMP, RMON and a web-based interface.
A PC may also be connected directly to the switch for configuration and monitoring
via a command line interface (CLI).

Note:

An IPv4 address for this switch is obtained via DHCP by default. To change

this address, see “Setting an IP Address” on page 72.

Configuration Options The switch’s HTTP web agent allows you to configure switch parameters, monitor

port connections, and display statistics using a standard web browser such as
Internet Explorer 11, Mozilla Firefox 49, or Google Chrome 54 or more recent
versions. The switch’s web management interface can be accessed from any
computer attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial
console port on the switch, or remotely by a Telnet connection over the network.

The switch’s management agent also supports SNMP (Simple Network
Management Protocol). This SNMP agent permits the switch to be managed from
any system in the network using network management software.

The switch’s web interface, console interface, and SNMP agent allow you to
perform the following management functions:

◆ Set user names and passwords

◆ Set an IP interface for any VLAN

◆ Configure SNMP parameters

◆ Enable/disable any port

◆ Set the speed/duplex mode for any port

◆ Configure the bandwidth of any port by limiting input or output rates

◆ Control port access through IEEE 802.1X security or static address filtering

– 65 –

Chapter 1

Connecting to the Switch

| Initial Switch Configuration

◆ Filter packets using Access Control Lists (ACLs)

◆ Configure up to 4094 IEEE 802.1Q VLANs

◆ Enable GVRP automatic VLAN registration

◆ Configure IP routing for unicast or multicast traffic

◆ Configure router redundancy

◆ Configure IGMP multicast filtering

◆ Upload and download system firmware or configuration files via HTTP (using

the web interface) or FTP/TFTP (using the command line or web interface)

◆ Configure Spanning Tree parameters

◆ Configure Class of Service (CoS) priority queuing

◆ Configure static or LACP trunks (up to 16)

◆ Enable port mirroring

◆ Set storm control on any port for excessive broadcast, multicast, or unknown

unicast traffic

Connecting to the

Console Port

◆ Display system information and statistics

◆ Configure any stack unit through the same IP address

The switch provides an RS-232 serial port that enables a connection to a PC or
terminal for monitoring and configuring the switch. A null-modem console cable is
provided with the switch.

Note:

When configuring a stack, connect to the console port on the Master unit.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program
to the switch. You can use the console cable provided with this package, or use a
null-modem cable that complies with the wiring assignments shown in the
Installation Guide.

To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC running

terminal emulation software, and tighten the captive retaining screws on the
DB-9 connector.

2. Connect the other end of the cable to the RS-45 serial port on the switch.

3. Make sure the terminal emulation software is set as follows:

■

Select the appropriate serial port (COM port 1 or COM port 2).

■

Set the baud rate to 115200 bps.

■

Set the data format to 8 data bits, 1 stop bit, and no parity.

– 66 –

Chapter 1

■

Set flow control to none.

■

Set the emulation mode to VT100.

■

When using HyperTerminal, select Terminal keys, not Windows keys.

| Initial Switch Configuration

Connecting to the Switch

4. Power on the switch.

After the system completes the boot cycle, the logon screen appears.

Logging Onto the

Command Line

Interface

The CLI program provides two different command levels — normal access level
(Normal Exec) and privileged access level (Privileged Exec). The commands
available at the Normal Exec level are a limited subset of those available at the
Privileged Exec level and allow you to only display information and use basic
utilities. To fully configure the switch parameters, you must access the CLI at the
Privileged Exec level.

Access to both CLI levels are controlled by user names and passwords. The switch
has a default user name and password for each level. To log into the CLI at the
Privileged Exec level using the default user name and password, perform these
steps:

1. To initiate your console connection, press <Enter>. The “User Access

Verification” procedure starts.

2. At the User Name prompt, enter “admin.”

3. At the Password prompt, also enter “admin.” (The password characters are not

displayed on the console screen.)

4. The session is opened and the CLI displays the “Console#” prompt indicating

you have access at the Privileged Exec level.

Setting Passwords If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record
them and put them in a safe place.

Passwords can consist of up to 32 alphanumeric characters and are case sensitive.
To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name and password “admin”

to access the Privileged Exec level.

2. Type “configure” and press <Enter>.

3. Type “username guest password 0 password,” for the Normal Exec level, where

password is your new password. Press <Enter>.

– 67 –

Chapter 1

Connecting to the Switch

| Initial Switch Configuration

4. Type “username admin password 0 password,” for the Privileged Exec level,

where password is your new password. Press <Enter>.

Username: admin
Password:

CLI session with the ECS4620-28T* is opened.
To end the CLI session, enter [Exit].

Console#configure
Console(config)#username guest password 0 [password]
Console(config)#username admin password 0 [password]
Console(config)#

* This manual covers all switches in the ECS4620 series. Other than the difference

in port types, and support for PoE (ECS4620-28P/52P/52P-2AC), there are no
significant differences. Therefore nearly all of the screen display examples are
based on the ECS4620-28T.

Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must

first configure it with a valid IPv4 or IPv6 address, subnet mask, and default gateway
using a console connection, BOOTP or DHCP protocol. To configure this device as
the default gateway, use the ip default-gateway command.

An IPv4 address for the switch is obtained via DHCP by default. To manually
configure this address or enable dynamic address assignment via DHCP, see

“Setting an IP Address” on page 72.

After configuring the switch’s IP parameters, you can access the onboard
configuration program from anywhere within the attached network. The onboard
configuration program can be accessed using Telnet or SSH from any computer
attached to the network. The switch can also be managed by any computer using a
web browser (Internet Explorer 6, Mozilla Firefox 4, or Google Chrome 29, or more
recent versions), or from a network computer using SNMP network management
software.

Note:

This switch supports eight Telnet sessions or SSH sessions.

Note:

Any VLAN group can be assigned an IP interface address (page 72) for
managing the switch. Also, note that the Master unit does not have to include an
active port member in the VLAN interface used for management access.

The onboard program only provides access to basic configuration functions. To
access the full range of SNMP management functions, you must use SNMP-based
network management software.

– 68 –

Stack Operations

Chapter 1

| Initial Switch Configuration

Stack Operations

Up to eight switches can be stacked together as described in the Installation Guide.
One unit in the stack acts as the Master for configuration tasks and firmware
upgrade. All of the other units function in Slave mode, but can automatically take
over management of the stack if the Master unit fails.

To configure any unit in the stack, first verify the unit number from the front panel
indicator on the switch, and then select the appropriate unit number from the web
or console management interface.

Selecting the

Stack Master

Note the following points about unit numbering:

◆ When the stack is initially powered on, the Master unit is selected based on the

following rules:

■

If the stack master button has been enabled with the switch master button
command on only one unit in the stack, that unit will serve as the stack
Master.

■

If the stack master button has been enabled on more than one unit, the
system will select the unit with the lowest MAC address as the stack Master
from those with the stack master button enabled.

■

If the stack master button is not enabled on any unit, the system will select
the unit with the lowest MAC address as the stack Master.

◆ When the stack is initially powered on, the Master unit is designated as unit 1

for a ring topology. For a line topology, the stack is simply numbered from top
to bottom, with the first unit in the stack designated at unit 1. This unit
identification number appears on the Stack Unit ID LED on the front panel of
the switch. Any unit in the stack can be selected on the front panel graphic of
the web interface (from the Unit scroll-down list), or from the CLI (as specified
by the “unit” parameter for applicable commands).

◆ If the Master unit fails and another unit takes over control of the stack, the unit

numbering will not change.

◆ If a unit in the stack fails or is removed from the stack, the unit numbers will not

change. This means that when you replace a unit in the stack, the original
configuration for the failed unit will be restored to the replacement unit.

◆ If a unit is removed from the stack and later reattached to the stack, it will retain

the original unit number obtained during stacking.

◆ If a unit is removed from the stack, and powered up as a stand-alone unit, it will

also retain the original unit number obtained during stacking.

– 69 –

Chapter 1

Stack Operations

| Initial Switch Configuration

Selecting the

Backup Unit

Recovering from

Stack Failure or

Topology Change

Once the Master unit finishes booting up, it continues to synchronize configuration
information to all of the Slave units in the stack. If the Master unit fails or is powered
off, a new master unit will be selected based on the election rules described in the
preceding section. The backup unit elected to serve as the new stack Master will
take control of the stack without any loss of configuration settings. To ensure a
logical fail over to the next unit down in the stack, place the Slave unit with the
lowest MAC address directly beneath the Master unit in the stack.

When a link or unit in the stack fails, a trap message is sent and a failure event is
logged. The stack will be rebooted after any system failure or topology change. It
takes two to three minutes to for the stack to reboot. If the Master unit fails, the
backup unit will take over operations as the new Master unit, reboot the stack, and
then select another backup unit after the stack finishes rebooting. Also note that
powering down a unit or inserting a new unit in the stack will cause the stack to
reboot. If a unit is removed from the stack (due to a power down or failure) or a new
unit added to the stack, the original unit IDs are not affected after rebooting, and a
new unit is assigned the lowest available unit ID.

Broken Link for Line and Wrap-around Topologies

All units in the stack must be connected via stacking cable. You can connect the
units in a simple cascade configuration from the top to the bottom unit. Using this
kind of line topology, if any link or unit in the stack fails, the stack will be broken in
two.

When the stack fails, a Master unit is selected from the two stack segments, either
the unit with the Master button enabled, or the unit with the lowest MAC address if
the Master button is not enabled on any unit. The stack reboots and resumes
operations. However, note that the IP address will be the same for any common
VLANs (with active port connections) that appear in both of the new stack
segments. To resolve the conflicting IP addresses, you should manually replace the
failed link or unit as soon as possible. If you are using a wrap-around stack topology,
a single point of failure in the stack will not cause the stack to fail. It would take two
or more points of failure to break the stack apart.

Note:

If a stack breaks apart, the IP address will be the same for any common
VLANs (with active port connections) that appear in both stack segments.

Resilient IP Interface for Management Access

The stack functions as one integral system for management and configuration
purposes. You can therefore manage the stack through any IP interface configured
on the stack. The Master unit does not even have to include an active port member
in the VLAN interface used for management access. However, if the unit to which
you normally connect for management access fails, and there are no active port
members on the other units within this VLAN interface, then this IP address will no
longer be available. To retain a constant IP address for management access across

– 70 –

Chapter 1

| Initial Switch Configuration

Stack Operations

failover events, you should include port members on several units within the
primary VLAN used for stack management.

Resilient Configuration

If a unit in the stack fails, the unit numbers will not change. This means that when
you replace a unit in the stack, the original configuration for the failed unit will be
restored to the replacement unit. This applies to both the Master and Slave units.

Renumbering

the Stack

Ensuring Consistent

Code is Used Across

the Stack

The startup configuration file maps configuration settings to each switch in the
stack based on the unit identification number. If the units are no longer numbered
sequentially after several topology changes or failures, you can reset the unit
numbers using the System > Stacking (Renumber) menu in the web interface or the

switch all renumber command in the CLI. Just remember to save the new

configuration settings to a startup configuration file prior to powering off the stack
Master.

Consistent Runtime Code in Each Switch – The main board runtime firmware
version for each unit in the stack must be the same as the Master unit’s runtime
firmware. After Auto-ID assignment is completed, the Master unit checks the image
versions for consistency. If the firmware versions (i.e., runtime code) configured for
bootup on any slave units are not the same as those on the Master unit, the stack
will operate in Special Stacking Mode in which all backup units are disabled as
described below:

◆ The master unit starts normal operation mode in standalone mode.

◆ The master unit can see all units in the stack and maintain stack topology.

◆ None of the other units can function (all ports will be disabled).

◆ All user-initiated commands to configure the non-functioning units are

dropped. The master unit, however, will be able to communicate the following
information to the non-functioning units:

■

Image downloads

■

Stack topology information

■

System configuration information already stored on the master.

In Special Stacking mode, the master unit displays warning messages whenever
you log into the system through the CLI that inform you that an image download is
required.

You can use the CLI, web or SNMP to download the runtime image from an FTP or
TFTP server to the master unit. The master unit stores the image as its “Next boot

– 71 –

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

image” and downloads the image to those backup units that are running a different
image version.

Configuring the Switch for Remote Management

Using the Network

Interface

The switch can be managed through the operational network, known as in-band
management. Because in-band management traffic is mixed in with operational
network traffic, it is subject to all of the filtering rules usually applied to a standard
network ports such as ACLs and VLAN tagging. In-band network management can
be accessed via a connection to any network port (1-28/52).

Setting an IP Address You must establish IP address information for a stand-alone switch or a stack to

obtain management access through the network. This can be done in either of the
following ways:

◆ Manual — You have to input the information, including IP address and subnet

mask. If your management station is not in the same IP subnet as the switch,
you will also need to specify the default gateway router. To configure this
device as the default gateway, use the ip default-gateway command.

◆ Dynamic — The switch can send IPv4 configuration requests to BOOTP or

DHCP address allocation servers on the network, or automatically generate a
unique IPv6 host address based on the local subnet address prefix received in
router advertisement messages. An IPv6 link local address for use in a local
network can also be dynamically generated as described in “Obtaining an IPv6

Address” on page 77.

This switch is designed as a router, and therefore does not support DHCP for
IPv6, so an IPv6 global unicast address for use in a network containing more
than one subnet can only be manually configured as described in “Assigning an

IPv6 Address” on page 73.

Manual Configuration

You can manually assign an IP address to the switch. You may also need to specify a
default gateway that resides between this device and management stations that
exist on another network segment. Valid IPv4 addresses consist of four decimal
numbers, 0 to 255, separated by periods. Anything outside this format will not be
accepted by the CLI program.

Note:

The IPv4 address for VLAN 1 is obtained via DHCP by default.

– 72 –

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

Assigning an IPv4 Address

Before you can assign an IP address to the switch, you must obtain the following
information from your network administrator:

◆ IP address for the switch

◆ Network mask for this network

◆ Default gateway for the network

To assign an IPv4 address to the switch, complete the following steps

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP

address and “netmask” is the network mask for the network. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the default gateway for the network to which the switch

belongs, type “ip default-gateway gateway,” where “gateway” is the IP address
of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.5 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 192.168.1.254

Assigning an IPv6 Address

This section describes how to configure a “link local” address for connectivity
within the local subnet only, and also how to configure a “global unicast” address,
including a network prefix for use on a multi-segment network and the host
portion of the address.

An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One
double colon may be used to indicate the appropriate number of zeros required to
fill the undefined fields. For detailed information on the other ways to assign IPv6
addresses, see “IPv6 Interface” on page 922.

Link Local Address — All link-local addresses must be configured with a prefix in
the range of FE80~FEBF. Remember that this address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet only. Also, if
the switch detects that the address you configured conflicts with that in use by
another device on the subnet, it will stop using the address in question, and
automatically generate a link local address that does not conflict with any other
devices on the local subnet.

– 73 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

To configure an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimal

values for the ipv6-address similar to that shown in the example, followed by
the “link-local” command parameter. Then press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700 link-local
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):
(None)
Joined group address(es):
ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Address for Multi-segment Network — Before you can assign an IPv6 address to the
switch that will be used to connect to a multi-segment network, you must obtain
the following information from your network administrator:

◆ Prefix for this network

◆ IP address for the switch

◆ Default gateway for the network

For networks that encompass several different subnets, you must define the full
address, including a network prefix and the host address for the switch. You can
specify either the full IPv6 address, or the IPv6 address and prefix length. The prefix
length for an IPv6 network is the number of bits (from the left) of the prefix that
form the network address, and is expressed as a decimal number. For example, all
IPv6 addresses that start with the first byte of 73 (hexadecimal) could be expressed
as 73:0:0:0:0:0:0:0/8 or 73::/8.

– 74 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

To generate an IPv6 global unicast address for the switch, complete the following
steps:

1. From the global configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. From the interface prompt, type “ipv6 address ipv6-address” or “ipv6 address

ipv6-address/prefix-length,” where “prefix-length” indicates the address bits

used to form the network portion of the address. (The network address starts
from the left of the prefix and should encompass some of the ipv6-address
bits.) The remaining bits are assigned to the host interface. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the IPv6 default gateway for the network to which the

switch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the
IPv6 address of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:DB8:2222:7272::/64
Console(config-if)#exit
Console(config)#ipv6 default-gateway 2001:DB8:2222:7272::254
Console(config)end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::200:e8ff:fe94:4000%1/64
Global unicast address(es):
2001:db8:2222:7272::/64, subnet is 2001:db8:2222:7272::/64
Joined group address(es):
ff02::1:ff00:0
ff02::1:ff94:4000
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#show ipv6 route
Codes: C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

S* ::/0 [1/0] via 2001:db8:2222:7272::254, VLAN1
C 2001:db8:2222:7272::/64, VLAN1
C fe80::/64, VLAN1

Console#

– 75 –

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

Dynamic Configuration

Obtaining an IPv4 Address

If you select the “bootp” or “dhcp” option, the system will immediately start
broadcasting service requests. IP will be enabled but will not function until a
BOOTP or DHCP reply has been received. Requests are broadcast every few minutes
using exponential backoff until IP configuration information is obtained from a
BOOTP or DHCP server. BOOTP and DHCP values can include the IP address, subnet
mask, and default gateway. If the DHCP/BOOTP server is slow to respond, you may
need to use the “ip dhcp restart client” command to re-start broadcasting service
requests.

Note that the “ip dhcp restart client” command can also be used to start
broadcasting service requests for all VLANs configured to obtain address
assignments through BOOTP or DHCP. It may be necessary to use this command
when DHCP is configured on a VLAN, and the member ports which were previously
shut down are now enabled.

If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the
switch will start broadcasting service requests as soon as it is powered on.

To automatically configure the switch by communicating with BOOTP or DHCP
address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following

commands:

■

To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.

■

To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.

4. Wait a few minutes, and then check the IP configuration settings by typing the

“show ip interface” command. Press <Enter>.

5. Then save your configuration changes by typing “copy running-config startup-

config.” Enter the startup file name and press <Enter>.

– 76 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

Console(config)#interface vlan 1
Console(config-if)#ip address dhcp
Console(config-if)#end
Console#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is 00-E0-0C-00-00-FB
Index: 1001, MTU: 1500
Address Mode is DHCP
IP Address: 192.168.0.2 Mask: 255.255.255.0
Proxy ARP is disabled
DHCP Client Vendor Class ID (text): ECS4620-28T
DHCP Inform is disabled
DHCP relay server: 0.0.0.0
Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.

\Write to FLASH finish.
Success.

Obtaining an IPv6 Address

Link Local Address — There are several ways to configure IPv6 addresses. The
simplest method is to automatically generate a “link local” address (identified by an
address prefix in the range of FE80~FEBF). This address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet.

To generate an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 enable” and press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::7272:cfff:fe83:3466%1/64
Global unicast address(es):
(None)
Joined group address(es):
ff02::1:ff94:4000
ff02::1:ff00:0
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

– 77 –

Chapter 1

Enabling SNMP Management Access

| Initial Switch Configuration

Enabling SNMP Management Access

The switch can be configured to accept management commands from Simple
Network Management Protocol (SNMP) applications such as Edge-Core ECView Pro.
You can configure the switch to respond to SNMP requests or generate SNMP traps.

When SNMP management stations send requests to the switch (either to return
information or to set a parameter), the switch provides the requested data or sets
the specified parameter. The switch can also be configured to send information to
SNMP managers (without being requested by the managers) through trap
messages, which inform the manager that certain events have occurred.

The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients.
To provide management access for version 1 or 2c clients, you must specify a
community string. The switch provides a default MIB View (i.e., an SNMPv3
construct) for the default “public” community string that provides read access to
the entire MIB tree, and a default view for the “private” community string that
provides read/write access to the entire MIB tree. However, you may assign new
views to version 1 or 2c community strings that suit your specific security
requirements (see snmp-server view command).

Community Strings (for SNMP version 1 and 2c clients)

Community strings are used to control management access to SNMP version 1 and
2c stations, as well as to authorize SNMP stations to receive trap messages from the
switch. You therefore need to assign community strings to specified users, and set
the access level.

The default strings are:

◆ public - with read-only access. Authorized management stations are only able

to retrieve MIB objects.

◆ private - with read/write access. Authorized management stations are able to

both retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is
recommended that you change the default community strings.

To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type “snmp-

server community string mode,” where “string” is the community access string
and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the
default mode is read only.)

2. To remove an existing string, simply type “no snmp-server community string,”

where “string” is the community access string to remove. Press <Enter>.

– 78 –

Chapter 1

Console(config)#snmp-server community admin rw
Console(config)#snmp-server community private
Console(config)#

Note:

If you do not intend to support access to SNMP version 1 and 2c clients, we

| Initial Switch Configuration

Enabling SNMP Management Access

recommend that you delete both of the default community strings. If there are no
community strings, then SNMP management access from SNMP v1 and v2c clients
is disabled.

Trap Receivers

You can also specify SNMP stations that are to receive traps from the switch. To
configure a trap receiver, use the “snmp-server host” command. From the
Privileged Exec level global configuration mode prompt, type:

“snmp-server host host-address community-string [version {1 | 2c | 3 {auth |

noauth | priv}}]”

where “host-address” is the IP address for the trap receiver, “community-string”
specifies access rights for a version 1/2c host, or is the user name of a version 3 host,
“version” indicates the SNMP client version, and “auth | noauth | priv” means that
authentication, no authentication, or authentication and privacy is used for v3
clients. Then press <Enter>. For a more detailed description of these parameters,
see the snmp-server host command. The following example creates a trap host for
each type of SNMP client.

Console(config)#snmp-server host 10.1.19.23 batman
Console(config)#snmp-server host 10.1.19.98 robin version 2c
Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth
Console(config)#

Configuring Access for SNMP Version 3 Clients

To configure management access for SNMPv3 clients, you need to first create a
view that defines the portions of MIB that the client can read or write, assign the
view to a group, and then assign the user to a group. The following example creates
one view called “mib-2” that includes the entire MIB-2 tree branch, and then
another view that includes the IEEE 802.1d bridge MIB. It assigns these respective
read and read/write views to a group call “r&d” and specifies group authentication
via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that
MD5 will be used for authentication, provides the password “greenpeace” for
authentication, and the password “einstien” for encryption.

Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included
Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included
Console(config)#snmp-server group r&d v3 auth read mib-2 write 802.1d
Console(config)#snmp-server user steve group r&d v3 auth md5 greenpeace priv

des56 einstien

Console(config)#

– 79 –

Chapter 1

Managing System Files

| Initial Switch Configuration

For a more detailed explanation on how to configure the switch for access from
SNMP v3 clients, refer to “SNMP Commands” on page 203 or to the Web
Management Guide.

Managing System Files

The switch’s flash memory supports three types of system files that can be
managed by the CLI program, the web interface, or SNMP. The switch’s file system
allows files to be uploaded and downloaded, copied, deleted, and set as a start-up
file.

The types of files are:

◆ Configuration — This file type stores system configuration information and is

created when configuration settings are saved. Saved configuration files can be
selected as a system start-up file or can be uploaded via FTP/TFTP to a server
for backup. The file named “Factory_Default_Config.cfg” contains all the system
default settings and cannot be deleted from the system. If the system is booted
with the factory default settings, the switch will also create a file named
“startup1.cfg” that contains system settings for switch initialization, including
information about the unit identifier, and MAC address for the switch. The
configuration settings from the factory defaults configuration file are copied to
this file, which is then used to boot the switch. See “Saving or Restoring

Configuration Settings” on page 81 for more information.

◆ Operation Code — System software that is executed after boot-up, also

known as run-time code. This code runs the switch operations and provides the
CLI and web management interfaces.

◆ Diagnostic Code — Software that is run during system boot-up, also known as

POST (Power On Self-Test).

Note:

The Boot ROM and Loader cannot be uploaded or downloaded from the
FTP/TFTP server. You must follow the instructions in the release notes for new
firmware, or contact your distributor for help.

Due to the size limit of the flash memory, the switch supports only two operation
code files. However, you can have as many diagnostic code files and configuration
files as available flash memory space allows. The switch has a total of 128 Mbytes of
flash memory for system files.

In the system flash memory, one file of each type must be set as the start-up file.
During a system boot, the diagnostic and operation code files set as the start-up file
are run, and then the start-up configuration file is loaded.

Note that configuration files should be downloaded using a file name that reflects
the contents or usage of the file settings. If you download directly to the running-

– 80 –

Chapter 1

| Initial Switch Configuration

Managing System Files

config, the system will reboot, and the settings will have to be copied from the
running-config to a permanent file.

Upgrading the

Operation Code

The following example shows how to download new firmware to the switch and
activate it. The TFTP server could be any standards-compliant server running on
Windows or Linux. When downloading from an FTP server, the logon interface will
prompt for a user name and password configured on the remote server. Note that
“anonymous” is set as the default user name.

File names on the switch are case-sensitive. The destination file name should not
contain slashes (\ or /), and the maximum length for file names is 32 characters for
files on the switch or 128 characters for files on the server. (Valid characters: A-Z,
a-z, 0-9, “.”, “-”)

Console#copy tftp file
TFTP server ip address: 10.1.0.19
Choose file type:

1. config: 2. opcode: 2
Source file name: m360.bix
Destination file name: m360.bix
\Write to FLASH Programming.

-Write to FLASH finish.
Success.
Console#config
Console(config)#boot system opcode: m360.bix
Console(config)#exit
Console#dir

File Name Type Startup Modify Time Size(bytes)

-------------------------- -------------- ------- ------------------- ---------­ Unit 1:

m360.bix OpCode Y 2013-02-25 15:41:04 25812529
m355.bix OpCode N 2012-12-04 13:23:59 25783857

Factory_Default_Config.cfg Config N 2012-12-04 13:18:37 455
startup1.cfg Config Y 2013-03-21 05:39:15 3463

----------------------------------------------------------------------------­ Free space for compressed user config files:1593241600

Console#

Saving or Restoring

Configuration

Settings

Configuration commands only modify the running configuration file and are not
saved when the switch is rebooted. To save all your configuration changes in
nonvolatile storage, you must copy the running configuration file to the start-up
configuration file using the “copy” command.

New startup configuration files must have a name specified. File names on the
switch are case-sensitive, can be from 1 to 31 characters, must not contain slashes
(\ or /), and the leading letter of the file name must not be a period (.). (Valid
characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

There can be more than one user-defined configuration file saved in the switch’s
flash memory, but only one is designated as the “startup” file that is loaded when
the switch boots. The copy running-config startup-config command always sets

– 81 –

Chapter 1

| Initial Switch Configuration

Managing System Files

the new file as the startup file. To select a previously saved configuration file, use
the boot system config:<filename> command.

The maximum number of saved configuration files depends on available flash
memory. The amount of available flash memory can be checked by using the dir
command.

To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config startup-

config” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.

Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.

\Write to FLASH finish.
Success.

Console#

To restore configuration settings from a backup server, enter the following
command:

1. From the Privileged Exec mode prompt, type “copy tftp startup-config” and

press <Enter>.

2. Enter the address of the TFTP server. Press <Enter>.

3. Enter the name of the startup file stored on the server. Press <Enter>.

4. Enter the name for the startup file on the switch. Press <Enter>.

Console#copy tftp startup-config
TFTP server IP address: 192.168.0.4
Source configuration file name: startup-rd.cfg
Startup configuration file name [startup1.cfg]:

Success.
Console#

– 82 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

Automatic Installation of Operation Code and Configuration Settings

Downloading

Operation Code from

a File Server

Automatic Operation Code Upgrade can automatically download an operation
code file when a file newer than the currently installed one is discovered on the file
server. After the file is transferred from the server and successfully written to the file
system, it is automatically set as the startup file, and the switch is rebooted.

Usage Guidelines

◆ If this feature is enabled, the switch searches the defined URL once during the

bootup sequence.

◆ FTP (port 21) and TFTP (port 69) are both supported. Note that the TCP/UDP

port bindings cannot be modified to support servers listening on non-standard
ports.

◆ The host portion of the upgrade file location URL must be a valid IPv4 IP

address. DNS host names are not recognized. Valid IP addresses consist of four
numbers, 0 to 255, separated by periods.

◆ The path to the directory must also be defined. If the file is stored in the root

directory for the FTP/TFTP service, then use the “/” to indicate this (e.g., ftp://

192.168.0.1/).

◆ The file name must not be included in the upgrade file location URL. The file

name of the code stored on the remote server must be ECS4620-28T.bix (using
lower case letters as indicated).

◆ The FTP connection is made with PASV mode enabled. PASV mode is needed to

traverse some fire walls, even if FTP traffic is not blocked. PASV mode cannot be
disabled.

◆ The switch-based search function is case-insensitive in that it will accept a file

name in upper or lower case (i.e., the switch will accept ECS4620-28T.BIX from
the server even though ECS4620-28T.bix was requested). However, keep in mind
that the file systems of many operating systems such as Unix and most Unix­like systems (FreeBSD, NetBSD, OpenBSD, and most Linux distributions, etc.) are
case-sensitive, meaning that two files in the same directory, ecs4620-28t.bix and
ECS4620-28T.BIX are considered to be unique files. Thus, if the upgrade file is
stored as ECS4620-28T.BIX (or even Ecs4620-28t.bix) on a case-sensitive server,
then the switch (requesting ECS4620-28T.bix) will not be upgraded because the
server does not recognize the requested file name and the stored file name as
being equal. A notable exception in the list of case-sensitive Unix-like operating
systems is Mac OS X, which by default is case-insensitive. Please check the
documentation for your server’s operating system if you are unsure of its file
system’s behavior.

– 83 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

◆ Note that the switch itself does not distinguish between upper and lower-case

file names, and only checks to see if the file stored on the server is more recent
than the current runtime image.

◆ If two operation code image files are already stored on the switch’s file system,

then the non-startup image is deleted before the upgrade image is transferred.

◆ The automatic upgrade process will take place in the background without

impeding normal operations (data switching, etc.) of the switch.

◆ During the automatic search and transfer process, the administrator cannot

transfer or update another operation code image, configuration file, public key,
or HTTPS certificate (i.e., no other concurrent file management operations are
possible).

◆ The upgrade operation code image is set as the startup image after it has been

successfully written to the file system.

◆ The switch will send an SNMP trap and make a log entry upon all upgrade

successes and failures.

◆ The switch will immediately restart after the upgrade file is successfully written

to the file system and set as the startup image.

To enable automatic upgrade, enter the following commands:

1. Specify the TFTP or FTP server to check for new operation code.

■

When specifying a TFTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:

tftp://192.168.0.1[/filedir]/

■

When specifying an FTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:

ftp://[username[:password@]]192.168.0.1[/filedir]/

If the user name is omitted, “anonymous” will be used for the connection. If
the password is omitted a null string (“”) will be used for the connection.

If no user name nor password is required for the connection, then the “@”
character cannot be used in the path name.

This shows how to specify a TFTP server where new code is stored.

Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#

– 84 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

This shows how to specify an FTP server where new code is stored.

Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#

2. Set the switch to automatically reboot and load the new code after the opcode

upgrade is completed.

Console(config)#upgrade opcode reload
Console(config)#

3. Set the switch to automatically upgrade the current operational code when a

new version is detected on the server. When the switch starts up and automatic
image upgrade is enabled by this command, the switch will follow these steps
when it boots up:

a. It will search for a new version of the image at the location specified by

upgrade opcode path command. The name for the new image stored on

the TFTP server must be ECS4620-28T.bix. If the switch detects a code
version newer than the one currently in use, it will download the new
image. If two code images are already stored in the switch, the image not
set to start up the system will be overwritten by the new version.

b. After the image has been downloaded, the switch will send a trap message

to log whether or not the upgrade operation was successful.

c. It sets the new version as the startup image.

d. It then restarts the system to start using the new image.

Console(config)#upgrade opcode auto
Console(config)#

4. Display the automatic upgrade settings.

Console#show upgrade
Auto Image Upgrade Global Settings:
Status : Enabled
Reload Status : Enabled
Path :
File Name : ECS4620-28T.bix
Console#

– 85 –

Chapter 1

| Initial Switch Configuration

Automatic Installation of Operation Code and Configuration Settings

The following shows an example of the upgrade process.

Console#dir
File Name Type Startup Modify Time Size(bytes)

-------------------------- -------------- ------- ------------------- ------­ Unit 1:
ECS4620-28T_V1.2.2.26.bix OpCode Y 2000-12-31 00:19:13 18601012
Factory_Default_Config.cfg Config N 1999-12-31 00:00:34 455
startup1.cfg Config Y 2001-01-01 00:03:16 2055

---------------------------------------------------------------------------­ Free space for compressed user config files: 46497792
Total space: 128 MB
...
Press ENTER to start session
Automatic Upgrade is looking for a new image
New image detected: current version V1.2.2.26; new version V1.2.2.27
Image upgrade in progress
Downloading new image
Flash programming started
Flash programming completed
Success
The switch will now restart
...
Press ENTER to start session
Automatic Upgrade is looking for a new image
No new image detected
User Access Verification

Specifying a DHCP

Client Identifier

Username: admin
Password:

CLI session with the ECS4100-26TX is opened.
To end the CLI session, enter [Exit].

Console#dir
File Name Type Startup Modify Time Size(bytes)

-------------------------- -------------- ------- ------------------- ------­ Unit 1:
File Name Type Startup Modify Time Size(bytes)

-------------------------- -------------- ------- ------------------- ------­ Unit 1:
ECS4620-28T_V1.2.2.27.bix OpCode Y 2000-12-31 00:19:13 18601012
Factory_Default_Config.cfg Config N 1999-12-31 00:00:34 455
startup1.cfg Config Y 2001-01-01 00:03:16 2055

---------------------------------------------------------------------------­ Free space for compressed user config files: 46497792
Total space: 128 MB
Console#

DHCP servers index their database of address bindings using the client’s Media
Access Control (MAC) Address or a unique client identifier. The client identifier is
used to identify the vendor class and configuration of the switch to the DHCP
server, which then uses this information to decide on how to service the client or
the type of information to return.

DHCP client Identifier (Option 60) is used by DHCP clients to specify their unique
identifier. The client identifier is optional and can be specified while configuring
DHCP on the primary network interface. DHCP Option 60 is disabled by default.

– 86 –

Chapter 1

Downloading a Configuration File and Other Parameters from a DHCP Server

| Initial Switch Configuration

The general framework for this DHCP option is set out in RFC 2132 (Option 60). This
information is used to convey configuration settings or other identification
information about a client, but the specific string to use should be supplied by your
service provider or network administrator. Options 60 (vendor-class-identifier), 66
(tftp-server-name) and 67 (bootfile-name) statements can be added to the server
daemon’s configuration file as described in the following section.

If the DHCP server has an index entry for a switch requesting service, it should reply
with the TFTP server name and boot file name. Note that the vendor class identifier
can be formatted in either text or hexadecimal, but the format used by both the
client and server must be the same.

Console(config)#interface vlan 2
Console(config-if)#ip dhcp client class-id hex 0000e8666572
Console(config-if)#

Downloading a Configuration File and Other Parameters from a DHCP Server

Information passed on to the switch from a DHCP server may also include a
configuration file to be downloaded and the TFTP servers where that file can be
accessed, as well as other parameters. If the Factory Default Configuration file is
used to provision the switch at startup, in addition to requesting IP configuration
settings from the DHCP server, it will also ask for the name of a bootup
configuration file and TFTP servers where that file is stored.

If the switch receives information that allows it to download the remote bootup file,
it will save this file to a local buffer, and then restart the provision process.

Note the following DHCP client behavior:

◆ The bootup configuration file received from a TFTP server is stored on the

switch with the original file name. If this file name already exists in the switch,
the file is overwritten.

◆ If the name of the bootup configuration file is the same as the Factory Default

Configuration file, the download procedure will be terminated, and the switch
will not send any further DHCP client requests.

◆ If the switch fails to download the bootup configuration file based on

information passed by the DHCP server, it will not send any further DHCP client
requests.

◆ If the switch does not receive a DHCP response prior to completing the bootup

process, it will continue to send a DHCP client request once a minute. These
requests will only be terminated if the switch’s address is manually configured,
but will resume if the address mode is set back to DHCP.

– 87 –

Chapter 1

| Initial Switch Configuration

Downloading a Configuration File and Other Parameters from a DHCP Server

To successfully transmit a bootup configuration file to the switch, the DHCP
daemon (using a Linux based system for this example) must be configured with the
following information:

◆ Options 60, 66 and 67 statements can be added to the daemon’s configuration

file.

Table 1: Options 60, 66 and 67 Statements

Option

Keyword Parameter

60 vendor-class-identifier a string indicating the vendor class identifier

66 tftp-server-name a string indicating the tftp server name

67 bootfile-name a string indicating the bootfile name

Statement

◆ By default, DHCP option 66/67 parameters are not carried in a DHCP server

reply. To ask for a DHCP reply with option 66/67 information, the DHCP client
request sent by this switch includes a “parameter request list” asking for this
information. Besides these items, the client request also includes a “vendor
class identifier” that allows the DHCP server to identify the device, and select
the appropriate configuration file for download. This information is included in
Option 55 and 124.

Table 2: Options 55 and 124 Statements

Option

Keyword Parameter

55 dhcp-parameter-request-list a list of parameters, separated by a comma ', '

124 vendor-class-identifier a string indicating the vendor class identifier

Statement

The following configuration example is provided for a Linux-based DHCP daemon
(dhcpd.conf file). In the “Vendor class” section, the server will always send Option
66 and 67 to tell the switch to download the “test” configuration file from server

192.168.255.101.

ddns-update-style ad-hoc;

default-lease-time 600;
max-lease-time 7200;

log-facility local7;

server-name "Server1";
Server-identifier 192.168.255.250;
#option 66, 67
option space dynamicProvision code width 1 length 1 hash size 2;
option dynamicProvision.tftp-server-name code 66 = text;
option dynamicProvision.bootfile-name code 67 = text;

– 88 –

subnet 192.168.255.0 netmask 255.255.255.0 {
range 192.168.255.160 192.168.255.200;
option routers 192.168.255.101;
option tftp-server-name "192.168.255.100"; #Default Option 66
option bootfile-name "bootfile"; #Default Option 67
}

class "Option66,67_1" { #DHCP Option 60 Vendor class
two
match if option vendor-class-identifier = "ecs4620-28t.cfg";
option tftp-server-name "192.168.255.101";
option bootfile-name "test";
}

Note:

Setting the System Clock

Chapter 1

| Initial Switch Configuration

Setting the System Clock

Use “ecs4620-28t.cfg” for the vendor-class-identifier in the dhcpd.conf file.

Setting the Time

Manually

Simple Network Time Protocol (SNTP) or Network Time Protocol (NTP) can be used
to set the switch’s internal clock based on periodic updates from a time server.
Maintaining an accurate time on the switch enables the system log to record
meaningful dates and times for event entries. You can also manually set the clock. If
the clock is not set manually or via SNTP or NTP, the switch will only record the time
from the factory default set at the last bootup.

When the SNTP client is enabled, the switch periodically sends a request for a time
update to a configured time server. You can configure up to three time server IP
addresses. The switch will attempt to poll each server in the configured sequence.

The switch also supports the following time settings:

◆ Time Zone – You can specify the offset from Coordinated Universal Time (UTC),

also known as Greenwich Mean Time (GMT).

◆ Summer Time/Daylight Saving Time (DST) – In some regions, the time shifts by

one hour in the fall and spring. The switch supports manual entry for one-time
or recurring clock shifts.

To manually set the clock to 14:11:36, April 1st, 2013, enter this command.

Console#calendar set 14 11 36 1 April 2013
Console#

To set the time zone, enter a command similar to the following.

Console(config)#clock timezone Japan hours 8 after-UTC
Console(config)#

– 89 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

To set the time shift for summer time, enter a command similar to the following.

Console(config)#clock summer-time SUMMER date 2 april 2013 0 0 30 june 2013 0

0

Console(config)#

To display the clock configuration settings, enter the following command.

Console#show calendar
Current Time : Apr 2 15:56:12 2013
Time Zone : UTC, 08:00
Summer Time : SUMMER, offset 60 minutes
Apr 2 2013 00:00 to Jun 30 2013 00:00
Summer Time in Effect : Yes
Console#

Configuring SNTP Setting the clock based on an SNTP server can provide more accurate clock

synchronization across network switches than manually-configured time. To
configure SNTP, set the switch as an SNTP client, and then set the polling interval,
and specify a time server as shown in the following example.

Console(config)#sntp client
Console(config)#sntp poll 60
Console(config)#sntp server 10.1.0.19
Console(config)#exit
Console#show sntp
Current Time : Apr 2 16:06:07 2013
Poll Interval : 60 seconds
Current Mode : Unicast
SNTP Status : Enabled
SNTP Server : 10.1.0.19
Current Server : 10.1.0.19
Console#

Configuring NTP Requesting the time from a an NTP server is the most secure method. You can

enable NTP authentication to ensure that reliable updates are received from only
authorized NTP servers. The authentication keys and their associated key number
must be centrally managed and manually distributed to NTP servers and clients.
The key numbers and key values must match on both the server and client.

When more than one time server is configured, the client will poll all of the time
servers, and compare the responses to determine the most reliable and accurate
time update for the switch.

To configure NTP time synchronization, enter commands similar to the following.

Console(config)#ntp client
Console(config)#ntp authentication-key 45 md5 thisiskey45
Console(config)#ntp authenticate
Console(config)#ntp server 192.168.3.20

– 90 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

Console(config)#ntp server 192.168.3.21
Console(config)#ntp server 192.168.5.23 key 19
Console(config)#exit
Console#show ntp
Current Time : Apr 29 13:57:32 2011
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.0.88 Port: 123
Last Update Time : Mar 12 02:41:01 2013 UTC
NTP Server 192.168.0.88 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.4.22 version 3 key 19
NTP Authentication Key 19 md5 42V68751663T6K11P2J307210R885

Current Time : Apr 2 16:28:34 2013
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.5.23 Port: 0
Last Update Time : Apr 2 16:00:00 2013 UTC
NTP Server 192.168.3.20 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.5.23 version 3 key 19
NTP Authentication Key 45 md5 2662T75S5658RU5424180034777
Console#

– 91 –

Chapter 1

Setting the System Clock

| Initial Switch Configuration

– 92 –

Section II

Command Line Interface

This section provides a detailed description of the Command Line Interface, along
with examples for all of the commands.

This section includes these chapters:

◆ “Using the Command Line Interface” on page 95

◆ “General Commands” on page 109

◆ “System Management Commands” on page 117

◆ “SNMP Commands” on page 203

◆ “Remote Monitoring Commands” on page 229

◆ “Flow Sampling Commands” on page 237

◆ “Authentication Commands” on page 243

◆ “General Security Measures” on page 311

◆ “Access Control Lists” on page 395

◆ “Interface Commands” on page 423

◆ “Link Aggregation Commands” on page 453

◆ “Power over Ethernet Commands” on page 467

◆ “Port Mirroring Commands” on page 473

◆ “Congestion Control Commands” on page 483

◆ “Loopback Detection Commands” on page 501

◆ “UniDirectional Link Detection Commands” on page 507

– 93 –

Section II

| Command Line Interface

◆ “Address Table Commands” on page 515

◆ “Spanning Tree Commands” on page 523

◆ “ERPS Commands” on page 553

◆ “VLAN Commands” on page 585

◆ “Class of Service Commands” on page 631

◆ “Quality of Service Commands” on page 645

◆ “Multicast Filtering Commands” on page 665

◆ “LLDP Commands” on page 793

◆ “CFM Commands” on page 819

◆ “OAM Commands” on page 861

◆ “Domain Name Service Commands” on page 873

◆ “DHCP Commands” on page 883

◆ “IP Interface Commands” on page 907

◆ “VRRP Commands” on page 965

◆ “IP Routing Commands” on page 975

◆ “Multicast Routing Commands” on page 1175

– 94 –

2 Using the Command Line

Interface

This chapter describes how to use the Command Line Interface (CLI).

Note: You can only access the console interface through the Master unit in the

stack.

Accessing the CLI

When accessing the management interface for the switch over a direct connection
to the server’s console port, or via a Telnet or Secure Shell connection (SSH), the
switch can be managed by entering command keywords and parameters at the
prompt. Using the switch's command-line interface (CLI) is very similar to entering
commands on a UNIX system.

Console Connection To access the switch through the console port, perform these steps:

1. At the console prompt, enter the user name and password. (The default user

names are “admin” and “guest” with corresponding passwords of “admin” and
“guest.”) When the administrator user name and password is entered, the CLI
displays the “Console#” prompt and enters privileged access mode
(i.e., Privileged Exec). But when the guest user name and password is entered,
the CLI displays the “Console>” prompt and enters normal access mode
(i.e., Normal Exec).

2. Enter the necessary commands to complete your desired tasks.

3. When finished, exit the session with the “quit” or “exit” command.

After connecting to the system through the console port, the login screen displays:

User Access Verification

Username: admin
Password:
CLI session with the ECS4620-28T is opened.
To end the CLI session, enter [Exit].

Console#

– 95 –

Chapter 2

Accessing the CLI

| Using the Command Line Interface

Telnet Connection Telnet operates over the IP transport protocol. In this environment, your

management station and any network device you want to manage over the
network must have a valid IP address. Valid IP addresses consist of four numbers, 0
to 255, separated by periods. Each address consists of a network portion and host
portion. For example, the IP address assigned to this switch, 10.1.0.1, consists of a
network portion (10.1.0) and a host portion (1).

Note:

The IP address for this switch is obtained via DHCP by default.

To access the switch through a Telnet session, you must first set the IP address for
the Master unit, and set the default gateway if you are managing the switch from a
different IP subnet. For example,

Console(config)#interface vlan 1
Console(config-if)#ip address 10.1.0.254 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 10.1.0.254
Console(config)#

If your corporate network is connected to another network outside your office or to
the Internet, you need to apply for a registered IP address. However, if you are
attached to an isolated network, then you can use any IP address that matches the
network segment to which you are attached.

After you configure the switch with an IP address, you can open a Telnet session by
performing these steps:

1. From the remote host, enter the Telnet command and the IP address or host

name of the device you want to access.

2. At the prompt, enter the user name and system password. The CLI will display

the “Vty-n#” prompt for the administrator to show that you are using privileged
access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you
are using normal access mode (i.e., Normal Exec), where n indicates the number
of the current Telnet session.

3. Enter the necessary commands to complete your desired tasks.

4. When finished, exit the session with the “quit” or “exit” command.

After entering the Telnet command, the login screen displays:

Username: admin
Password:

CLI session with the ECS4620-28T is opened.
To end the CLI session, enter [Exit].

Vty-0#

– 96 –

Entering Commands

Chapter 2

Note:

You can open up to eight sessions to the device via Telnet or SSH.

| Using the Command Line Interface

This section describes how to enter CLI commands.

Entering Commands

Keywords and

Arguments

A CLI command is a series of keywords and arguments. Keywords identify a
command, and arguments specify configuration parameters. For example, in the
command “show interfaces status ethernet 1/5,” show interfaces and status are
keywords, ethernet is an argument that specifies the interface type, and 1/5
specifies the unit/port.

You can enter commands as follows:

◆ To enter a simple command, enter the command keyword.

◆ To enter multiple commands, enter each command in the required order. For

example, to enable Privileged Exec command mode, and display the startup
conficonfiguration, enter the following commands. The default password
“super” is used to change from Normal Exec to Privileged Exec mode:

Console>enable
Password:
Console#show startup-config

◆ To enter commands that require parameters, enter the required parameters

after the command keyword. For example, to set a password for the
administrator, enter:

Console(config)#username admin password 0 smith

Minimum

Abbreviation

Command

Completion

The CLI will accept a minimum number of characters that uniquely identify a
command. For example, the command “configure” can be entered as con. If an
entry is ambiguous, the system will prompt for further input.

If you terminate input with a Tab key, the CLI will print the remaining characters of a
partial keyword up to the point of ambiguity. In the “logging history” example,
typing log followed by a tab will result in printing the command up to “logging.”

– 97 –

Chapter 2

| Using the Command Line Interface

Entering Commands

Getting Help

on Commands

You can display a brief description of the help system by entering the help
command. You can also display command syntax by using the “?” character to list
keywords or parameters.

Showing Commands

If you enter a “?” at the command prompt, the system will display the first level of
keywords or command groups. You can also display a list of valid keywords for a
specific command. For example, the command “show system ?” displays a list of
possible show commands:

Console#show ?
access-group Access groups
access-list Access lists
accounting Uses the specified accounting list
arp Information of ARP cache
authorization Enables EXEC accounting
auto-traffic-control Auto traffic control information
banner Banner info
bridge-ext Bridge extension information
cable-diagnostics Shows the information of cable diagnostics
calendar Date and time information
class-map Displays class maps
cluster Display cluster
collision-mac-address-table Show collision mac address
debug State of each debugging option
discard Discard packet
dns DNS information
dos-protection Shows the system dos-protection summary
information
dot1q-tunnel dot1q-tunnel
dot1x 802.1X content
efm Ethernet First Mile feature
erps Displays ERPS configuration
ethernet Shows Metro Ethernet information
garp GARP properties
gvrp GVRP interface information
history Shows history information
hosts Host information
interfaces Shows interface information
ip IP information
ipv6 IPv6 information
l2protocol-tunnel Layer 2 protocol tunneling configuration
lacp LACP statistics
line TTY line information
lldp LLDP
log Log records
logging Logging setting
loop Shows the information of loopback
loopback-detection Shows loopback detection information
mac MAC access list
mac-address-table Configuration of the address table
mac-vlan MAC-based VLAN information
management Shows management information
memory Memory utilization
mvr multicast vlan registration
mvr6 IPv6 Multicast VLAN registration
network-access Shows the entries of the secure port.
nlm Show notification log
ntp Network Time Protocol configuration
policy-map Displays policy maps

– 98 –

Chapter 2

| Using the Command Line Interface

Entering Commands

port Port characteristics
port-channel Port channel information
power Shows power
power-save Shows the power saving information
pppoe Displays PPPoE configuration
privilege Shows current privilege level
process Device process
protocol-vlan Protocol-VLAN information
public-key Public key information
qos Quality of Service
queue Priority queue information
radius-server RADIUS server information
reload Shows the reload settings
rmon Remote monitoring information
route-map Shows route-map
rspan Display status of the current RSPAN
configuration
running-config Information on the running configuration
sflow Shows the sflow information
snmp Simple Network Management Protocol
configuration and statistics
snmp-server Displays SNMP server configuration
sntp Simple Network Time Protocol configuration
spanning-tree Spanning-tree configuration
ssh Secure shell server connections
startup-config Startup system configuration
subnet-vlan IP subnet-based VLAN information
switch stacking switch
system System information
tacacs-server TACACS server information
tech-support Technical information
time-range Time range
traffic-segmentation Traffic segmentation information
udld Displays UDLD information
upgrade Shows upgrade information
users Information about users logged in
version System hardware and software versions
vlan Shows virtual LAN settings
vlan-translation VLAN translation information
voice Shows the voice VLAN information
vrrp Shows VRRP
watchdog Displays watchdog status
web-auth Shows web authentication configuration
Console#show

The command “show interfaces ?” will display the following information:

Console#show interfaces ?
brief Shows brief interface description
counters Interface counters information
protocol-vlan Protocol-VLAN information
status Shows interface status
switchport Shows interface switchport information
transceiver Interface of transceiver information
transceiver-threshold Interface of transceiver-threshold information
Console#

Show commands which display more than one page of information (e.g., show
running-config) pause and require you to press the [Space] bar to continue

displaying one more page, the [Enter] key to display one more line, or the [a] key to

– 99 –

Chapter 2

Entering Commands

| Using the Command Line Interface

display the rest of the information without stopping. You can press any other key to
terminate the display.

Partial Keyword

Lookup

Negating the Effect of

Commands

Using Command

History

If you terminate a partial keyword with a question mark, alternatives that match the
initial letters are provided. (Remember not to leave a space between the command
and question mark.) For example “s?” shows all the keywords starting with “s.”

Console#show s?
sflow snmp snmp-server sntp spanning-tree
ssh startup-config subnet-vlan switch system
Console#show s

For many configuration commands you can enter the prefix keyword “no” to cancel
the effect of a command or reset the configuration to the default value. For
example, the logging command will log system messages to a host server. To
disable logging, specify the no logging command. This guide describes the
negation effect for all applicable commands.

The CLI maintains a history of commands that have been entered. You can scroll
back through the history of commands by pressing the up arrow key. Any
command displayed in the history list can be executed again, or first modified and
then executed.

Understanding

Command Modes

Using the show history command displays a longer list of recently executed
commands.

The command set is divided into Exec and Configuration classes. Exec commands
generally display information on system status or clear statistical counters.
Configuration commands, on the other hand, modify interface parameters or
enable certain switching functions. These classes are further divided into different
modes. Available commands depend on the selected mode. You can always enter a
question mark “?” at the prompt to display a list of the commands available for the
current mode. The command classes and associated modes are displayed in the
following table:

– 100 –