Kontron AT8402 CLI User Manual

AT8402 CLI Reference Manual

AdvancedTCA

M5306_TECH_2 Manual ID

2.02 Revision Index

16 June, 2007 Date of Issue

Revision History

Publication Title: AT8402 CLI Reference Manual

ID Number: M5306_TECH_2

Rev.

Index

2.00 First Release for AT8402 12 Feb., 2007

2.01 Clock commands added 16 May, 2007

2.02 Remove BCM5650x references in chapter QoS, acl commands
rework, change copy command parameter

Brief Description of Changes Date of Issue

16 June, 2007

Imprint

Kontron AG may be contacted via the following:

North America EMEA

Kontron Canada, Inc. Kontron Modular Computers GmbH

616 Curé Boivin Sudetenstrasse 7

Boisbriand, Québec 87600 Kaufbeuren

J7G 2A7 Canada Germany

Tel: [phone] [phone]

[phone]

Fax: [phone] [phone]

E-mail: [e-mail] [e-mail]

For further information about Kontron AG, our products or services, please visit our Internet
web site: www.kontron.com

Disclaimer

Copyright © 2006 Kontron AG. All rights reserved. All data is for information purposes only and not guaranteed for
legal purposes. Information has been carefully checked and is believed to be accurate; however, no responsibility
is assumed for inaccuracies. Kontron and the Kontron logo and all other trademarks or registered trademarks are
the property of their respective owners and are recognized. Specifications are subject to change without notice.

AT8402

Table of Content

Revision History .........................................................................................................ii

Imprint ........................................................................................................................ii

Disclaimer ..................................................................................................................ii

About This Book ..................................................................................................... xvii

Why the Document was Created ....................................................................... xvii

How to Use This Document ............................................................................... xvii

Proprietary Note ..................................................................................................... xvii

Trademarks ............................................................................................................ xvii

Environmental Protection Statement .................................................................... xviii

Explanation of Symbols ........................................................................................ xviii

For Your Safety ..................................................................................................... xviii

High Voltage Safety Instructions .........................................................................xix

Special Handling and Unpacking Instructions ....................................................xix

General Instructions on Usage ........................................................................... xix

Two Year Warranty ..................................................................................................xx

Chapter

1. Using the Command-Line Interface ............................................................. 1 - 2

1.1 Command Syntax .................................................................................... 1 - 2

1.2 Command Conventions ........................................................................... 1 - 2

1.2.1 Common Parameter Values ............................................................ 1 - 3

1.3 Slot/Port Naming Convention .................................................................. 1 - 4

1.4 Using the “No” Form of a Command ....................................................... 1 - 5

1.5 Command Modes .................................................................................... 1 - 5

1.5.1 Command Completion and Abbreviation ........................................ 1 - 7

1.5.2 CLI Error Messages ........................................................................ 1 - 8

1.5.3 CLI Line-Editing Conventions ......................................................... 1 - 8

1

1.6 Using CLI Help ........................................................................................ 1 - 9

1.7 Accessing the CLI ................................................................................... 1 - 9

Page iii AT8402 CLI Reference Manual

AT8402

Chapter

2. Switching Commands ..................................................................................2 - 2

2.1 Port Configuration Commands ................................................................2 - 2

2.1.1 interface ..........................................................................................2 - 2

2.1.2 auto-negotiate .................................................................................2 - 2

2.1.3 auto-negotiate all .............................................................................2 - 3

2.1.4 description .......................................................................................2 - 3

2.1.5 mtu ..................................................................................................2 - 3

2.1.6 shutdown .........................................................................................2 - 4

2.1.7 shutdown all ....................................................................................2 - 4

2.1.8 speed ..............................................................................................2 - 4

2.1.9 speed all ..........................................................................................2 - 5

2.1.10 block ................................................................................................2 - 5

2.1.11 show port .........................................................................................2 - 5

2.1.12 show port protocol ...........................................................................2 - 6

2.2 Spanning Tree Protocol (STP) Commands ..............................................2 - 6

2.2.1 spanning-tree ..................................................................................2 - 6

2.2.2 spanning-tree bpdumigrationcheck .................................................2 - 7

2.2.3 spanning-tree configuration name ...................................................2 - 7

2.2.4 spanning-tree configuration revision ...............................................2 - 7

2.2.5 spanning-tree edgeport ...................................................................2 - 8

2.2.6 spanning-tree forceversion ..............................................................2 - 8

2.2.7 spanning-tree forward-time .............................................................2 - 8

2.2.8 spanning-tree hello-time ..................................................................2 - 9

2.2.9 spanning-tree max-age ...................................................................2 - 9

2.2.10 spanning-tree max-hops ..................................................................2 - 9

2.2.11 spanning-tree mst ..........................................................................2 - 10

2.2.12 spanning-tree mst instance ...........................................................2 - 11

2.2.13 spanning-tree mst priority ..............................................................2 - 11

2.2.14 spanning-tree mst vlan ..................................................................2 - 12

2.2.15 spanning-tree port mode ...............................................................2 - 12

2.2.16 spanning-tree port mode all ...........................................................2 - 12

2.2.17 show spanning-tree .......................................................................2 - 13

2.2.18 show spanning-tree brief ...............................................................2 - 14

2.2.19 show spanning-tree interface ........................................................2 - 14

2.2.20 show spanning-tree mst port detailed ...........................................2 - 15

2.2.21 show spanning-tree mst port summary .........................................2 - 16

2.2.22 show spanning-tree mst summary ................................................2 - 16

2.2.23 show spanning-tree summary .......................................................2 - 17

2.2.24 show spanning-tree vlan ...............................................................2 - 17

2

2.3 VLAN Commands ..................................................................................2 - 17

AT8402 CLI Reference Manual Page iv

AT8402

2.3.1 vlan database ............................................................................... 2 - 17

2.3.2 network mgmt_vlan ....................................................................... 2 - 18

2.3.3 vlan ............................................................................................... 2 - 18

2.3.4 vlan acceptframe .......................................................................... 2 - 18

2.3.5 vlan ingressfilter ............................................................................ 2 - 19

2.3.6 vlan makestatic ............................................................................. 2 - 19

2.3.7 vlan name ..................................................................................... 2 - 19

2.3.8 vlan participation ........................................................................... 2 - 19

2.3.9 vlan participation all ...................................................................... 2 - 20

2.3.10 vlan port acceptframe all ............................................................... 2 - 20

2.3.11 vlan port ingressfilter all ................................................................ 2 - 21

2.3.12 vlan port pvid all ............................................................................ 2 - 21

2.3.13 vlan port tagging all ....................................................................... 2 - 21

2.3.14 vlan protocol group ....................................................................... 2 - 22

2.3.15 vlan protocol group add protocol .................................................. 2 - 22

2.3.16 vlan protocol group remove .......................................................... 2 - 22

2.3.17 protocol group ............................................................................... 2 - 23

2.3.18 protocol vlan group ....................................................................... 2 - 23

2.3.19 protocol vlan group all ................................................................... 2 - 23

2.3.20 vlan pvid ........................................................................................ 2 - 24

2.3.21 vlan tagging .................................................................................. 2 - 24

2.3.22 vlan association subnet ................................................................ 2 - 24

2.3.23 vlan association mac .................................................................... 2 - 25

2.3.24 show vlan ...................................................................................... 2 - 25

2.3.25 show vlan brief .............................................................................. 2 - 26

2.3.26 show vlan port ............................................................................... 2 - 26

2.3.27 show vlan association subnet ....................................................... 2 - 27

2.3.28 show vlan association mac ........................................................... 2 - 27

2.4 Double VLAN Commands ..................................................................... 2 - 28

2.4.1 dvlan-tunnel ethertype .................................................................. 2 - 28

2.4.2 mode dot1q-tunnel ........................................................................ 2 - 28

2.4.3 mode dvlan-tunnel ........................................................................ 2 - 28

2.4.4 show dot1q-tunnel ........................................................................ 2 - 29

2.4.5 show dvlan-tunnel ......................................................................... 2 - 29

2.5 Provisioning (IEEE 802.1p) Commands ................................................ 2 - 29

2.5.1 vlan port priority all ........................................................................ 2 - 30

2.5.2 vlan priority ................................................................................... 2 - 30

2.6 Protected Ports Commands .................................................................. 2 - 30

2.6.1 switchport protected (Global Config) ............................................ 2 - 30

2.6.2 switchport protected (Interface Config) ......................................... 2 - 31

2.6.3 show switchport protected ............................................................ 2 - 31

2.6.4 show interfaces switchport ............................................................ 2 - 31

2.7 GARP Commands ................................................................................. 2 - 32

2.7.1 set garp timer join ......................................................................... 2 - 32

2.7.2 set garp timer leave ...................................................................... 2 - 32

Page v AT8402 CLI Reference Manual

AT8402

2.7.3 set garp timer leaveall ...................................................................2 - 33

2.7.4 show garp ......................................................................................2 - 33

2.8 GVRP Commands .................................................................................2 - 34

2.8.1 set gvrp adminmode ......................................................................2 - 34

2.8.2 set gvrp interfacemode ..................................................................2 - 34

2.8.3 show gvrp configuration ................................................................2 - 34

2.9 GMRP Commands .................................................................................2 - 35

2.9.1 set gmrp adminmode ....................................................................2 - 35

2.9.2 set gmrp interfacemode ................................................................2 - 36

2.9.3 show gmrp configuration ...............................................................2 - 36

2.9.4 show mac-address-table gmrp ......................................................2 - 37

2.10 Port-Based Network Access Control Commands ..................................2 - 37

2.10.1 authentication login .......................................................................2 - 37

2.10.2 clear dot1x statistics ......................................................................2 - 38

2.10.3 clear radius statistics .....................................................................2 - 38

2.10.4 dot1x defaultlogin ..........................................................................2 - 39

2.10.5 dot1x initialize ................................................................................2 - 39

2.10.6 dot1x login .....................................................................................2 - 39

2.10.7 dot1x max-req ...............................................................................2 - 39

2.10.8 dot1x port-control ..........................................................................2 - 40

2.10.9 dot1x port-control all ......................................................................2 - 40

2.10.10 dot1x re-authenticate ....................................................................2 - 40

2.10.11 dot1x re-authentication ..................................................................2 - 41

2.10.12 dot1x system-auth-control .............................................................2 - 41

2.10.13 dot1x timeout .................................................................................2 - 41

2.10.14 dot1x user .....................................................................................2 - 42

2.10.15 users defaultlogin ..........................................................................2 - 42

2.10.16 users login .....................................................................................2 - 43

2.10.17 show authentication ......................................................................2 - 43

2.10.18 show authentication users .............................................................2 - 43

2.10.19 show dot1x ....................................................................................2 - 43

2.10.20 show dot1x users ..........................................................................2 - 46

2.10.21 show users authentication .............................................................2 - 46

2.11 Storm-Control Commands .....................................................................2 - 46

2.11.1 storm-control broadcast ................................................................2 - 46

2.11.2 storm-control broadcast level ........................................................2 - 47

2.11.3 storm-control broadcast all ............................................................2 - 47

2.11.4 storm-control broadcast all level ...................................................2 - 47

2.11.5 storm-control multicast ..................................................................2 - 48

2.11.6 storm-control multicast level ..........................................................2 - 48

2.11.7 storm-control multicast all .............................................................2 - 48

2.11.8 storm-control multicast all level .....................................................2 - 49

2.11.9 storm-control unicast .....................................................................2 - 49

2.11.10 storm-control unicast level ............................................................2 - 50

2.11.11 storm-control unicast all ................................................................2 - 50

AT8402 CLI Reference Manual Page vi

AT8402

2.11.12 storm-control unicast all level ....................................................... 2 - 50

2.11.13 storm-control flowcontrol ............................................................... 2 - 51

2.11.14 show storm-control ....................................................................... 2 - 51

2.12 Port-Channel/LAG (802.3ad) Commands ............................................. 2 - 52

2.12.1 port-channel .................................................................................. 2 - 52

2.12.2 addport .......................................................................................... 2 - 52

2.12.3 deleteport (Interface Config) ......................................................... 2 - 53

2.12.4 deleteport (Global Config) ............................................................. 2 - 53

2.12.5 port-channel static ........................................................................ 2 - 53

2.12.6 port lacpmode ............................................................................... 2 - 53

2.12.7 port lacpmode all .......................................................................... 2 - 54

2.12.8 port lacp timeout (Interface Config) .............................................. 2 - 54

2.12.9 port lacp timeout (Global Config) .................................................. 2 - 54

2.12.10 port-channel adminmode .............................................................. 2 - 55

2.12.11 port-channel linktrap ..................................................................... 2 - 55

2.12.12 port-channel name ........................................................................ 2 - 55

2.12.13 show port-channel brief ................................................................ 2 - 55

2.12.14 show port-channel ........................................................................ 2 - 56

2.13 Port Mirroring ........................................................................................ 2 - 56

2.13.1 monitor session ............................................................................. 2 - 57

2.13.2 no monitor ..................................................................................... 2 - 57

2.13.3 show monitor session ................................................................... 2 - 57

2.14 Static MAC Filtering ............................................................................... 2 - 58

2.14.1 macfilter ........................................................................................ 2 - 58

2.14.2 macfilter addsrc ............................................................................ 2 - 59

2.14.3 macfilter addsrc all ........................................................................ 2 - 59

2.14.4 show mac-address-table static ..................................................... 2 - 59

2.14.5 show mac-address-table staticfiltering .......................................... 2 - 60

2.15 IGMP Snooping Configuration Commands ........................................... 2 - 60

2.15.1 set igmp ........................................................................................ 2 - 60

2.15.2 set igmp interfacemode ................................................................ 2 - 61

2.15.3 set igmp fast-leave ........................................................................ 2 - 61

2.15.4 set igmp groupmembership-interval ............................................. 2 - 62

2.15.5 set igmp maxresponse .................................................................. 2 - 62

2.15.6 set igmp mcrtexpiretime ................................................................ 2 - 63

2.15.7 set igmp mrouter ........................................................................... 2 - 63

2.15.8 set igmp mrouter interface ............................................................ 2 - 64

2.15.9 show igmpsnooping ...................................................................... 2 - 64

2.15.10 show igmpsnooping mrouter interface .......................................... 2 - 65

2.15.11 show igmpsnooping mrouter vlan ................................................. 2 - 65

2.15.12 show mac-address-table igmpsnooping ....................................... 2 - 66

2.16 Port Security Commands ...................................................................... 2 - 66

2.16.1 port-security .................................................................................. 2 - 66

2.16.2 port-security max-dynamic ............................................................ 2 - 67

2.16.3 port-security max-static ................................................................. 2 - 67

Page vii AT8402 CLI Reference Manual

AT8402

2.16.4 port-security mac-address .............................................................2 - 67

2.16.5 port-security mac-address move ...................................................2 - 68

2.16.6 show port-security .........................................................................2 - 68

2.16.7 show port-security dynamic ...........................................................2 - 68

2.16.8 show port-security static ................................................................2 - 68

2.16.9 show port-security violation ...........................................................2 - 68

2.17 LLDP (802.1AB) Commands .................................................................2 - 69

2.17.1 lldp transmit ...................................................................................2 - 69

2.17.2 lldp receive ....................................................................................2 - 69

2.17.3 lldp timers ......................................................................................2 - 69

2.17.4 lldp transmit-tlv ..............................................................................2 - 70

2.17.5 lldp transmit-mgmt .........................................................................2 - 70

2.17.6 lldp notification ...............................................................................2 - 70

2.17.7 lldp notification-interval ..................................................................2 - 71

2.17.8 clear lldp statistics .........................................................................2 - 71

2.17.9 clear lldp remote-data ....................................................................2 - 71

2.17.10 show lldp .......................................................................................2 - 71

2.17.11 show lldp interface .........................................................................2 - 72

2.17.12 show lldp statistics .........................................................................2 - 72

2.17.13 show lldp remote-device ................................................................2 - 73

2.17.14 show lldp remote-device detail ......................................................2 - 73

2.17.15 show lldp local-device ...................................................................2 - 74

2.17.16 show lldp local-device detail ..........................................................2 - 74

2.18 Denial of Service Commands ................................................................2 - 74

2.18.1 dos-control sipdip ..........................................................................2 - 75

2.18.2 dos-control firstfrag ........................................................................2 - 75

2.18.3 dos-control tcpfrag .........................................................................2 - 76

2.18.4 dos-control tcpflag .........................................................................2 - 76

2.18.5 dos-control l4port ..........................................................................2 - 76

2.18.6 dos-control icmp ............................................................................2 - 77

2.18.7 show dos-control ...........................................................................2 - 77

2.19 MAC Database Commands ...................................................................2 - 77

2.19.1 bridge aging-time ..........................................................................2 - 78

2.19.2 show forwardingdb agetime ..........................................................2 - 78

2.19.3 show mac-address-table multicast ................................................2 - 78

2.19.4 show mac-address-table stats .......................................................2 - 79

Chapter

3. Quality of Service (QoS) Commands ...........................................................3 - 2

3.1 Class of Service (CoS) Commands .........................................................3 - 2

3.1.1 classofservice dot1p-mapping .........................................................3 - 2

3.1.2 classofservice ip-dscp-mapping ......................................................3 - 3

3

AT8402 CLI Reference Manual Page viii

AT8402

3.1.3 classofservice trust ......................................................................... 3 - 3

3.1.4 cos-queue min-bandwidth ............................................................... 3 - 3

3.1.5 cos-queue strict .............................................................................. 3 - 4

3.1.6 traffic-shape .................................................................................... 3 - 4

3.1.7 show classofservice dot1p-mapping ............................................... 3 - 4

3.1.8 show classofservice ip-precedence-mapping ................................. 3 - 5

3.1.9 show classofservice ip-dscp-mapping ............................................ 3 - 5

3.1.10 show classofservice trust ................................................................ 3 - 5

3.1.11 show interfaces cos-queue ............................................................. 3 - 6

3.2 Differentiated Services (DiffServ) Commands ......................................... 3 - 6

3.2.1 diffserv ............................................................................................ 3 - 7

3.3 DiffServ Class Commands ...................................................................... 3 - 7

3.3.1 class-map ....................................................................................... 3 - 8

3.3.2 class-map rename .......................................................................... 3 - 8

3.3.3 match any ....................................................................................... 3 - 8

3.3.4 match class-map ............................................................................. 3 - 9

3.3.5 match dstip ..................................................................................... 3 - 9

3.3.6 match dstl4port ............................................................................... 3 - 9

3.3.7 match ip dscp ................................................................................ 3 - 10

3.3.8 match ip precedence .................................................................... 3 - 10

3.3.9 match ip tos .................................................................................. 3 - 10

3.3.10 match protocol .............................................................................. 3 - 11

3.3.11 match srcip ................................................................................... 3 - 11

3.3.12 match srcl4port ............................................................................. 3 - 11

3.4 DiffServ Policy Commands .................................................................... 3 - 12

3.4.1 assign-queue ................................................................................ 3 - 12

3.4.2 drop ............................................................................................... 3 - 12

3.4.3 conform-color ................................................................................ 3 - 12

3.4.4 class .............................................................................................. 3 - 13

3.4.5 mark cos ....................................................................................... 3 - 13

3.4.6 mark ip-dscp ................................................................................. 3 - 13

3.4.7 mark ip-precedence ...................................................................... 3 - 14

3.4.8 police-simple ................................................................................. 3 - 14

3.4.9 policy-map .................................................................................... 3 - 14

3.4.10 policy-map rename ....................................................................... 3 - 15

3.5 DiffServ Service Commands ................................................................. 3 - 15

3.5.1 service-policy ................................................................................ 3 - 15

3.6 DiffServ Show Commands .................................................................... 3 - 16

3.6.1 show class-map ............................................................................ 3 - 16

3.6.2 show diffserv ................................................................................. 3 - 17

3.6.3 show policy-map ........................................................................... 3 - 17

3.6.4 show diffserv service .................................................................... 3 - 19

3.6.5 show diffserv service brief ............................................................ 3 - 19

3.6.6 show policy-map interface ............................................................ 3 - 20

3.6.7 show service-policy ....................................................................... 3 - 20

Page ix AT8402 CLI Reference Manual

AT8402

3.7 MAC Access Control List (ACL) Commands .........................................3 - 20

3.7.1 mac access-list extended ..............................................................3 - 21

3.7.2 mac access-list extended rename .................................................3 - 21

3.7.3 {deny | permit} ...............................................................................3 - 21

3.7.4 mac access-group .........................................................................3 - 22

3.7.5 show mac access-lists ...................................................................3 - 23

3.8 IP Access Control List (ACL) Commands ..............................................3 - 23

3.8.1 access-list .....................................................................................3 - 24

3.8.2 ip access-group .............................................................................3 - 25

3.8.3 acl-trapflags ...................................................................................3 - 26

3.8.4 show ip access-lists .......................................................................3 - 26

3.8.5 show access-lists ..........................................................................3 - 27

Chapter

4. Utility Commands .........................................................................................4 - 2

4.1 Commands for update and startup Configuration ....................................4 - 2

4.1.1 download ipmifw ..............................................................................4 - 2

4.1.2 download initrd ................................................................................4 - 2

4.1.3 download frudata .............................................................................4 - 2

4.1.4 download fwum ...............................................................................4 - 3

4.1.5 download bootloader .......................................................................4 - 3

4.1.6 download amcipmifw .......................................................................4 - 3

4.1.7 startupslot ........................................................................................4 - 3

4.1.8 startupslot activate ..........................................................................4 - 3

4.1.9 show startupconfig ..........................................................................4 - 4

4.2 ATCA commands .....................................................................................4 - 4

4.2.1 set board sensor threshold ..............................................................4 - 4

4.2.2 set board ipmi-controller debug .......................................................4 - 4

4.2.3 set board device-id ..........................................................................4 - 4

4.2.4 set board fcap .................................................................................4 - 4

4.2.5 show atca ekeying ...........................................................................4 - 5

4.2.6 ekeying (interface) ...........................................................................4 - 5

4.2.7 set board bootcycle .........................................................................4 - 5

4

4.3 System Information and Statistics Commands ........................................4 - 5

4.3.1 show arp switch ...............................................................................4 - 6

4.3.2 show eventlog .................................................................................4 - 6

4.3.3 show hardware ................................................................................4 - 6

4.3.4 show version ...................................................................................4 - 6

4.3.5 show interface .................................................................................4 - 7

4.3.6 show interface ethernet ...................................................................4 - 8

4.3.7 show mac-addr-table .....................................................................4 - 15

4.3.8 show running-config ......................................................................4 - 16

AT8402 CLI Reference Manual Page x

AT8402

4.3.9 show sysinfo ................................................................................. 4 - 16

4.3.10 show tech-support ........................................................................ 4 - 17

4.3.11 show boardinfo post-status ........................................................... 4 - 17

4.3.12 show boardinfo sensors ................................................................ 4 - 17

4.3.13 show boardinfo event-log .............................................................. 4 - 17

4.3.14 show boardinfo update-status ....................................................... 4 - 17

4.3.15 show boardinfo version ................................................................. 4 - 18

4.3.16 show boardinfo address ................................................................ 4 - 18

4.3.17 show boardinfo fru ........................................................................ 4 - 18

4.3.18 show boardinfo ipmidev ................................................................ 4 - 18

4.3.19 show boardinfo led ........................................................................ 4 - 18

4.3.20 show boardinfo fcap ...................................................................... 4 - 19

4.3.21 show boardinfo amc connection ................................................... 4 - 19

4.3.22 show boardinfo amc fru ................................................................ 4 - 19

4.3.23 show boardinfo amc ipmidev ........................................................ 4 - 19

4.3.24 show boardinfo bootcycle ............................................................. 4 - 19

4.4 Logging Commands .............................................................................. 4 - 19

4.4.1 logging buffered ............................................................................ 4 - 20

4.4.2 logging buffered wrap ................................................................... 4 - 20

4.4.3 logging cli-command ..................................................................... 4 - 20

4.4.4 logging console ............................................................................. 4 - 20

4.4.5 logging host .................................................................................. 4 - 21

4.4.6 logging host remove ..................................................................... 4 - 21

4.4.7 logging port ................................................................................... 4 - 21

4.4.8 logging syslog ............................................................................... 4 - 22

4.4.9 show logging ................................................................................. 4 - 22

4.4.10 show logging buffered ................................................................... 4 - 22

4.4.11 show logging hosts ....................................................................... 4 - 23

4.4.12 show logging traplogs ................................................................... 4 - 23

4.4.13 clear board event-log .................................................................... 4 - 23

4.4.14 show logging backtrace ................................................................ 4 - 23

4.4.15 show logging diag-report .............................................................. 4 - 23

4.5 System Utility and Clear Commands .................................................... 4 - 24

4.5.1 traceroute ...................................................................................... 4 - 24

4.5.2 clear config ................................................................................... 4 - 24

4.5.3 clear counters ............................................................................... 4 - 24

4.5.4 clear igmpsnooping ....................................................................... 4 - 24

4.5.5 clear pass ..................................................................................... 4 - 24

4.5.6 clear port-channel ......................................................................... 4 - 25

4.5.7 clear traplog .................................................................................. 4 - 25

4.5.8 clear vlan ...................................................................................... 4 - 25

4.5.9 enable passwd .............................................................................. 4 - 25

4.5.10 logout ............................................................................................ 4 - 25

4.5.11 set bootstopkey ............................................................................. 4 - 25

4.5.12 ping ............................................................................................... 4 - 26

4.5.13 quit ................................................................................................ 4 - 26

Page xi AT8402 CLI Reference Manual

AT8402

4.5.14 reload ............................................................................................4 - 26

4.5.15 copy ...............................................................................................4 - 26

4.6 Keying for Advanced Features ..............................................................4 - 27

4.6.1 license advanced ..........................................................................4 - 27

4.6.2 show key-features .........................................................................4 - 28

4.7 Simple Network Time Protocol (SNTP) Commands ..............................4 - 28

4.7.1 sntp broadcast client poll-interval ..................................................4 - 28

4.7.2 sntp client mode ............................................................................4 - 28

4.7.3 sntp client port ...............................................................................4 - 29

4.7.4 sntp unicast client poll-interval ......................................................4 - 29

4.7.5 sntp unicast client poll-timeout ......................................................4 - 29

4.7.6 sntp unicast client poll-retry ...........................................................4 - 30

4.7.7 sntp multicast client poll-interval ...................................................4 - 30

4.7.8 sntp server ....................................................................................4 - 30

4.7.9 show sntp ......................................................................................4 - 30

4.7.10 show sntp client .............................................................................4 - 31

4.7.11 show sntp server ...........................................................................4 - 31

4.8 DHCP Server Commands ......................................................................4 - 32

4.8.1 ip dhcp pool ...................................................................................4 - 32

4.8.2 client-identifier ...............................................................................4 - 32

4.8.3 client-name ....................................................................................4 - 33

4.8.4 default-router .................................................................................4 - 33

4.8.5 dns-server .....................................................................................4 - 33

4.8.6 hardware-address .........................................................................4 - 34

4.8.7 host ...............................................................................................4 - 34

4.8.8 lease ..............................................................................................4 - 34

4.8.9 network (DHCP Pool Config) ........................................................4 - 35

4.8.10 bootfile ...........................................................................................4 - 35

4.8.11 domain-name ................................................................................4 - 35

4.8.12 netbios-name-server .....................................................................4 - 36

4.8.13 netbios-node-type .........................................................................4 - 36

4.8.14 next-server ....................................................................................4 - 36

4.8.15 option ............................................................................................4 - 37

4.8.16 ip dhcp excluded-address .............................................................4 - 37

4.8.17 ip dhcp ping packets ......................................................................4 - 38

4.8.18 service dhcp ..................................................................................4 - 38

4.8.19 ip dhcp bootp automatic ................................................................4 - 38

4.8.20 ip dhcp conflict logging ..................................................................4 - 39

4.8.21 clear ip dhcp binding .....................................................................4 - 39

4.8.22 clear ip dhcp server statistics ........................................................4 - 39

4.8.23 clear ip dhcp conflict ......................................................................4 - 39

4.8.24 show ip dhcp binding .....................................................................4 - 39

4.8.25 show ip dhcp global configuration .................................................4 - 40

4.8.26 show ip dhcp pool configuration ....................................................4 - 40

4.8.27 show ip dhcp server statistics ........................................................4 - 41

AT8402 CLI Reference Manual Page xii

AT8402

4.8.28 show ip dhcp conflict ..................................................................... 4 - 41

4.9 DHCP Filtering ...................................................................................... 4 - 42

4.9.1 ip dhcp filtering .............................................................................. 4 - 42

4.9.2 ip dhcp filtering trust ...................................................................... 4 - 42

4.9.3 show ip dhcp filtering .................................................................... 4 - 42

4.10 Serviceability Packet Tracing Commands ............................................. 4 - 43

4.10.1 debug console .............................................................................. 4 - 43

4.10.2 debug clear ................................................................................... 4 - 43

4.10.3 debug spanning-tree bpdu transmit .............................................. 4 - 43

4.10.4 debug spanning-tree bpdu receive ............................................... 4 - 44

4.10.5 debug spanning-tree bpdu ............................................................ 4 - 45

4.10.6 debug igmpsnooping packet transmit ........................................... 4 - 45

4.10.7 debug igmpsnooping packet receive ............................................ 4 - 46

4.10.8 debug igmpsnooping packet ......................................................... 4 - 47

4.10.9 debug ping packet ........................................................................ 4 - 47

4.10.10 debug rip packet ........................................................................... 4 - 48

4.10.11 debug ospf packet ........................................................................ 4 - 49

4.10.12 debug lacp packet ......................................................................... 4 - 50

Chapter

5. Management Commands ............................................................................ 5 - 2

5.1 Network Interface Commands ................................................................. 5 - 2

5.1.1 enable (Privileged EXEC access) ................................................... 5 - 2

5.1.2 serviceport ip .................................................................................. 5 - 2

5.1.3 serviceport protocol ........................................................................ 5 - 3

5.1.4 network parms ................................................................................ 5 - 3

5.1.5 network protocol ............................................................................. 5 - 3

5.1.6 network mac-address ..................................................................... 5 - 3

5.1.7 network mac-type ........................................................................... 5 - 3

5.1.8 show network .................................................................................. 5 - 4

5.1.9 show serviceport ............................................................................. 5 - 4

5.2 Console Port Access Commands ........................................................... 5 - 5

5.2.1 configuration ................................................................................... 5 - 5

5.2.2 lineconfig ......................................................................................... 5 - 5

5.2.3 serial baudrate ................................................................................ 5 - 5

5.2.4 serial timeout .................................................................................. 5 - 6

5.2.5 show serial ...................................................................................... 5 - 6

5.3 Telnet Commands ................................................................................... 5 - 6

5.3.1 ip telnet server enable .................................................................... 5 - 6

5.3.2 telnet ............................................................................................... 5 - 7

5.3.3 transport input telnet ....................................................................... 5 - 7

5.3.4 transport output telnet ..................................................................... 5 - 7

5

Page xiii AT8402 CLI Reference Manual

AT8402

5.3.5 session-limit ....................................................................................5 - 8

5.3.6 session-timeout ...............................................................................5 - 8

5.3.7 telnetcon maxsessions ....................................................................5 - 8

5.3.8 telnetcon timeout .............................................................................5 - 9

5.3.9 disconnect .......................................................................................5 - 9

5.3.10 show loginsession ...........................................................................5 - 9

5.3.11 show telnet ....................................................................................5 - 10

5.3.12 show telnetcon ..............................................................................5 - 10

5.4 Secure Shell (SSH) Command ..............................................................5 - 10

5.4.1 ip ssh .............................................................................................5 - 10

5.4.2 ip ssh protocol ............................................................................... 5 - 11

5.4.3 ip ssh server enable ...................................................................... 5 - 11

5.4.4 sshcon maxsessions ..................................................................... 5 - 11

5.4.5 sshcon timeout ..............................................................................5 - 12

5.4.6 show ip ssh ...................................................................................5 - 12

5.5 User Account Commands ......................................................................5 - 12

5.5.1 users name ...................................................................................5 - 12

5.5.2 users passwd ................................................................................5 - 13

5.5.3 users snmpv3 accessmode ...........................................................5 - 13

5.5.4 users snmpv3 authentication ........................................................5 - 14

5.5.5 users snmpv3 encryption ..............................................................5 - 14

5.5.6 show users ....................................................................................5 - 15

5.6 SNMP Commands .................................................................................5 - 15

5.6.1 snmp-server ..................................................................................5 - 15

5.6.2 snmp-server community ................................................................5 - 16

5.6.3 snmp-server community ipaddr .....................................................5 - 16

5.6.4 snmp-server community ipmask ...................................................5 - 16

5.6.5 snmp-server community mode ......................................................5 - 17

5.6.6 snmp-server community ro ............................................................5 - 17

5.6.7 snmp-server community rw ...........................................................5 - 17

5.6.8 snmp-server enable traps violation ...............................................5 - 18

5.6.9 snmp-server enable traps ..............................................................5 - 18

5.6.10 snmp-server enable traps bcaststorm ...........................................5 - 18

5.6.11 snmp-server enable traps linkmode ..............................................5 - 19

5.6.12 snmp-server enable traps multiusers ............................................5 - 19

5.6.13 snmp-server enable traps stpmode ...............................................5 - 19

5.6.14 snmptrap .......................................................................................5 - 20

5.6.15 snmptrap snmpversion ..................................................................5 - 20

5.6.16 snmptrap ipaddr ............................................................................5 - 20

5.6.17 snmptrap mode .............................................................................5 - 20

5.6.18 snmp trap link-status .....................................................................5 - 21

5.6.19 snmp trap link-status all .................................................................5 - 21

5.6.20 show snmpcommunity ...................................................................5 - 21

5.6.21 show snmptrap ..............................................................................5 - 22

5.6.22 show trapflags ...............................................................................5 - 22

AT8402 CLI Reference Manual Page xiv

AT8402

5.7 CLI Command Logging Command ........................................................ 5 - 23

5.7.1 logging cli-command ..................................................................... 5 - 23

5.8 RADIUS Commands ............................................................................. 5 - 23

5.8.1 radius accounting mode ................................................................ 5 - 24

5.8.2 radius server host ......................................................................... 5 - 24

5.8.3 radius server key .......................................................................... 5 - 25

5.8.4 radius server msgauth .................................................................. 5 - 25

5.8.5 radius server primary .................................................................... 5 - 25

5.8.6 radius server retransmit ................................................................ 5 - 25

5.8.7 radius server timeout .................................................................... 5 - 26

5.8.8 show radius ................................................................................... 5 - 26

5.8.9 show radius accounting ................................................................ 5 - 27

5.8.10 show radius statistics .................................................................... 5 - 28

5.9 TACACS+ Commands .......................................................................... 5 - 29

5.9.1 tacacs-server host ........................................................................ 5 - 29

5.9.2 tacacs-server key .......................................................................... 5 - 29

5.9.3 tacacs-server timeout ................................................................... 5 - 30

5.9.4 key ................................................................................................ 5 - 30

5.9.5 port ................................................................................................ 5 - 30

5.9.6 priority ........................................................................................... 5 - 30

5.9.7 timeout .......................................................................................... 5 - 31

5.9.8 show tacacs .................................................................................. 5 - 31

5.10 Configuration Scripting Commands ...................................................... 5 - 31

5.10.1 script apply .................................................................................... 5 - 32

5.10.2 script delete .................................................................................. 5 - 32

5.10.3 script list ........................................................................................ 5 - 32

5.10.4 script show .................................................................................... 5 - 32

5.10.5 script validate ................................................................................ 5 - 32

5.11 Pre-login Banner and System Prompt Commands ............................... 5 - 33

5.11.1 copy (pre-login banner) ................................................................. 5 - 33

5.11.2 set prompt ..................................................................................... 5 - 33

5.12 Watchdog Support Commands ............................................................. 5 - 33

5.12.1 set watchdog ................................................................................. 5 - 33

5.12.2 show watchdog ............................................................................. 5 - 34

5.13 Diagnostics Commands ........................................................................ 5 - 34

5.13.1 diagnostics .................................................................................... 5 - 34

5.13.2 copy nvram: diag-report url ........................................................... 5 - 34

5.14 PCI express Commands ....................................................................... 5 - 34

5.14.1 set board pcie upstream ............................................................... 5 - 34

5.14.2 set board pcie hotplug .................................................................. 5 - 35

5.14.3 set board pcie clock ...................................................................... 5 - 35

5.14.4 set board pcie mode ..................................................................... 5 - 35

5.14.5 show boardinfo pcie ...................................................................... 5 - 36

5.15 Storage Commands .............................................................................. 5 - 36

Page xv AT8402 CLI Reference Manual

AT8402

5.15.1 set board storage connect .............................................................5 - 36

5.15.2 show boardinfo storage .................................................................5 - 37

5.15.3 set board sasexp program ............................................................5 - 37

5.15.4 show board sasexp program .........................................................5 - 37

5.16 Clock Support Commands .....................................................................5 - 37

5.16.1 show boardinfo pll status ...............................................................5 - 37

5.16.2 show boardinfo pll config ...............................................................5 - 37

5.16.3 set board pll ...................................................................................5 - 37

5.16.4 show boardinfo clock bpl ...............................................................5 - 38

5.16.5 show boardinfo clock amc .............................................................5 - 38

5.16.6 show boardinfo clock map .............................................................5 - 38

5.16.7 set board clock bpl ........................................................................5 - 38

5.16.8 set board clock map ......................................................................5 - 39

Appendix

A. Getting Help ................................................................................................ A - 2

Appendix

B. List of Commands ....................................................................................... B - 2

A

B

AT8402 CLI Reference Manual Page xvi

AT8402 Preface

About This Book

This document describes configuration commands for FASTPATH® software. The commands
can be accessed from the CLI.

Why the Document was Created

This document was created primarily for system administrators configuring and operating a
system using FASTPATH software. It is intended to provide an understanding of the
configuration options of FASTPATH software.

In addition, software engineers who will be integrating FASTPATH software into their router
or switch product can benefit from a description of the configuration options.

It is assumed that the reader has an understanding of the FASTPATH software base and has
read the appropriate specification for the relevant networking device platform. It is also
assumed that the reader has a basic knowledge of Ethernet and networking concepts.

How to Use This Document

• Chapter 1 “” details the procedure to quickly become acquainted with the FASTPATH
software.

Proprietary Note

This document contains information proprietary to Kontron Modular Computers GmbH. It may
not be copied or transmitted by any means, disclosed to others, or stored in any retrieval system
or media without the prior written consent of Kontron Modular Computers GmbH or one of its
authorized agents.

The information contained in this document is, to the best of our knowledge, entirely correct.
However, Kontron Modular Computers GmbH cannot accept liability for any inaccuracies or
the consequences thereof, or for any liability arising from the use or application of any circuit,
product, or example shown in this document.

Kontron Modular Computers GmbH reserves the right to change, modify, or improve this
document or the product described herein, as seen fit by Kontron Modular Computers GmbH
without further notice.

Trademarks

Note

Refer to the release notes for the FASTPATH application level code. The
release notes detail the platform specific functionality of the Switching, Rout­ing, SNMP, Config, Management, and Bandwidth Provisioning packages. The
suite of features supported by the FASTPATH packages are not available on
all the platforms to which FASTPATH has been ported.

© 2005 LVL7 Systems, Inc. All rights reserved. FASTPATH® and MasterDriver® are
registered trademarks, and LVL7™ and the LVL7 logo are trademarks of LVL7 Systems, Inc.
All other trademarks are the property of their respective owners.

Linux is a registered trademark of Linus Torvalds.

RedHat is a registered trademark of RedHat

Kontron Modular Computers GmbH and the Kontron Logo are trade marks owned by Kontron
Modular Computers GmbH, Kaufbeuren (Germany). In addition, this document may include

Page xvii AT8402 CLI Reference Manual

Preface AT8402

names, company logos and trademarks, which are registered trademarks and, therefore,
proprietary to their respective owners.

Environmental Protection Statement

This product has been manufactured to satisfy environmental protection requirements where
possible. Many of the components used (structural parts, printed circuit boards, connectors,
batteries, etc.) are capable of being recycled.

Final disposition of this product after its service life must be accomplished in accordance with
applicable country, state, or local laws or regulations.

Explanation of Symbols

CE Conformity

This symbol indicates that the product described in this manual is in com­pliance with all applied CE standards. Please refer also to the section
“Applied Standards” in this manual.

Caution, Electric Shock!

This symbol and title warn of hazards due to electrical shocks (> 60V)
when touching products or parts of them. Failure to observe the precautions
indicated and/or prescribed by the law may endanger your life/health and/or
result in damage to your material.

Please refer also to the section “High Voltage Safety Instructions” on the
following page.

Warning, ESD Sensitive Device!

This symbol and title inform that electronic boards and their components
are sensitive to static electricity. Therefore, care must be taken during all
handling operations and inspections of this product, in order to ensure prod­uct integrity at all times.

Please read also the section “Special Handling and Unpacking Instructions”
on the following page.

Warning!

This symbol and title emphasize points which, if not fully understood and
taken into consideration by the reader, may endanger your health and/or
result in damage to your material.

Note...

This symbol and title emphasize aspects the reader should read through
carefully for his or her own advantage.

For Your Safety

AT8402 CLI Reference Manual Page xviii

AT8402 Preface

Your new Kontron product was developed and tested carefully to provide all features necessary
to ensure its compliance with electrical safety requirements. It was also designed for a long
fault-free life. However, the life expectancy of your product can be drastically reduced by
improper treatment during unpacking and installation. Therefore, in the interest of your own
safety and of the correct operation of your new Kontron product, you are requested to conform
with the following guidelines.

High Voltage Safety Instructions

Warning!

All operations on this device must be carried out by sufficiently skilled per­sonnel only.

Caution, Electric Shock!

Indicates that you must enter a value in place of the brackets and text inside
them. Before installing your new Kontron product into a system always
ensure that your mains power is switched off. This applies also to the
installation of piggybacks.

Serious electrical shock hazards can exist during all installation, repair and
maintenance operations with this product. Therefore, always unplug the
power cable and any other cables which provide external voltages before
performing work.

Special Handling and Unpacking Instructions

ESD Sensitive Device!

Electronic boards and their components are sensitive to static electricity.
Therefore, care must be taken during all handling operations and inspec­tions of this product, in order to ensure product integrity at all times.

Do not handle this product out of its protective enclosure while it is not used for operational
purposes unless it is otherwise protected.

Whenever possible, unpack or pack this product only at EOS/ESD safe work stations. Where a
safe work station is not guaranteed, it is important for the user to be electrically discharged
before touching the product with his/her hands or tools. This is most easily done by touching a
metal part of your system housing.

It is particularly important to observe standard anti-static precautions when changing
piggybacks, ROM devices, jumper settings etc. If the product contains batteries for RTC or
memory back-up, ensure that the board is not placed on conductive surfaces, including anti­static plastics or sponges. They can cause short circuits and damage the batteries or conductive
circuits on the board.

General Instructions on Usage

In order to maintain Kontron’s product warranty, this product must not be altered or modified in
any way. Changes or modifications to the device, which are not explicitly approved by Kontron
Modular Computers GmbH and described in this manual or received from Kontron’s Technical
Support as a special handling instruction, will void your warranty.

Page xix AT8402 CLI Reference Manual

Preface AT8402

This device should only be installed in or connected to systems that fulfill all necessary
technical and specific environmental requirements. This applies also to the operational
temperature range of the specific board version, which must not be exceeded. If batteries are
present their temperature restrictions must be taken into account.

In performing all necessary installation and application operations, please follow only the
instructions supplied by the present manual.

Keep all the original packaging material for future storage or warranty shipments. If it is
necessary to store or ship the board please re-pack it as nearly as possible in the manner in
which it was delivered.

Special care is necessary when handling or unpacking the product. Please, consult the special
handling and unpacking instruction on the previous page of this manual.

Two Year Warranty

Kontron Modular Computers GmbH grants the original purchaser of Kontron’s products a two
year limited hardware warranty as described in the following. However, no other warranties that
may be granted or implied by anyone on behalf of Kontron are valid unless the consumer has
the express written consent of Kontron Modular Computers GmbH.

Kontron Modular Computers GmbH warrants their own products, excluding software, to be
free from manufacturing and material defects for a period of 24 consecutive months from the
date of purchase. This warranty is not transferable nor extendible to cover any other users or
long-term storage of the product. It does not cover products which have been modified, altered
or repaired by any other party than Kontron Modular Computers GmbH or their authorized
agents. Furthermore, any product which has been, or is suspected of being damaged as a result
of negligence, improper use, incorrect handling, servicing or maintenance, or which has been
damaged as a result of excessive current/voltage or temperature, or which has had its serial
number(s), any other markings or parts thereof altered, defaced or removed will also be
excluded from this warranty.

If the customer’s eligibility for warranty has not been voided, in the event of any claim, he may
return the product at the earliest possible convenience to the original place of purchase, together
with a copy of the original document of purchase, a full description of the application the
product is used on and a description of the defect. Pack the product in such a way as to ensure
safe transportation (see our safety instructions).

Kontron provides for repair or replacement of any part, assembly or sub-assembly at their own
discretion, or to refund the original cost of purchase, if appropriate. In the event of repair,
refunding or replacement of any part, the ownership of the removed or replaced parts reverts to
Kontron Modular Computers GmbH, and the remaining part of the original guarantee, or any
new guarantee to cover the repaired or replaced items, will be transferred to cover the new or
repaired items. Any extensions to the original guarantee are considered gestures of goodwill,
and will be defined in the “Repair Report” issued by Kontron with the repaired or replaced
item.

Kontron Modular Computers GmbH will not accept liability for any further claims resulting
directly or indirectly from any warranty claim, other than the above specified repair,
replacement or refunding. In particular, all claims for damage to any system or process in which
the product was employed, or any loss incurred as a result of the product not functioning at any
given time, are excluded. The extent of Kontron Modular Computers GmbH liability to the
customer shall not exceed the original purchase price of the item for which the claim exists.

Kontron Modular Computers GmbH issues no warranty or representation, either explicit or
implicit, with respect to its products’ reliability, fitness, quality, marketability or ability to fulfil

AT8402 CLI Reference Manual Page xx

AT8402 Preface

any particular application or purpose. As a result, the products are sold “as is,” and the
responsibility to ensure their suitability for any given task remains that of the purchaser. In no
event will Kontron be liable for direct, indirect or consequential damages resulting from the use
of our hardware or software products, or documentation, even if Kontron were advised of the
possibility of such claims prior to the purchase of the product or during any period since the
date of its purchase.

Please remember that no Kontron Modular Computers GmbH employee, dealer or agent is
authorized to make any modification or addition to the above specified terms, either verbally or
in any other form, written or electronically transmitted, without the company’s consent.

Page xxi AT8402 CLI Reference Manual

Preface AT8402

AT8402 CLI Reference Manual Page xxii

AT8402

Chapter 1

1

Using the Command-Line Interface

Page 1 - 1 AT8402 CLI Reference Manual

Using the Command-Line Interface AT8402

1. Using the Command-Line Interface

The command-line interface (CLI) is a text-based way to manage and monitor the
system. You can access the CLI by using a direct serial connection or by using a remote
logical connection with telnet or SSH.

This chapter describes the CLI syntax, conventions, and modes. It contains the
following sections:

• 1.1 “Command Syntax” on page 1 - 2

• 1.2 “Command Conventions” on page 1 - 2

• 1.3 “Slot/Port Naming Convention” on page 1 - 4

• 1.4 “Using the “No” Form of a Command” on page 1 - 5

• 1.5 “Command Modes” on page 1 - 5

• 1.6 “Using CLI Help” on page 1 - 9

• 1.7 “Accessing the CLI” on page 1 - 9

1.1 Command Syntax

A command is one or more words that might be followed by one or more parameters.
Parameters can be required or optional values.

Some commands, such as
Other commands, such as
command. You must type the parameter values in a specific order, and optional
parameters follow required parameters. The following example describes the

parms

command syntax:

Format

• network parms is the command name.

<ipaddr> and <netmask> are parameters and represent required values that you

•
must enter after you type the command keywords.

•

[gateway] is an optional parameter, so you are not required to enter a value in

place of the parameter.

The CLI Reference lists each command by the command name and provides a brief
description of the command. Each command reference also contains the following
information:

• Format shows the command keywords and the required and optional parameters.

• Mode identifies the command mode you must be in to access the command.

• Default shows the default value, if any, of a configurable setting on the device.

show commands also contain a description of the information that the command

The
shows.

network parms <ipaddr> <netmask> [gateway]

show network or clear vlan, do not require parameters.
network parms, require that you supply a value after the

network

1.2 Command Conventions

In this document, the command name is in bold font. Parameters are in italic font.
You must replace the parameter name with an appropriate value, which might be a
name or number. Parameters are order dependent.

AT8402 CLI Reference Manual Page 1 - 2

AT8402 Using the Command-Line Interface

The parameters for a command might include mandatory values, optional values, or
keyword choices. Table 4.1 describes the conventions this document uses to
distinguish between value types.

Table 4.1. Parameter Conventions

Symbol Example Description

<> angle brackets <value> Indicates that you must enter a value

in place of the brackets and text
inside them.

[] square brackets [value] Indicates an optional parameter that

you can enter in place of the brackets
and text inside them.

{} curly braces {choice1 | choice2} Indicates that you must select a

parameter from the list of choices.

| Vertical bars choice1 | choice2 Separates the mutually exclusive

choices.

[{}] Braces within
square brackets

[{choice1 | choice2}] Indicates a choice within an optional

element.

1.2.1 Common Parameter Values

Parameter values might be names (strings) or numbers.To use spaces as part of a name
parameter, enclose the name value in double quotes. For example, the expression
“System Name with Spaces” forces the system to accept the spaces. Empty strings (““)
are not valid user-defined strings. Table 4.2 describes common parameter values and
value formatting.

Table 4.2. Parameter Descriptions

Parameter Description

ipaddr This parameter is a valid IP address. You can enter the IP address in the

following formats:

a (32 bits)

a.b (8.24 bits)

a.b.c (8.8.16 bits)

a.b.c.d (8.8.8.8)

In addition to these formats, the CLI accepts decimal, hexidecimal and
octal formats through the following input formats (where n is any valid
hexidecimal, octal or decimal number):

0xn (CLI assumes hexidecimal format)

0n (CLI assumes octal format with leading zeros)

n (CLI assumes decimal format)

areaid Enter area IDs in dotted-decimal notation (for example, 0.0.0.1). An

area ID of 0.0.0.0 is reserved for the backbone. Area IDs have the same
format as IP addresses but are distinct from IP addresses. You can use
the IP network number of the sub-netted network for the area ID.

routerid Enter the value of

0.0.0.1. A router ID of 0.0.0.0 is invalid.

<routerid> in dotted-decimal notation, such as

Page 1 - 3 AT8402 CLI Reference Manual

Using the Command-Line Interface AT8402

Table 4.2. Parameter Descriptions

Parameter Description

Interface or
slot/port

Logical Interface Represents a Logical slot and port number.. This is applicable in the

Character strings Use double quotation marks to identify character strings, for example,

1.3 Slot/Port Naming Convention

FASTPATH software references physical entities such as cards and ports by using a
slot/port naming convention. The FASTPATH software also uses this convention to
identify certain logical entities, such as Port-Channel interfaces.

The slot number has two uses. In the case of physical ports, it identifies the card
containing the ports. In the case of logical and CPU ports it also identifies the type of
interface or port.

Table 4.3. Type of Slots

Valid slot and port number separated by forward slashes. For example,
0/1 represents slot number 0 and port number 1.

case of a port-channel (LAG). You can use the logical slot/port to con­figure the port-channel.

“System Name with Spaces”. An empty string (“”) is not valid.

Slot Type Description

Physical slot numbers Physical slot numbers begin with zero, and are allocated up to the

maximum number of physical slots.

Logical slot numbers Logical slots immediately follow physical slots and identify port-

channel (LAG) or router interfaces.

CPU slot numbers The CPU slots immediately follow the logical slots.

The port identifies the specific physical port or logical interface being managed on a
given slot.

Table 4.4. Type of Ports

Port Type Description

Physical Ports The physical ports for each slot are numbered sequentially starting

from zero.

Logical Interfaces Port-channel or Link Aggregation Group (LAG) interfaces are

logical interfaces that are only used for bridging functions.

VLAN routing interfaces are only used for routing functions.

Loopback interfaces are logical interfaces that are always up.

Tunnel interfaces are logical point-to-point links that carry encap­sulated packets.

CPU ports CPU ports are handled by the driver as one or more physical enti-

ties located on physical slots.

NOTE: In the CLI, loopback and tunnel interfaces do not use the slot/port for-

mat. To specify a loopback interface, you use the loopback ID. To
specify a tunnel interface, you use the tunnel ID.

AT8402 CLI Reference Manual Page 1 - 4

AT8402 Using the Command-Line Interface

1.4 Using the “No” Form of a Command

The no keyword is a specific form of an existing command and does not represent a
new or distinct command. Almost every configuration command has a
general, use the
default. For example, the
of an interface. Use the command without the keyword

no form to reverse the action of a command or reset a value back to the

no shutdown configuration command reverses the shutdown

no to re-enable a disabled

feature or to enable a feature that is disabled by default.

no form. In

Only the configuration commands are available in the

1.5 Command Modes

The CLI groups commands into modes according to the command function. Each of
the command modes supports specific FASTPATH software commands. The
commands in one mode are not available until you switch to that particular mode, with
the exception of the User EXEC mode commands. You can execute the User EXEC
mode commands in the Privileged EXEC mode.

The command prompt changes in each command mode to help you identify the current
mode. Table 4.5 describes the command modes and the prompts visible in that mode.

Table 4.5. CLI Command Modes

Command

Mode

User EXEC

Privileged EXEC

Global Config

VLAN Config

Interface Config

Switch> Contains a limited set of

Switch# Allows you to issue any

Switch (Config)# Groups general setup

Switch (Vlan)# Groups all the VLAN

Switch (Interface <slot/port>)#

Switch (Interface Loopback <id>)#

Switch (Interface Tunnel <id>)#

no form.

Prompt Mode Description

commands to view basic
system information.

EXEC command, enter

the VLAN mode, or
enter the Global Config­uration mode.

commands and permits
you to make modifica­tions to the running con­figuration.

commands.

Allows you to enable or
modify the operation of
an interface and provides
access to the router inter­face configuration com­mands.

Use this mode to set up a
physical port for a spe­cific logical connection
operation.

Page 1 - 5 AT8402 CLI Reference Manual

Using the Command-Line Interface AT8402

Table 4.5. CLI Command Modes

Command

Mode

Prompt Mode Description

Line Config Switch (line)# Allows you to configure

various telnet settings
and the console interface.

Policy Map
Config

Switch (Config-policy-map)# Allows you to access the

QoS Policy-Map config­uration mode to config­ure the QoS Policy-Map.

Policy Class
Config

Switch (Config-policy-class­map)#

Consists of class cre­ation, deletion, and
matching commands.
The class match com­mands specify Layer 2,
Layer 3, and general
match criteria.

Class Map Con­fig

Switch (Config-class-map)# Allows you to access the

QoS Class-Map configu­ration mode to configure
QoS class maps.

MAC Access-list
Config

Switch (Config-mac-access-list)# Allows you to create a

MAC Access-List and to
enter the mode contain­ing Mac Access-List
configuration com­mands.

TACACS Config

Switch (Tacacs)# Allows you to configure

properties for the
TACACS servers.

DHCP Pool
Config

Switch (Config dhcp-pool)# Allows you to access the

DHCP Pool configura­tion.

Table 4.6 explains how to enter or exit each mode.

Table 4.6. CLI Mode Access and Exit

Command

Mode

User EXEC This is the first level of access. To exit, enter

Privileged EXEC From the User EXEC mode, enter

enable.

Global Config From the Privileged EXEC mode, enter

configure.

VLAN Config From the Privileged EXEC mode, enter

vlan database.

AT8402 CLI Reference Manual Page 1 - 6

Access Method

Exit or Access Previous

Mode

logout.

To exit to the User EXEC
mode, enter exit or press

Ctrl-Z.

To exit to the Privileged
EXEC mode, enter exit, or
press

Ctrl-Z.

To exit to the Privileged
EXEC mode, enter exit, or
press

Ctrl-Z.

AT8402 Using the Command-Line Interface

Table 4.6. CLI Mode Access and Exit

Command

Mode

Access Method

Interface Config From the Global Config mode, enter

interface <slot/port> or inter­face loopback <id>
tunnel <id>

or interface

or

Line Config From the Global Config mode, enter

lineconfig.

Policy-Map
Config

Policy-Class­Map Config

Class-Map
Config

MAC Access-list
Config

From the Global Config mode, enter

policy-map.

From the Policy Map mode enter

class.

From the Global Config mode, enter

class-map.

From the Global Config mode, enter

mac access-list extended

<name>

.

TACACS Config From the Global Config mode, enter

tacacs-server host <ip-addr>,

where

<ip-addr> is the IP address of

the TACACS server on your network.

DHCP Pool
Config

From the Global Config mode, enter

ip dhcp pool <pool-name>.

Exit or Access Previous

Mode

To exit to the Global Config
mode, enter

exit. To return

to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Global Config
mode, enter exit. To return
to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Global Config
mode, enter exit. To return
to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Policy Map
mode, enter exit. To return
to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Global Config
mode, enter exit. To return
to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Global Config
mode, enter

exit. To return

to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Global Config
mode, enter

exit. To return

to the Privileged EXEC
mode, enter

Ctrl-Z.

To exit to the Global Config
mode, enter exit. To return
to the Privileged EXEC
mode, enter

Ctrl-Z.

1.5.1 Command Completion and Abbreviation

Command completion finishes spelling the command when you type enough letters of
a command to uniquely identify the command keyword. Once you have entered
enough letters, press the SPACEBAR or TAB key to complete the word.

Command abbreviation allows you to execute a command when you have entered there
are enough letters to uniquely identify the command. You must enter all of the required
keywords and parameters before you enter the command.

Page 1 - 7 AT8402 CLI Reference Manual

Using the Command-Line Interface AT8402

1.5.2 CLI Error Messages

If you enter a command and the system is unable to execute it, an error message
appears. Table 4.7 describes the most common CLI error messages.

Table 4.7. CLI Error Messages

Message Text Description

% Invalid input detected at '^'
marker.

Command not found / Incomplete
command. Use ? to list commands.

Ambiguous command Indicates that you did not enter enough letters

1.5.3 CLI Line-Editing Conventions

Indicates that you entered an incorrect or
unavailable command. The carat (^) shows
where the invalid text is detected. This mes­sage also appears if any of the parameters or
values are not recognized.

Indicates that you did not enter the required
keywords or values.

to uniquely identify the command.

Table 4.8 describes the key combinations you can use to edit commands or increase the
speed of command entry. You can access this list from the CLI by entering

help from

the User or Privileged EXEC modes.

Table 4.8. CLI Editing Conventions

Key Sequence Description

DEL or Backspace Delete previous character

Ctrl-A Go to beginning of line

Ctrl-E Go to end of line

Ctrl-F Go forward one character

Ctrl-B Go backward one character

Ctrl-D Delete current character

Ctrl-U, X Delete to beginning of line

Ctrl-K Delete to end of line

Ctrl-W Delete previous word

Ctrl-T Transpose previous character

Ctrl-P Go to previous line in history buffer

Ctrl-R Rewrites or pastes the line

Ctrl-N Go to next line in history buffer

Ctrl-Y Prints last deleted character

Ctrl-Q Enables serial flow

Ctrl-S Disables serial flow

Ctrl-Z Return to root command prompt

Tab, <SPACE> Command-line completion

Exit Go to next lower command prompt

? List available commands, keywords, or parameters

AT8402 CLI Reference Manual Page 1 - 8

AT8402 Using the Command-Line Interface

1.6 Using CLI Help

Enter a question mark (?) at the command prompt to display the commands available in
the current mode.

(switch) >?

enable Enter into user privilege mode.
help Display help for various special keys.
logout Exit this session. Any unsaved changes are lost.
ping Send ICMP echo packets to a specified IP

address.
quit Exit this session. Any unsaved changes are lost.
show Display Switch Options and Settings.
telnet Telnet to a remote host.

Enter a question mark (?) after each word you enter to display available command
keywords or parameters.

(switch) #network ?

javamode Enable/Disable.
mgmt_vlan Configure the Management VLAN ID of the switch.
parms Configure Network Parameters of the router.
protocol Select DHCP, BootP, or None as the network

config
protocol.

If the help output shows a parameter in angle brackets, you must replace the parameter
with a value.

(switch) #network parms ?

<ipaddr> Enter the IP Address.

If there are no additional command keywords or parameters, or if additional parameters
are optional, the following message appears in the output:

<cr> Press Enter to execute the command

You can also enter a question mark (?) after typing one or more characters of a word to
list the available command or parameters that begin with the letters, as shown in the
following example:

(switch) #show m?

mac-addr-table mac-address-table monitor

1.7 Accessing the CLI

You can access the CLI by using a direct console connection or by using a telnet or
SSH connection from a remote management host.

For the initial connection, you must use a direct connection to the console port. You
cannot access the system remotely until the system has an IP address, subnet mask, and
default gateway. You can set the network configuration information manually, or you
can configure the system to accept these settings from a BOOTP or DHCP server on
your network. For more information, see 5.1 “Network Interface Commands” on page
5 - 2.

Page 1 - 9 AT8402 CLI Reference Manual

Using the Command-Line Interface AT8402

AT8402 CLI Reference Manual Page 1 - 10

AT8402

Chapter 1

2

Switching Commands

Page 2 - 1 AT8402 CLI Reference Manual

Switching Commands AT8402

2. Switching Commands

This chapter describes the switching commands available in the CLI.

The Switching Commands chapter includes the following sections:

• 2.1 “Port Configuration Commands” on page 2 - 2

• 2.2 “Spanning Tree Protocol (STP) Commands” on page 2 - 6

• 2.3 “VLAN Commands” on page 2 - 17

• 2.4 “Double VLAN Commands” on page 2 - 28

• 2.5 “Provisioning (IEEE 802.1p) Commands” on page 2 - 29

• 2.6 “Protected Ports Commands” on page 2 - 30

• 2.7 “GARP Commands” on page 2 - 32

• 2.8 “GVRP Commands” on page 2 - 34

• 2.9 “GMRP Commands” on page 2 - 35

• 2.10 “Port-Based Network Access Control Commands” on page 2 - 37

• 2.11 “Storm-Control Commands” on page 2 - 46

• 2.12 “Port-Channel/LAG (802.3ad) Commands” on page 2 - 52

• 2.13 “Port Mirroring” on page 2 - 56

• 2.15 “IGMP Snooping Configuration Commands” on page 2 - 60

• 2.16 “Port Security Commands” on page 2 - 66

• 2.17 “LLDP (802.1AB) Commands” on page 2 - 69

• 2.18 “Denial of Service Commands” on page 2 - 74

• 2.19 “MAC Database Commands” on page 2 - 77

CAUTION: The commands in this chapter are in one of three functional

groups:

• Show commands display switch settings, statistics, and other information.

• Configuration commands configure features and options of the switch. For every
configuration command, there is a show command that displays the configuration
setting.

• Clear commands clear some or all of the settings to factory defaults.

2.1 Port Configuration Commands

This section describes the commands you use to view and configure port settings.

2.1.1 interface

This command gives you access to the Interface Config mode, which allows you to
enable or modify the operation of an interface (port).

Format

Mode Global Config

2.1.2 auto-negotiate

This command enables automatic negotiation on a port.

interface <slot/port>

Default enabled

Format

AT8402 CLI Reference Manual Page 2 - 2

auto-negotiate

AT8402 Switching Commands

Mode Interface Config

2.1.2.1 no auto-negotiate

This command disables automatic negotiation on a port.

NOTE: Automatic sensing is disabled when automatic negotiation is disabled.

Format

no auto-negotiate

Mode Interface Config

2.1.3 auto-negotiate all

This command enables automatic negotiation on all ports.

Default enabled

Format

auto-negotiate all

Mode Global Config

2.1.3.1 no auto-negotiate all

This command disables automatic negotiation on all ports.

Format

no auto-negotiate all

Mode Global Config

2.1.4 description

Use this command to create an alpha-numeric description of the port.

Format

Mode Interface Config

description <description>

2.1.5 mtu

Use the mtu command to set the maximum transmission unit (MTU) size, in bytes, for
frames that ingress or egress the interface. You can use the
jumbo frame support for physical and port-channel (LAG) interfaces. For the standard
FASTPATH implementation, the MTU size is a valid integer between 1522 - 9216 for
tagged packets and a valid integer between 1518 - 9216 for untagged packets.

NOTE: To receive and process packets, the Ethernet MTU must include any

Default 1518 (untagged)

Format

Mode Interface Config

2.1.5.1 no mtu

This command sets the default MTU size (in bytes) for the interface.

Format

mtu command to configure

extra bytes that Layer-2 headers might require.

mtu <1518-9216>

no mtu

Page 2 - 3 AT8402 CLI Reference Manual

Switching Commands AT8402

Mode Interface Config

2.1.6 shutdown

This command disables a port.

NOTE: You can use the

(LAG) interfaces, but not on VLAN routing interfaces.

Default enabled

Format

Mode Interface Config

2.1.6.1 no shutdown

This command enables a port.

Format

Mode Interface Config

2.1.7 shutdown all

This command disables all ports.

NOTE: You can use the

nel (LAG) interfaces, but not on VLAN routing interfaces.

Default enabled

Format

Mode Global Config

shutdown command on physical and port-channel

shutdown

no shutdown

shutdown all command on physical and port-chan-

shutdown all

2.1.7.1 no shutdown all

This command enables all ports.

Format

no shutdown all

Mode Global Config

2.1.8 speed

This command sets the speed and duplex setting for the interface.

Format

Mode Interface Config

Acceptable values are:

100h 100BASE-T half duplex

100f 100BASE-T full duplex

10h 10BASE-T half duplex

10f 10BASE-T full duplex

speed {<100 | 10> <half-duplex | full-duplex>}

AT8402 CLI Reference Manual Page 2 - 4

AT8402 Switching Commands

2.1.9 speed all

This command sets the speed and duplex setting for all interfaces.

Format

Mode Global Config

Acceptable values are:

100h 100BASE-T half-duplex

100f 100BASE-T full duplex

10h 10BASE-T half duplex

10f 10BASE-T full duplex

2.1.10 block

This command sets a port in blocking mode. A blocking port will not receive or
forward data frames. The command is only allowed if no spanning tree is enabled
because the spanning tree is setting the port states itself. If the port is currently
disabled, the state is not changed until it will become enabled. The state of the ports
can be listed (spanning tree) by using:

show spanning-tree mst port summary 0 all

Format block

Mode Interface Config

speed all {<100 | 10> <half-duplex | full-duplex>}

2.1.10.1 no block

This command resets a port in non-blocking mode.

Format

Mode Interface Config

2.1.11 show port

This command displays port information.

Format

Mode Privileged EXEC

Interface Valid slot and port number separated by forward slashes.

Type If not blank, this field indicates that this port is a special type of port.

Admin Mode The Port control administration state. The port must be enabled in

no block

show port {<slot/port> | all}

The possible values are:
Mirror - this port is a monitoring port. For more information, see 2.13

“Port Mirroring” on page 2 - 56.

PC Mbr- this port is a member of a port-channel (LAG).
Probe - this port is a probe port.

order for it to be allowed into the network. - May be enabled or dis­abled. The factory default is enabled.

Page 2 - 5 AT8402 CLI Reference Manual

Switching Commands AT8402

Physical Mode The desired port speed and duplex mode. If auto-negotiation support

is selected, then the duplex mode and speed is set from the auto-nego­tiation process. Note that the maximum capability of the port (full
duplex -100M) is advertised. Otherwise, this object determines the
port's duplex mode and transmission rate. The factory default is Auto.

Physical Status The port speed and duplex mode.

Link Status The Link is up or down.

Link Trap This object determines whether or not to send a trap when link status

changes. The factory default is enabled.

LACP Mode LACP is enabled or disabled on this port.

2.1.12 show port protocol

This command displays the Protocol-Based VLAN information for either the entire
system, or for the indicated group.

Format

Mode Privileged EXEC

Group Name The group name of an entry in the Protocol-based VLAN table.

Group ID The group identifier of the protocol group.

Protocol(s) The type of protocol(s) for this group.

VLAN The VLAN associated with this Protocol Group.

Interface(s) Lists the slot/port interface(s) that are associated with this Protocol

show port protocol {<groupid> | all}

Group.

2.2 Spanning Tree Protocol (STP) Commands

This section describes the commands you use to configure Spanning Tree Protocol
(STP). STP helps prevent network loops, duplicate messages, and network instability.

NOTE: STP is disabled by default. When you enable STP on the switch, STP

is still disabled on each port.

NOTE: If STP is disabled, the system does not forward BPDU messages.

2.2.1 spanning-tree

This command sets the spanning-tree operational mode to enabled.

Default disabled

Format

Mode Global Config

spanning-tree

2.2.1.1 no spanning-tree

This command sets the spanning-tree operational mode to disabled. While disabled, the
spanning-tree configuration is retained and can be changed, but is not activated.

AT8402 CLI Reference Manual Page 2 - 6

AT8402 Switching Commands

Format no spanning-tree

Mode Global Config

2.2.2 spanning-tree bpdumigrationcheck

Use this command to force a transmission of rapid spanning tree (RSTP) and multiple
spanning tree (MSTP) BPDUs. Use the
from a specified interface, or use the
interfaces. This command forces the BPDU transmission when you execute it, so the
command does not change the system configuration or have a “no” version.

<slot/port> parameter to transmit a BPDU

all keyword to transmit BPDUs from all

Format

spanning-tree bpdumigrationcheck {<slot/port> | all}

Mode Global Config

2.2.3 spanning-tree configuration name

This command sets the Configuration Identifier Name for use in identifying the
configuration that this switch is currently using. The
characters.

Default base MAC address in hexadecimal notation

Format

spanning-tree configuration name <name>

Mode Global Config

2.2.3.1 no spanning-tree configuration name

This command resets the Configuration Identifier Name to its default.

Format

no spanning-tree configuration name

Mode Global Config

2.2.4 spanning-tree configuration revision

This command sets the Configuration Identifier Revision Level for use in identifying
the configuration that this switch is currently using. The Configuration Identifier
Revision Level is a number in the range of 0 to 65535.

<name> is a string of up to 32

Default 0

Format

spanning-tree configuration revision <0-65535>

Mode Global Config

2.2.4.1 no spanning-tree configuration revision

This command sets the Configuration Identifier Revision Level for use in identifying
the configuration that this switch is currently using to the default value.

Format

Mode Global Config

no spanning-tree configuration revision

Page 2 - 7 AT8402 CLI Reference Manual

Switching Commands AT8402

2.2.5 spanning-tree edgeport

This command specifies that this port is an Edge Port within the common and internal
spanning tree. This allows this port to transition to Forwarding State without delay.

Format

spanning-tree edgeport

Mode Interface Config

2.2.5.1 no spanning-tree edgeport

This command specifies that this port is not an Edge Port within the common and
internal spanning tree.

Format

no spanning-tree edgeport

Mode Interface Config

2.2.6 spanning-tree forceversion

This command sets the Force Protocol Version parameter to a new value. Use 802.1d to
specify that the switch transmits ST BPDUs rather than MST BPDUs (IEEE 802.1d
functionality supported). Use 802.1w to specify that the switch transmits RST BPDUs
rather than MST BPDUs (IEEE 802.1w functionality supported). Use 802.1s to specify
that the switch transmits MST BPDUs (IEEE 802.1s functionality supported).

Default 802.1s

Format

Mode Global Config

spanning-tree forceversion <802.1d | 802.1s | 802.1w>

2.2.6.1 no spanning-tree forceversion

This command sets the Force Protocol Version parameter to the default value.

Format

no spanning-tree forceversion

Mode Global Config

2.2.7 spanning-tree forward-time

This command sets the Bridge Forward Delay parameter to a new value for the
common and internal spanning tree. The forward-time value is in seconds within a
range of 4 to 30, with the value being greater than or equal to “(Bridge Max Age / 2) +
1”.

Default 15

Format

spanning-tree forward-time <4-30>

Mode Global Config

2.2.7.1 no spanning-tree forward-time

This command sets the Bridge Forward Delay parameter for the common and internal
spanning tree to the default value.

Format

no spanning-tree forward-time

AT8402 CLI Reference Manual Page 2 - 8

AT8402 Switching Commands

Mode Global Config

2.2.8 spanning-tree hello-time

This command sets the Admin Hello Time parameter to a new value for the common
and internal spanning tree. The hello time
of 1 to 10, with the value being less than or equal to (Bridge Max Age / 2) - 1.

Default 2

<value> is in whole seconds within a range

Format

spanning-tree hello-time <1-10>

Mode Interface Config

2.2.8.1 no spanning-tree hello-time

This command sets the admin Hello Time parameter for the common and internal
spanning tree to the default value.

Format

no spanning-tree hello-time

Mode Interface Config

2.2.9 spanning-tree max-age

This command sets the Bridge Max Age parameter to a new value for the common and
internal spanning tree. The max-age value is in seconds within a range of 6 to 40, with
the value being less than or equal to 2 x (Bridge Forward Delay - 1).

Default 20

Format

spanning-tree max-age <6-40>

Mode Global Config

2.2.9.1 no spanning-tree max-age

This command sets the Bridge Max Age parameter for the common and internal
spanning tree to the default value.

Format

no spanning-tree max-age

Mode Global Config

2.2.10 spanning-tree max-hops

This command sets the MSTP Max Hops parameter to a new value for the common
and internal spanning tree. The max-hops value is a range from 1 to 127.

Default 20

Format

spanning-tree max-hops <1-127>

Mode Global Config

2.2.10.1 no spanning-tree max-hops

This command sets the Bridge Max Hops parameter for the common and internal
spanning tree to the default value.

Page 2 - 9 AT8402 CLI Reference Manual

Switching Commands AT8402

Format no spanning-tree max-hops

Mode Global Config

2.2.11 spanning-tree mst

This command sets the Path Cost or Port Priority for this port within the multiple
spanning tree instance or in the common and internal spanning tree. If you specify an

<mstid> parameter that corresponds to an existing multiple spanning tree instance, the

configurations are done for that multiple spanning tree instance. If you specify 0
(defined as the default CIST ID) as the
common and internal spanning tree instance.

If you specify the cost option, the command sets the path cost for this port within a
multiple spanning tree instance or the common and internal spanning tree instance,
depending on the

<mstid> parameter. You can set the path cost as a number in the

range of 1 to 200000000 or auto. If you select auto the path cost value is set based on
Link Speed.

<mstid>, the configurations are done for the

If you specify the external-cost option, this command sets the external-path cost for
MST instance ‘0’ i.e. CIST instance. You can set the external cost as a number in the
range of 1 to 200000000 or auto. If you specify auto, the external path cost value is set
based on Link Speed.

If you specify the port-priority option, this command sets the priority for this port
within a specific multiple spanning tree instance or the common and internal spanning
tree instance, depending on the
in the range of 0 to 240 in increments of 16.

Default cost—auto

external-cost—auto
port-priority—128

Format

spanning-tree mst <mstid> {{cost <1-200000000> | auto} |

{external-cost <1-200000000> | auto} | port-priority <0-240>}

Mode Interface Config

2.2.11.1 no spanning-tree mst

This command sets the Path Cost or Port Priority for this port within the multiple
spanning tree instance, or in the common and internal spanning tree to the respective
default values. If you specify an
multiple spanning tree instance, you are configuring that multiple spanning tree
instance. If you specify 0 (defined as the default CIST ID) as the
configuring the common and internal spanning tree instance.

<mstid> parameter. The port-priority value is a number

<mstid> parameter that corresponds to an existing

<mstid>, you are

If the you specify cost, this command sets the path cost for this port within a multiple
spanning tree instance or the common and internal spanning tree instance, depending

<mstid> parameter, to the default value, i.e. a path cost value based on the Link

on the
Speed.

If you specify external-cost, this command sets the external path cost for this port for
mst ‘0’ instance, to the default value, i.e. a path cost value based on the Link Speed.

AT8402 CLI Reference Manual Page 2 - 10

AT8402 Switching Commands

If you specify port-priority, this command sets the priority for this port within a
specific multiple spanning tree instance or the common and internal spanning tree
instance, depending on the

<mstid> parameter, to the default value.

Format

no spanning-tree mst <mstid> <cost | external-cost | port-prior-

ity>

Mode Interface Config

2.2.12 spanning-tree mst instance

This command adds a multiple spanning tree instance to the switch. The parameter

<mstid> is a number within a range of 1 to 4094, that corresponds to the new instance

ID to be added. The maximum number of multiple instances supported by the switch is

4.

Default none

Format

spanning-tree mst instance <mstid>

Mode Global Config

2.2.12.1 no spanning-tree mst instance

This command removes a multiple spanning tree instance from the switch and
reallocates all VLANs allocated to the deleted instance to the common and internal
spanning tree. The parameter
existing multiple spanning tree instance to be removed.

Format

no spanning-tree mst instance <mstid>

<mstid> is a number that corresponds to the desired

Mode Global Config

2.2.13 spanning-tree mst priority

This command sets the bridge priority for a specific multiple spanning tree instance.
The parameter

<mstid> is a number that corresponds to the desired existing multiple

spanning tree instance. The priority value is a number within a range of 0 to 61440 in
increments of 4096.

If you specify 0 (defined as the default CIST ID) as the
Bridge Priority parameter to a new value for the common and internal spanning tree.
The bridge priority value is a number within a range of 0 to 61440. The twelve least
significant bits are masked according to the 802.1s specification. This causes the
priority to be rounded down to the next lower valid priority.

Default 32768

Format

spanning-tree mst priority <mstid> <0-61440>

Mode Global Config

2.2.13.1 no spanning-tree mst priority

This command sets the bridge priority for a specific multiple spanning tree instance to
the default value. The parameter
existing multiple spanning tree instance.

<mstid>, this command sets the

<mstid> is a number that corresponds to the desired

Page 2 - 11 AT8402 CLI Reference Manual

Switching Commands AT8402

If 0 (defined as the default CIST ID) is passed as the <mstid>, this command sets the
Bridge Priority parameter for the common and internal spanning tree to the default
value.

Format

spanning-tree mst priority <mstid>

Mode Global Config

2.2.14 spanning-tree mst vlan

This command adds an association between a multiple spanning tree instance and a
VLAN so that the VLAN is no longer associated with the common and internal
spanning tree. The parameter
existing multiple spanning tree instance. The
VLAN ID.

Format

spanning-tree mst vlan <mstid> <vlanid>

Mode Global Config

2.2.14.1 no spanning-tree mst vlan

This command removes an association between a multiple spanning tree instance and a
VLAN so that the VLAN is again be associated with the common and internal
spanning tree. The parameter
existing multiple spanning tree instance. The
VLAN ID.

Format

no spanning-tree mst vlan <mstid> <vlanid>

<mstid> is a number that corresponds to the desired

<vlanid> corresponds to an existing

<mstid> is a number that corresponds to the desired

<vlanid> corresponds to an existing

Mode Global Config

2.2.15 spanning-tree port mode

This command sets the Administrative Switch Port State for this port to enabled.

Default disabled

Format

spanning-tree port mode

Mode Interface Config

2.2.15.1 no spanning-tree port mode

This command sets the Administrative Switch Port State for this port to disabled.

Format

no spanning-tree port mode

Mode Interface Config

2.2.16 spanning-tree port mode all

This command sets the Administrative Switch Port State for all ports to enabled.

Default disabled

Format

Mode Global Config

spanning-tree port mode all

AT8402 CLI Reference Manual Page 2 - 12

AT8402 Switching Commands

2.2.16.1 no spanning-tree port mode all

This command sets the Administrative Switch Port State for all ports to disabled.

Format

Mode Global Config

no spanning-tree port mode all

2.2.17 show spanning-tree

This command displays spanning tree settings for the common and internal spanning
tree. The following details are displayed.

Format

Modes Privileged EXEC

Bridge Priority Specifies the bridge priority for the Common and Internal Spanning

Bridge Identifier The bridge identifier for the CST. It is made up using the bridge pri-

Time Since Topology Change Time in seconds.

Topology Change Count Number of times changed.

Topology Change Boolean value of the Topology Change parameter for the switch

show spanning-tree

User EXEC

tree (CST). The value lies between 0 and 61440. It is displayed in mul­tiples of 4096.

ority and the base MAC address of the bridge.

indicating if a topology change is in progress on any port assigned to
the common and internal spanning tree.

Designated Root The bridge identifier of the root bridge. It is made up from the

bridge priority and the base MAC address of the bridge.

Root Path Cost Value of the Root Path Cost parameter for the common and internal

spanning tree.

Root Port Identifier Identifier of the port to access the Designated Root for the CST.

Root Port Max Age Derived value.

Root Port Bridge Forward Delay Derived value.

Hello Time Configured value of the parameter for the CST.

Bridge Hold Time Minimum time between transmission of Configuration Bridge

Protocol Data Units (BPDUs)

Bridge Max Hops

CST Regional Root Bridge Identifier of the CST Regional Root. It is made up using

Regional Root Path Cost Path Cost to the CST Regional Root.

Associated FIDs List of forwarding database identifiers currently associated with this

Associated VLANs List of VLAN IDs currently associated with this instance.

Bridge max-hops count for the device.

the bridge priority and the base MAC address of the bridge.

instance.

Page 2 - 13 AT8402 CLI Reference Manual

Switching Commands AT8402

2.2.18 show spanning-tree brief

This command displays spanning tree settings for the bridge. The following
information appears.

Format

Modes Privileged EXEC

Bridge Priority Configured value.

Bridge Identifier The bridge identifier for the selected MST instance. It is made up

Bridge Max Age Configured value.

Bridge Max Hops Bridge max-hops count for the device.

Bridge Hello Time Configured value.

Bridge Forward Delay Configured value.

Bridge Hold Time Minimum time between transmission of Configuration Bridge

show spanning-tree brief

User EXEC

using the bridge priority and the base MAC address of the bridge.

Protocol Data Units (BPDUs)

2.2.19 show spanning-tree interface

This command displays the settings and parameters for a specific switch port within
the common and internal spanning tree. The
following details are displayed on execution of the command.

Format

show spanning-tree interface <slot/port>

<slot/port> is the desired switch port. The

Modes Privileged EXEC

User EXEC

Hello Time Admin hello time for this port.

Port mode Enabled or disabled.

Port Up Time Since Counters Last Cleared Time since port was reset, displayed in

days, hours, minutes, and seconds.

STP BPDUs Transmitted Spanning Tree Protocol Bridge Protocol Data Units sent

STP BPDUs Received Spanning Tree Protocol Bridge Protocol Data Units received.

RST BPDUs Transmitted Rapid Spanning Tree Protocol Bridge Protocol Data Units

sent

RST BPDUs Received Rapid Spanning Tree Protocol Bridge Protocol Data Units

received.

MSTP BPDUs Transmitted Multiple Spanning Tree Protocol Bridge Protocol Data

Units sent

MSTP BPDUs Received Multiple Spanning Tree Protocol Bridge Protocol Data

Units received.

AT8402 CLI Reference Manual Page 2 - 14

AT8402 Switching Commands

2.2.20 show spanning-tree mst port detailed

This command displays the detailed settings and parameters for a specific switch port
within a particular multiple spanning tree instance. The parameter
that corresponds to the desired existing multiple spanning tree instance. The
port> is the desired switch port.

<mstid> is a number

<slot/

Format

show spanning-tree mst port detailed <mstid> <slot/port>

Mode Privileged EXEC

User EXEC

MST Instance ID The ID of the existing MST instance.

Port Identifier The port identifier for the specified port within the selected MST

instance. It is made up from the port priority and the interface number
of the port.

Port Priority The priority for a particular port within the selected MST instance.

The port priority is displayed in multiples of 16.

Port Forwarding State Current spanning tree state of this port.

Port Role Each enabled MST Bridge Port receives a Port Role for each spanning

tree. The port role is one of the following values: Root Port, Desig­nated Port, Alternate Port, Backup Port, Master Port or Disabled Port

Auto-Calculate Port Path Cost Indicates whether auto calculation for port path cost

is enabled.

Port Path Cost Configured value of the Internal Port Path Cost parameter.

Auto-Calculate External Port Path Cost Indicates whether auto calculation for

external port path cost is enabled.

External Port Path Cost Configured value of the external Port Path Cost parameter.

Designated Root The Identifier of the designated root for this port.

Designated Port Cost Path Cost offered to the LAN by the Designated Port

Designated Bridge

Bridge Identifier of the bridge with the Designated Port.

Designated Port Identifier Port on the Designated Bridge that offers the lowest cost

to the LAN.

If you specify 0 (defined as the default CIST ID) as the

<mstid>, this command

displays the settings and parameters for a specific switch port within the common and
internal spanning tree. The

<slot/port> is the desired switch port. In this case, the

following are displayed.

Port Identifier The port identifier for this port within the CST.

Port Priority The priority of the port within the CST.

Port Forwarding State The forwarding state of the port within the CST.

Port Role The role of the specified interface within the CST.

Port Path Cost The configured path cost for the specified interface.

Designated Root Identifier of the designated root for this port within the CST.

Designated Port Cost Path Cost offered to the LAN by the Designated Port.

Page 2 - 15 AT8402 CLI Reference Manual

Switching Commands AT8402

Designated Bridge The bridge containing the designated port

Designated Port Identifier Port on the Designated Bridge that offers the lowest cost

to the LAN

Topology Change Acknowledgement Value of flag in next Configuration Bridge

Protocol Data Unit (BPDU) transmission indicating if a topology
change is in progress for this port.

Hello Time The hello time in use for this port.

Edge Port The configured value indicating if this port is an edge port.

Edge Port Status The derived value of the edge port status. True if operating as an

edge port; false otherwise.

Point To Point MAC Status Derived value indicating if this port is part of a point to

point link

CST Regional Root The regional root identifier in use for this port.

CST Port Cost The configured path cost for this port.

.

2.2.21 show spanning-tree mst port summary

This command displays the settings of one or all ports within the specified multiple
spanning tree instance. The parameter
The parameter {

<slot/port> | all} indicates the desired switch port or all ports.

If you specify 0 (defined as the default CIST ID) as the
displays for one or all ports within the common and internal spanning tree.

Format

show spanning-tree mst port summary <mstid> {<slot/port> |

all}

Modes Privileged EXEC

User EXEC

MST Instance ID The MST instance associated with this port.

Interface Valid slot and port number separated by forward slashes.

Type Currently not used.

STP State The forwarding state of the port in the specified spanning tree instance

Port Role The role of the specified port within the spanning tree.

Link Status The operational status of the link. Possible values are “Up” or

“Down”.

Link Trap The link trap configuration for the specified interface.

<mstid> indicates a particular MST instance.

<mstid>, the status summary

2.2.22 show spanning-tree mst summary

This command displays summary information about all multiple spanning tree
instances in the switch. On execution, the following details are displayed.

Format

Modes Privileged EXEC

AT8402 CLI Reference Manual Page 2 - 16

show spanning-tree mst summary

User EXEC

AT8402 Switching Commands

MST Instance ID List List of multiple spanning trees IDs currently configured.

For each MSTID:

Associated FIDs List of forwarding database identifiers associated with this instance.

Associated VLANs List of VLAN IDs associated with this instance.

2.2.23 show spanning-tree summary

This command displays spanning tree settings and parameters for the switch. The
following details are displayed on execution of the command.

Format

Modes Privileged EXEC

Spanning Tree Adminmode Enabled or disabled.

Spanning Tree Version Version of 802.1 currently supported (IEEE 802.1s, IEEE

Configuration Name Identifier used to identify the configuration currently being

Configuration Revision Level Identifier used to identify the configuration currently

Configuration Digest Key Identifier used to identify the configuration currently

MST Instances List of all multiple spanning tree instances configured on the switch

show spanning-tree summary

User EXEC

802.1w, or IEEE 802.1d) based upon the Force Protocol Version
parameter.

used.

being used.

being used.

2.2.24 show spanning-tree vlan

This command displays the association between a VLAN and a multiple spanning tree
instance. The

Format

<vlanid> corresponds to an existing VLAN ID.

show spanning-tree vlan <vlanid>

Modes Privileged EXEC

User EXEC

VLAN Identifier The VLANs associated with the selected MST instance.

Associated Instance Identifier for the associated multiple spanning tree instance or

“CST” if associated with the common and internal spanning tree.

2.3 VLAN Commands

This section describes the commands you use to configure VLAN settings.

2.3.1 vlan database

This command gives you access to the VLAN Config mode, which allows you to
configure VLAN characteristics.

Format

vlan database

Page 2 - 17 AT8402 CLI Reference Manual

Switching Commands AT8402

Mode Privileged EXEC

2.3.2 network mgmt_vlan

This command configures the Management VLAN ID.

Default 1

Format

network mgmt_vlan <1-4069>

Mode Privileged EXEC

2.3.2.1 no network mgmt_vlan

This command sets the Management VLAN ID to the default.

Format

no network mgmt_vlan

Mode Privileged EXEC

2.3.3 vlan

This command creates a new VLAN and assigns it an ID. The ID is a valid VLAN
identification number (ID 1 is reserved for the default VLAN). VLAN range is 2-4094.

Format

vlan <2-4094>

Mode VLAN Config

2.3.3.1 no vlan

This command deletes an existing VLAN. The ID is a valid VLAN identification
number (ID 1 is reserved for the default VLAN). The VLAN range is 2-4094.

Format

no vlan <2-4094>

Mode VLAN Config

2.3.4 vlan acceptframe

This command sets the frame acceptance mode per interface. For VLAN Only mode,
untagged frames or priority frames received on this interface are discarded. For Admit
All mode, untagged frames or priority frames received on this interface are accepted
and assigned the value of the interface VLAN ID for this port. With either option,
VLAN tagged frames are forwarded in accordance with the IEEE 802.1Q VLAN
Specification.

Default all

Format

vlan acceptframe {vlanonly | all}

Mode Interface Config

2.3.4.1 no vlan acceptframe

This command resets the frame acceptance mode for the interface to the default value.

Format

Mode Interface Config

no vlan acceptframe

AT8402 CLI Reference Manual Page 2 - 18

AT8402 Switching Commands

2.3.5 vlan ingressfilter

This command enables ingress filtering. If ingress filtering is disabled, frames received
with VLAN IDs that do not match the VLAN membership of the receiving interface
are admitted and forwarded to ports that are members of that VLAN.

Default disabled

Format

vlan ingressfilter

Mode Interface Config

2.3.5.1 no vlan ingressfilter

This command disables ingress filtering. If ingress filtering is disabled, frames
received with VLAN IDs that do not match the VLAN membership of the receiving
interface are admitted and forwarded to ports that are members of that VLAN.

Format

no vlan ingressfilter

Mode Interface Config

2.3.6 vlan makestatic

This command changes a dynamically created VLAN (one that is created by GVRP
registration) to a static VLAN (one that is permanently configured and defined). The
ID is a valid VLAN identification number. VLAN range is 2-4094.

Format

vlan makestatic <2-4094>

Mode VLAN Config

2.3.7 vlan name

This command changes the name of a VLAN. The name is an alphanumeric string of
up to 32 characters, and the ID is a valid VLAN identification number. ID range is 1-

4094.

Default VLAN ID 1 - default

other VLANS - blank string

Format

vlan name <2-4094> <name>

Mode VLAN Config

2.3.7.1 no vlan name

This command sets the name of a VLAN to a blank string.

Format

no vlan name <2-4094>

Mode VLAN Config

2.3.8 vlan participation

This command configures the degree of participation for a specific interface in a
VLAN. The ID is a valid VLAN identification number, and the interface is a valid
interface number

Format vlan participation {exclude | include | auto} <1-4094>

.

Page 2 - 19 AT8402 CLI Reference Manual

Switching Commands AT8402

Mode Interface Config

Participation options are:

include The interface is always a member of this VLAN. This is equivalent to

registration fixed.

exclude The interface is never a member of this VLAN. This is equivalent to

registration forbidden.

auto The interface is dynamically registered in this VLAN by GVRP. The

interface will not participate in this VLAN unless a join request is
received on this interface. This is equivalent to registration normal.

2.3.9 vlan participation all

This command configures the degree of participation for all interfaces in a VLAN. The
ID is a valid VLAN identification number. You can use the following participation
options:

• include—The interface is always a member of this VLAN. This is equivalent to
registration fixed.

• exclude—The interface is never a member of this VLAN. This is equivalent to reg­istration forbidden.

• auto—The interface is dynamically registered in this VLAN by GVRP. The inter­face will not participate in this VLAN unless a join request is received on this
interface. This is equivalent to registration normal.

Format

Mode Global Config

vlan participation all {exclude | include | auto} <1-4094>

2.3.10 vlan port acceptframe all

This command sets the frame acceptance mode for all interfaces. The modes defined as
follows:

• VLAN Only mode - Untagged frames or priority frames received on this interface
are discarded.

• Admit All mode - Untagged frames or priority frames received on this interface are
accepted and assigned the value of the interface VLAN ID for this port.

With either option, VLAN tagged frames are forwarded in accordance with the IEEE

802.1Q VLAN Specification.

Default all

Format

Mode Global Config

vlan port acceptframe all {vlanonly | all}

2.3.10.1 no vlan port acceptframe all

This command sets the frame acceptance mode for all interfaces to Admit All. For
Admit All mode, untagged frames or priority frames received on this interface are
accepted and assigned the value of the interface VLAN ID for this port. With either
option, VLAN tagged frames are forwarded in accordance with the IEEE 802.1Q
VLAN Specification.

AT8402 CLI Reference Manual Page 2 - 20

AT8402 Switching Commands

Format no vlan port acceptframe all

Mode Global Config

2.3.11 vlan port ingressfilter all

This command enables ingress filtering for all ports. If ingress filtering is disabled,
frames received with VLAN IDs that do not match the VLAN membership of the
receiving interface are admitted and forwarded to ports that are members of that
VLAN.

Default disabled

Format

vlan port ingressfilter all

Mode Global Config

2.3.11.1 no vlan port ingressfilter all

This command disables ingress filtering for all ports. If ingress filtering is disabled,
frames received with VLAN IDs that do not match the VLAN membership of the
receiving interface are admitted and forwarded to ports that are members of that
VLAN.

Format

no vlan port ingressfilter all

Mode Global Config

2.3.12 vlan port pvid all

This command changes the VLAN ID for all interface.

Default 1

Format

vlan port pvid all <1-4094>

Mode Global Config

2.3.12.1 no vlan port pvid all

This command sets the VLAN ID for all interfaces to 1.

Format

no vlan port pvid all

Mode Global Config

2.3.13 vlan port tagging all

This command configures the tagging behavior for all interfaces in a VLAN to
enabled. If tagging is enabled, traffic is transmitted as tagged frames. If tagging is
disabled, traffic is transmitted as untagged frames. The ID is a valid VLAN
identification number.

Format

Mode Global Config

vlan port tagging all <1-4094>

Page 2 - 21 AT8402 CLI Reference Manual

Switching Commands AT8402

2.3.13.1 no vlan port tagging all

This command configures the tagging behavior for all interfaces in a VLAN to
disabled. If tagging is disabled, traffic is transmitted as untagged frames. The ID is a
valid VLAN identification number.

Format

no vlan port tagging all

Mode Global Config

2.3.14 vlan protocol group

This command adds protocol-based VLAN groups to the system. The <groupName> is
a character string of 1 to 16 characters. When it is created, the protocol group will be
assigned a unique number that will be used to identify the group in subsequent
commands.

Format

vlan protocol group <groupname>

Mode Global Config

2.3.15 vlan protocol group add protocol

This command adds the <protocol> to the protocol-based VLAN identified by

<groupid>. A group may have more than one protocol associated with it. Each

interface and protocol combination can only be associated with one group. If adding a
protocol to a group causes any conflicts with interfaces currently associated with the
group, this command fails and the protocol is not added to the group. The possible
values for protocol are

NOTE: FASTPATH software supports IPv4 protocol-based VLANs.

ip, arp, and ipx.

Default none

Format

vlan protocol group add protocol <groupid> <protocol>

Mode Global Config

2.3.15.1 no vlan protocol group add protocol

This command removes the <protocol> from this protocol-based VLAN group that is
identified by this <

Format

groupid>. The possible values for protocol are ip, arp, and ipx.

no vlan protocol group add protocol <groupid> <protocol>

Mode Global Config

2.3.16 vlan protocol group remove

This command removes the protocol-based VLAN group that is identified by this

<groupid>.

Format

Mode Global Config

vlan protocol group remove <groupid>

AT8402 CLI Reference Manual Page 2 - 22

AT8402 Switching Commands

2.3.17 protocol group

This command attaches a <vlanid> to the protocol-based VLAN identified by

<groupid>. A group may only be associated with one VLAN at a time, however the

VLAN association can be changed.

The referenced VLAN should be created prior to the creation of the protocol-based
VLAN except when GVRP is expected to create the VLAN.

Default none

Format

protocol group <groupid> <vlanid>

Mode VLAN Config

2.3.17.1 no protocol group

This command removes the <vlanid> from this protocol-based VLAN group that is
identified by this

Format

<groupid>.

no protocol group <groupid> <vlanid>

Mode VLAN Config

2.3.18 protocol vlan group

This command adds the physical interface to the protocol-based VLAN identified by

<groupid>. You can associate multiple interfaces with a group, but you can only

associate each interface and protocol combination with one group. If adding an
interface to a group causes any conflicts with protocols currently associated with the
group, this command fails and the interface(s) are not added to the group.

You should create the referenced VLAN before you create the protocol-based VLAN
except when you configure GVRP to create the VLAN.

Default none

Format

protocol vlan group <groupid>

Mode Interface Config

2.3.18.1 no protocol vlan group

This command removes the interface from this protocol-based VLAN group that is
identified by this

Format

<groupid>.

no protocol vlan group <groupid>

Mode Interface Config

2.3.19 protocol vlan group all

This command adds all physical interfaces to the protocol-based VLAN identified by

<groupid>. You can associate multiple interfaces with a group, but you can only

associate each interface and protocol combination with one group. If adding an
interface to a group causes any conflicts with protocols currently associated with the
group, this command will fail and the interface(s) will not be added to the group.

Page 2 - 23 AT8402 CLI Reference Manual

Switching Commands AT8402

You should create the referenced VLAN before you create the protocol-based VLAN
except when you configure GVRP to create the VLAN.

Default none

Format

protocol vlan group all <groupid>

Mode Global Config

2.3.19.1 no protocol vlan group all

This command removes all interfaces from this protocol-based VLAN group that is
identified by this

Format

<groupid>.

no protocol vlan group all <groupid>

Mode Global Config

2.3.20 vlan pvid

This command changes the VLAN ID per interface.

Default 1

Format

vlan pvid <1-4094>

Mode Interface Config

2.3.20.1 no vlan pvid

This command sets the VLAN ID per interface to 1.

Format

no vlan pvid

Mode Interface Config

2.3.21 vlan tagging

This command configures the tagging behavior for a specific interface in a VLAN to
enabled. If tagging is enabled, traffic is transmitted as tagged frames. If tagging is
disabled, traffic is transmitted as untagged frames. The ID is a valid VLAN
identification number.

Format

vlan tagging <1-4094>

Mode Interface Config

2.3.21.1 no vlan tagging

This command configures the tagging behavior for a specific interface in a VLAN to
disabled. If tagging is disabled, traffic is transmitted as untagged frames. The ID is a
valid VLAN identification number.

Format

no vlan tagging <1-4094>

Mode Interface Config

2.3.22 vlan association subnet

This command associates a VLAN to a specific IP-subnet.

AT8402 CLI Reference Manual Page 2 - 24

AT8402 Switching Commands

Format vlan association subnet <ipaddr> <netmask> <vlanid>

Mode VLAN Config

2.3.22.1 no vlan association subnet

This command removes association of a specific IP-subnet to a VLAN.

Format

Mode VLAN Config

no vlan association subnet <ipaddr> <netmask>

2.3.23 vlan association mac

This command associates a MAC address to a VLAN.

Format

Mode VLAN database

vlan association mac <macaddr> <vlanid>

2.3.23.1 no vlan association mac

This command removes the association of a MAC address to a VLAN.

Format

Mode VLAN database

no vlan association mac <macaddr>

2.3.24 show vlan

This command displays detailed information, including interface information, for a
specific VLAN. The ID is a valid VLAN identification number.

Format

Modes Privileged EXEC

show vlan <vlanid>

User EXEC

VLAN ID There is a VLAN Identifier (VID) associated with each VLAN. The

range of the VLAN ID is 1 to 4094.

VLAN Name A string associated with this VLAN as a convenience. It can be up to

32 alphanumeric characters long, including blanks. The default is
blank. VLAN ID 1 always has a name of “Default.” This field is
optional.

VLAN Type Type of VLAN, which can be Default (VLAN ID = 1) or static (one

that is configured and permanently defined), or Dynamic (one that is
created by GVRP registration).

Interface Valid slot and port number separated by forward slashes. It is possible

to set the parameters for all ports by using the selectors on the top line.

Current The degree of participation of this port in this VLAN. The permissible

values are:
Include - This port is always a member of this VLAN. This is equiva-

lent to registration fixed in the IEEE 802.1Q standard.
Exclude - This port is never a member of this VLAN. This is equiva-

lent to registration forbidden in the IEEE 802.1Q standard.

Page 2 - 25 AT8402 CLI Reference Manual

Switching Commands AT8402

Autodetect - To allow the port to be dynamically registered in this
VLAN via GVRP. The port will not participate in this VLAN unless a
join request is received on this port. This is equivalent to registration
normal in the IEEE 802.1Q standard.

Configured The configured degree of participation of this port in this VLAN. The

permissible values are:
Include - This port is always a member of this VLAN. This is equiva-

lent to registration fixed in the IEEE 802.1Q standard.
Exclude - This port is never a member of this VLAN. This is equiva-

lent to registration forbidden in the IEEE 802.1Q standard.
Autodetect - To allow the port to be dynamically registered in this

VLAN via GVRP. The port will not participate in this VLAN unless a
join request is received on this port. This is equivalent to registration
normal in the IEEE 802.1Q standard.

Tag gin g The tagging behavior for this port in this VLAN.

Tag ged - Transmit traffic for this VLAN as tagged frames.
Untagged - Transmit traffic for this VLAN as untagged frames.

2.3.25 show vlan brief

This command displays a list of all configured VLANs.

Format

Modes Privileged EXEC

VLAN ID There is a VLAN Identifier (vlanid) associated with each VLAN. The

VLAN Name A string associated with this VLAN as a convenience. It can be up to

VLAN Type Type of VLAN, which can be Default (VLAN ID = 1) or static (one

show vlan brief

User EXEC

range of the VLAN ID is 1 to 4094.

32 alphanumeric characters long, including blanks. The default is
blank. VLAN ID 1 always has a name of “Default.” This field is
optional.

that is configured and permanently defined), or a Dynamic (one that is
created by GVRP registration).

2.3.26 show vlan port

This command displays VLAN port information.

Format

Modes Privileged EXEC

show vlan port {<slot/port> | all}

User EXEC

Interface Valid slot and port number separated by forward slashes. It is possible

to set the parameters for all ports by using the selectors on the top line.

Port VLAN ID The VLAN ID that this port will assign to untagged frames or priority

tagged frames received on this port. The value must be for an existing
VLAN. The factory default is 1.

AT8402 CLI Reference Manual Page 2 - 26

AT8402 Switching Commands

Acceptable Frame Types The types of frames that may be received on this port. The

options are 'VLAN only' and 'Admit All'. When set to 'VLAN only',
untagged frames or priority tagged frames received on this port are
discarded. When set to 'Admit All', untagged frames or priority tagged
frames received on this port are accepted and assigned the value of the
Port VLAN ID for this port. With either option, VLAN tagged frames
are forwarded in accordance to the 802.1Q VLAN specification.

Ingress Filtering May be enabled or disabled. When enabled, the frame is discarded

if this port is not a member of the VLAN with which this frame is
associated. In a tagged frame, the VLAN is identified by the VLAN ID
in the tag. In an untagged frame, the VLAN is the Port VLAN ID spec­ified for the port that received this frame. When disabled, all frames
are forwarded in accordance with the 802.1Q VLAN bridge specifica­tion. The factory default is disabled.

GVRP

Default Priority The 802.1p priority assigned to tagged packets arriving on the port.

May be enabled or disabled.

2.3.27 show vlan association subnet

This command displays the VLAN associated with a specific configured IP-Address
and net mask. If no IP address and net mask are specified, the VLAN associations of all
the configured IP-subnets are displayed.

Format

Mode Privileged EXEC

IP Address The IP address assigned to each interface.

Net Mask The subnet mask

VLAN ID There is a VLAN Identifier (VID) associated with each VLAN.

show vlan association subnet [<ipaddr> <netmask>]

2.3.28 show vlan association mac

This command displays the VLAN associated with a specific configured MAC
address. If no MAC address is specified, the VLAN associations of all the configured
MAC addresses are displayed.

Format

show vlan association mac [<macaddr>]

Mode Privileged EXEC

Mac Address

A MAC address for which the switch has forwarding and or fil­tering information. The format is 6 or 8 two-digit hexadecimal
numbers that are separated by colons, for example
01:23:45:67:89:AB. In an IVL system the MAC address will be
displayed as 8 bytes.

VLAN ID There is a VLAN Identifier (VID) associated with each VLAN.

Page 2 - 27 AT8402 CLI Reference Manual

Switching Commands AT8402

2.4 Double VLAN Commands

This section describes the commands you use to configure double VLAN (DVLAN).
Double VLAN tagging is a way to pass VLAN traffic from one customer domain to
another through a Metro Core in a simple and cost effective manner. The additional tag
on the traffic helps differentiate between customers in the MAN while preserving the
VLAN identification of the individual customers when they enter their own 802.1Q
domain.

2.4.1 dvlan-tunnel ethertype

This command configures the ether-type for all interfaces. The ether-type may have the
values of
value of the custom ether type must be set to a value from 0 to 65535.

Default vman

802.1Q, vMAN, or custom. If the ether-type has a value of custom, the optional

Format

Mode Global Config

dvlan-tunnel ethertype {802.1Q | vman | custom} [0-65535]

2.4.2 mode dot1q-tunnel

This command is used to enable Double VLAN Tunneling on the specified interface.

Default disabled

Format

Mode Interface Config

mode dot1q-tunnel

2.4.2.1 no mode dot1q-tunnel

This command is used to disable Double VLAN Tunneling on the specified interface.
By default, Double VLAN Tunneling is disabled.

Format

Mode Interface Config

no mode dot1q-tunnel

2.4.3 mode dvlan-tunnel

Use this command to enable Double VLAN Tunneling on the specified interface.

NOTE: When you use the

becomes a service provider port. Ports that do not have double VLAN
tunneling enabled are customer ports.

mode dvlan-tunnel command on an interface, it

Default disabled

Format

Mode Interface Config

mode dvlan-tunnel

2.4.3.1 no mode dvlan-tunnel

This command is used to disable Double VLAN Tunneling on the specified interface.
By default, Double VLAN Tunneling is disabled.

AT8402 CLI Reference Manual Page 2 - 28

AT8402 Switching Commands

Format no mode dvlan-tunnel

Mode Interface Config

2.4.4 show dot1q-tunnel

Use this command without the optional parameters to display all interfaces enabled for
Double VLAN Tunneling. Use the optional parameters to display detailed information
about Double VLAN Tunneling for the specified interface or all interfaces.

Format

Modes Privileged EXEC

Interface Valid slot and port number separated by forward slashes.

Mode The administrative mode through which Double VLAN Tunneling can

EtherType A 2-byte hex EtherType to be used as the first 16 bits of the DVLAN

show dot1q-tunnel [interface {<slot/port> | all}]

User EXEC

be enabled or disabled. The default value for this field is disabled.

tunnel. There are three different EtherType tags. The first is 802.1Q,
which represents the commonly used value of 0x8100. The second is
vMAN, which represents the commonly used value of 0x88A8. If
EtherType is not one of these two values, then it is a custom tunnel
value, representing any value in the range of 0 to 65535.

2.4.5 show dvlan-tunnel

Use this command without the optional parameters to display all interfaces enabled for
Double VLAN Tunneling. Use the optional parameters to display detailed information
about Double VLAN Tunneling for the specified interface or all interfaces.

Format

Modes Privileged EXEC

show dvlan-tunnel [interface {<slot/port> | all}]

User EXEC

Interface Valid slot and port number separated by forward slashes.

Mode The administrative mode through which Double VLAN Tunneling can

be enabled or disabled. The default value for this field is disabled.

EtherType A 2-byte hex EtherType to be used as the first 16 bits of the DVLAN

tunnel. There are three different EtherType tags. The first is 802.1Q,
which represents the commonly used value of 0x8100. The second is
vMAN, which represents the commonly used value of 0x88A8. If
EtherType is not one of these two values, then it is a custom tunnel
value, representing any value in the range of 0 to 65535.

2.5 Provisioning (IEEE 802.1p) Commands

This section describes the commands you use to configure provisioning, which allows
you to prioritize ports.

Page 2 - 29 AT8402 CLI Reference Manual

Switching Commands AT8402

2.5.1 vlan port priority all

This command configures the port priority assigned for untagged packets for all ports
presently plugged into the device. The range for the priority is 0-7. Any subsequent per
port configuration will override this configuration setting.

Format

Mode Global Config

vlan port priority all <priority>

2.5.2 vlan priority

This command configures the default 802.1p port priority assigned for untagged
packets for a specific interface. The range for the priority is 0-7

Default 0

Format

Mode Interface Config

vlan priority <priority>

2.6 Protected Ports Commands

This section describes commands you use to configure and view protected ports on a
switch. Protected ports do not forward traffic to each other, even if they are on the same
VLAN. However, protected ports can forward traffic to all unprotected ports in their
group. Unprotected ports can forward traffic to both protected and unprotected ports.
Ports are unprotected by default.

If an interface is configured as a protected port, and you add that interface to a Port
Channel or Link Aggregation Group (LAG), the protected port status becomes
operationally disabled on the interface, and the interface follows the configuration of
the LAG port. However, the protected port configuration for the interface remains
unchanged. Once the interface is no longer a member of a LAG, the current
configuration for that interface automatically becomes effective.

2.6.1 switchport protected (Global Config)

Use this command to create a protected port group. The <groupid> parameter
identifies the set of protected ports. Use the
protected port group. The name can be up to 32 alphanumeric characters long,
including blanks. The default is blank.

NOTE: Port protection occurs within a single switch. Protected port configura-

tion does not affect traffic between ports on two different switches. No
traffic forwarding is possible between two protected ports.

Default unprotected

Format

Mode Global Config

AT8402 CLI Reference Manual Page 2 - 30

switchport protected <groupid> [name <name>]

name <name> pair to assign a name to the

AT8402 Switching Commands

2.6.1.1 no switchport protected (Global Config)

Use this command to remove a protected port group. The groupid parameter identifies
the set of protected ports. Use the

name keyword to remove the name from the group.

Format

no switchport protected <groupid> [name]

Mode Global Config

2.6.2 switchport protected (Interface Config)

Use this command to add an interface to a protected port group. The <groupid>
parameter identifies the set of protected ports to which this interface is assigned. You
can only configure an interface as protected in one group.

NOTE: Port protection occurs within a single switch. Protected port configura-

tion does not affect traffic between ports on two different switches. No
traffic forwarding is possible between two protected ports.

Default unprotected

Format

switchport protected <groupid>

Mode Interface Config

2.6.2.1 no switchport protected (Interface Config)

Use this command to configure a port as unprotected. The groupid parameter
identifies the set of protected ports to which this interface is assigned.

Format

no switchport protected <groupid>

Mode Interface Config

2.6.3 show switchport protected

This command displays the status of all the interfaces, including protected and
unprotected interfaces.

Format

show switchport protected <groupid>

Modes Privileged EXEC

User EXEC

Group ID The number that identifies the protected port group.

Name An optional name of the protected port group. The name can be up to

32 alphanumeric characters long, including blanks. The default is
blank.

List of Physical Ports List of ports, which are configured as protected for the group

identified with

<groupid>. If no port is configured as protected for

this group, this field is blank.

2.6.4 show interfaces switchport

This command displays the status of the interface (protected/unprotected) under the
groupid.

Format

show interfaces switchport <slot/port> <groupid>

Page 2 - 31 AT8402 CLI Reference Manual

Switching Commands AT8402

Mode User EXEC

Privileged EXEC

Name A string associated with this group as a convenience. It can be up to 32

alphanumeric characters long, including blanks. The default is blank.
This field is optional.

Protected Indicates whether the interface is protected or not. It shows TRUE or

FALSE. If the group is a multiple groups then it shows TRUE in
Group

2.7 GARP Commands

This section describes the commands you use to configure Generic Attribute
Registration Protocol (GARP) and view GARP status. The commands in this section
affect both GARP VLAN Registration Protocol (GVRP) and Garp Multicast
Registration Protocol (GMRP). GARP is a protocol that allows client stations to
register with the switch for membership in VLANS (by using GVMP) or multicast
groups (by using GVMP).

<groupid>

2.7.1 set garp timer join

This command sets the GVRP join time for one port (Interface Config mode) or all
(Global Config mode) and per GARP. Join time is the interval between the
transmission of GARP Protocol Data Units (PDUs) registering (or re-registering)
membership for a VLAN or multicast group. This command has an effect only when
GVRP is enabled. The time is from 10 to 100 (centiseconds). The value 20
centiseconds is 0.2 seconds.

Default 20

Format set garp timer join <10-100>

Modes Interface Config

Global Config

2.7.1.1 no set garp timer join

This command sets the GVRP join time (for one or all ports and per GARP) to the
default and only has an effect when GVRP is enabled.

Format no set garp timer join

Modes Interface Config

Global Config

2.7.2 set garp timer leave

This command sets the GVRP leave time for one port (Interface Config mode) or all
ports (Global Config mode) and only has an effect when GVRP is enabled. Leave time
is the time to wait after receiving an unregister request for a VLAN or a multicast
group before deleting the VLAN entry. This can be considered a buffer time for
another station to assert registration for the same attribute in order to maintain
uninterrupted service. The leave time is 20 to 600 (centiseconds). The value 60
centiseconds is 0.6 seconds.

AT8402 CLI Reference Manual Page 2 - 32

AT8402 Switching Commands

Default 60

Format

set garp timer leave <20-600>

Modes Interface Config

Global Config

2.7.2.1 no set garp timer leave

This command sets the GVRP leave time on all ports or a single port to the default and
only has an effect when GVRP is enabled.

Format

no set garp timer leave

Modes Interface Config

Global Config

2.7.3 set garp timer leaveall

This command sets how frequently Leave All PDUs are generated. A Leave All PDU
indicates that all registrations will be unregistered. Participants would need to rejoin in
order to maintain registration. The value applies per port and per GARP participation.
The time may range from 200 to 6000 (centiseconds). The value 1000 centiseconds is
10 seconds. You can use this command on all ports (Global Config mode) or a single
port (Interface Config mode), and it only has an effect only when GVRP is enabled.

Default 1000

Format

set garp timer leaveall <200-6000>

Modes Interface Config

Global Config

2.7.3.1 no set garp timer leaveall

This command sets how frequently Leave All PDUs are generated the default and only
has an effect when GVRP is enabled.

Format

no set garp timer leaveall

Modes Interface Config

Global Config

2.7.4 show garp

This command displays GARP information.

Format

Modes Privileged EXEC

GMRP Admin Mode The administrative mode of GARP Multicast Registration Pro-

GVRP Admin Mode The administrative mode of GARP VLAN Registration Proto-

show garp

User EXEC

tocol (GMRP) for the system.

col (GVRP) for the system

Page 2 - 33 AT8402 CLI Reference Manual

Switching Commands AT8402

2.8 GVRP Commands

This section describes the commands you use to configure and view GARP VLAN
Registration Protocol (GVRP) information. GVRP-enabled switches exchange VLAN
configuration information, which allows GVRP to provide dynamic VLAN creation on
trunk ports and automatic VLAN pruning.

NOTE: If GVRP is disabled, the system does not forward GVRP messages.

2.8.1 set gvrp adminmode

This command enables GVRP on the system.

Default disabled

Format

Mode Privileged EXEC

set gvrp adminmode

2.8.1.1 no set gvrp adminmode

This command disables GVRP.

Format

Mode Privileged EXEC

no set gvrp adminmode

2.8.2 set gvrp interfacemode

This command enables GVRP on a single port (Interface Config mode) or all ports
(Global Config mode).

Default disabled

Format

Modes Interface Config

set gvrp interfacemode

Global Config

2.8.2.1 no set gvrp interfacemode

This command disables GVRP on a single port (Interface Config mode) or all ports
(Global Config mode). If GVRP is disabled, Join Time, Leave Time and Leave All
Time have no effect.

Format

Modes Interface Config

no set gvrp interfacemode

Global Config

2.8.3 show gvrp configuration

This command displays Generic Attributes Registration Protocol (GARP) information
for one or all interfaces.

Format

Modes Privileged EXEC

AT8402 CLI Reference Manual Page 2 - 34

show gvrp configuration {<slot/port> | all}

User EXEC

AT8402 Switching Commands

Interface Valid slot and port number separated by forward slashes.

Join Timer The interval between the transmission of GARP PDUs registering (or

re-registering) membership for an attribute. Current attributes are a
VLAN or multicast group. There is an instance of this timer on a per­Port, per-GARP participant basis. Permissible values are 10 to 100
centiseconds (0.1 to 1.0 seconds). The factory default is 20 centisec­onds (0.2 seconds). The finest granularity of specification is one centi­second (0.01 seconds).

Leave Timer The period of time to wait after receiving an unregister request for an

attribute before deleting the attribute. Current attributes are a VLAN
or multicast group. This may be considered a buffer time for another
station to assert registration for the same attribute in order to maintain
uninterrupted service. There is an instance of this timer on a per-Port,
per-GARP participant basis. Permissible values are 20 to 600 centisec­onds (0.2 to 6.0 seconds). The factory default is 60 centiseconds (0.6
seconds).

LeaveAll Timer This Leave All Time controls how frequently LeaveAll PDUs are

generated. A LeaveAll PDU indicates that all registrations will shortly
be deregistered. Participants will need to rejoin in order to maintain
registration. There is an instance of this timer on a per-Port, per-GARP
participant basis. The Leave All Period Timer is set to a random value
in the range of LeaveAllTime to 1.5*LeaveAllTime. Permissible val­ues are 200 to 6000 centiseconds (2 to 60 seconds). The factory default
is 1000 centiseconds (10 seconds).

Port GMRP Mode The GMRP administrative mode for the port, which is enabled or

disabled (default). If this parameter is disabled, Join Time, Leave Time
and Leave All Time have no effect.

2.9 GMRP Commands

This section describes the commands you use to configure and view GARP Multicast
Registration Protocol (GMRP) information. Like IGMP snooping, GMRP helps
control the flooding of multicast packets.GMRP-enabled switches dynamically register
and de-register group membership information with the MAC networking devices
attached to the same segment. GMRP also allows group membership information to
propagate across all networking devices in the bridged LAN that support Extended
Filtering Services.

NOTE: If GMRP is disabled, the system does not forward GMRP messages.

2.9.1 set gmrp adminmode

This command enables GARP Multicast Registration Protocol (GMRP) on the system.

Default disabled

Format

Mode Privileged EXEC

set gmrp adminmode

Page 2 - 35 AT8402 CLI Reference Manual

Switching Commands AT8402

2.9.1.1 no set gmrp adminmode

This command disables GARP Multicast Registration Protocol (GMRP) on the system.

Format

no set gmrp adminmode

Mode Privileged EXEC

2.9.2 set gmrp interfacemode

This command enables GARP Multicast Registration Protocol on a single interface
(Interface Config mode) or all interfaces (Global Config mode). If an interface which
has GARP enabled is enabled for routing or is enlisted as a member of a port-channel
(LAG), GARP functionality is disabled on that interface. GARP functionality is
subsequently re-enabled if routing is disabled and port-channel (LAG) membership is
removed from an interface that has GARP enabled.

Default disabled

Format

set gmrp interfacemode

Modes Interface Config

Global Config

2.9.2.1 no set gmrp interfacemode

This command disables GARP Multicast Registration Protocol on a single interface or
all interfaces. If an interface which has GARP enabled is enabled for routing or is
enlisted as a member of a port-channel (LAG), GARP functionality is disabled. GARP
functionality is subsequently re-enabled if routing is disabled and port-channel (LAG)
membership is removed from an interface that has GARP enabled.

Format

no set gmrp interfacemode

Modes Interface Config

Global Config

2.9.3 show gmrp configuration

This command displays Generic Attributes Registration Protocol (GARP) information
for one or all interfaces.

Format

Modes Privileged EXEC

Interface The slot/port

Join Timer The interval between the transmission of GARP PDUs registering (or

show gmrp configuration {<slot/port> | all}

User EXEC

of the interface that this row in the table describes.

re-registering) membership for an attribute. Current attributes are a
VLAN or multicast group. There is an instance of this timer on a per­port, per-GARP participant basis. Permissible values are 10 to 100
centiseconds (0.1 to 1.0 seconds). The factory default is 20 centisec­onds (0.2 seconds). The finest granularity of specification is 1 centi­second (0.01 seconds).

AT8402 CLI Reference Manual Page 2 - 36

AT8402 Switching Commands

Leave Timer The period of time to wait after receiving an unregister request for an

attribute before deleting the attribute. Current attributes are a VLAN
or multicast group. This may be considered a buffer time for another
station to assert registration for the same attribute in order to maintain
uninterrupted service. There is an instance of this timer on a per-Port,
per-GARP participant basis. Permissible values are 20 to 600 centisec­onds (0.2 to 6.0 seconds). The factory default is 60 centiseconds (0.6
seconds).

LeaveAll Timer This Leave All Time controls how frequently LeaveAll PDUs are

generated. A LeaveAll PDU indicates that all registrations will shortly
be deregistered. Participants will need to rejoin in order to maintain
registration. There is an instance of this timer on a per-Port, per-GARP
participant basis. The Leave All Period Timer is set to a random value
in the range of LeaveAllTime to 1.5*LeaveAllTime. Permissible val­ues are 200 to 6000 centiseconds (2 to 60 seconds). The factory default
is 1000 centiseconds (10 seconds).

Port GMRP Mode The GMRP administrative mode for the port. It may be enabled or

disabled. If this parameter is disabled, Join Time, Leave Time and
Leave All Time have no effect.

2.9.4 show mac-address-table gmrp

This command displays the GMRP entries in the Multicast Forwarding Database
(MFDB) table.

Format

Mode Privileged EXEC

Mac Address A unicast MAC address for which the switch has forwarding and or

Type The type of the entry. Static entries are those that are configured by the

Description The text description of this multicast table entry.

Interfaces The list of interfaces that are designated for forwarding (Fwd:) and fil-

show mac-address-table gmrp

filtering information. The format is 6 or 8 two-digit hexadecimal num­bers that are separated by colons, for example 01:23:45:67:89:AB. In
an IVL system the MAC address is displayed as 8 bytes.

end user. Dynamic entries are added to the table as a result of a learn­ing process or protocol.

tering (Flt:).

2.10 Port-Based Network Access Control Commands

This section describes the commands you use to configure port-based network access
control (802.1x). Port-based network access control allows you to permit access to
network services only to and devices that are authorized and authenticated.

2.10.1 authentication login

This command creates an authentication login list. The <listname> is any character
string and is not case sensitive. Up to 10 authentication login lists can be configured on

Page 2 - 37 AT8402 CLI Reference Manual

Switching Commands AT8402

the switch. When a list is created, the authentication method “local” is set as the first
method.

When the optional parameters “Option1”, “Option2” and/or “Option3” are used, an
ordered list of methods are set in the authentication login list. If the authentication
login list does not exist, a new authentication login list is first created and then the
authentication methods are set in the authentication login list. The maximum number
of authentication login methods is three. The possible method values are

radius and reject.

local,

The value of

local indicates that the user’s locally stored ID and password are used for

authentication. The value of
authenticated using the RADIUS server. The value of
never authenticated.

To authenticate a user, the first authentication method in the user’s login
(authentication login list) is attempted. FASTPATH software does not utilize multiple
entries in the user’s login. If the first entry returns a timeout, the user authentication
attempt fails.

NOTE: The default login list included with the default configuration can not

be changed.

Format

authentication login <listname> [<method1> [<method2>

[<method3>]]]

Mode Global Config

2.10.1.1 no authentication login

This command deletes the specified authentication login list. The attempt to delete fails
if any of the following conditions are true:

• The login list name is invalid or does not match an existing authentication login list

• The specified authentication login list is assigned to any user or to the non config­ured user for any component

• The login list is the default login list included with the default configuration and
was not created using ‘authentication login’. The default login list cannot be
deleted.

radius indicates that the user’s ID and password will be

reject indicates the user is

Format

no authentication login <listname>

Mode Global Config

2.10.2 clear dot1x statistics

This command resets the 802.1x statistics for the specified port or for all ports.

Format

clear dot1x statistics {<slot/port> | all}

Mode Privileged EXEC

2.10.3 clear radius statistics

This command is used to clear all RADIUS statistics.

Format

AT8402 CLI Reference Manual Page 2 - 38

clear radius statistics

AT8402 Switching Commands

Mode Privileged EXEC

2.10.4 dot1x defaultlogin

This command assigns the authentication login list to use for non-configured users for

802.1x port security. This setting is over-ridden by the authentication login list
assigned to a specific user if the user is configured locally. If this value is not
configured, users will be authenticated using local authentication only.

Format

dot1x defaultlogin <listname>

Mode Global Config

2.10.5 dot1x initialize

This command begins the initialization sequence on the specified port. This command
is only valid if the control mode for the specified port is 'auto'. If the control mode is
not 'auto' an error will be returned.

Format

dot1x initialize <slot/port>

Mode Privileged EXEC

2.10.6 dot1x login

This command assigns the specified authentication login list to the specified user for

802.1x port security. The

<listname> parameter must be a configured authentication login list.

Format

dot1x login <user> <listname>

Mode Global Config

2.10.7 dot1x max-req

This command sets the maximum number of times the authenticator state machine on
this port will transmit an EAPOL EAP Request/Identity frame before timing out the
supplicant. The

<count> value must be in the range 1 - 10.

<user> parameter must be a configured user and the

Default 2

Format

dot1x max-req <count>

Mode Interface Config

2.10.7.1 no dot1x max-req

This command sets the maximum number of times the authenticator state machine on
this port will transmit an EAPOL EAP Request/Identity frame before timing out the
supplicant.

Format

Mode Interface Config

no dot1x max-req

Page 2 - 39 AT8402 CLI Reference Manual

Switching Commands AT8402

2.10.8 dot1x port-control

This command sets the authentication mode to use on the specified port. Select force-

unauthorized

port to unauthorized. Select
unconditionally sets the controlled port to authorized. Select
authenticator PAE sets the controlled port mode to reflect the outcome of the
authentication exchanges between the supplicant, authenticator and the authentication
server.

Default auto

to specify that the authenticator PAE unconditionally sets the controlled

force-authorized to specify that the authenticator PAE

auto to specify that the

Format

dot1x port-control {force-unauthorized | force-authorized | auto}

Mode Interface Config

2.10.8.1 no dot1x port-control

This command sets the authentication mode on the specified port to the default value.

Format

no dot1x port-control

Mode Interface Config

2.10.9 dot1x port-control all

This command sets the authentication mode to use on all ports. Select force-

unauthorized

port to unauthorized. Select
unconditionally sets the controlled port to authorized. Select
authenticator PAE sets the controlled port mode to reflect the outcome of the
authentication exchanges between the supplicant, authenticator and the authentication
server.

Default auto

Format

to specify that the authenticator PAE unconditionally sets the controlled

dot1x port-control all {force-unauthorized | force-authorized |

auto}

force-authorized to specify that the authenticator PAE

auto to specify that the

Mode Global Config

2.10.9.1 no dot1x port-control all

This command sets the authentication mode on all ports to the default value.

Format

no dot1x port-control all

Mode Global Config

2.10.10 dot1x re-authenticate

This command begins the re-authentication sequence on the specified port. This
command is only valid if the control mode for the specified port is 'auto'. If the control
mode is not 'auto' an error will be returned.

Format

Mode Privileged EXEC

AT8402 CLI Reference Manual Page 2 - 40

dot1x re-authenticate <slot/port>

AT8402 Switching Commands

2.10.11 dot1x re-authentication

This command enables re-authentication of the supplicant for the specified port.

Default disabled

Format

Mode Interface Config

dot1x re-authentication

2.10.11.1 no dot1x re-authentication

This command disables re-authentication of the supplicant for the specified port.

Format

Mode Interface Config

no dot1x re-authentication

2.10.12 dot1x system-auth-control

Use this command to enable the dot1x authentication support on the switch. While
disabled, the dot1x configuration is retained and can be changed, but is not activated.

Default disabled

Format

Mode Global Config

dot1x system-auth-control

2.10.12.1 no dot1x system-auth-control

This command is used to disable the dot1x authentication support on the switch.

Format

no dot1x system-auth-control

Mode Global Config

2.10.13 dot1x timeout

This command sets the value, in seconds, of the timer used by the authenticator state
machine on this port. Depending on the token used and the value (in seconds) passed,
various timeout configurable parameters are set. The following tokens are supported.

reauth-period - The value, in seconds, of the timer used by the authenticator state
machine on this port to determine when re-authentication of the supplicant takes place.
The reauth-period must be a value in the range 1 - 65535.

quiet-period - The value, in seconds, of the timer used by the authenticator state
machine on this port to define periods of time in which it will not attempt to acquire a
supplicant. The quiet-period must be a value in the range 0 - 65535.

tx-period - The value, in seconds, of the timer used by the authenticator state machine
on this port to determine when to send an EAPOL EAP Request/Identity frame to the
supplicant. The quiet-period must be a value in the range 1 - 65535.

supp-timeout - The value, in seconds, of the timer used by the authenticator state
machine on this port to timeout the supplicant. The supp-timeout must be a value in the
range 1 - 65535.

Page 2 - 41 AT8402 CLI Reference Manual

Switching Commands AT8402

server-timeout - The value, in seconds, of the timer used by the authenticator state
machine on this port to timeout the authentication server. The supp-timeout must be a
value in the range 1 - 65535.

Default reauth-period: 3600 seconds

quiet-period: 60 seconds
tx-period: 30 seconds
supp-timeout: 30 seconds
server-timeout: 30 seconds

Format

dot1x timeout {{reauth-period <seconds>} | {quiet-period <sec-

onds>} | {tx-period <seconds>} | {supp-timeout <seconds>} |
{server-timeout <seconds>}}

Mode Interface Config

2.10.13.1 no dot1x timeout

This command sets the value, in seconds, of the timer used by the authenticator state
machine on this port to the default values. Depending on the token used, the
corresponding default values are set.

Format

no dot1x timeout {reauth-period | quiet-period | tx-period | supp-

timeout | server-timeout}

Mode Interface Config

2.10.14 dot1x user

This command adds the specified user to the list of users with access to the specified
port or all ports. The

Format

dot1x user <user> {<slot/port> | all}

Mode Global Config

2.10.14.1 no dot1x user

<user> parameter must be a configured user.

This command removes the user from the list of users with access to the specified port
or all ports.

Format

no dot1x user <user> {<slot/port> | all}

Mode Global Config

2.10.15 users defaultlogin

This command assigns the authentication login list to use for non-configured users
when attempting to log in to the system. This setting is overridden by the
authentication login list assigned to a specific user if the user is configured locally. If
this value is not configured, users will be authenticated using local authentication only.

Format

Mode Global Config

AT8402 CLI Reference Manual Page 2 - 42

users defaultlogin <listname>

AT8402 Switching Commands

2.10.16 users login

This command assigns the specified authentication login list to the specified user for
system login. The
a configured login list.

If the user is assigned a login list that requires remote authentication, all access to the
interface from all CLI, web, and telnet sessions will be blocked until the authentication
is complete.

Note that the login list associated with the ‘admin’ user can not be changed to prevent
accidental lockout from the switch.

<user> must be a configured <user> and the <listname> must be

Format

users login <user> <listname>

Mode Global Config

2.10.17 show authentication

This command displays the ordered authentication methods for all authentication login
lists.

Format

show authentication

Mode Privileged EXEC

Authentication Login List The authentication login listname.

Method 1 The first method in the specified authentication login list, if any.

Method 2 The second method in the specified authentication login list, if any.

Method 3 The third method in the specified authentication login list, if any.

2.10.18 show authentication users

This command displays information about the users assigned to the specified
authentication login list. If the login is assigned to non-configured users, the user
“default” will appear in the user column.

Format

show authentication users <listname>

Mode Privileged EXEC

User The user assigned to the specified authentication login list.

Component The component (User or 802.1x) for which the authentication login list

2.10.19 show dot1x

This command is used to show a summary of the global dot1x configuration, summary
information of the dot1x configuration for a specified port or all ports, the detailed
dot1x configuration for a specified port and the dot1x statistics for a specified port ­depending on the tokens used.

Format

Mode Privileged EXEC

is assigned.

show dot1x [{summary {<slot/port> | all} | detail <slot/port> |

statistics <

slot/port>]

Page 2 - 43 AT8402 CLI Reference Manual

Switching Commands AT8402

If you do not use any of the optional parameters, the global dot1x configuration
summary is displayed.

Administrative mode Indicates whether authentication control on the switch is

enabled or disabled.

If you use the optional parameter
configuration for the specified port or all ports are displayed.

Port The interface whose configuration is displayed.

Control Mode The configured control mode for this port. Possible values are force-

unauthorized | force-authorized | auto.

Operating Control Mode The control mode under which this port is operating. Possi-

ble values are authorized | unauthorized.

Reauthentication Enabled Indicates whether re-authentication is enabled on this

port.

Key Transmission Enabled Indicates if the key is transmitted to the supplicant for

the specified port.

If the optional parameter 'detail
for the specified port are displayed.

Port The interface whose configuration is displayed.

Protocol Version The protocol version associated with this port. The only possible

value is 1, corresponding to the first version of the dot1x specification.

PAE Capabilities The port access entity (PAE) functionality of this port. Possible val-

ues are Authenticator or Supplicant.

Authenticator PAE State Current state of the authenticator PAE state machine. Possi-

ble values are Initialize, Disconnected, Connecting, Authenticating,
Authenticated, Aborting, Held, ForceAuthorized, and ForceUnautho­rized.

summary {<slot/port> | all}, the dot1x

<slot/port>' is used, the detailed dot1x configuration

Backend Authentication State Current state of the backend authentication state

machine. Possible values are Request, Response, Success, Fail, Time­out, Idle, and Initialize.

Quiet Period The timer used by the authenticator state machine on this port to

define periods of time in which it will not attempt to acquire a suppli­cant. The value is expressed in seconds and will be in the range 0 and

65535.

Transmit Period The timer used by the authenticator state machine on the specified

port to determine when to send an EAPOL EAP Request/Identity
frame to the supplicant. The value is expressed in seconds and will be
in the range of 1 and 65535.

Supplicant Timeout The timer used by the authenticator state machine on this port to

timeout the supplicant. The value is expressed in seconds and will be
in the range of 1 and 65535.

Server Timeout The timer used by the authenticator on this port to timeout the

authentication server. The value is expressed in seconds and will be in
the range of 1 and 65535.

AT8402 CLI Reference Manual Page 2 - 44

AT8402 Switching Commands

Maximum Requests The maximum number of times the authenticator state machine

on this port will retransmit an EAPOL EAP Request/Identity before
timing out the supplicant. The value will be in the range of 1 and 10.

Reauthentication Period The timer used by the authenticator state machine on this

port to determine when reauthentication of the supplicant takes place.
The value is expressed in seconds and will be in the range of 1 and

65535.

Reauthentication Enabled Indicates if reauthentication is enabled on this port. Possi-

ble values are ‘True” or “False”.

Key Transmission Enabled Indicates if the key is transmitted to the supplicant for

the specified port. Possible values are True or False.

Control Direction The control direction for the specified port or ports. Possible val-

ues are both or in.

If you use the optional parameter
statistics for the specified port appear.

Port The interface whose statistics are displayed.

EAPOL Frames Received The number of valid EAPOL frames of any type that have

been received by this authenticator.

EAPOL Frames Transmitted The number of EAPOL frames of any type that have

been transmitted by this authenticator.

EAPOL Start Frames Received The number of EAPOL start frames that have been

received by this authenticator.

EAPOL Logoff Frames Received The number of EAPOL logoff frames that have

been received by this authenticator.

Last EAPOL Frame Version The protocol version number carried in the most

recently received EAPOL frame.

Last EAPOL Frame Source The source MAC address carried in the most recently

received EAPOL frame.

EAP Response/Id Frames Received The number of EAP response/identity frames

that have been received by this authenticator.

EAP Response Frames Received The number of valid EAP response frames (other

than resp/id frames) that have been received by this authenticator.

statistics <slot/port>, the following dot1x

EAP Request/Id Frames Transmitted The number of EAP request/identity frames

that have been transmitted by this authenticator.

EAP Request Frames Transmitted The number of EAP request frames (other than

request/identity frames) that have been transmitted by this authentica­tor.

Invalid EAPOL Frames Received The number of EAPOL frames that have been

received by this authenticator in which the frame type is not recog­nized.

EAP Length Error Frames Received The number of EAPOL frames that have been

received by this authenticator in which the frame type is not recog­nized.

Page 2 - 45 AT8402 CLI Reference Manual

Switching Commands AT8402

2.10.20 show dot1x users

This command displays 802.1x port security user information for locally configured
users.

Format

Mode Privileged EXEC

User Users configured locally to have access to the specified port.

show dot1x users <slot/port>

2.10.21 show users authentication

This command displays all user and all authentication login information. It also
displays the authentication login list assigned to the default user.

Format

Mode Privileged EXEC

User Lists every user that has an authentication login list assigned.

System Login The authentication login list assigned to the user for system login.

802.1x Port Security The authentication login list assigned to the user for 802.1x port

show users authentication

security.

2.11 Storm-Control Commands

This section describes commands you use to configure storm control and view storm­control configuration information. The Storm Control feature allows you to limit the
rate of specific types of packets through the switch on a per-port, per-type, basis. The
Storm Control feature can help maintain network performance.

2.11.1 storm-control broadcast

Use this command to enable broadcast storm recovery mode for a specific interface. If
the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast
traffic ingressing on an interface increases beyond the configured threshold, the traffic
will be dropped. Therefore, the rate of broadcast traffic will be limited to the
configured threshold.

Default disabled

Format

Mode Interface Config

storm-control broadcast

2.11.1.1 no storm-control broadcast

Use this command to disable broadcast storm recovery mode for a specific interface.

Format

Mode Interface Config

no storm-control broadcast

AT8402 CLI Reference Manual Page 2 - 46

AT8402 Switching Commands

2.11.2 storm-control broadcast level

Use this command to configure the broadcast storm recovery threshold for an interface.
When you use this command, broadcast storm recovery mode is enabled on the
interface and broadcast storm recovery is active. If the rate of L2 broadcast traffic
ingressing on an interface increases beyond the configured threshold, the traffic is
dropped. Therefore, the rate of broadcast traffic is limited to the configured threshold.

Default 5

Format

storm-control broadcast level <0-100>

Mode Interface Config

2.11.2.1 no storm-control broadcast level

This command sets the broadcast storm recovery threshold to the default value for an
interface and disables broadcast storm recovery.

Format

no storm-control broadcast level

Mode Interface Config

2.11.3 storm-control broadcast all

This command enables broadcast storm recovery mode for all interfaces. If the mode is
enabled, broadcast storm recovery is active, and if the rate of L2 broadcast traffic
ingressing on an interface increases beyond the configured threshold, the traffic will be
dropped. Therefore, the rate of broadcast traffic will be limited to the configured
threshold.

Default disabled

Format

Mode Global Config

storm-control broadcast all

2.11.3.1 no storm-control broadcast all

This command disables broadcast storm recovery mode for all interfaces.

Format

no storm-control broadcast all

Mode Global Config

2.11.4 storm-control broadcast all level

This command configures the broadcast storm recovery threshold for all interfaces. If
the mode is enabled, broadcast storm recovery is active, and if the rate of L2 broadcast
traffic ingressing on an interface increases beyond the configured threshold, the traffic
will be dropped. Therefore, the rate of broadcast traffic will be limited to the
configured threshold.This command also enables broadcast storm recovery mode for
all interfaces.

Default 5

Format

Mode Global Config

storm-control broadcast all level <0-100>

Page 2 - 47 AT8402 CLI Reference Manual

Switching Commands AT8402

2.11.4.1 no storm-control broadcast all level

This command sets the broadcast storm recovery threshold to the default value for all
interfaces and disables broadcast storm recovery.

Format

Mode Global Config

no storm-control broadcast all level

2.11.5 storm-control multicast

This command enables multicast storm recovery mode for an interface. If the mode is
enabled, multicast storm recovery is active, and if the rate of L2 multicast traffic
ingressing on an interface increases beyond the configured threshold, the traffic will be
dropped. Therefore, the rate of multicast traffic will be limited to the configured
threshold.

Default disabled

Format

Mode Interface Config

storm-control multicast

2.11.5.1 no storm-control multicast

This command disables multicast storm recovery mode for an interface.

Format

Mode Interface Config

no storm-control multicast

2.11.6 storm-control multicast level

This command configures the multicast storm recovery threshold for an interface and
enables multicast storm recovery mode. If the mode is enabled, multicast storm
recovery is active, and if the rate of L2 multicast traffic ingressing on an interface
increases beyond the configured threshold, the traffic will be dropped. Therefore, the
rate of multicast traffic will be limited to the configured threshold.

Default 5

Format

Mode Interface Config

storm-control multicast level <0-100>

2.11.6.1 no storm-control multicast level

This command sets the multicast storm recovery threshold to the default value for an
interface and disables multicast storm recovery.

Format

Mode Interface Config

no storm-control multicast level

2.11.7 storm-control multicast all

This command enables multicast storm recovery mode for all interfaces. If the mode is
enabled, multicast storm recovery is active, and if the rate of L2 multicast traffic
ingressing on an interface increases beyond the configured threshold, the traffic will be

AT8402 CLI Reference Manual Page 2 - 48

AT8402 Switching Commands

dropped. Therefore, the rate of multicast traffic will be limited to the configured
threshold.

Default disabled

Format

storm-control multicast all

Mode Global Config

2.11.7.1 no storm-control multicast all

This command disables multicast storm recovery mode for all interfaces.

Format

no storm-control multicast all

Mode Global Config

2.11.8 storm-control multicast all level

This command configures the multicast storm recovery threshold for all interfaces and
enables multicast storm recovery mode. If the mode is enabled, multicast storm
recovery is active, and if the rate of L2 multicast traffic ingressing on an interface
increases beyond the configured threshold, the traffic will be dropped. Therefore, the
rate of multicast traffic will be limited to the configured threshold.

Default 5

Format

storm-control multicast all level <0-100>

Mode Global Config

2.11.8.1 no storm-control multicast all level

This command sets the multicast storm recovery threshold to the default value for all
interfaces and disables multicast storm recovery.

Format

no storm-control multicast all level

Mode Global Config

2.11.9 storm-control unicast

This command enables unicast storm recovery mode for an interface. If the mode is
enabled, unicast storm recovery is active, and if the rate of unknown L2 unicast
(destination lookup failure) traffic ingressing on an interface increases beyond the
configured threshold, the traffic will be dropped. Therefore, the rate of unknown
unicast traffic will be limited to the configured threshold.

Default disabled

Format

storm-control unicast

Mode Interface Config

2.11.9.1 no storm-control unicast

This command disables unicast storm recovery mode for an interface.

Format

no storm-control unicast

Page 2 - 49 AT8402 CLI Reference Manual

Switching Commands AT8402

Mode Interface Config

2.11.10 storm-control unicast level

This command configures the unicast storm recovery threshold for an interface and
enables unicast storm recovery. If the mode is enabled, unicast storm recovery is
active, and if the rate of unknown L2 unicast (destination lookup failure) traffic
ingressing on an interface increases beyond the configured threshold, the traffic will be
dropped. Therefore, the rate of unknown unicast traffic will be limited to the
configured threshold.This command also enables unicast storm recovery mode for an
interface.

Default 5

Format

Mode Interface Config

storm-control unicast level <0-100>

2.11.10.1 no storm-control unicast level

This command sets the unicast storm recovery threshold to the default value for an
interface and disables unicast storm recovery.

Format

Mode Interface Config

no storm-control unicast level

2.11.11 storm-control unicast all

This command enables unicast storm recovery mode for all interfaces. If the mode is
enabled, unicast storm recovery is active, and if the rate of unknown L2 unicast
(destination lookup failure) traffic ingressing on an interface increases beyond the
configured threshold, the traffic will be dropped. Therefore, the rate of unknown
unicast traffic will be limited to the configured threshold.

Default disabled

Format

Mode Global Config

storm-control unicast all

2.11.11.1 no storm-control unicast all

This command disables unicast storm recovery mode for all interfaces.

Format

Mode Global Config

no storm-control unicast all

2.11.12 storm-control unicast all level

This command configures the unicast storm recovery threshold and enables unicast
storm recovery for all interfaces. If the mode is enabled, unicast storm recovery is
active, and if the rate of unknown L2 unicast (destination lookup failure) traffic
ingressing on an interface increases beyond the configured threshold, the traffic will be
dropped. Therefore, the rate of unknown unicast traffic will be limited to the
configured threshold.

AT8402 CLI Reference Manual Page 2 - 50

AT8402 Switching Commands

Default 5

Format

storm-control unicast all level <0-100>

Mode Global Config

2.11.12.1 no storm-control unicast all level

This command returns the unicast storm recovery threshold to the default value and
disables unicast storm recovery for all interfaces.

Format

no storm-control unicast all level

Mode Global Config

2.11.13 storm-control flowcontrol

This command enables 802.3x flow control for the switch and only applies to full­duplex mode ports.

NOTE: 802.3x flow control works by pausing a port when the port becomes

oversubscribed and dropping all traffic for small bursts of time during
the congestion condition. This can lead to high-priority and/or network
control traffic loss.

Default disabled

Format

storm-control flowcontrol

Mode Global Config

2.11.13.1 no storm-control flowcontrol

This command disables 802.3x flow control for the switch.

NOTE: This command only applies to full-duplex mode ports.

Format

no storm-control flowcontrol

Mode Global Config

2.11.14 show storm-control

This command displays switch configuration information. If you do not use any of the
optional parameters, this command displays global storm control configuration
parameters. Use the
all interfaces, or specify the slot/port to display information about a specific interface.

Format

Mode Privileged EXEC

Bcast Mode Shows whether the broadcast storm control mode is enabled or dis-

Bcast Level The broadcast storm control level.

all keyword to display the per-port configuration parameters for

show storm-control [all | <slot/port>]

abled.

Mcast Mode Shows whether the multicast storm control mode is enabled or dis-

abled.

Mcast Level The multicast storm control level.

Page 2 - 51 AT8402 CLI Reference Manual

Switching Commands AT8402

Ucast Mode Shows whether the Unknown Unicast or DLF (Destination Lookup

Failure) storm control mode is enabled or disabled.

Ucast Level The Unknown Unicast or DLF (Destination Lookup Failure) storm

control level

2.12 Port-Channel/LAG (802.3ad) Commands

This section describes the commands you use to configure port-channels, which are
also known as link aggregation groups (LAGs). Link aggregation allows you to
combine multiple full-duplex Ethernet links into a single logical link. Network devices
treat the aggregation as if it were a single link, which increases fault tolerance and
provides load sharing. The LAG feature initially load shares traffic based upon the
source and destination MAC address.Assign the port-channel (LAG) VLAN
membership after you create a port-channel. If you do not assign VLAN membership,
the port-channel might become a member of the management VLAN which can result
in learning and switching issues.

A port-channel (LAG) interface can be either static or dynamic, but not both. All
members of a port channel must participate in the same protocols.) A static port­channel interface does not require a partner system to be able to aggregate its member
ports.

NOTE: If you configure the maximum number of dynamic port-channels

(LAGs) that your platform supports, additional port-channels that you
configure are automatically static.

2.12.1 port-channel

This command configures a new port-channel (LAG) and generates a logical slot/port
number for the port-channel. The
dash “-” character as well as alphanumeric characters. Use the
command to display the slot/port number for the logical interface.

NOTE: Before you include a port in a port-channel, set the port physical

mode. For more information, see 2.1.8 “speed” on page 2 - 4.

Format

Mode Global Config

port-channel <name>

2.12.1.1 no port-channel

<name> field is a character string which allows the

show port channel

This command deletes a port-channel (LAG).

Format

Mode Global Config

no port-channel {<logical slot/port> | all}

2.12.2 addport

This command adds one port to the port-channel (LAG). The first interface is a logical
slot/port number of a configured port-channel.

AT8402 CLI Reference Manual Page 2 - 52

AT8402 Switching Commands

NOTE: Before adding a port to a port-channel, set the physical mode of the

port. For more information, see 2.1.8 “speed” on page 2 - 4.

Format

addport <logical slot/port>

Mode Interface Config

2.12.3 deleteport (Interface Config)

This command deletes the port from the port-channel (LAG). The interface is a logical
slot/port number. of a configured port-channel.

Format

deleteport <logical slot/port>

Mode Interface Config

2.12.4 deleteport (Global Config)

This command deletes all configured ports from the port-channel (LAG). The interface
is a logical slot/port number. of a configured port-channel. To clear the port channels,
see 4.5.6 “clear port-channel” on page 4 - 25

Format

deleteport {<logical slot/port> | all}

Mode Global Config

2.12.5 port-channel static

This command enables the static mode on a port-channel (LAG) interface. By default
the static mode for a new port-channel is disabled, which means the port-channel is
dynamic. However if the maximum number of allowable dynamic port-channels are
already present in the system, the static mode for a new port-channel enabled, which
means the port-channel is static.You can only use this command on port-channel
interfaces.

Default disabled

Format

port-channel static

Mode Interface Config

2.12.5.1 no port-channel static

This command sets the static mode on a particular port-channel (LAG) interface to the
default value. This command will be executed only for interfaces of type port-channel
(LAG).

Format

no port-channel static

Mode Interface Config

2.12.6 port lacpmode

This command enables Link Aggregation Control Protocol (LACP) on a port.

Default enabled

Format port lacpmode

Mode Interface Config

Page 2 - 53 AT8402 CLI Reference Manual

Switching Commands AT8402

2.12.6.1 no port lacpmode

This command disables Link Aggregation Control Protocol (LACP) on a port.

Format

no port lacpmode

Mode Interface Config

2.12.7 port lacpmode all

This command enables Link Aggregation Control Protocol (LACP) on all ports.

Format

port lacpmode all

Mode Global Config

2.12.7.1 no port lacpmode all

This command disables Link Aggregation Control Protocol (LACP) on all ports.

Format

no port lacpmode all

Mode Global Config

2.12.8 port lacp timeout (Interface Config)

This command sets the timeout on a physical interface of a particular device type
(actor or partner) to either long or short timeout.

Default long

Format

port lacp timeout {actor | partner} {long | short}

Mode Interface Config

2.12.8.1 no port lacp timeout

This command sets the timeout back to its default value on a physical interface of a
particular device type (actor or partner).

Format

no port lacp timeout {actor | partner}

Mode Interface Config

2.12.9 port lacp timeout (Global Config)

This command sets the timeout for all interfaces of a particular device type (actor or
partner) to either long or short timeout.

Default long

Format

port lacp timeout {actor | partner} {long | short}

Mode Global Config

2.12.9.1 no port lacp timeout

This command sets the timeout for all physical interfaces of a particular device type
(actor or partner) back to their default values.

Format

AT8402 CLI Reference Manual Page 2 - 54

no port lacp timeout {actor | partner}

AT8402 Switching Commands

Mode Global Config

2.12.10 port-channel adminmode

This command enables a port-channel (LAG). The option all sets every configured
port-channel with the same administrative mode setting.

Format

port-channel adminmode [all]

Mode Global Config

2.12.10.1 no port-channel adminmode

This command disables a port-channel (LAG). The option all sets every configured
port-channel with the same administrative mode setting.

Format

no port-channel adminmode [all]

Mode Global Config

2.12.11 port-channel linktrap

This command enables link trap notifications for the port-channel (LAG). The
interface is a logical slot/port for a configured port-channel. The option
configured port-channel with the same administrative mode setting.

Default enabled

Format

port-channel linktrap {<logical slot/port> | all}

Mode Global Config

2.12.11.1 no port-channel linktrap

all sets every

This command disables link trap notifications for the port-channel (LAG). The
interface is a logical slot and port for a configured port-channel. The option
every configured port-channel with the same administrative mode setting.

Format

no port-channel linktrap {<logical slot/port> | all}

Mode Global Config

2.12.12 port-channel name

This command defines a name for the port-channel (LAG). The interface is a logical
slot/port for a configured port-channel, and
characters.

Format

port-channel name {<logical slot/port> | all | <name>}

Mode Global Config

2.12.13 show port-channel brief

This command displays the static capability of all port-channel (LAG) interfaces on the
device as well as a summary of individual port-channel interfaces.

Format

show port-channel brief

all sets

<name> is an alphanumeric string up to 15

Page 2 - 55 AT8402 CLI Reference Manual

Switching Commands AT8402

Modes Privileged EXEC

User EXEC

For each port-channel the following information is displayed:

Logical Interface The slot/port of the logical interface.

Port-channel Name The name of port-channel (LAG) interface.

Link-State Shows whether the link is up or down.

Type Shows whether the port-channel is statically or dynamically main-

tained.

LACP Device Type/Timeout The timeout (long or short) for the type of device

(actor or partner)

Mbr Ports The members of this port-channel.

Active Ports The ports that are actively participating in the port-channel.

2.12.14 show port-channel

This command displays an overview of all port-channels (LAGs) on the switch.

Format

Modes Privileged EXEC

Logical Interface Valid slot and port number separated by forward slashes.

Port-Channel Name The name of this port-channel (LAG). You may enter any string

Link State Indicates whether the Link is up or down.

Admin Mode May be enabled or disabled. The factory default is enabled.

Mbr Ports A listing of the ports that are members of this port-channel (LAG), in

Device Timeout For each port, lists the timeout (long or short) for Device Type (actor
or partner)

Port Speed Speed of the port-channel port.

Type The status designating whether a particular port-channel (LAG) is stat-

show port-channel {<logical slot/port> | all}

User EXEC

of up to 15 alphanumeric characters.

slot/port notation. There can be a maximum of eight ports assigned to
a given port-channel (LAG).

ically or dynamically maintained.

Static - The port-channel is statically maintained.
Dynamic - The port-channel is dynamically maintained.

Active Ports This field lists ports that are actively participating in the port-channel

(LAG).

2.13 Port Mirroring

Port mirroring, which is also known as port monitoring, selects network traffic that you
can analyze with a network analyzer, such as a SwitchProbe device or other Remote
Monitoring (RMON) probe.

AT8402 CLI Reference Manual Page 2 - 56

AT8402 Switching Commands

2.13.1 monitor session

This command configures a probe port and a monitored port for monitor session (port
monitoring). Use the
to monitor. Use
packets. If you do not specify an
ingress and egress packets. Use the
the interface to receive the monitored traffic. Use the
administrative mode of the session. If enabled, the probe port monitors all the traffic
received and transmitted on the physical monitored port.

source interface <slot/port> parameter to specify the interface

rx to monitor only ingress packets, or use tx to monitor only egress

{rx | tx} option, the destination port monitors both

destination interface <slot/port> to specify

mode parameter to enabled the

Format

monitor session <session-id> {source interface <slot/port> [{rx |

tx}] | destination interface <slot/port> | mode}

Mode Global Config

2.13.1.1 no monitor session

Use this command without optional parameters to remove the monitor session (port
monitoring) designation from the source probe port, the destination monitored port and
all VLANs. Once the port is removed from the VLAN, you must manually add the port
to any desired VLANs. Use the

destination interface <slot/port> to remove the specified interface from the port

monitoring session. Use the
session.

NOTE: Since the current version of FASTPATH software only supports one

session, if you do not supply optional parameters, the behavior of this
command is similar to the behavior of the

Format

no monitor session <session-id> [{source interface <slot/port> |

destination interface <slot/port> | mode}]

Mode Global Config

2.13.2 no monitor

source interface <slot/port> parameter or

mode parameter to disable the administrative mode of the

no monitor command.

This command removes all the source ports and a destination port for the and restores
the default value for mirroring session mode for all the configured sessions.

NOTE: This is a stand-alone “no” command. This command does not have a

“normal” form.

Default enabled

Format

no monitor

Mode Global Config

2.13.3 show monitor session

This command displays the Port monitoring information for a particular mirroring
session.

Page 2 - 57 AT8402 CLI Reference Manual

Switching Commands AT8402

NOTE: The <session-id> parameter is an integer value used to identify the

session. In the current version of the software, the
parameter is always one (1).

<session-id>

Format

show monitor session <session-id>

Mode Privileged EXEC

Session ID An integer value used to identify the session. Its value can be anything

between 1 and the maximum number of mirroring sessions allowed on
the platform.

Monitor Session Mode I

ndicates whether the Port Mirroring feature is enabled or
disabled for the session identified with
values are Enabled and Disabled

Probe Port Probe port (destination port) for the session identified with

. If probe port is not set then this field is blank.

id>

Source Port The

port, which is configured as mirrored port (source port) for the
session identified with
ured for the session then this field is blank.

Type Direction in which source port configured for port mirroring.Types

are tx for transmitted packets and rx for receiving packets.

2.14 Static MAC Filtering

The commands in this section describe how to configure static MAC filtering.

<session-id>. The possible

.

<session-

<session-id>. If no source port is config-

2.14.1 macfilter

This command adds a static MAC filter entry for the MAC address <macaddr> on the
VLAN <

vlanid>. The value of the <macaddr> parameter is a 6-byte hexadecimal

number in the format of b1:b2:b3:b4:b5:b6. The restricted MAC Addresses are:
00:00:00:00:00:00, 01:80:C2:00:00:00 to 01:80:C2:00:00:0F, 01:80:C2:00:00:20 to
01:80:C2:00:00:21, and FF:FF:FF:FF:FF:FF. The <
valid VLAN. You can create up to 100 static MAC filters.

Format

Mode Global Config

2.14.1.1 no macfilter

This command removes all filtering restrictions and the static MAC filter entry for the
MAC address
specified as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6.

<vlanid> parameter must identify a valid VLAN.

The

Format

Mode Global Config

vlanid> parameter must identify a

macfilter <macaddr> <vlanid>

<macaddr> on the VLAN <vlanid>. The <macaddr> parameter must be

no macfilter <macaddr> <vlanid>

AT8402 CLI Reference Manual Page 2 - 58

AT8402 Switching Commands

2.14.2 macfilter addsrc

This command adds the interface to the source filter set for the MAC filter with the
MAC address of <macaddr> and VLAN of <vlanid>. The <macaddr> parameter must
be specified as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The

<vlanid> parameter must identify a valid VLAN.

Format

macfilter addsrc <macaddr> <vlanid>

Mode Interface Config

2.14.2.1 no macfilter addsrc

This command removes a port from the source filter set for the MAC filter with the
MAC address of

<macaddr> and VLAN of <vlanid>. The <macaddr> parameter

must be specified as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6.
The

<vlanid> parameter must identify a valid VLAN.

Format

no macfilter addsrc <macaddr> <vlanid>

Mode Interface Config

2.14.3 macfilter addsrc all

This command adds all interfaces to the source filter set for the MAC filter with the
MAC address of

<macaddr> and <vlanid>. You must specify the <macaddr>

parameter as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6. The

<vlanid> parameter must identify a valid VLAN.

Format

macfilter addsrc all <macaddr> <vlanid>

Mode Global Config

2.14.3.1 no macfilter addsrc all

This command removes all interfaces to the source filter set for the MAC filter with the
MAC address of

<macaddr> and VLAN of <vlanid>. You must specify the <macaddr>

parameter as a 6-byte hexadecimal number in the format of b1:b2:b3:b4:b5:b6.

<vlanid> parameter must identify a valid VLAN.

The

Format

no macfilter addsrc all <macaddr> <vlanid>

Mode Global Config

2.14.4 show mac-address-table static

This command displays the Static MAC Filtering information for all Static MAC
Filters. If you select
you supply a value for
system displays Static MAC Filter information only for that MAC address and VLAN.

Format

Mode Privileged EXEC

MAC Address The MAC Address of the static MAC filter entry.

VLAN ID The VLAN ID of the static MAC filter entry.

<all>, all the Static MAC Filters in the system are displayed. If

<macaddr>, you must also enter a value for <vlanid>, and the

show mac-address-table static {<macaddr> <vlanid> | all}

Page 2 - 59 AT8402 CLI Reference Manual

Switching Commands AT8402

Source Port(s) The source port filter set's slot and port(s).

2.14.5 show mac-address-table staticfiltering

This command displays the Static Filtering entries in the Multicast Forwarding
Database (MFDB) table.

Format

Mode Privileged EXEC

Mac Address A unicast MAC address for which the switch has forwarding and or

Type The type of the entry. Static entries are those that are configured by the

Description The text description of this multicast table entry.

Interfaces The list of interfaces that are designated for forwarding (Fwd:) and fil-

show mac-address-table staticfiltering

filtering information. The format is 6 or 8 two-digit hexadecimal num­bers that are separated by colons, for example 01:23:45:67:89:AB. In
an IVL system the MAC address will be displayed as 8 bytes.

end user. Dynamic entries are added to the table as a result of a learn­ing process or protocol.

tering (Flt:).

2.15 IGMP Snooping Configuration Commands

This section describes the commands you use to configure IGMP snooping.
FASTPATH software supports IGMP Versions 1, 2, and 3. The IGMP snooping feature
can help conserve bandwidth because it allows the switch to forward IP multicast
traffic only to connected hosts that request multicast traffic. IGMPv3 adds source
filtering capabilities to IGMP versions 1 and 2.

2.15.1 set igmp

This command enables IGMP Snooping on the system (Global Config Mode) or an
interface (Interface Config Mode). This command also enables IGMP snooping on a
particular VLAN (VLAN Config Mode) and can enable IGMP snooping on all
interfaces participating in a VLAN.

If an interface has IGMP Snooping enabled and you enable this interface for routing or
enlist it as a member of a port-channel (LAG), IGMP Snooping functionality is
disabled on that interface. IGMP Snooping functionality is re-enabled if you disable
routing or remove port-channel (LAG) membership from an interface that has IGMP
Snooping enabled.

The IGMP application supports the following activities:

• Validation of the IP header checksum (as well as the IGMP header checksum) and
discarding of the frame upon checksum error.

• Maintenance of the forwarding table entries based on the MAC address versus the
IP address.

• Flooding of unregistered multicast data packets to all ports in the VLAN.

Default disabled

AT8402 CLI Reference Manual Page 2 - 60

AT8402 Switching Commands

Format set igmp

Modes Global Config

Interface Config

Format

set igmp <vlanid>

Mode VLAN Config

2.15.1.1 no set igmp

This command disables IGMP Snooping on the system, an interface or a VLAN.

Format

no set igmp

Modes Global Config

Interface Config

Format

no set igmp <vlanid>

Mode VLAN Config

2.15.2 set igmp interfacemode

This command enables IGMP Snooping on all interfaces. If an interface has IGMP
Snooping enabled and you enable this interface for routing or enlist it as a member of a
port-channel (LAG), IGMP Snooping functionality is disabled on that interface. IGMP
Snooping functionality is re-enabled if you disable routing or remove port-channel
(LAG) membership from an interface that has IGMP Snooping enabled.

Default disabled

Format

set igmp interfacemode

Mode Global Config

2.15.2.1 no set igmp interfacemode

This command disables IGMP Snooping on all interfaces.

Format

no set igmp interfacemode

Mode Global Config

2.15.3 set igmp fast-leave

This command enables or disables IGMP Snooping fast-leave admin mode on a
selected interface or VLAN. Enabling fast-leave allows the switch to immediately
remove the layer 2 LAN interface from its forwarding table entry upon receiving an
IGMP leave message for that multicast group without first sending out MAC-based
general queries to the interface.

You should enable fast-leave admin mode only on VLANs where only one host is
connected to each layer 2 LAN port. This prevents the inadvertent dropping of the
other hosts that were connected to the same layer 2 LAN port but were still interested
in receiving multicast traffic directed to that group. Also, fast-leave processing is
supported only with IGMP version 2 hosts.

Default disabled

Page 2 - 61 AT8402 CLI Reference Manual

Switching Commands AT8402

Format set igmp fast-leave

Mode Interface Config

Format

set igmp fast-leave <vlan_id>

Mode VLAN Config

2.15.3.1 no set igmp fast-leave

This command disables IGMP Snooping fast-leave admin mode on a selected
interface.

Format

no set igmp fast-leave

Modes Interface Config

Format

no set igmp fast-leave <vlan_id>

Mode VLAN Config

2.15.4 set igmp groupmembership-interval

This command sets the IGMP Group Membership Interval time on a VLAN, one
interface or all interfaces. The Group Membership Interval time is the amount of time
in seconds that a switch waits for a report from a particular group on a particular
interface before deleting the interface from the entry. This value must be greater than
the IGMPv3 Maximum Response time value. The range is 2 to 3600 seconds.

Default 260 seconds

Format

set igmp groupmembership-interval <2-3600>

Modes Interface Config

Global Config

Format

set igmp groupmembership-interval <vlan_id> <2-3600>

Modes VLAN Config

2.15.4.1 no set igmp groupmembership-interval

This command sets the IGMPv3 Group Membership Interval time to the default value.

Format

no set igmp groupmembership-interval

Modes Interface Config

Global Config

Format

no set igmp groupmembership-interval <vlan_id>

Mode VLAN Config

2.15.5 set igmp maxresponse

This command sets the IGMP Maximum Response time for the system, or on a
particular interface or VLAN. The Maximum Response time is the amount of time in
seconds that a switch will wait after sending a query on an interface because it did not
receive a report for a particular group in that interface. This value must be less than the
IGMP Query Interval time value. The range is 1 to 3599 seconds.

AT8402 CLI Reference Manual Page 2 - 62

AT8402 Switching Commands

Default 10 seconds

Format

set igmp maxresponse <1-3599>

Modes Global Config

Interface Config

Format

set igmp maxresponse <vlan_id> <1-3599>

Mode VLAN Config

2.15.5.1 no set igmp maxresponse

This command sets the max response time (on the interface or VLAN) to the default
value.

Format

no set igmp maxresponse

Modes Global Config

Interface Config

Format

no set igmp maxresponse <vlan_id>

Mode VLAN Config

2.15.6 set igmp mcrtexpiretime

This command sets the Multicast Router Present Expiration time. The time is set for
the system, on a particular interface or VLAN. This is the amount of time in seconds
that a switch waits for a query to be received on an interface before the interface is
removed from the list of interfaces with multicast routers attached. The range is 0 to
3600 seconds. A value of 0 indicates an infinite time-out, i.e. no expiration.

Default 0

Format

set igmp mcrtexpiretime <0-3600>

Modes Global Config

Interface Config

Format

set igmp mcrtexpiretime <vlan_id> <0-3600>

Mode VLAN Config

2.15.6.1 no set igmp mcrtexpiretime

This command sets the Multicast Router Present Expiration time to 0. The time is set
for the system, on a particular interface or a VLAN.

Format

no set igmp mcrtexpiretime

Modes Global Config

Interface Config

Format

no set igmp mcrtexpiretime <vlan_id>

Mode VLAN Config

2.15.7 set igmp mrouter

This command configures the VLAN ID (<vlan_id>) that has the multicast router
mode enabled.

Page 2 - 63 AT8402 CLI Reference Manual

Switching Commands AT8402

Format set igmp mrouter <vlan_id>

Mode Interface Config

2.15.7.1 no set igmp mrouter

This command disables multicast router mode for a particular VLAN ID (<vlan_id>) .

Format

no set igmp mrouter <vlan_id>

Mode Interface Config

2.15.8 set igmp mrouter interface

This command configures the interface as a multicast router interface. When
configured as a multicast router interface, the interface is treated as a multicast router
interface in all VLANs.

Default disabled

Format

set igmp mrouter interface

Mode Interface Config

2.15.8.1 no set igmp mrouter interface

This command disables the status of the interface as a statically configured multicast
router interface.

Format

no set igmp mrouter interface

Mode Interface Config

2.15.9 show igmpsnooping

This command displays IGMP Snooping information. Configured information is
displayed whether or not IGMP Snooping is enabled.

Format

show igmpsnooping [<slot/port> | <vlan_id>]

Mode Privileged EXEC

When the optional arguments

<slot/port> or <vlan_id> are not used, the command

displays the following information:

Admin Mode Indicates whether or not IGMP Snooping is active on the switch.

Multicast Control Frame Count The number of multicast control frames that are

processed by the CPU.

Interface Enabled for IGMP Snooping The list of interfaces on which IGMP

Snooping is enabled.

VLANS Enabled for IGMP Snooping A list of VLANS on which IGMP Snooping

is enabled.

When you specify the

<slot/port> values, the following information appears:

IGMP Snooping Admin Mode Indicates whether IGMP Snooping is active on the

interface.

AT8402 CLI Reference Manual Page 2 - 64

AT8402 Switching Commands

Fast Leave Mode Indicates whether IGMP Snooping Fast-leave is active on the

interface.

Group Membership Interval The amount of time in seconds that a switch will wait

for a report from a particular group on a particular interface before
deleting the interface from the entry.This value may be configured

Maximum Response Time The amount of time the switch waits after it sends a query

on an interface because it did not receive a report for a particular group
on that interface. This value may be configured.

Multicast Router Expiry Time The amount of time to wait before removing an inter-

face from the list of interfaces with multicast routers attached. The
interface is removed if a query is not received. This value may be con­figured.

When you specify a value for

VLAN ID The VLAN ID.

IGMP Snooping Admin Mode Indicates whether IGMP Snooping is active on the

VLAN.

Fast Leave Mode ndicates whether IGMP Snooping Fast-leave is active on the

VLAN.

Group Membership Interval The amount of time in seconds that a switch will wait

for a report from a particular group on a particular interface, which is
participating in the VLAN, before deleting the interface from the
entry.This value may be configured.

Maximum Response Time The amount of time the switch waits after it sends a query

on an interface, participating in the VLAN, because it did not receive a
report for a particular group on that interface. This value may be con­figured.

Multicast Router Expiry Time The amount of time to wait before removing an inter-

face that is participating in the VLAN from the list of interfaces with
multicast routers attached. The interface is removed if a query is not
received. This value may be configured.

<vlan_id>, the following information appears:

2.15.10 show igmpsnooping mrouter interface

This command displays information about statically configured ports.

Format

Mode Privileged EXEC

Interface The port on which multicast router information is being displayed.

Multicast Router Attached Indicates whether multicast router is statically enabled

VLAN ID The list of VLANs of which the interface is a member.

show igmpsnooping mrouter interface <slot/port>

on the interface.

2.15.11 show igmpsnooping mrouter vlan

This command displays information about statically configured ports.

Page 2 - 65 AT8402 CLI Reference Manual

Switching Commands AT8402

Format show igmpsnooping mrouter vlan <slot/port>

Mode Privileged EXEC

Interface The port on which multicast router information is being displayed.

VLAN ID The list of VLANs of which the interface is a member.

2.15.12 show mac-address-table igmpsnooping

This command displays the IGMP Snooping entries in the MFDB table.

Format

Mode Privileged EXEC

MAC Address A multicast MAC address for which the switch has forwarding or fil-

Type The type of the entry, which is either static (added by the user) or

Description The text description of this multicast table entry.

Interfaces The list of interfaces that are designated for forwarding (Fwd:) and fil-

show mac-address-table igmpsnooping

tering information. The format is two-digit hexadecimal numbers that
are separated by colons, for example 01:23:45:67:89:AB. In an IVL
system the MAC address is displayed as a MAC address and VLAN
ID combination of 8 bytes.

dynamic (added to the table as a result of a learning process or proto­col).

tering (Flt:).

2.16 Port Security Commands

This section describes the command you use to configure Port Security on the switch.
Port security, which is also known as port MAC locking, allows you to secure the
network by locking allowable MAC addresses on a given port. Packets with a matching
source MAC address are forwarded normally, and all other packets are discarded.

NOTE: To enable the SNMP trap specific to port security, see 5.6.8 “snmp-

server enable traps violation” on page 5 - 18.

2.16.1 port-security

This command enables port locking at the system level (Global Config) or port level
(Interface Config)

Default disabled

Format

Modes Global Config

port-security

Interface Config

2.16.1.1 no port-security

This command disables port locking for one (Interface Config) or all (Global Config)
ports.

Format

AT8402 CLI Reference Manual Page 2 - 66

no port-security

AT8402 Switching Commands

Modes Global Config

Interface Config

2.16.2 port-security max-dynamic

This command sets the maximum number of dynamically locked MAC addresses
allowed on a specific port.

Default 600

Format

port-security max-dynamic <maxvalue>

Mode Interface Config

2.16.2.1 no port-security max-dynamic

This command resets the maximum number of dynamically locked MAC addresses
allowed on a specific port to its default value.

Format

no port-security max-dynamic

Mode Interface Config

2.16.3 port-security max-static

This command sets the maximum number of statically locked MAC addresses allowed
on a port.

Default 20

Format

port-security max-static <maxvalue>

Mode Interface Config

2.16.3.1 no port-security max-static

This command sets maximum number of statically locked MAC addresses to the
default value.

Format

no port-security max-static

Mode Interface Config

2.16.4 port-security mac-address

This command adds a MAC address to the list of statically locked MAC addresses. The

<vid> is the VLAN ID.

Format

port-security mac-address <mac-address> <vid>

Mode Interface Config

2.16.4.1 no port-security mac-address

This command removes a MAC address from the list of statically locked MAC
addresses.

Format

Mode Interface Config

no port-security mac-address <mac-address> <vid>

Page 2 - 67 AT8402 CLI Reference Manual

Switching Commands AT8402

2.16.5 port-security mac-address move

This command converts dynamically locked MAC addresses to statically locked
addresses.

Format

port-security mac-address move

Mode Interface Config

2.16.6 show port-security

This command displays the port-security settings. If you do not use a parameter, the
command displays the settings for the entire system. Use the optional parameters to
display the settings on a specific interface or on all interfaces.

Format

show port-security [{<slot/port> | all}]

Mode Privileged EXEC

Admin Mode Port Locking mode for the entire system. This field displays if you do

not supply any parameters.

For each interface, or for the interface you specify, the following information appears:

Admin Mode Port Locking mode for the Interface.

Dynamic Limit Maximum dynamically allocated MAC Addresses.

Static Limit Maximum statically allocated MAC Addresses.

Violation Trap Mode Whether violation traps are enabled.

2.16.7 show port-security dynamic

This command displays the dynamically locked MAC addresses for the port.

Format

show port-security dynamic <slot/port>

Mode Privileged EXEC

MAC Address MAC Address of dynamically locked MAC.

2.16.8 show port-security static

This command displays the statically locked MAC addresses for port.

Format

show port-security static <slot/port>

Mode Privileged EXEC

MAC Addres MAC Address of statically locked MAC.

2.16.9 show port-security violation

This command displays the source MAC address of the last packet discarded on a
locked port.

Format

Mode Privileged EXEC

MAC Address MAC Address of discarded packet on locked port.

show port-security violation <slot/port>

AT8402 CLI Reference Manual Page 2 - 68