Page 1
Motorola Solutions
EX-3524/EX-3548
Layer 2 Gigabit Ethernet PoE/PoE+ Switch
CLI Reference Guide
www.edge-core.com
Page 2
Page 3
How to Use This Guide
This guide includes detailed information on the switch software, including how to
operate and use the management functions of the switch. To deploy this switch
effectively and ensure trouble-free operation, you should first read the relevant
sections in this guide so that you are familiar with all of its software features.
Who Should
Read this Guide?
How this Guide
is Organized
Related
Documentation
This guide is for network administrators who are responsible for operating and
maintaining network equipment. The guide assumes a basic working knowledge of
LANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).
This guide describes the switch’s command line interface (CLI). For more detailed
information on the switch’s key features refer to the System Reference Guide.
The guide includes these sections:
◆ Section I “Getting Started” — Includes information on initial configuration.
◆ Section II “Command Line Interface” — Includes all management options
available through the CLI.
◆ Section III “App en di ce s” — Includes information on troubleshooting switch
management access.
This guide focuses on switch software configuration through the CLI.
For information on how to manage the switch through the Web management
interface, see the following guide:
System Reference Guide
For information on how to install the switch, see the following guide:
Installation Guide
For all safety information and regulatory statements, see the following documents:
Quick Start Guide
Safety and Regulatory Information
– 3 –
Page 4
How to Use This Guide
Conventions The following conventions are used throughout this guide to show information:
Note:
Emphasizes important information or calls your attention to related features
or instructions.
Caution:
Alerts you to a potential hazard that could cause loss of data, or damage
the system or equipment.
War ning:
Alerts you to a potential hazard that could cause personal injury.
– 4 –
Page 5
Contents
How to Use This Guide 3
Contents 5
Figures 27
Tables 29
Section I Getting Started 33
1 Initial Switch Configuration 35
Connecting to the Switch 35
Configuration Options 35
Connecting to the Console Port 36
Logging Onto the Command Line Interface 37
Setting Passwords 37
Remote Connections 38
Configuring the Switch for Remote Management 39
Setting an IP Address 39
Enabling SNMP Management Access 44
Managing System Files 47
Upgrading the Operation Code 48
Saving or Restoring Configuration Settings 48
Configuring Automatic Installation of Operation Code and
Configuration Settings 50
Downloading Operation Code from a File Server 50
Specifying a DHCP Client Identifier 52
Downloading a Configuration File Referenced by a DHCP Server 53
Setting the System Clock 55
Setting the Time Manually 55
Configuring SNTP 56
– 5 –
Page 6
Contents
Configuring NTP 56
Section II Command Line Interface 59
2 Using the Command Line Interface 61
Accessing the CLI 61
Console Connection 61
Telnet Connection 62
Entering Commands 63
Keywords and Arguments 63
Minimum Abbreviation 63
Command Completion 63
Getting Help on Commands 64
Partial Keyword Lookup 65
Negating the Effect of Commands 66
Using Command History 66
Understanding Command Modes 66
Exec Commands 66
Configuration Commands 67
Command Line Processing 69
Output Modifiers 69
CLI Command Groups 70
3 General Commands 73
prompt 73
reload (Global Configuration) 74
enable 75
quit 76
show history 76
configure 77
disable 78
reload (Privileged Exec) 78
show reload 79
end 79
exit 79
– 6 –
Page 7
Contents
4 System Management Commands 81
Device Designation 81
hostname 82
System Status 82
show access-list tcam-utilization 83
show memory 83
show process cpu 84
show running-config 84
show startup-config 85
show system 86
show users 87
show version 88
Frame Size 89
jumbo frame 89
File Management 90
General Commands 91
boot system 91
copy 92
delete 95
dir 96
whichboot 97
Automatic Code Upgrade Commands 97
upgrade opcode auto 97
upgrade opcode path 98
show upgrade 99
Line 100
line 101
databits 101
exec-timeout 102
login 103
parity 104
password 104
password-thresh 105
silent-time 106
speed 107
– 7 –
Page 8
Contents
stopbits 107
timeout login response 108
disconnect 109
show line 109
Event Logging 110
logging facility 110
logging history 111
logging host 112
logging on 112
logging trap 113
clear log 114
show log 114
show logging 115
SMTP Alerts 116
logging sendmail 117
logging sendmail host 117
logging sendmail level 118
logging sendmail destination-email 119
logging sendmail source-email 119
show logging sendmail 120
Time 120
SNTP Commands 121
sntp client 121
sntp poll 122
sntp server 122
show sntp 123
Manual Configuration Commands 124
clock summer-time 124
clock timezone 125
Time Range 128
clock timezone-predefined 126
calendar set 126
show calendar 127
time-range 128
absolute 129
– 8 –
Page 9
Contents
periodic 130
show time-range 131
Switch Clustering 131
cluster 132
cluster commander 133
cluster ip-pool 134
cluster member 134
rcommand 135
show cluster 136
show cluster members 136
show cluster candidates 136
5 SNMP Commands 137
General SNMP Commands 138
snmp-server 138
snmp-server community 139
snmp-server contact 139
snmp-server location 140
show snmp 140
SNMP Target Host Commands 141
snmp-server enable traps 141
snmp-server host 142
SNMPv3 Commands 145
snmp-server engine-id 145
snmp-server group 146
snmp-server user 147
snmp-server view 148
show snmp engine-id 149
show snmp group 150
show snmp user 151
Notification Log Commands 153
show snmp view 152
nlm 153
snmp-server notify-filter 153
show nlm oper-status 155
– 9 –
Page 10
Contents
show snmp notify-filter 155
6 Remote Monitoring Commands 157
rmon alarm 158
rmon event 159
rmon collection history 160
rmon collection rmon1 161
show rmon alarms 162
show rmon events 162
show rmon history 162
show rmon statistics 163
7 Authentication Commands 165
User Accounts 165
enable password 166
username 167
Authentication Sequence 168
authentication enable 168
authentication login 169
RADIUS Client 170
radius-server acct-port 170
radius-server auth-port 171
radius-server host 171
radius-server key 172
radius-server retransmit 173
radius-server timeout 173
show radius-server 174
TACACS+ Client 174
tacacs-server host 175
tacacs-server key 175
AAA 177
tacacs-server port 176
show tacacs-server 176
aaa accounting dot1x 177
aaa accounting exec 178
aaa accounting update 179
– 10 –
Page 11
Contents
aaa authorization exec 180
aaa group server 181
server 181
accounting dot1x 182
accounting exec 182
authorization exec 183
show accounting 183
Web Server 184
ip http port 185
ip http server 185
ip http secure-port 186
ip http secure-server 186
Telnet Server 188
ip telnet max-sessions 188
ip telnet port 189
ip telnet server 189
show ip telnet 190
Secure Shell 190
ip ssh authentication-retries 193
ip ssh server 193
ip ssh server-key size 194
ip ssh timeout 195
delete public-key 195
ip ssh crypto host-key generate 196
ip ssh crypto zeroize 197
ip ssh save host-key 197
show ip ssh 198
show public-key 198
show ssh 199
802.1X Port Authentication 200
General Commands 201
dot1x default 201
dot1x eapol-pass-through 202
dot1x system-auth-control 202
– 11 –
Page 12
Contents
Authenticator Commands 203
dot1x intrusion-action 203
dot1x max-req 203
dot1x operation-mode 204
dot1x port-control 205
dot1x re-authentication 205
dot1x timeout quiet-period 206
dot1x timeout re-authperiod 206
dot1x timeout supp-timeout 207
dot1x timeout tx-period 208
dot1x re-authenticate 208
Supplicant Commands 209
dot1x identity profile 209
dot1x max-start 209
dot1x pae supplicant 210
dot1x timeout auth-period 211
dot1x timeout held-period 211
dot1x timeout start-period 212
Information Display Commands 212
show dot1x 212
Management IP Filter 215
management 215
show management 216
8 General Security Measures 219
Port Security 220
port security 220
Network Access (MAC Address Authentication) 222
network-access aging 223
network-access mac-filter 224
mac-authentication reauth-time 224
network-access dynamic-qos 225
network-access dynamic-vlan 226
network-access guest-vlan 227
network-access link-detection 228
– 12 –
Page 13
Contents
network-access link-detection link-down 228
network-access link-detection link-up 229
network-access link-detection link-up-down 229
network-access max-mac-count 230
network-access mode mac-authentication 230
network-access port-mac-filter 231
mac-authentication intrusion-action 232
mac-authentication max-mac-count 232
clear network-access 233
show network-access 233
show network-access mac-address-table 234
show network-access mac-filter 235
Web Authentication 236
web-auth login-attempts 237
web-auth quiet-period 237
web-auth session-timeout 238
web-auth system-auth-control 238
web-auth 239
web-auth re-authenticate (Port) 239
web-auth re-authenticate (IP) 240
show web-auth 240
show web-auth interface 241
show web-auth summary 241
DHCP Snooping 242
ip dhcp snooping 242
ip dhcp snooping information option 244
ip dhcp snooping information policy 245
ip dhcp snooping verify mac-address 246
ip dhcp snooping vlan 246
ip dhcp snooping trust 247
clear ip dhcp snooping database flash 248
ip dhcp snooping database flash 248
show ip dhcp snooping 249
show ip dhcp snooping binding 249
– 13 –
Page 14
Contents
IP Source Guard 250
ip source-guard binding 250
ip source-guard 252
ip source-guard max-binding 253
show ip source-guard 254
show ip source-guard binding 254
ARP Inspection 255
ip arp inspection 256
ip arp inspection filter 257
ip arp inspection log-buffer logs 258
ip arp inspection validate 259
ip arp inspection vlan 259
ip arp inspection limit 260
ip arp inspection trust 261
show ip arp inspection configuration 262
show ip arp inspection interface 262
show ip arp inspection log 263
show ip arp inspection statistics 263
show ip arp inspection vlan 263
Denial of Service Protection 264
flow tcp-udp-port-zero 264
show flow 265
Port-based Traffic Segmentation 265
traffic-segmentation 266
show traffic-segmentation 267
9 Access Control Lists 269
IPv4 ACLs 269
access-list ip 270
permit, deny, redirect-to (Standard IP ACL) 271
permit, deny, redirect-to (Extended IPv4 ACL) 272
ip access-group 274
show ip access-group 275
show ip access-list 275
– 14 –
Page 15
Contents
IPv6 ACLs 277
access-list ipv6 277
permit, deny, redirect-to (Standard IPv6 ACL) 278
permit, deny, redirect-to (Extended IPv6 ACL) 279
show ipv6 access-list 281
ipv6 access-group 282
show ipv6 access-group 282
MAC ACLs 283
access-list mac 283
permit, deny, redirect-to
(MAC ACL) 284
mac access-group 286
show mac access-group 287
show mac access-list 287
ARP ACLs 288
access-list arp 288
permit, deny (ARP ACL) 289
show arp access-list 290
ACL Information 290
show access-group 290
show access-list 291
10 Interface Commands 293
Interface Configuration 294
interface 294
alias 295
capabilities 295
description 296
flowcontrol 297
giga-phy-mode 298
negotiation 299
shutdown 300
speed-duplex 300
clear counters 301
show interfaces brief 302
– 15 –
Page 16
Contents
show interfaces counters 302
show interfaces status 304
show interfaces switchport 305
show interfaces transceiver 307
Cable Diagnostics 308
test cable-diagnostics 308
show cable-diagnostics 309
Power Savings 310
power-save 310
show power-save 311
11 Link Aggregation Commands 313
Manual Configuration Commands 314
channel-group 314
Dynamic Configuration Commands 315
lacp 315
lacp admin-key (Ethernet Interface) 316
lacp port-priority 317
lacp system-priority 318
lacp admin-key (Port Channel) 319
Trunk Status Display Commands 320
show lacp 320
12 Power over Ethernet Commands 325
power inline compatible 325
power inline 326
power inline maximum allocation 327
power inline priority 328
power inline time-range 329
show power inline status 330
13 Port Mirroring Commands 333
Local Port Mirroring Commands 333
show power inline time-range 331
show power poe 331
port monitor 333
– 16 –
Page 17
Contents
show port monitor 335
RSPAN Mirroring Commands 336
rspan source 338
rspan destination 339
rspan remote vlan 340
no rspan session 341
show rspan 341
14 Congestion Control Commands 343
Rate Limit Commands 343
rate-limit 344
Storm Control Commands 345
switchport packet-rate 345
Automatic Traffic Control Commands 346
Threshold Commands 349
auto-traffic-control apply-timer 349
auto-traffic-control release-timer 350
auto-traffic-control 351
auto-traffic-control action 351
auto-traffic-control alarm-clear-threshold 352
auto-traffic-control alarm-fire-threshold 353
auto-traffic-control auto-control-release 354
auto-traffic-control control-release 355
SNMP Trap Commands 355
snmp-server enable port-traps atc broadcast-alarm-clear 355
snmp-server enable port-traps atc broadcast-alarm-fire 356
snmp-server enable port-traps atc broadcast-control-apply 356
snmp-server enable port-traps atc broadcast-control-release 357
snmp-server enable port-traps atc multicast-alarm-clear 357
snmp-server enable port-traps atc multicast-alarm-fire 358
ATC Display Commands 359
snmp-server enable port-traps atc multicast-control-apply 358
snmp-server enable port-traps atc multicast-control-release 359
show auto-traffic-control 359
show auto-traffic-control interface 360
– 17 –
Page 18
Contents
15 Address Table Commands 361
mac-address-table aging-time 361
mac-address-table static 362
clear mac-address-table dynamic 363
show mac-address-table 363
show mac-address-table aging-time 364
show mac-address-table count 365
16 Spanning Tree Commands 367
spanning-tree 368
spanning-tree cisco-prestandard 369
spanning-tree forward-time 369
spanning-tree hello-time 370
spanning-tree max-age 371
spanning-tree mode 371
spanning-tree pathcost method 373
spanning-tree priority 373
spanning-tree mst configuration 374
spanning-tree transmission-limit 374
max-hops 375
mst priority 376
mst vlan 376
name 377
revision 378
spanning-tree bpdu-filter 378
spanning-tree bpdu-guard 379
spanning-tree cost 380
spanning-tree edge-port 381
spanning-tree link-type 382
spanning-tree loopback-detection 382
spanning-tree loopback-detection action 383
spanning-tree loopback-detection release-mode 384
spanning-tree loopback-detection trap 385
spanning-tree mst cost 385
spanning-tree mst port-priority 386
– 18 –
Page 19
Contents
spanning-tree port-priority 387
spanning-tree root-guard 388
spanning-tree spanning-disabled 389
spanning-tree loopback-detection release 389
spanning-tree protocol-migration 390
show spanning-tree 390
show spanning-tree mst configuration 392
17 VLAN Commands 393
GVRP and Bridge Extension Commands 394
bridge-ext gvrp 394
garp timer 395
switchport forbidden vlan 396
switchport gvrp 397
show bridge-ext 397
show garp timer 398
show gvrp configuration 399
Editing VLAN Groups 399
vlan database 400
vlan 400
Configuring VLAN Interfaces 401
interface vlan 402
switchport acceptable-frame-types 403
switchport allowed vlan 403
switchport ingress-filtering 404
switchport mode 405
switchport native vlan 406
vlan-trunking 407
Displaying VLAN Information 408
show vlan 408
Configuring IEEE 802.1Q Tunneling 409
dot1q-tunnel system-tunnel-control 410
dot1q-tunnel tpid 411
switchport dot1q-tunnel mode 412
show dot1q-tunnel 413
– 19 –
Page 20
Contents
Configuring Protocol-based VLANs 413
protocol-vlan protocol-group (Configuring Groups) 414
protocol-vlan protocol-group (Configuring Interfaces) 415
show protocol-vlan protocol-group 416
show interfaces protocol-vlan protocol-group 416
Configuring IP Subnet VLANs 417
subnet-vlan 417
show subnet-vlan 418
Configuring MAC Based VLANs 419
mac-vlan 419
show mac-vlan 420
Configuring Voice VLANs 421
voice vlan 421
voice vlan aging 422
voice vlan mac-address 423
switchport voice vlan 424
switchport voice vlan priority 424
switchport voice vlan rule 425
switchport voice vlan security 426
show voice vlan 426
18 Class of Service Commands 429
Priority Commands (Layer 2) 429
queue mode 430
queue weight 431
switchport priority default 432
show queue mode 433
show queue weight 433
Priority Commands (Layer 3 and 4) 434
qos map cos-dscp 434
qos map dscp-mutation 436
qos map phb-queue 437
qos map trust-mode 438
show qos map cos-dscp 439
show qos map dscp-mutation 439
– 20 –
Page 21
Contents
show qos map phb-queue 440
show qos map trust-mode 440
19 Quality of Service Commands 441
class-map 442
description 443
match 444
rename 445
policy-map 445
class 446
police flow 447
police srtcm-color 449
police trtcm-color 451
set cos 453
set ip dscp 454
set phb 455
service-policy 456
show class-map 457
show policy-map 457
show policy-map interface 458
20 Multicast Filtering Commands 459
IGMP Snooping 459
ip igmp snooping 461
ip igmp snooping proxy-reporting 461
ip igmp snooping querier 462
ip igmp snooping router-alert-option-check 462
ip igmp snooping router-port-expire-time 463
ip igmp snooping tcn-flood 464
ip igmp snooping tcn-query-solicit 465
ip igmp snooping unregistered-data-flood 466
ip igmp snooping unsolicited-report-interval 466
ip igmp snooping version 467
ip igmp snooping version-exclusive 468
ip igmp snooping vlan general-query-suppression 468
ip igmp snooping vlan immediate-leave 469
– 21 –
Page 22
Contents
ip igmp snooping vlan last-memb-query-count 470
ip igmp snooping vlan last-memb-query-intvl 470
ip igmp snooping vlan mrd 471
ip igmp snooping vlan proxy-address 472
ip igmp snooping vlan query-interval 473
ip igmp snooping vlan query-resp-intvl 474
ip igmp snooping vlan static 475
show ip igmp snooping 475
show ip igmp snooping group 476
show ip igmp snooping mrouter 477
Static Multicast Routing 478
ip igmp snooping vlan mrouter 478
IGMP Filtering and Throttling 479
ip igmp filter (Global Configuration) 479
ip igmp profile 480
permit, deny 481
range 481
ip igmp filter (Interface Configuration) 482
ip igmp max-groups 482
ip igmp max-groups action 483
show ip igmp filter 484
show ip igmp profile 484
show ip igmp throttle interface 485
Multicast VLAN Registration 486
mvr 486
mvr immediate-leave 487
mvr type 488
mvr vlan group 489
show mvr 490
21 LLDP Commands 493
lldp 495
lldp holdtime-multiplier 495
lldp med-fast-start-count 496
lldp notification-interval 496
– 22 –
Page 23
Contents
lldp refresh-interval 497
lldp reinit-delay 497
lldp tx-delay 498
lldp admin-status 499
lldp basic-tlv management-ip-address 499
lldp basic-tlv port-description 500
lldp basic-tlv system-capabilities 500
lldp basic-tlv system-description 501
lldp basic-tlv system-name 501
lldp dot1-tlv proto-ident 502
lldp dot1-tlv proto-vid 502
lldp dot1-tlv pvid 503
lldp dot1-tlv vlan-name 503
lldp dot3-tlv link-agg 504
lldp dot3-tlv max-frame 504
lldp dot3-tlv poe 505
lldp med-location civic-addr 506
lldp med-notification 507
lldp med-tlv ext-poe 508
lldp med-tlv inventory 509
lldp med-tlv location 509
lldp med-tlv med-cap 510
lldp med-tlv network-policy 510
lldp notification 511
show lldp config 512
show lldp info local-device 513
show lldp info remote-device 514
show lldp info statistics 516
22 CDP Commands 517
cdp (Global Configuration) 518
cdp hold-time 518
cdp transmit-interval 519
cdp version 519
cdp (Interface Configuration) 520
– 23 –
Page 24
Contents
clear cdp table 520
show cdp 520
show cdp interface 521
show cdp neighbors 521
23 Domain Name Service Commands 523
ip domain-list 523
ip domain-lookup 524
ip domain-name 525
ip host 526
ip name-server 526
ipv6 host 527
clear dns cache 528
clear host 528
show dns 529
show dns cache 529
show hosts 530
24 DHCP Commands 531
DHCP Client 531
DHCP for IPv4 532
ip dhcp client class-id 532
ip dhcp restart client 532
show ip dhcp client-identifier 533
DHCP for IPv6 534
ipv6 dhcp client rapid-commit vlan 534
ipv6 dhcp restart client vlan 534
show ipv6 dhcp duid 536
show ipv6 dhcp vlan 536
25 IP Interface Commands 537
IPv4 Interface 537
Basic IPv4 Configuration 538
ip address 538
ip default-gateway 540
show ip interface 541
– 24 –
Page 25
Contents
show ip traffic 541
traceroute 542
ping 543
ARP Configuration 545
arp 545
ip proxy-arp 546
clear arp-cache 547
show arp 547
IPv6 Interface 548
Interface Address Configuration and Utilities 549
ipv6 default-gateway 549
ipv6 address 550
ipv6 address autoconfig 551
ipv6 address eui-64 552
ipv6 address link-local 554
ipv6 enable 555
ipv6 mtu 556
show ipv6 default-gateway 557
show ipv6 interface 558
show ipv6 mtu 559
show ipv6 traffic 560
clear ipv6 traffic 564
ping6 565
Neighbor Discovery 566
ipv6 hop-limit 566
ipv6 nd dad attempts 566
ipv6 nd ns-interval 568
ipv6 nd reachable-time 569
clear ipv6 neighbors 570
26 IP Routing Commands 573
Global Routing Configuration 573
IPv4 Commands 574
show ipv6 neighbors 570
ip route 574
– 25 –
Page 26
Contents
show ip route 575
show ip route database 576
show ip route summary 576
Section I Appendices 577
A Troubleshooting 579
Problems Accessing the Management Interface 579
Using System Logs 580
B License Information 581
The GNU General Public License 581
GNU Lesser General Public License, version 3.0 584
The BSD License 586
Open Source Software Used 587
ISC License 587
C Customer Support 593
Motorola Solutions Enterprise Mobility Support Center 593
Customer Support Web Site 593
Manuals 593
Glossary 595
Index of CLI Commands 603
Index 609
– 26 –
Page 27
Figures
Figure 1: Storm Control by Limiting the Traffic Rate 348
Figure 2: Storm Control by Shutting Down a Port 349
Figure 3: Configuring VLAN Trunking 407
– 27 –
Page 28
Figures
– 28 –
Page 29
Tables
Table 1: Options 60, 66 and 67 Statements 54
Table 2: Options 55 and 124 Statements 54
Table 3: General Command Modes 66
Table 4: Configuration Command Modes 68
Table 5: Keystroke Commands 69
Table 6: Command Group Index 70
Table 7: General Commands 73
Table 8: System Management Commands 81
Table 9: Device Designation Commands 81
Table 10: System Status Commands 82
Table 11: show system – display description 87
Table 12: show version – display description 88
Table 13: Frame Size Commands 89
Table 14: Flash/File Commands 90
Table 15: File Directory Information 96
Table 16: Line Commands 100
Table 17: Event Logging Commands 110
Table 18: Logging Levels 111
Table 19: show logging flash/ram - display description 116
Table 20: show logging trap - display description 116
Table 21: Event Logging Commands 116
Table 22: Time Commands 120
Table 23: Time Range Commands 128
Table 24: Switch Cluster Commands 131
Table 25: SNMP Commands 137
Table 26: show snmp engine-id - display description 150
Table 27: show snmp group - display description 151
Table 28: show snmp user - display description 151
Table 29: show snmp view - display description 152
– 29 –
Page 30
Tabl es
Table 30: RMON Commands 157
Table 31: Authentication Commands 165
Table 32: User Access Commands 165
Table 33: Default Login Settings 167
Table 34: Authentication Sequence Commands 168
Table 35: RADIUS Client Commands 170
Table 36: TACACS+ Client Commands 174
Table 37: AAA Commands 177
Table 38: Web Server Commands 184
Table 39: HTTPS System Support 187
Table 40: Telnet Server Commands 188
Table 41: Secure Shell Commands 190
Table 42: show ssh - display description 199
Table 43: 802.1X Port Authentication Commands 200
Table 44: Management IP Filter Commands 215
Table 45: General Security Commands 219
Table 46: Management IP Filter Commands 220
Table 47: Network Access Commands 222
Table 48: Dynamic QoS Profiles 225
Table 49: Web Authentication 236
Table 50: DHCP Snooping Commands 242
Table 51: IP Source Guard Commands 250
Table 52: ARP Inspection Commands 255
Table 53: DoS Protection Commands 264
Table 54: Commands for Configuring Traffic Segmentation 265
Table 55: Access Control List Commands 269
Table 56: IPv4 ACL Commands 269
Table 57: IPv4 ACL Commands 277
Table 58: MAC ACL Commands 283
Table 59: ARP ACL Commands 288
Table 60: ACL Information Commands 290
Table 61: Interface Commands 293
Table 62: show interfaces switchport - display description 306
Table 63: Link Aggregation Commands 313
Table 64: show lacp counters - display description 320
– 30 –
Page 31
Tabl es
Table 65: show lacp internal - display description 321
Table 66: show lacp neighbors - display description 322
Table 67: show lacp sysid - display description 323
Table 68: PoE Commands 325
Table 69: show power inline status - display description 330
Table 70: show power mainpower - display description 332
Table 71: Port Mirroring Commands 333
Table 72: Mirror Port Commands 333
Table 73: RSPAN Commands 336
Table 74: Congestion Control Commands 343
Table 75: Rate Limit Commands 343
Table 76: Rate Limit Commands 345
Table 77: ATC Commands 346
Table 78: Address Table Commands 361
Table 79: Spanning Tree Commands 367
Table 80: Recommended STA Path Cost Range 380
Table 81: Default STA Path Costs 380
Table 82: VLAN Commands 393
Table 83: GVRP and Bridge Extension Commands 394
Table 84: show bridge-ext - display description 398
Table 85: Commands for Editing VLAN Groups 399
Table 86: Commands for Configuring VLAN Interfaces 401
Table 87: Commands for Displaying VLAN Information 408
Table 88: 802.1Q Tunneling Commands 409
Table 89: Protocol-based VLAN Commands 413
Table 90: IP Subnet VLAN Commands 417
Table 91: MAC Based VLAN Commands 419
Table 92: Voice VLAN Commands 421
Table 93: Priority Commands 429
Table 94: Priority Commands (Layer 2) 429
Table 95: Priority Commands (Layer 3 and 4) 434
Table 96: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence 435
Table 97: Default Mapping of DSCP Values to Internal PHB/Drop Values 436
Table 98: Mapping Internal Per-hop Behavior to Hardware Queues 437
Table 99: Quality of Service Commands 441
– 31 –
Page 32
Tabl es
Table 100: Multicast Filtering Commands 459
Table 101: IGMP Snooping Commands 459
Table 102: Static Multicast Interface Commands 478
Table 103: IGMP Filtering and Throttling Commands 479
Table 104: Multicast VLAN Registration Commands 486
Table 105: show mvr - display description 491
Table 106: show mvr interface - display description 491
Table 107: show mvr members - display description 492
Table 108: LLDP Commands 493
Table 109: LLDP MED Location CA Types 506
Table 110: CDP Commands 517
Table 111: show cdp neighbors - display description 522
Table 112: Address Table Commands 523
Table 113: show dns cache - display description 529
Table 114: show hosts - display description 530
Table 115: DHCP Commands 531
Table 116: DHCP Client Commands 531
Table 117: IP Interface Commands 537
Table 118: IPv4 Interface Commands 537
Table 119: Basic IP Configuration Commands 538
Table 120: Address Resolution Protocol Commands 545
Table 121: IPv6 Configuration Commands 548
Table 122: show ipv6 interface - display description 558
Table 123: show ipv6 mtu - display description 560
Table 124: show ipv6 traffic - display description 561
Table 125: show ipv6 neighbors - display description 571
Table 203: IP Routing Commands 573
Table 204: Global Routing Configuration Commands 573
Table 205: Troubleshooting Chart 579
– 32 –
Page 33
Section I
Getting Started
This section describes how to configure the switch for management access through
the web interface or SNMP.
This section includes these chapters:
◆ "Initial Switch Configuration" on page 35
– 33 –
Page 34
Section I
| Getting Started
– 34 –
Page 35
1 Initial Switch Configuration
This chapter includes information on connecting to the switch and basic
configuration procedures.
Connecting to the Switch
The switch includes a built-in network management agent. The agent offers a
variety of management options, including SNMP, RMON and a web-based interface.
A PC may also be connected directly to the switch for configuration and monitoring
via a command line interface (CLI).
Note:
An IPv4 address for this switch is obtained via DHCP by default. To change
this address, see “Setting an IP Address” on page 39.
Configuration Options The switch’s HTTP web agent allows you to configure switch parameters, monitor
port connections, and display statistics using a standard web browser such as
Internet Explorer 6, Mozilla Firefox 4, or Google Chrome 29, or more recent versions.
The switch’s web management interface can be accessed from any computer
attached to the network.
The CLI program can be accessed by a direct connection to the RS-232 serial
console port on the switch, or remotely by a Telnet connection over the network.
The switch’s management agent also supports SNMP (Simple Network
Management Protocol). This SNMP agent permits the switch to be managed from
any system in the network using network management software.
The switch’s web interface, console interface, and SNMP agent allow you to
perform the following management functions:
◆ Set user names and passwords
◆ Set an IP interface for any VLAN
◆ Configure SNMP parameters
◆ Enable/disable any port
◆ Set the speed/duplex mode for any port
◆ Configure the bandwidth of any port by limiting input or output rates
◆ Control port access through IEEE 802.1X security or static address filtering
– 35 –
Page 36
Chapter 1
| Initial Switch Configuration
Connecting to the Switch
◆ Filter packets using Access Control Lists (ACLs)
◆ Configure up to 256 IEEE 802.1Q VLANs
◆ Enable GVRP automatic VLAN registration
◆ Configure IP routing for unicast traffic
◆ Configure IGMP multicast filtering
◆ Upload and download system firmware or configuration files via HTTP (using
the web interface) or FTP/TFTP (using the command line or web interface)
◆ Configure Spanning Tree parameters
◆ Configure Class of Service (CoS) priority queuing
◆ Configure static or LACP trunks (up to 12)
◆ Enable port mirroring
◆ Set storm control on any port for excessive broadcast, multicast, or unknown
unicast traffic
◆ Display system information and statistics
Connecting to the
Console Port
The switch provides an RS-232 serial port that enables a connection to a PC or
terminal for monitoring and configuring the switch. A null-modem console cable is
provided with the switch.
Attach a VT100-compatible terminal, or a PC running a terminal emulation program
to the switch. You can use the console cable provided with this package, or use a
null-modem cable that complies with the wiring assignments shown in the
Installation Guide.
To connect a terminal to the console port, complete the following steps:
1. Connect the console cable to the serial port on a terminal, or a PC running
terminal emulation software, and tighten the captive retaining screws on the
DB-9 connector.
2. Connect the other end of the cable to the RS-45 serial port on the switch.
3. Make sure the terminal emulation software is set as follows:
■
Select the appropriate serial port (COM port 1 or COM port 2).
■
Set the baud rate to any of 9600, 19200, 38400, 57600, or 115200 bps.
■
Set the data format to 8 data bits, 1 stop bit, and no parity.
■
■
■
Set flow control to none.
Set the emulation mode to VT100.
When using HyperTerminal, select Terminal keys, not Windows keys.
– 36 –
Page 37
Chapter 1
| Initial Switch Configuration
Connecting to the Switch
4. Power on the switch.
After the system completes the boot cycle, the logon screen appears.
Logging Onto the
Command Line
Interface
The CLI program provides two different command levels — normal access level
(Normal Exec) and privileged access level (Privileged Exec). The commands
available at the Normal Exec level are a limited subset of those available at the
Privileged Exec level and allow you to only display information and use basic
utilities. To fully configure the switch parameters, you must access the CLI at the
Privileged Exec level.
Access to both CLI levels are controlled by user names and passwords. The switch
has a default user name and password for each level. To log into the CLI at the
Privileged Exec level using the default user name and password, perform these
steps:
1. To initiate your console connection, press <Enter>. The “User Access
Verification” procedure starts.
2. At the Username prompt, enter “motorola.”
3. At the Password prompt, also enter “admin.” (The password characters are not
displayed on the console screen.)
4. The session is opened and the CLI displays the “Console#” prompt indicating
you have access at the Privileged Exec level.
Setting Passwords If this is your first time to log into the CLI program, you should define new
passwords for both default user names using the “username” command, record
them and put them in a safe place.
Passwords can consist of up to 32 alphanumeric characters and are case sensitive.
To prevent unauthorized access to the switch, set the passwords as follows:
1. Open the console interface with the default user name “motorola” and
password “admin” to access the Privileged Exec level.
2. Type “configure” and press <Enter>.
3. Type “username guest password 0 password,” for the Normal Exec level, where
password is your new password. Press <Enter>.
– 37 –
Page 38
Chapter 1
Connecting to the Switch
| Initial Switch Configuration
4. Type “username motorola password 0 password,” for the Privileged Exec level,
where password is your new password. Press <Enter>.
Username: motorola
Password:
CLI session with the EX-3524* is opened.
To end the CLI session, enter [Exit].
Console#configure
Console(config)#username guest password 0 [password]
Console(config)#username motorola password 0 [password]
Console(config)#
* This manual covers both the EX-3524 and EX-3548 Gigabit Ethernet PoE/PoE+
switches. Other than the difference in the number of ports, there are no other
significant differences. Therefore nearly all of the screen display examples are
based on the EX-3524.
Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must
first configure switch’s network interface with a valid IPv4 or IPv6 address.
The default network interface is VLAN 1 which includes ports 1-28/52. When
configuring the network interface, the IP address, subnet mask, and default
gateway may all be set using a console connection, or DHCP protocol as described
in the following sections.
An IPv4 address for this switch is obtained via DHCP by default. To manually
configure this address or enable dynamic address assignment via DHCP, see
“Setting an IP Address” on page 39.
After configuring the switch’s IP parameters, you can access the onboard
configuration program from anywhere within the attached network. The onboard
configuration program can be accessed using Telnet or SSH from any computer
attached to the network. The switch can also be managed by any computer using a
web browser (Internet Explorer 6, Mozilla Firefox 4, or Google Chrome 29, or more
recent versions), or from a network computer using SNMP network management
software.
Note:
This switch supports four Telnet sessions or SSH sessions.
The onboard program only provides access to basic configuration functions. To
access the full range of SNMP management functions, you must use SNMP-based
network management software.
– 38 –
Page 39
Chapter 1
Configuring the Switch for Remote Management
| Initial Switch Configuration
Configuring the Switch for Remote Management
Setting an IP Address You must establish IP address information for the switch to obtain management
access through the network. This can be done in either of the following ways:
◆ Manual — You have to input the information, including IP address and subnet
mask. If your management station is not in the same IP subnet as the switch,
you will also need to specify the default gateway router.
◆ Dynamic — The switch can send IPv4 configuration requests to BOOTP or
DHCP address allocation servers on the network, or automatically generate a
unique IPv6 host address based on the local subnet address prefix received in
router advertisement messages. An IPv6 link local address for use in a local
network can also be dynamically generated as described in “Obtaining an IPv6
Address” on page 43.
The current software supports DHCP for IPv6, so an IPv6 global unicast address
for use in a network containing more than one subnet can obtained through
the DHCPv6 server, or manually configured as described in “Assigning an IPv6
Address” on page 40.
Manual Configuration
You can manually assign an IP address to the switch. You may also need to specify a
default gateway that resides between this device and management stations that
exist on another network segment. Valid IPv4 addresses consist of four decimal
numbers, 0 to 255, separated by periods. Anything outside this format will not be
accepted by the CLI program.
Note:
The IPv4 address for VLAN 1 is obtained via DHCP by default.
Assigning an IPv4 Address
Before you can assign an IP address to the switch, you must obtain the following
information from your network administrator:
◆ IP address for the switch
◆ Network mask for this network
◆ Default gateway for the network
To assign an IPv4 address to the switch, complete the following steps
1. From the Global Configuration mode prompt, type “interface vlan 1” to access
the interface-configuration mode. Press <Enter>.
2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP
address and “netmask” is the network mask for the network. Press <Enter>.
– 39 –
Page 40
Chapter 1
| Initial Switch Configuration
Configuring the Switch for Remote Management
3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.
4. To set the IP address of the default gateway for the network to which the switch
belongs, type “ip default-gateway gateway,” where “gateway” is the IP address
of the default gateway. Press <Enter>.
Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.5 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 192.168.1.254
Assigning an IPv6 Address
This section describes how to configure a “link local” address for connectivity
within the local subnet only, and also how to configure a “global unicast” address,
including a network prefix for use on a multi-segment network and the host
portion of the address.
An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One
double colon may be used to indicate the appropriate number of zeros required to
fill the undefined fields. For detailed information on the other ways to assign IPv6
addresses, see “IPv6 Interface” on page 548.
Link Local Address — All link-local addresses must be configured with a prefix in
the range of FE80~FEBF. Remember that this address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet only. Also, if
the switch detects that the address you configured conflicts with that in use by
another device on the subnet, it will stop using the address in question, and
automatically generate a link local address that does not conflict with any other
devices on the local subnet.
To configure an IPv6 link local address for the switch, complete the following steps:
1. From the Global Configuration mode prompt, type “interface vlan 1” to access
the interface-configuration mode. Press <Enter>.
2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimal
values for the ipv6-address similar to that shown in the example, followed by
the “link-local” command parameter. Then press <Enter>.
Console(config)#interface vlan 1
Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700 link-local
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled
Link-Local Address:
FE80::260:3EFF:FE11:6700/64
Global Unicast Address(es):
(None)
– 40 –
Page 41
Chapter 1
| Initial Switch Configuration
Configuring the Switch for Remote Management
Joined Group Address(es):
FF02::1:FF11:6700
FF02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3
ND retransmit interval is 1000 milliseconds
ND reachable time is 30000 milliseconds
Console#
Address for Multi-segment Network — Before you can assign an IPv6 address to the
switch that will be used to connect to a multi-segment network, you must obtain
the following information from your network administrator:
◆ Prefix for this network
◆ IP address for the switch
◆ Default gateway for the network
For networks that encompass several different subnets, you must define the full
address, including a network prefix and the host address for the switch. You can
specify either the full IPv6 address, or the IPv6 address and prefix length. The prefix
length for an IPv6 network is the number of bits (from the left) of the prefix that
form the network address, and is expressed as a decimal number. For example, all
IPv6 addresses that start with the first byte of 73 (hexadecimal) could be expressed
as 73:0:0:0:0:0:0:0/8 or 73::/8.
To generate an IPv6 global unicast address for the switch, complete the following
steps:
1. From the global configuration mode prompt, type “interface vlan 1” to access
the interface-configuration mode. Press <Enter>.
2. From the interface prompt, type “ipv6 address ipv6-address” or “ipv6 address
ipv6-address/prefix-length,” where “prefix-length” indicates the address bits
used to form the network portion of the address. (The network address starts
from the left of the prefix and should encompass some of the ipv6-address
bits.) The remaining bits are assigned to the host interface. Press <Enter>.
3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.
4. To set the IP address of the IPv6 default gateway for the network to which the
switch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the
IPv6 address of the default gateway. Press <Enter>.
Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:DB8:2222:7272::66/64
Console(config-if)#exit
Console(config)#ipv6 default-gateway 2001:DB8:2222:7272::254
Console(config)end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled
– 41 –
Page 42
Chapter 1
| Initial Switch Configuration
Configuring the Switch for Remote Management
Link-Local Address:
FE80::260:3EFF:FE11:6700/64
Global Unicast Address(es):
2001:DB8:2222:7272::/64, subnet is 2001:DB8:2222:7272::/64
Joined Group Address(es):
FF02::1:FF00:0
FF02::1:FF11:6700
FF02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3
ND retransmit interval is 1000 milliseconds
ND reachable time is 30000 milliseconds
Console#show ipv6 default-gateway
ipv6 default gateway: 2001:DB8:2222:7272::254
Console#
Dynamic Configuration
Obtaining an IPv4 Address
If you select the “bootp” or “dhcp” option, the system will immediately start
broadcasting service requests. IP will be enabled but will not function until a
BOOTP or DHCP reply has been received. Requests are broadcast every few minutes
using exponential backoff until IP configuration information is obtained from a
BOOTP or DHCP server. BOOTP and DHCP values can include the IP address, subnet
mask, and default gateway. If the DHCP/BOOTP server is slow to respond, you may
need to use the “ip dhcp restart client” command to re-start broadcasting service
requests.
Note that the “ip dhcp restart client” command can also be used to start
broadcasting service requests for all VLANs configured to obtain address
assignments through BOOTP or DHCP. It may be necessary to use this command
when DHCP is configured on a VLAN, and the member ports which were previously
shut down are now enabled.
If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the
switch will start broadcasting service requests as soon as it is powered on.
To automatically configure the switch by communicating with BOOTP or DHCP
address allocation servers on the network, complete the following steps:
1. From the Global Configuration mode prompt, type “interface vlan 1” to access
the interface-configuration mode. Press <Enter>.
2. At the interface-configuration mode prompt, use one of the following
commands:
■
To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.
■
To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.
3. Type “end” to return to the Privileged Exec mode. Press <Enter>.
– 42 –
Page 43
Chapter 1
| Initial Switch Configuration
Configuring the Switch for Remote Management
4. Wait a few minutes, and then check the IP configuration settings by typing the
“show ip interface” command. Press <Enter>.
5. Then save your configuration changes by typing “copy running-config startup-
config.” Enter the startup file name and press <Enter>.
Console(config)#interface vlan 1
Console(config-if)#ip address dhcp
Console(config-if)#end
Console#show ip interface
Vlan 1 is Administrative Up - Link Up
Address is B4-0E-DC-34-E6-3C
Index: 1001, MTU: 1500, Bandwidth: 1g
Address Mode is DHCP
IP Address: 192.168.0.5 Mask: 255.255.255.0
Proxy ARP is disabled
Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.
\Write to FLASH finish.
Success.
Obtaining an IPv6 Address
Link Local Address — There are several ways to configure IPv6 addresses. The
simplest method is to automatically generate a “link local” address (identified by an
address prefix in the range of FE80~FEBF). This address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet.
To generate an IPv6 link local address for the switch, complete the following steps:
1. From the Global Configuration mode prompt, type “interface vlan 1” to access
the interface-configuration mode. Press <Enter>.
2. Type “ipv6 enable” and press <Enter>.
Console(config)#interface vlan 1
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
FE80::2E0:CFF:FE00:FD/64
Global unicast address(es):
(None)
Joined group address(es):
FF02::1:FF11:6700
FF02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND reachable time is 30000 milliseconds
Console#
– 43 –
Page 44
Chapter 1
| Initial Switch Configuration
Enabling SNMP Management Access
Address for Multi-segment Network — To generate an IPv6 address that can be
used in a network containing more than one subnet, the switch can be configured
to automatically generate a unique host address based on the local subnet address
prefix received in router advertisement messages. (DHCP for IPv6 can also be used
to obtain a unique IPv6 host address.)
To dynamically generate an IPv6 host address for the switch, complete the
following steps:
1. From the Global Configuration mode prompt, type “interface vlan 1” to access
the interface-configuration mode. Press <Enter>.
2. From the interface prompt, type “ipv6 address autoconfig” and press <Enter>.
3. Type “ipv6 enable” and press <Enter> to enable IPv6 on an interface that has
not been configured with an explicit IPv6 address.
Console(config)#interface vlan 1
Console(config-if)#ipv6 address autoconfig
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
FE80::212:CFFF:FE0B:4600/64
Global unicast address(es):
2001:DB8:2222:7272:2E0:CFF:FE00:FD/64, subnet is 2001:DB8:2222:7272::/
64[AUTOCONFIG]
valid lifetime 2591978 preferred lifetime 604778
Joined group address(es):
FF02::1:FF00:FD
FF02::1:FF11:6700
FF02::1
MTU is 1500 bytes.
ND DAD is enabled, number of DAD attempts: 1.
ND retransmit interval is 1000 milliseconds
ND reachable time is 30000 milliseconds
Console#
Enabling SNMP Management Access
The switch can be configured to accept management commands from Simple
Network Management Protocol (SNMP) applications. You can configure the switch
to respond to SNMP requests or generate SNMP traps.
When SNMP management stations send requests to the switch (either to return
information or to set a parameter), the switch provides the requested data or sets
the specified parameter. The switch can also be configured to send information to
SNMP managers (without being requested by the managers) through trap
messages, which inform the manager that certain events have occurred.
– 44 –
Page 45
Chapter 1
| Initial Switch Configuration
Enabling SNMP Management Access
The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients.
To provide management access for version 1 or 2c clients, you must specify a
community string. The switch provides a default MIB View (i.e., an SNMPv3
construct) for the default “public” community string that provides read access to
the entire MIB tree, and a default view for the “private” community string that
provides read/write access to the entire MIB tree. However, you may assign new
views to version 1 or 2c community strings that suit your specific security
requirements (see snmp-server view command).
Community Strings (for SNMP version 1 and 2c clients)
Community strings are used to control management access to SNMP version 1 and
2c stations, as well as to authorize SNMP stations to receive trap messages from the
switch. You therefore need to assign community strings to specified users, and set
the access level.
The default strings are:
◆ public - with read-only access. Authorized management stations are only able
to retrieve MIB objects.
◆ private - with read/write access. Authorized management stations are able to
both retrieve and modify MIB objects.
To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is
recommended that you change the default community strings.
To configure a community string, complete the following steps:
1. From the Privileged Exec level global configuration mode prompt, type “snmp-
server community string mode,” where “string” is the community access string
and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the
default mode is read only.)
2. To remove an existing string, simply type “no snmp-server community string,”
where “string” is the community access string to remove. Press <Enter>.
Console(config)#snmp-server community motorola rw
Console(config)#snmp-server community private
Console(config)#
Note:
If you do not intend to support access to SNMP version 1 and 2c clients, we
recommend that you delete both of the default community strings. If there are no
community strings, then SNMP management access from SNMP v1 and v2c clients
is disabled.
– 45 –
Page 46
Chapter 1
Enabling SNMP Management Access
| Initial Switch Configuration
Trap Receivers
You can also specify SNMP stations that are to receive traps from the switch. To
configure a trap receiver, use the “snmp-server host” command. From the
Privileged Exec level global configuration mode prompt, type:
where “host-address” is the IP address for the trap receiver, “community-string”
specifies access rights for a version 1/2c host, or is the user name of a version 3 host,
“version” indicates the SNMP client version, and “auth | noauth | priv” means that
authentication, no authentication, or authentication and privacy is used for v3
clients. Then press <Enter>. For a more detailed description of these parameters,
see the snmp-server host command. The following example creates a trap host for
each type of SNMP client.
Console(config)#snmp-server host 10.1.19.23 batman
Console(config)#snmp-server host 10.1.19.98 robin version 2c
Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth
Console(config)#
“snmp-server host host-address community-string [version {1 | 2c | 3 {auth |
noauth | priv}}]”
Configuring Access for SNMP Version 3 Clients
To configure management access for SNMPv3 clients, you need to first create a
view that defines the portions of MIB that the client can read or write, assign the
view to a group, and then assign the user to a group. The following example creates
one view called “mib-2” that includes the entire MIB-2 tree branch, and then
another view that includes the IEEE 802.1d bridge MIB. It assigns these respective
read and read/write views to a group call “r&d” and specifies group authentication
via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that
MD5 will be used for authentication, provides the password “greenpeace” for
authentication, and the password “einstien” for encryption.
Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included
Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included
Console(config)#snmp-server group r&d v3 auth read mib-2 write 802.1d
Console(config)#snmp-server user steve group r&d v3 auth md5 greenpeace priv
des56 einstien
Console(config)#
For a more detailed explanation on how to configure the switch for access from
SNMP v3 clients, refer to “Simple Network Management Protocol” in the System
Reference Guide, or refer to the specific CLI commands for SNMP starting on
page 137 in this guide.
– 46 –
Page 47
Managing System Files
The switch’s flash memory supports three types of system files that can be
managed by the CLI program, the web interface, or SNMP. The switch’s file system
allows files to be uploaded and downloaded, copied, deleted, and set as a start-up
file.
The types of files are:
◆ Configuration — This file type stores system configuration information and is
Chapter 1
| Initial Switch Configuration
Managing System Files
created when configuration settings are saved. Saved configuration files can be
selected as a system start-up file or can be uploaded via FTP/TFTP to a server
for backup. The file named “Factory_Default_Config.cfg” contains all the system
default settings and cannot be deleted from the system. If the system is booted
with the factory default settings, the switch will also create a file named
“startup1.cfg” that contains system settings for switch initialization, including
information about the unit identifier, and MAC address for the switch. The
configuration settings from the factory defaults configuration file are copied to
this file, which is then used to boot the switch. See “Saving or Restoring
Configuration Settings” on page 48 for more information.
◆ Operation Code — System software that is executed after boot-up, also
known as run-time code. This code runs the switch operations and provides the
CLI and web management interfaces.
◆ Diagnostic Code — Software that is run during system boot-up, also known as
POST (Power On Self-Test).
Note:
The Boot ROM and Loader cannot be uploaded or downloaded from the
FTP/TFTP server. You must follow the instructions in the release notes for new
firmware, or contact your distributor for help.
Due to the size limit of the flash memory, the switch supports only two operation
code files. However, you can have as many diagnostic code files and configuration
files as available flash memory space allows. The switch has a total of 32 Mbytes of
flash memory for system files.
In the system flash memory, one file of each type must be set as the start-up file.
During a system boot, the diagnostic and operation code files set as the start-up file
are run, and then the start-up configuration file is loaded.
Note that configuration files should be downloaded using a file name that reflects
the contents or usage of the file settings. If you download directly to the runningconfig, the system will reboot, and the settings will have to be copied from the
running-config to a permanent file.
– 47 –
Page 48
Chapter 1
| Initial Switch Configuration
Managing System Files
Upgrading the
Operation Code
The following example shows how to download new firmware to the switch and
activate it. The TFTP server could be any standards-compliant server running on
Windows or Linux. When downloading from an FTP server, the logon interface will
prompt for a user name and password configured on the remote server. Note that
“anonymous” is set as the default user name.
File names on the switch are case-sensitive. The destination file name should not
contain slashes (\ or /), and the maximum length for file names is 32 characters for
files on the switch or 128 characters for files on the server. (Valid characters: A-Z,
a-z, 0-9, “.”, “-”)
Console#copy tftp file
TFTP server ip address: 10.1.0.19
Choose file type:
1. config: 2. opcode: 2
Source file name: m360.bix
Destination file name: m360.bix
\Write to FLASH Programming.
-Write to FLASH finish.
Success.
Console#config
Console(config)#boot system opcode: m360.bix
Console(config)#exit
Console#dir
File Name Type Startup Modify Time Size(bytes)
-------------------------- -------------- ------- ------------------- --------- Unit 1:
m360.bix OpCode Y 2013-02-25 15:41:04 25812529
m355.bix OpCode N 2012-12-04 13:23:59 25783857
Factory_Default_Config.cfg Config N 2012-12-04 13:18:37 455
startup1.cfg Config Y 2013-03-21 05:39:15 3463
---------------------------------------------------------------------------- Free space for compressed user config files:1593241600
Console#
Saving or Restoring
Configuration
Settings
Configuration commands only modify the running configuration file and are not
saved when the switch is rebooted. To save all your configuration changes in
nonvolatile storage, you must copy the running configuration file to the start-up
configuration file using the “copy” command.
New startup configuration files must have a name specified. File names on the
switch are case-sensitive, can be from 1 to 31 characters, must not contain slashes
(\ or /), and the leading letter of the file name must not be a period (.). (Valid
characters: A-Z, a-z, 0-9, “.”, “-”, “_”)
There can be more than one user-defined configuration file saved in the switch’s
flash memory, but only one is designated as the “startup” file that is loaded when
the switch boots. The copy running-config startup-config command always sets
the new file as the startup file. To select a previously saved configuration file, use
the boot system config:<filename> command.
– 48 –
Page 49
Chapter 1
| Initial Switch Configuration
Managing System Files
The maximum number of saved configuration files depends on available flash
memory. The amount of available flash memory can be checked by using the dir
command.
To save the current configuration settings, enter the following command:
1. From the Privileged Exec mode prompt, type “copy running-config startup-
config” and press <Enter>.
2. Enter the name of the start-up file. Press <Enter>.
Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.
\Write to FLASH finish.
Success.
Console#
To restore configuration settings from a backup server, enter the following
command:
1. From the Privileged Exec mode prompt, type “copy tftp startup-config” and
press <Enter>.
2. Enter the address of the TFTP server. Press <Enter>.
3. Enter the name of the startup file stored on the server. Press <Enter>.
4. Enter the name for the startup file on the switch. Press <Enter>.
Console#copy file startup-config
Console#copy tftp startup-config
TFTP server IP address: 192.168.0.4
Source configuration file name: startup-rd.cfg
Startup configuration file name [startup1.cfg]:
Success.
Console#
– 49 –
Page 50
Chapter 1
Configuring Automatic Installation of Operation Code and Configuration Settings
| Initial Switch Configuration
Configuring Automatic Installation of Operation Code and Configuration Settings
Downloading
Operation Code
from a File Server
Automatic Operation Code Upgrade can automatically download an operation
code file when a file newer than the currently installed one is discovered on the file
server. After the file is transferred from the server and successfully written to the file
system, it is automatically set as the startup file, and the switch is rebooted.
Usage Guidelines
◆ If this feature is enabled, the switch searches the defined URL once during the
bootup sequence.
◆ FTP (port 21) and TFTP (port 69) are both supported. Note that the TCP/UDP
port bindings cannot be modified to support servers listening on non-standard
ports.
◆ The host portion of the upgrade file location URL must be a valid IPv4 IP
address. DNS host names are not recognized. Valid IP addresses consist of four
numbers, 0 to 255, separated by periods.
◆ The path to the directory must also be defined. If the file is stored in the root
directory for the FTP/TFTP service, then use the “/” to indicate this (e.g., ftp://
192.168.0.1/).
◆ The file name must not be included in the upgrade file location URL. The file
name of the code stored on the remote server must be ECS4620-28T.bix (using
lower case letters as indicated).
◆ The FTP connection is made with PASV mode enabled. PASV mode is needed to
traverse some fire walls, even if FTP traffic is not blocked. PASV mode cannot be
disabled.
◆ The switch-based search function is case-insensitive in that it will accept a file
name in upper or lower case (i.e., the switch will accept EX3524_Op.BIX from the
server even though EX3524_Op.bix was requested). However, keep in mind that
the file systems of many operating systems such as Unix and most Unix-like
systems (FreeBSD, NetBSD, OpenBSD, and most Linux distributions, etc.) are
case-sensitive, meaning that two files in the same directory, ex3524_op.bix and
EX3524_Op.BIX are considered to be unique files. Thus, if the upgrade file is
stored as EX3524_Op.BIX (or even Ex3524_Op.bix) on a case-sensitive server,
then the switch (requesting EX3524_Op.BIX) will not be upgraded because the
server does not recognize the requested file name and the stored file name as
being equal. A notable exception in the list of case-sensitive Unix-like operating
systems is Mac OS X, which by default is case-insensitive. Please check the
documentation for your server’s operating system if you are unsure of its file
system’s behavior.
– 50 –
Page 51
Chapter 1
Configuring Automatic Installation of Operation Code and Configuration Settings
◆ Note that the switch itself does not distinguish between upper and lower-case
| Initial Switch Configuration
file names, and only checks to see if the file stored on the server is more recent
than the current runtime image.
◆ If two operation code image files are already stored on the switch’s file system,
then the non-startup image is deleted before the upgrade image is transferred.
◆ The automatic upgrade process will take place in the background without
impeding normal operations (data switching, etc.) of the switch.
◆ During the automatic search and transfer process, the administrator cannot
transfer or update another operation code image, configuration file, public key,
or HTTPS certificate (i.e., no other concurrent file management operations are
possible).
◆ The upgrade operation code image is set as the startup image after it has been
successfully written to the file system.
◆ The switch will send an SNMP trap and make a log entry upon all upgrade
successes and failures.
◆ The switch will immediately restart after the upgrade file is successfully written
to the file system and set as the startup image.
To enable automatic upgrade, enter the following commands:
1. Specify the TFTP or FTP server to check for new operation code.
■
When specifying a TFTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:
tftp://192.168.0.1[/filedir]/
■
When specifying an FTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:
ftp://[username[:password@]]192.168.0.1[/filedir]/
If the user name is omitted, “anonymous” will be used for the connection. If
the password is omitted a null string (“”) will be used for the connection.
This shows how to specify a TFTP server where new code is stored.
Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#
This shows how to specify an FTP server where new code is stored.
Console(config)#upgrade opcode path ftp://motorola:billy@192.168.0.1/sm24/
Console(config)#
– 51 –
Page 52
Chapter 1
Configuring Automatic Installation of Operation Code and Configuration Settings
| Initial Switch Configuration
2. Set the switch to automatically reboot and load the new code after the opcode
upgrade is completed.
Console(config)#upgrade opcode reload
Console(config)#
3. Set the switch to automatically upgrade the current operational code when a
new version is detected on the server. When the switch starts up and automatic
image upgrade is enabled by this command, the switch will follow these steps
when it boots up:
a. It will search for a new version of the image at the location specified by
upgrade opcode path command. The name for the new image stored on
the TFTP server must be EX3524_Op.bix. If the switch detects a code
version newer than the one currently in use, it will download the new
image. If two code images are already stored in the switch, the image not
set to start up the system will be overwritten by the new version.
b. After the image has been downloaded, the switch will send a trap message
to log whether or not the upgrade operation was successful.
Specifying a DHCP
Client Identifier
c. It sets the new version as the startup image.
d. It then restarts the system to start using the new image.
Console(config)#upgrade opcode auto
Console(config)#
4. Display the automatic upgrade settings.
Console#show upgrade
Auto Image Upgrade Global Settings:
Status : Enabled
Reload Status : Enabled
Path :
File Name : EX3524_Op.bix
Console#
DHCP servers index their database of address bindings using the client’s Media
Access Control (MAC) Address or a unique client identifier. The client identifier is
used to identify the vendor class and configuration of the switch to the DHCP
server, which then uses this information to decide on how to service the client or
the type of information to return.
DHCP client Identifier (Option 60) is used by DHCP clients to specify their unique
identifier. The client identifier is optional and can be specified while configuring
DHCP on the primary network interface. DHCP Option 60 is disabled by default.
– 52 –
Page 53
Chapter 1
Configuring Automatic Installation of Operation Code and Configuration Settings
| Initial Switch Configuration
The general framework for this DHCP option is set out in RFC 2132 (Option 60). This
information is used to convey configuration settings or other identification
information about a client, but the specific string to use should be supplied by your
service provider or network administrator. Options 60 (vendor-class-identifier), 66
(tftp-server-name) and 67 (bootfile-name) statements can be added to the server
daemon’s configuration file as described in the following section.
If the DHCP server has an index entry for a switch requesting service, it should reply
with the TFTP server name and boot file name. Note that the vendor class identifier
can be formatted in either text or hexadecimal, but the format used by both the
client and server must be the same.
Console(config)#interface vlan 2
Console(config-if)#ip dhcp client class-id hex 0000e8666572
Console(config-if)#
Downloading a
Configuration File
Referenced by a
DHCP Server
Information passed on to the switch from a DHCP server may also include a
configuration file to be downloaded and the TFTP servers where that file can be
accessed. If the Factory Default Configuration file is used to provision the switch at
startup, in addition to requesting IP configuration settings from the DHCP server, it
will also ask for the name of a bootup configuration file and TFTP servers where
that file is stored.
If the switch receives information that allows it to download the remote bootup file,
it will save this file to a local buffer, and then restart the provision process.
Note the following DHCP client behavior:
◆ The bootup configuration file received from a TFTP server is stored on the
switch with the original file name. If this file name already exists in the switch,
the file is overwritten.
◆ If the name of the bootup configuration file is the same as the Factory Default
Configuration file, the download procedure will be terminated, and the switch
will not send any further DHCP client requests.
◆ If the switch fails to download the bootup configuration file based on
information passed by the DHCP server, it will not send any further DHCP client
requests.
◆ If the switch does not receive a DHCP response prior to completing the bootup
process, it will continue to send a DHCP client request once a minute. These
requests will only be terminated if the switch’s address is manually configured,
but will resume if the address mode is set back to DHCP.
– 53 –
Page 54
Chapter 1
| Initial Switch Configuration
Configuring Automatic Installation of Operation Code and Configuration Settings
To successfully transmit a bootup configuration file to the switch the DHCP
daemon (using a Linux based system for this example) must be configured with the
following information:
◆ Options 60, 66 and 67 statements can be added to the daemon’s configuration
file.
Table 1: Options 60, 66 and 67 Statements
Option
Keyword Parameter
60 vendor-class-identifier a string indicating the vendor class identifier
66 tftp-server-name a string indicating the tftp server name
67 bootfile-name a string indicating the bootfile name
Statement
◆ By default, DHCP option 66/67 parameters are not carried in a DHCP server
reply. To ask for a DHCP reply with option 66/67 information, the DHCP client
request sent by this switch includes a “parameter request list” asking for this
information. Besides these items, the client request also includes a “vendor
class identifier” that allows the DHCP server to identify the device, and select
the appropriate configuration file for download. This information is included in
Option 55 and 124.
Table 2: Options 55 and 124 Statements
Option
Keyword Parameter
55 dhcp-parameter-request-list a list of parameters, separated by a comma ','
124 vendor-class-identifier a string indicating the vendor class identifier
Statement
The following configuration example is provided for a Linux-based DHCP daemon
(dhcpd.conf file). In the “Vendor class” section, the server will always send Option
66 and 67 to tell the switch to download the “test” configuration file from server
192.168.255.101.
ddns-update-style ad-hoc;
default-lease-time 600;
max-lease-time 7200;
log-facility local7;
server-name "Server1";
Server-identifier 192.168.255.250;
#option 66, 67
option space dynamicProvision code width 1 length 1 hash size 2;
option dynamicProvision.tftp-server-name code 66 = text;
option dynamicProvision.bootfile-name code 67 = text;
– 54 –
Page 55
subnet 192.168.255.0 netmask 255.255.255.0 {
range 192.168.255.160 192.168.255.200;
option routers 192.168.255.101;
option tftp-server-name "192.168.255.100"; #Default Option 66
option bootfile-name "bootfile"; #Default Option 67
}
class "Option66,67_1" { #DHCP Option 60 Vendor class two
match if option vendor-class-identifier = "EX3524_Op.cfg";
option tftp-server-name "192.168.255.101";
option bootfile-name "test";
}
Note:
Setting the System Clock
Chapter 1
| Initial Switch Configuration
Setting the System Clock
Use “EX3524_Op.cfg” for the vendor-class-identifier in the dhcpd.conf file.
Setting the
Time Manually
Simple Network Time Protocol (SNTP) or Network Time Protocol (NTP) can be used
to set the switch’s internal clock based on periodic updates from a time server.
Maintaining an accurate time on the switch enables the system log to record
meaningful dates and times for event entries. You can also manually set the clock. If
the clock is not set manually or via SNTP or NTP, the switch will only record the time
from the factory default set at the last bootup.
When the SNTP client is enabled, the switch periodically sends a request for a time
update to a configured time server. You can configure up to three time server IP
addresses. The switch will attempt to poll each server in the configured sequence.
The switch also supports the following time settings:
◆ Time Zone – You can specify the offset from Coordinated Universal Time (UTC),
also known as Greenwich Mean Time (GMT).
◆ Summer Time/Daylight Saving Time (DST) – In some regions, the time shifts by
one hour in the fall and spring. The switch supports manual entry for one-time
or recurring clock shifts.
To manually set the clock to 14:11:36, April 1st, 2013, enter this command.
Console#calendar set 14 11 36 1 April 2013
Console#
To set the time zone, enter a command similar to the following.
Console(config)#clock timezone Japan hours 8 after-UTC
Console(config)#
– 55 –
Page 56
Chapter 1
| Initial Switch Configuration
Setting the System Clock
To set the time shift for summer time, enter a command similar to the following.
Console(config)#clock summer-time SUMMER date 2 april 2013 0 0 30 june 2013 0
0
Console(config)#
To display the clock configuration settings, enter the following command.
Console#show calendar
Current Time : Apr 2 15:56:12 2013
Time Zone : UTC, 08:00
Summer Time : SUMMER, offset 60 minutes
Apr 2 2013 00:00 to Jun 30 2013 00:00
Summer Time in Effect : Yes
Console#
Configuring SNTP Setting the clock based on an SNTP server can provide more accurate clock
synchronization across network switches than manually-configured time. To
configure SNTP, set the switch as an SNTP client, and then set the polling interval,
and specify a time server as shown in the following example.
Console(config)#sntp client
Console(config)#sntp poll 60
Console(config)#sntp server 10.1.0.19
Console(config)#exit
Console#show sntp
Current Time : Apr 2 16:06:07 2013
Poll Interval : 60 seconds
Current Mode : Unicast
SNTP Status : Enabled
SNTP Server : 10.1.0.19
Current Server : 10.1.0.19
Console#
Configuring NTP Requesting the time from a an NTP server is the most secure method. You can
enable NTP authentication to ensure that reliable updates are received from only
authorized NTP servers. The authentication keys and their associated key number
must be centrally managed and manually distributed to NTP servers and clients.
The key numbers and key values must match on both the server and client.
When more than one time server is configured, the client will poll all of the time
servers, and compare the responses to determine the most reliable and accurate
time update for the switch.
To configure NTP time synchronization, enter commands similar to the following.
Console(config)#ntp client
Console(config)#ntp authentication-key 45 md5 thisiskey45
Console(config)#ntp authenticate
Console(config)#ntp server 192.168.3.20
– 56 –
Page 57
Chapter 1
| Initial Switch Configuration
Setting the System Clock
Console(config)#ntp server 192.168.3.21
Console(config)#ntp server 192.168.5.23 key 19
Console(config)#exit
Console#show ntp
Current Time : Apr 29 13:57:32 2011
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.0.88 Port: 123
Last Update Time : Mar 12 02:41:01 2013 UTC
NTP Server 192.168.0.88 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.4.22 version 3 key 19
NTP Authentication Key 19 md5 42V68751663T6K11P2J307210R885
Current Time : Apr 2 16:28:34 2013
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.5.23 Port: 0
Last Update Time : Apr 2 16:00:00 2013 UTC
NTP Server 192.168.3.20 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.5.23 version 3 key 19
NTP Authentication Key 45 md5 2662T75S5658RU5424180034777
Console#
– 57 –
Page 58
Chapter 1
| Initial Switch Configuration
Setting the System Clock
– 58 –
Page 59
Section II
Command Line Interface
This section provides a detailed description of the Command Line Interface, along
with examples for all of the commands.
This section includes these chapters:
◆ “General Commands” on page 73
◆ “System Management Commands” on page 81
◆ “SNMP Commands” on page 137
◆ “Remote Monitoring Commands” on page 157
◆ “Authentication Commands” on page 165
◆ “General Security Measures” on page 219
◆ “Access Control Lists” on page 269
◆ “Interface Commands” on page 293
◆ “Link Aggregation Commands” on page 313
◆ “Power over Ethernet Commands” on page 325
◆ “Port Mirroring Commands” on page 333
◆ “Congestion Control Commands” on page 343
◆ “Address Table Commands” on page 361
◆ “Spanning Tree Commands” on page 367
◆ “VLAN Commands” on page 393
◆ “Class of Service Commands” on page 429
– 59 –
Page 60
Section II
| Command Line Interface
◆ “Quality of Service Commands” on page 441
◆ “Multicast Filtering Commands” on page 459
◆ “LLDP Commands” on page 493
◆ “CDP Commands” on page 517
◆ “Domain Name Service Commands” on page 523
◆ “DHCP Commands” on page 531
◆ “IP Interface Commands” on page 537
◆ “IP Routing Commands” on page 573
– 60 –
Page 61
2 Using the Command Line
Interface
This chapter describes how to use the Command Line Interface (CLI).
Accessing the CLI
When accessing the management interface for the switch over a direct connection
to the server’s console port, or via a Telnet or Secure Shell connection (SSH), the
switch can be managed by entering command keywords and parameters at the
prompt. Using the switch's command-line interface (CLI) is very similar to entering
commands on a UNIX system.
Console Connection To access the switch through the console port, perform these steps:
1. At the console prompt, enter the user name and password. (The default user
names are “motorola” and “guest” with corresponding passwords of “admin”
and “guest.”) When the administrator user name and password is entered, the
CLI displays the “Console#” prompt and enters privileged access mode
(i.e., Privileged Exec). But when the guest user name and password is entered,
the CLI displays the “Console>” prompt and enters normal access mode
(i.e., Normal Exec).
2. Enter the necessary commands to complete your desired tasks.
3. When finished, exit the session with the “quit” or “exit” command.
After connecting to the system through the console port, the login screen displays:
User Access Verification
Username: motorola
Password:
CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].
Console#
– 61 –
Page 62
Chapter 2
Accessing the CLI
| Using the Command Line Interface
Telne t Conn ec tion Telnet operates over the IP transport protocol. In this environment, your
management station and any network device you want to manage over the
network must have a valid IP address. Valid IP addresses consist of four numbers, 0
to 255, separated by periods. Each address consists of a network portion and host
portion. For example, the IP address assigned to this switch, 10.1.0.1, consists of a
network portion (10.1.0) and a host portion (1).
Note:
The IP address for this switch is obtained via DHCP by default.
To access the switch through a Telnet session, you must first set the IP address for
the Master unit, and set the default gateway if you are managing the switch from a
different IP subnet. For example,
Console(config)#interface vlan 1
Console(config-if)#ip address 10.1.0.254 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 10.1.0.254
Console(config)#
If your corporate network is connected to another network outside your office or to
the Internet, you need to apply for a registered IP address. However, if you are
attached to an isolated network, then you can use any IP address that matches the
network segment to which you are attached.
After you configure the switch with an IP address, you can open a Telnet session by
performing these steps:
1. From the remote host, enter the Telnet command and the IP address of the
device you want to access.
2. At the prompt, enter the user name and system password. The CLI will display
the “Vty-n#” prompt for the administrator to show that you are using privileged
access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you
are using normal access mode (i.e., Normal Exec), where n indicates the number
of the current Telnet session.
3. Enter the necessary commands to complete your desired tasks.
4. When finished, exit the session with the “quit” or “exit” command.
After entering the Telnet command, the login screen displays:
Username: motorola
Password:
CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].
Vty-0#
– 62 –
Page 63
Entering Commands
Chapter 2
Note:
You can open up to four sessions to the device via Telnet or SSH.
| Using the Command Line Interface
This section describes how to enter CLI commands.
Entering Commands
Keywords and
Arguments
A CLI command is a series of keywords and arguments. Keywords identify a
command, and arguments specify configuration parameters. For example, in the
command “show interfaces status ethernet 1/5,” show interfaces and status are
keywords, ethernet is an argument that specifies the interface type, and 1/5
specifies the unit/port.
You can enter commands as follows:
◆ To enter a simple command, enter the command keyword.
◆ To enter multiple commands, enter each command in the required order. For
example, to enable Privileged Exec command mode, and display the startup
configuration, enter:
Console>enable
Console#show startup-config
◆ To enter commands that require parameters, enter the required parameters
after the command keyword. For example, to set a password for the
administrator, enter:
Console(config)#username motorola password 0 smith
Minimum
Abbreviation
The CLI will accept a minimum number of characters that uniquely identify a
command. For example, the command “configure” can be entered as con. If an
entry is ambiguous, the system will prompt for further input.
Command
Completion
If you terminate input with a Tab key, the CLI will print the remaining characters of a
partial keyword up to the point of ambiguity. In the “logging history” example,
typing log followed by a tab will result in printing the command up to “logging.”
– 63 –
Page 64
Chapter 2
| Using the Command Line Interface
Entering Commands
Getting Help on
Commands
You can display a brief description of the help system by entering the help
command. You can also display command syntax by using the “?” character to list
keywords or parameters.
Showing Commands
If you enter a “?” at the command prompt, the system will display the first level of
keywords or command groups. You can also display a list of valid keywords for a
specific command. For example, the command “system ?” displays a list of possible
system commands:
Console#show ?
access-group Access groups
access-list Access lists
accounting Uses an accounting list with this name
arp Information of ARP cache
authorization Enables EXEC accounting
auto-traffic-control Auto traffic control information
bridge-ext Bridge extension information
cable-diagnostics Shows the information of cable diagnostics
calendar Date and time information
cdp CDP
class-map Displays class maps
cluster Display cluster
dns DNS information
dot1q-tunnel dot1q-tunnel
dot1x 802.1X content
flow Shows packet flow information
garp GARP properties
gvrp GVRP interface information
history Shows history information
hosts Host information
interfaces Shows interface information
ip IP information
ipv6 IPv6 information
lacp LACP statistics
line TTY line information
lldp LLDP
log Log records
logging Logging setting
mac MAC access list
mac-address-table Configuration of the address table
mac-vlan MAC-based VLAN information
management Shows management information
memory Memory utilization
mvr multicast vlan registration
network-access Shows the entries of the secure port.
nlm Show notification log
policy-map Displays policy maps
port Port characteristics
power Shows power
power-save Shows the power saving information
process Device process
protocol-vlan Protocol-VLAN information
public-key Public key information
qos Quality of Service
queue Priority queue information
radius-server RADIUS server information
reload Shows the reload settings
rmon Remote Monitoring Protocol
rspan Display status of the current RSPAN configuration
– 64 –
Page 65
Chapter 2
| Using the Command Line Interface
Entering Commands
running-config Information on the running configuration
snmp Simple Network Management Protocol configuration and
sntp Simple Network Time Protocol configuration
spanning-tree Spanning-tree configuration
ssh Secure shell server connections
startup-config Startup system configuration
subnet-vlan IP subnet-based VLAN information
system System information
tacacs-server TACACS server information
tech-support Technical information
time-range Time range
traffic-segmentation Traffic segmentation information
upgrade Shows upgrade information
users Information about users logged in
version System hardware and software versions
vlan Shows virtual LAN settings
voice Shows the voice VLAN information
web-auth Shows web authentication configuration
Console#show
statistics
The command “show interfaces ?” will display the following information:
Partial Keyword
Lookup
Console#show interfaces ?
brief Shows brief interface description
counters Interface counters information
protocol-vlan Protocol-VLAN information
status Shows interface status
switchport Shows interface switchport information
transceiver Interface of transceiver information
Console#
Show commands which display more than one page of information (e.g., show
running-config) pause and require you to press the [Space] bar to continue
displaying one more page, the [Enter] key to display one more line, or the [a] key to
display the rest of the information without stopping. You can press any other key to
terminate the display.
If you terminate a partial keyword with a question mark, alternatives that match the
initial letters are provided. (Remember not to leave a space between the command
and question mark.) For example “s?” shows all the keywords starting with “s.”
Console#show s?
snmp sntp spanning-tree ssh startup-config
subnet-vlan system
Console#show s
– 65 –
Page 66
Chapter 2
Entering Commands
| Using the Command Line Interface
Negating the Effect of
Commands
Using Command
History
Understanding
Command Modes
For many configuration commands you can enter the prefix keyword “no” to cancel
the effect of a command or reset the configuration to the default value. For
example, the logging command will log system messages to a host server. To
disable logging, specify the no logging command. This guide describes the
negation effect for all applicable commands.
The CLI maintains a history of commands that have been entered. You can scroll
back through the history of commands by pressing the up arrow key. Any
command displayed in the history list can be executed again, or first modified and
then executed.
Using the show history command displays a longer list of recently executed
commands.
The command set is divided into Exec and Configuration classes. Exec commands
generally display information on system status or clear statistical counters.
Configuration commands, on the other hand, modify interface parameters or
enable certain switching functions. These classes are further divided into different
modes. Available commands depend on the selected mode. You can always enter a
question mark “?” at the prompt to display a list of the commands available for the
current mode. The command classes and associated modes are displayed in the
following table:
Table 3: General Command Modes
Class Mode
Exec Normal
Privileged
Configuration
* You must be in Privileged Exec mode to access the Global configuration mode.
You must be in Global Configuration mode to access any of the other configuration modes.
Global
*
Access Control List
Class Map
IGMP Profile
Interface
Line
Multiple Spanning Tree
Policy Map
Time Range
VLAN Database
Exec Commands When you open a new console session on the switch with the user name and
password “guest,” the system enters the Normal Exec command mode (or guest
mode), displaying the “Console>” command prompt. Only a limited number of the
commands are available in this mode. You can access all commands only from the
Privileged Exec command mode (or administrator mode). To access Privilege Exec
mode, open a new console session with the user name “motorola” and password
“admin.” The system will now display the “Console#” command prompt. You can
– 66 –
Page 67
Chapter 2
| Using the Command Line Interface
Entering Commands
also enter Privileged Exec mode from within Normal Exec mode, by entering the
enable command, followed by the privileged level password “super.”
To enter Privileged Exec mode, enter the following user names and passwords:
Username: motorola
Password: [admin login password]
CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].
Console#
Username: guest
Password: [guest login password]
CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].
Console>enable
Password: [privileged level password]
Console#
Configuration
Commands
Configuration commands are privileged level commands used to modify switch
settings. These commands modify the running configuration only and are not
saved when the switch is rebooted. To store the running configuration in nonvolatile storage, use the copy running-config startup-config command.
The configuration commands are organized into different modes:
◆ Global Configuration - These commands modify the system level configuration,
and include commands such as hostname and snmp-server community.
◆ Access Control List Configuration - These commands are used for packet
filtering.
◆ Class Map Configuration - Creates a DiffServ class map for a specified traffic
type.
◆ IGMP Profile - Sets a profile group and enters IGMP filter profile configuration
mode.
◆ Interface Configuration - These commands modify the port configuration such
as speed-duplex and negotiation.
◆ Line Configuration - These commands modify the console port and Telnet
configuration, and include command such as parity and databits.
◆ Multiple Spanning Tree Configuration - These commands configure settings for
the selected multiple spanning tree instance.
– 67 –
Page 68
Chapter 2
| Using the Command Line Interface
Entering Commands
◆ Policy Map Configuration - Creates a DiffServ policy map for multiple interfaces.
◆ Time Range - Sets a time range for use by other functions, such as Access
Control Lists.
◆ VLAN Configuration - Includes the command to create VLAN groups.
To enter the Global Configuration mode, enter the command configure in
Privileged Exec mode. The system prompt will change to “Console(config)#” which
gives you access privilege to all Global Configuration commands.
Console#configure
Console(config)#
To enter the other modes, at the configuration prompt type one of the following
commands. Use the exit or end command to return to the Privileged Exec mode.
Table 4: Configuration Command Modes
Mode Command Prompt Page
Line line {console | vty} Console(config-line) 101
Access Control
List
Class Map class-map Console(config-cmap) 442
Interface interface {ethernet port |
MSTP spanning-tree mst-configuration Console(config-mstp) 374
Policy Map policy-map Console(config-pmap) 445
Time Range time-range Console(config-time-range) 128
VLAN vlan database Console(config-vlan) 400
access-list ip standard
access-list ip extended
access-list ipv6 standard
access-list ipv6 extended
access-list mac
port-channel id| vlan id}
Console(config-std-acl)
Console(config-ext-acl)
Console(config-mac-acl)
Console(config-if) 294
270
270
283
For example, you can use the following commands to enter interface configuration
mode, and then return to Privileged Exec mode
Console(config)#interface ethernet 1/5
.
.
.
Console(config-if)#exit
Console(config)#
– 68 –
Page 69
Chapter 2
| Using the Command Line Interface
Entering Commands
Command Line
Processing
Commands are not case sensitive. You can abbreviate commands and parameters
as long as they contain enough letters to differentiate them from any other
currently available commands or parameters. You can use the Tab key to complete
partial commands, or enter a partial command followed by the “?” character to
display a list of possible matches. You can also use the following editing keystrokes
for command-line processing:
Table 5: Keystroke Commands
Keystroke Func tion
Ctrl-A Shifts cursor to start of command line.
Ctrl-B Shifts cursor to the left one character.
Ctrl-C Terminates the current task and displays the command prompt.
Ctrl-E Shifts cursor to end of command line.
Ctrl-F Shifts cursor to the right one character.
Ctrl-K Deletes all characters from the cursor to the end of the line.
Ctrl-L Repeats current command line on a new line.
Ctrl-N Enters the next command line in the history buffer.
Ctrl-P Enters the last command.
Ctrl-R Repeats current command line on a new line.
Ctrl-U Deletes from the cursor to the beginning of the line.
Ctrl-W Deletes the last word typed.
Esc-B Moves the cursor back one word.
Esc-D Deletes from the cursor to the end of the word.
Esc-F Moves the cursor forward one word.
Delete key or
backspace key
Erases a mistake when entering a command.
Output Modifiers Some of the show commands include options for output modifiers. For example,
the “show running-config” command includes the following keyword options:
Console#show running-config ?
| Output modifiers
<cr>
The output modifiers include options which indicate a string that occurs at the
beginning of a line, in lines that are to be excluded, or in lines that are to be
included.
Console#show running-config | ?
begin Begin with line that matches
exclude Exclude lines that match
include Include lines that match
– 69 –
Page 70
Chapter 2
| Using the Command Line Interface
CLI Command Groups
CLI Command Groups
Note that the output modifier begin can only be used as the first modifier if more
than one modifier is used in a command.
The system commands can be broken down into the functional groups shown
below
.
Table 6: Command Group Index
Command Group Description Page
General Basic commands for entering privileged access mode,
System Management Display and setting of system information, basic modes of
Simple Network
Management Protocol
Remote Monitoring Supports statistics, history, alarm and event groups 157
User Authentication Configures user names and passwords, logon access using
General Security Measures Segregates traffic for clients attached to common data ports;
Access Control List Provides filtering for IPv4 frames (based on address, protocol,
Interface Configures the connection parameters for all Ethernet ports,
restarting the system, or quitting the CLI
operation, maximum frame size, file management, console
port and telnet settings, system logs, SMTP alerts, the system
clock, and switch clustering
Activates authentication failure traps; configures community
access strings, and trap receivers
local or remote authentication, management access through
the web server, Telnet server and Secure Shell; as well as port
security, IEEE 802.1X port access control, and restricted access
based on specified IP addresses
and prevents unauthorized access by configuring valid static
or dynamic addresses, web authentication, MAC address
authentication, filtering DHCP requests and replies, and
discarding invalid ARP responses
TCP/UDP port number or TCP control code), IPv6 frames
(based on address or DSCP traffic class), or non-IP frames
(based on MAC address or Ethernet type)
aggregated links, and VLANs
73
81
137
165
219
269
293
Link Aggregation Statically groups multiple ports into a single logical trunk;
Power over Ethernet Configures power output for connected devices 325
Mirror Port Mirrors data to another port for analysis without affecting the
Congestion Control Sets the input/output rate limits, traffic storm thresholds, and
Address Table Configures the address table for filtering specified addresses,
Spanning Tree Configures Spanning Tree settings for the switch 367
configures Link Aggregation Control Protocol for port trunks
313
333
data passing through or the performance of the monitored
port
343
thresholds for broadcast and multicast storms which can be
used to trigger configured rate limits or to shut down a port.
361
displays current entries, clears the table, or sets the aging time
– 70 –
Page 71
Chapter 2
| Using the Command Line Interface
CLI Command Groups
Table 6: Command Group Index (Continued)
Command Group Description Page
VLANs Configures VLAN settings, and defines port membership for
Class of Service Sets port priority for untagged frames, selects strict priority or
Quality of Service Configures Differentiated Services 441
Multicast Filtering Configures IGMP multicast filtering, query, profile, and proxy
Link Layer Discovery
Protocol
Cisco Discovery Protocol Configures CDP settings to enable information discovery
Domain Name Service Configures DNS services. 523
Dynamic Host
Configuration Protocol
IP Interface Configures IP address for the switch interfaces; also
IP Routing Configures static unicast routing 573
VLAN groups; also enables or configures private VLANs,
protocol VLANs, voice VLANs, and QinQ tunneling
weighted round robin, relative weight for each priority queue,
also sets priority for DSCP
parameters; sp ecifies ports attached to a mu lticast router; also
configures multicast VLAN registration
Configures LLDP settings to enable information discovery
about neighbor devices
about neighbor devices
Configures DHCP client functions 531
configures ARP parameters and static entries
393
429
459
493
517
537
The access mode shown in the following tables is indicated by these abbreviations:
ACL (Access Control List Configuration)
CM (Class Map Configuration)
GC (Global Configuration)
IC (Interface Configuration)
IPC (IGMP Profile Configuration)
LC (Line Configuration)
MST (Multiple Spanning Tree)
NE (Normal Exec)
PE (Privileged Exec)
PM (Policy Map Configuration)
VC (VLAN Database Configuration)
– 71 –
Page 72
Chapter 2
| Using the Command Line Interface
CLI Command Groups
– 72 –
Page 73
3 General Commands
The general commands are used to control the command access mode,
configuration mode, and other basic functions.
Tab le 7: Gene ral Commands
Command Function Mode
prompt Customizes the CLI prompt GC
reload Restarts the system at a specified time, after a specified delay, or at a
periodic interval
enable Activates privileged mode NE
quit Exits a CLI session NE, PE
show history Shows the command history buffer NE, PE
configure Activates global configuration mode PE
disable Returns to normal mode from privileged mode PE
reload Restarts the system immediately PE
show reload Displays the current reload settings, and the time at which next
scheduled reload will take place
end Returns to Privileged Exec mode any config.
exit Returns to the previous configuration mode, or exits the CLI any mode
help Shows how to use help any mode
? Shows options for command completion (context sensitive) any mode
GC
PE
mode
prompt This command customizes the CLI prompt. Use the no form to restore the default
prompt.
Syntax
prompt string
no prompt
Default Setting
Console
string - Any alphanumeric string to use for the CLI prompt.
(Maximum length: 255 characters)
– 73 –
Page 74
Chapter 3
| General Commands
Command Mode
Global Configuration
Command Usage
This command and the hostname command can be used to set the command line
prompt as shown in the example below. Using the no form of either command will
restore the default command line prompt.
Example
Console(config)#prompt RD2
RD2(config)#
reload
(Global Configuration)
This command restarts the system at a specified time, after a specified delay, or at a
periodic interval. You can reboot the system immediately, or you can configure the
switch to reset after a specified amount of time. Use the cancel option to remove a
configured setting.
Syntax
reload {at hour minute [{month day | day month} [year]] |
in {hour hours | minute minutes | hour hours minute minutes} |
regularity hour minute [period {daily
|
weekly day-of-week
|
monthly day
}] |
cancel [at | in | regularity]}
reload at - A specified time at which to reload the switch.
hour - The hour at which to reload. (Range: 0-23)
minute - The minute at which to reload. (Range: 0-59)
month - The month at which to reload. (january ... december)
day - The day of the month at which to reload. (Range: 1-31)
year - The year at which to reload. (Range: 1970-2037)
reload in - An interval after which to reload the switch.
hours - The number of hours, combined with the minutes, before the
switch resets. (Range: 0-576)
minutes - The number of minutes, combined with the hours, before the
switch resets. (Range: 0-59)
reload
regularity
- A periodic interval at which to reload the switch.
hour - The hour at which to reload. (Range: 0-23)
minute - The minute at which to reload. (Range: 0-59)
day-of-week - Day of the week at which to reload.
(Range: monday ... saturday)
day
- Day of the month at which to reload. (Range: 1-31)
reload cancel - Cancels the specified reload option.
– 74 –
Page 75
Chapter 3
| General Commands
Default Setting
None
Command Mode
Global Configuration
Command Usage
◆ This command resets the entire system.
◆ Any combination of reload options may be specified. If the same option is re-
specified, the previous setting will be overwritten.
◆ When the system is restarted, it will always run the Power-On Self-Test. It will
also retain all configuration information stored in non-volatile memory by the
copy running-config startup-config command (See “copy ” on page 92).
Example
This example shows how to reset the switch after 30 minutes:
Console(config)#reload in minute 30
***
*** --- Rebooting at January 1 02:10:43 2007 --***
Are you sure to reboot the system at the specified time? <y/n>
enable This command activates Privileged Exec mode. In privileged mode, additional
commands are available, and certain commands display additional information.
See “Understanding Command Modes” on page 66.
Syntax
enable [level]
level - Privilege level to log into the device.
The device has two predefined privilege levels: 0: Normal Exec,
15: Privileged Exec. Enter level 15 to access Privileged Exec mode.
Default Setting
Level 15
Command Mode
Normal Exec
Command Usage
◆ “super” is the default password required to change the command mode from
Normal Exec to Privileged Exec. (To set this password, see the enable password
command.)
– 75 –
Page 76
Chapter 3
| General Commands
◆ The “#” character is appended to the end of the prompt to indicate that the
system is in privileged access mode.
Example
Console>enable
Password: [privileged level password]
Console#
Related Commands
disable (78)
enable password (166)
quit This command exits the configuration program.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
The quit and exit commands can both exit the configuration program.
Example
This example shows how to quit a CLI session:
Console#quit
Press ENTER to start session
User Access Verification
Username:
show history This command shows the contents of the command history buffer.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
The history buffer size is fixed at 10 Execution commands and 10 Configuration
commands.
– 76 –
Page 77
Chapter 3
| General Commands
Example
In this example, the show history command lists the contents of the command
history buffer:
Console#show history
Execution command history:
2 config
1 show history
Configuration command history:
4 interface vlan 1
3 exit
2 interface vlan 1
1 end
Console#
The ! command repeats commands from the Execution command history buffer
when you are in Normal Exec or Privileged Exec Mode, and commands from the
Configuration command history buffer when you are in any of the configuration
modes. In this example, the !2 command repeats the second command in the
Execution history buffer (config).
Console#!2
Console#config
Console(config)#
configure This command activates Global Configuration mode. You must enter this mode to
modify any settings on the switch. You must also enter Global Configuration mode
prior to enabling some of the other configuration modes, such as Interface
Configuration, Line Configuration, and VLAN Database Configuration. See
“Understanding Command Modes” on page 66.
Default Setting
None
Command Mode
Privileged Exec
Example
Console#configure
Console(config)#
Related Commands
end (79)
– 77 –
Page 78
Chapter 3
| General Commands
disable This command returns to Normal Exec mode from privileged mode. In normal
access mode, you can only display basic information on the switch's configuration
or Ethernet statistics. To gain access to all commands, you must use the privileged
mode. See “Understanding Command Modes” on page 66.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
The “>” character is appended to the end of the prompt to indicate that the system
is in normal access mode.
Example
Console#disable
Console>
Related Commands
enable (75)
reload (Privileged Exec) This command restarts the system.
Note:
When the system is restarted, it will always run the Power-On Self-Test. It will
also retain all configuration information stored in non-volatile memory by the copy
running-config startup-config command.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
This command resets the entire system.
Example
This example shows how to reset the switch:
Console#reload
System will be restarted, continue <y/n>? y
– 78 –
Page 79
Chapter 3
| General Commands
show reload This command displays the current reload settings, and the time at which next
scheduled reload will take place.
Command Mode
Privileged Exec
Example
Console#show reload
Reloading switch in time: 0 hours 29 minutes.
The switch will be rebooted at January 1 02:11:50 2001.
Remaining Time: 0 days, 0 hours, 29 minutes, 52 seconds.
Console#
end This command returns to Privileged Exec mode.
Default Setting
None
Command Mode
Global Configuration, Interface Configuration, Line Configuration, VLAN Database
Configuration, and Multiple Spanning Tree Configuration.
Example
This example shows how to return to the Privileged Exec mode from the Interface
Configuration mode:
Console(config-if)#end
Console#
exit This command returns to the previous configuration mode or exits the
configuration program.
Default Setting
None
Command Mode
Any
– 79 –
Page 80
Chapter 3
| General Commands
Example
This example shows how to return to the Privileged Exec mode from the Global
Configuration mode, and then quit the CLI session:
Console(config)#exit
Console#exit
Press ENTER to start session
User Access Verification
Username:
– 80 –
Page 81
4 System Management
Commands
The system management commands are used to control system logs, passwords,
user names, management options, and display or configure a variety of other
system information.
Table 8: System Management Commands
Command Group Function
Device Designation Configures information that uniquely identifies this switch
Device Designation
System Status Displays system configuration, active managers, and version
information
Frame Size Enables support for jumbo frames
File Management Manages code image or switch configuration files
Line Sets communication parameters for the serial port, including baud rate
and console time-out
Event Logging Controls logging of error messages
SMTP Alerts Configures SMTP email alerts
Time (System Clock) Sets the system clock automatically via NTP/SNTP server or manually
Time Range S ets a t ime ran ge for use by o ther f unc tio ns, suc h as Acce ss C ont rol Li sts
Switch Clustering Configures management of multiple devices via a single IP address
This section describes commands used to configure information that uniquely
identifies the switch.
Table 9: Device Designation Commands
Command Function Mode
hostname Specifies the host name for the switch GC
snmp-server contact Sets the system contact string GC
snmp-server location Sets the system location string GC
– 81 –
Page 82
Chapter 4
System Status
| System Management Commands
hostname This command specifies or modifies the host name for this device. Use the no form
to restore the default host name.
Syntax
hostname name
no hostname
name - The name of this host. (Maximum length: 255 characters)
Default Setting
None
Command Mode
Global Configuration
Command Usage
◆ The host name specified by this command is displayed by the show system
command and on the Show > System web page.
System Status
◆ This command and the prompt command can be used to set the command line
prompt as shown in the example below. Using the no form of either command
will restore the default command line prompt.
Example
Console(config)#hostname RD#1
RD#1(config)#
This section describes commands used to display system information.
Table 10: System Status Commands
Command Function Mode
show access-list
tcam-utilization
show memory Shows memory utilization parameters NE, PE
show process cpu Shows CPU utilization parameters NE, PE
Shows utilization parameters for TCAM PE
show running-config Displays the configuration data currently in use PE
show startup-config Displays the contents of the configuration file (stored in
show system Displays system information NE, PE
flash memory) that is used to start up the system
PE
– 82 –
Page 83
Chapter 4
| System Management Commands
System Status
Table 10: System Status Commands (Continued)
Command Function Mode
show access-list
tcam-utilization
show users Shows all active console and Telnet sessions, including user
name, idle time, and IP address of Telnet clients
show version Displays version information for the system NE, PE
NE, PE
This command shows utilization parameters for TCAM (Ternary Content
Addressable Memory), including the number policy control entries in use, the
number of free entries, and the overall percentage of TCAM in use.
Command Mode
Privileged Exec
Command Usage
Policy control entries (PCEs) are used by various system functions which rely on
rule-based searches, including Access Control Lists (ACLs), IP Source Guard filter
rules, Quality of Service (QoS) processes, or traps.
For example, when binding an ACL to a port, each rule in an ACL will use two PCEs;
and when setting an IP Source Guard filter rule for a port, the system will also use
two PCEs.
Example
Console#show access-list tcam-utilization
Total Policy Control Entries : 512
Free Policy Control Entries : 352
Entries Used by System : 160
Entries Used by User : 0
TCAM Utilization : 31.25%
Console#
show memory This command shows memory utilization parameters.
Command Mode
Normal Exec, Privileged Exec
Command Usage
This command shows the amount of memory currently free for use, the amount of
memory allocated to active processes, and the total amount of system memory.
Example
Console#show memory
Status Bytes
------ --------- Free 50917376
Used 83300352
Total 134217728
– 83 –
Page 84
Chapter 4
| System Management Commands
System Status
Console#
show process cpu This command shows the CPU utilization parameters.
Command Mode
Normal Exec, Privileged Exec
Example
Console#show process cpu
CPU Utilization in the past 5 seconds : 3.98%
Console#
show running-config This command displays the configuration information currently in use.
Command Mode
Privileged Exec
Command Usage
◆ Use this command in conjunction with the show startup-config command to
compare the information in running memory to the information stored in nonvolatile memory.
◆ This command displays settings for key command modes. Each mode group is
separated by “!” symbols, and includes the configuration mode command, and
corresponding commands. This command displays the following information:
■
MAC address for the switch
■
SNTP server settings
■
SNMP community strings
■
Users (names, access levels, and encrypted passwords)
■
VLAN database (VLAN ID, name and state)
■
VLAN configuration settings for each interface
■
Multiple spanning tree instances (name and interfaces)
■
IP address configured for management VLAN
■
Layer 4 precedence settings
■
Spanning tree settings
■
Interface settings
■
Any configured settings for the console port and Telnet
Example
Console#show running-config
Building startup configuration. Please wait...
!<stackingDB>00</stackingDB>
!<stackingMac>01_00-e0-0c-00-00-fd_00</stackingMac>
!
snmp-server community public ro
– 84 –
Page 85
Chapter 4
snmp-server community private rw
!
snmp-server enable traps authentication
!
username motorola access-level 15
username motorola password 7 21232f297a57a5a743894a0e4a801fc3
username guest access-level 0
username guest password 7 084e0343a0486ff05530df6c705c8bb4
enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca
!
vlan database
vlan 1 name DefaultVlan media ethernet state active
!
spanning-tree mst configuration
!
interface ethernet 1/1
switchport allowed vlan add 1 untagged
switchport native vlan 1
qos map dscp-mutation 6 0 from 46
.
.
.
!
interface vlan 1
ip address 192.168.1.10 255.255.255.0
!
queue mode strict-wrr 0 0 0 1
!
line console
!
line vty
!
end
!
Console#
| System Management Commands
System Status
Related Commands
show startup-config (85)
show startup-config This command displays the configuration file stored in non-volatile memory that is
used to start up the system.
Command Mode
Privileged Exec
Command Usage
◆ Use this command in conjunction with the show running-config command to
compare the information in running memory to the information stored in nonvolatile memory.
◆ This command displays settings for key command modes. Each mode group is
separated by “!” symbols, and includes the configuration mode command, and
corresponding commands. This command displays the following information:
■
MAC address for the switch
■
SNMP community strings
■
SNMP trap authentication
■
RMON alarms settings
– 85 –
Page 86
Chapter 4
System Status
| System Management Commands
■
Users (names and access levels)
■
VLAN database (VLAN ID, name and state)
■
Multiple spanning tree instances (name and interfaces)
■
Interface settings and VLAN configuration settings for each interface
■
IP address for management VLAN
■
Any configured settings for the console port and Telnet
Example
Refer to the example for the running configuration file.
Related Commands
show running-config (84)
show system This command displays system information.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
◆ The POST results should all display “PASS.” If any POST test indicates “FAIL,”
contact your distributor for assistance.
◆ The number of fans provided: EX-3524 - 2, EX-3548 - 3
Example
Console#show system
System Description : EX-3524 Managed POE/POE+ Switch
System OID String : 1.3.6.1.4.1.388.19.101
System Information
System Up Time : 0 days, 5 hours, 45 minutes, and 35.48 seconds
System Name :
System Location :
System Contact :
MAC Address (Unit 1) : 70-72-CF-95-DC-46
Web Server : Enabled
Web Server Port : 80
Web Secure Server : Disabled
Web Secure Server Port : 443
Telnet Server : Enabled
Telnet Server Port : 23
Jumbo Frame : Disabled
System Fan:
Unit 1
Fan 1: OK Fan 2: OK
POST Result:
Console#
– 86 –
Page 87
Chapter 4
| System Management Commands
System Status
Table 11: show system – display description
Parameter Description
System Description Brief description of device type.
System OID String MIB II object ID for switch’s network management subsystem.
System Up Time Length of time the management agent has been up.
System Name Name assigned to the switch system.
System Location Specifies the system location.
System Contact Administrator responsible for the system.
MAC Address MAC address assigned to this switch.
Web Server/Port Shows administrative status of web server and UDP port number.
Web Secure Server/Port Shows administrative status of secure web server and UDP port
Telnet Server/Port Shows administrative status of Telnet server and TCP port number.
Jumbo Frame Shows if jumbo frames are enabled or disabled.
System Fan Shows the status of the system fans.
POST Result The POST results should all display “PASS.” If any POST test indicates
number.
“FAIL,” contact your distributor for assistance.
show users Shows all active console and Telnet sessions, including user name, idle time, and IP
address of Telnet client.
Default Setting
None
Command Mode
Normal Exec, Privileged Exec
Command Usage
The session used to execute this command is indicated by a “*” symbol next to the
Line (i.e., session) index number.
Example
Console#show users
User Name Accounts:
User Name Privilege Public-Key
--------- --------- --------- motorola 15 None
guest 0 None
steve 15 RSA
Online Users:
Line Username Idle time (h:m:s) Remote IP addr.
----------- -------- ----------------- -------------- 0 console motorola 0:14:14
* 1 VTY 0 motorola 0:00:00 192.168.1.19
– 87 –
Page 88
Chapter 4
System Status
show version This command displays hardware and software version information for the system.
| System Management Commands
2 SSH 1 steve 0:00:06 192.168.1.19
Web Online Users:
Line Remote IP Addr User Name Idle time (h:m:s)
----------- --------------- --------- ----------------- 1 HTTP 192.168.1.19 motorola 0:00:0
Console#
Command Mode
Normal Exec, Privileged Exec
Example
Console#show version
Unit 1
Serial Number : LN11130371
Hardware Version : R0B
CPLD Version : 0.00
Number of Ports : 28
Main Power Status : Up
Role : Master
Loader Version : 4.0.0.0-01R
Linux Kernel Version : 2.6.22.18
Operation Code Version : 4.0.0.0-03R
Console#
Table 12: show version – display description
Parameter Description
Serial Number The serial number of the switch.
Hardware Version Hardware version of the main board.
CPLD Version Version number of Complex Programmable Logic Device.
Number of Ports Number of built-in ports.
Main Power Status Displays the status of the internal power supply.
Role Shows that this switch is operating as Master or Slave.
Loader Version Version number of loader code.
Linux Kernel Version Version number of Linux kernel.
Operation Code Version Version number of runtime code.
– 88 –
Page 89
Frame Size
jumbo frame This command enables support for Layer 2 jumbo frames for Gigabit Ethernet
Chapter 4
| System Management Commands
Frame Size
This section describes commands used to configure the Ethernet frame size on the
switch.
Table 13: Frame Size Commands
Command Function Mode
jumbo frame Enables support for jumbo frames GC
ports. Use the no form to disable it.
Syntax
[no] jumbo frame
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
◆ This switch provides more efficient throughput for large sequential data
transfers by supporting Layer 2 jumbo frames on Gigabit Ethernet ports or
trunks up to 10240 bytes. Compared to standard Ethernet frames that run only
up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead
required to process protocol encapsulation fields.
◆ To use jumbo frames, both the source and destination end nodes (such as a
computer or server) must support this feature. Also, when the connection is
operating at full duplex, all switches in the network between the two end
nodes must be able to accept the extended frame size. And for half-duplex
connections, all devices in the collision domain would need to support jumbo
frames.
◆ The current setting for jumbo frames can be displayed with the show system
command.
Example
Console(config)#jumbo frame
Console(config)#
– 89 –
Page 90
Chapter 4
File Management
| System Management Commands
File Management
Managing Firmware
Firmware can be uploaded and downloaded to or from an FTP/TFTP server. By
saving runtime code to a file on an FTP/TFTP server, that file can later be
downloaded to the switch to restore operation. The switch can also be set to use
new firmware without overwriting the previous version.
When downloading runtime code, the destination file name can be specified to
replace the current image, or the file can be first downloaded using a different
name from the current runtime code file, and then the new file set as the startup
file.
Saving or Restoring Configuration Settings
Configuration settings can be uploaded and downloaded to and from an FTP/TFTP
server. The configuration file can be later downloaded to restore switch settings.
The configuration file can be downloaded under a new file name and then set as
the startup file, or the current startup configuration file can be specified as the
destination file to directly replace it. Note that the file “Factory_Default_Config.cfg”
can be copied to the FTP/TFTP server, but cannot be used as the destination on the
switch.
Table 14: Flash/File Commands
Command Function Mode
General Commands
boot system Specifies the file or image used to start up the system GC
copy Copies a code image or a switch configuration to or from
flash memory or an FTP/TFTP server
delete Deletes a file or code image PE
dir Displays a list of files in flash memory PE
whichboot Displays the files booted PE
Automatic Code Upgrade Commands
upgrade opcode auto Automatically upgrades the current image when a new
version is detected on the indicated server
upgrade opcode path Specifies an FTP/TFTP server and directory in which the
new opcode is stored
PE
GC
GC
show upgrade Shows the opcode upgrade configuration settings. PE
– 90 –
Page 91
General Commands
boot system This command specifies the file or image used to start up the system.
Chapter 4
Syntax
boot system {boot-rom | config | opcode}: filename
boot-rom* - Boot ROM.
config* - Configuration file.
opcode* - Run-time operation code.
filename - Name of configuration file or code image.
* The colon (:) is required.
Default Setting
None
| System Management Commands
File Management
Command Mode
Global Configuration
Command Usage
◆ A colon (:) is required after the specified file type.
◆ If the file contains an error, it cannot be set as the default file.
Example
Console(config)#boot system config: startup
Console(config)#
Related Commands
dir (96)
whichboot (97)
– 91 –
Page 92
Chapter 4
File Management
| System Management Commands
copy This command moves (upload/download) a code image or configuration file
between the switch’s flash memory and an FTP/TFTP server. When you save the
system code or configuration settings to a file on an FTP/TFTP server, that file can
later be downloaded to the switch to restore system operation. The success of the
file transfer depends on the accessibility of the FTP/TFTP server and the quality of
the network connection.
Syntax
copy file {file | ftp | running-config | startup-config | tftp}
copy running-config {file | ftp | startup-config | tftp}
copy startup-config {file | ftp | running-config | tftp}
copy tftp {file | https-certificate | public-key | running-config |
startup-config}
file - Keyword that allows you to copy to/from a file.
ftp - Keyword that allows you to copy to/from an FTP server.
https-certificate - Keyword that allows you to copy the HTTPS secure site
certificate.
public-key - Keyword that allows you to copy a SSH key from a TFTP server.
(See “Secure Shell” on page 190.)
running-config - Keyword that allows you to copy to/from the current
running configuration.
startup-config - The configuration used for system initialization.
tftp - Keyword that allows you to copy to/from a TFTP server.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
◆ The system prompts for data required to complete the copy command.
◆ The destination file name should not contain slashes (\ or /), and the maximum
length for file names is 32 characters for files on the switch or 127 characters for
files on the server. (Valid characters: A-Z, a-z, 0-9, “.”, “-”)
◆ The switch supports only two operation code files, but the maximum number
of user-defined configuration files is 16.
◆ You can use “Factory_Default_Config.cfg” as the source to copy from the
factory default configuration file, but you cannot use it as the destination.
– 92 –
Page 93
Chapter 4
| System Management Commands
File Management
◆ To replace the startup configuration, you must use startup-config as the
destination.
◆ The Boot ROM and Loader cannot be uploaded or downloaded from the FTP/
TFTP server. You must follow the instructions in the release notes for new
firmware, or contact your distributor for help.
◆ For information on specifying an https-certificate, see “Replacing the Default
Secure-site Certificate” in the System Reference Guide. For information on
configuring the switch to
secure-server
◆ When logging into an FTP server, the interface prompts for a user name and
command.
use HTTPS for a secure connection, see the
ip http
password configured on the remote server. Note that “anonymous” is set as the
default user name.
Example
The following example shows how to download new firmware from a TFTP server:
Console#copy tftp file
TFTP server ip address: 10.1.0.19
Choose file type:
1. config: 2. opcode: 2
Source file name: m360.bix
Destination file name: m360.bix
\Write to FLASH Programming.
-Write to FLASH finish.
Success.
Console#
The following example shows how to upload the configuration settings to a file on
the TFTP server:
Console#copy file tftp
Choose file type:
1. config: 2. opcode: 1
Source file name: startup
TFTP server ip address: 10.1.0.99
Destination file name: startup.01
TFTP completed.
Success.
Console#
– 93 –
Page 94
Chapter 4
| System Management Commands
File Management
The following example shows how to copy the running configuration to a startup
file.
Console#copy running-config file
destination file name: startup
Write to FLASH Programming.
\Write to FLASH finish.
Success.
Console#
The following example shows how to download a configuration file:
Console#copy tftp startup-config
TFTP server ip address: 10.1.0.99
Source configuration file name: startup.01
Startup configuration file name [startup]:
Write to FLASH Programming.
\Write to FLASH finish.
Success.
Console#
This example shows how to copy a secure-site certificate from an TFTP server. It
then reboots the switch to activate the certificate:
Console#copy tftp https-certificate
TFTP server ip address: 10.1.0.19
Source certificate file name: SS-certificate
Source private file name: SS-private
Private password: ********
Success.
Console#reload
System will be restarted, continue <y/n>? y
This example shows how to copy a public-key used by SSH from an TFTP server.
Note that public key authentication via SSH is only supported for users configured
locally on the switch.
Console#copy tftp public-key
TFTP server IP address: 192.168.1.19
Choose public key type:
1. RSA: 2. DSA: 1
Source file name: steve.pub
Username: steve
TFTP Download
Success.
Write to FLASH Programming.
Success.
Console#
– 94 –
Page 95
This example shows how to copy a file to an FTP server.
Console#copy ftp file
FTP server IP address: 169.254.1.11
User[anonymous]: motorola
Password[]: *****
Choose file type:
1. config: 2. opcode: 2
Source file name: BLANC.BIX
Destination file name: BLANC.BIX
Console#
delete This command deletes a file or image.
Syntax
delete filename
filename - Name of configuration file or code image.
Chapter 4
| System Management Commands
File Management
Default Setting
None
Command Mode
Privileged Exec
Command Usage
◆ If the file type is used for system startup, then this file cannot be deleted.
◆ “Factory_Default_Config.cfg” cannot be deleted.
Example
This example shows how to delete the test2.cfg configuration file from flash
memory.
Console#delete test2.cfg
Console#
Related Commands
dir (96)
delete public-key (195)
– 95 –
Page 96
Chapter 4
| System Management Commands
File Management
dir This command displays a list of files in flash memory.
Syntax
dir {boot-rom: | config: | opcode:} [filename]}
boot-rom
- Boot ROM (or diagnostic) image file.
config - Switch configuration file.
opcode - Run-time operation code image file.
filename - Name of configuration file or code image. If this file exists but
contains errors, information on this file cannot be shown.
Default Setting
None
Command Mode
Privileged Exec
Command Usage
If you enter the command dir without any parameters, the system displays all files.
File information is shown below:
Table 15: File Directory Information
Column Heading Description
File Name The name of the file.
File Type File types: Boot-Rom, Operation Code, and Config file.
Startup Shows if this file is used when the system is started.
Create Time The date and time the file was created.
Size The length of the file in bytes.
Example
The following example shows how to display all file information:
Console#dir
File Name Type Startup Modify Time Size(bytes)
-------------------------- -------------- ------- ------------------- -------- Unit 1:
EX3524_Op_V0.0.0.2.bix OpCode Y 2013-10-18 05:21:23 7499044
Factory_Default_Config.cfg Config N 2013-10-18 01:43:38 517
startup1.cfg Config Y 2013-10-16 10:46:12 3559
---------------------------------------------------------------------------- Free space for compressed user config files : 573440
Used space : 32980992
Total space : 33554432
Console#
– 96 –
Page 97
Chapter 4
| System Management Commands
File Management
whichboot This command displays which files were booted when the system powered up.
Syntax
whichboot
Default Setting
None
Command Mode
Privileged Exec
Example
This example shows the information displayed by the whichboot command. See
the table under the dir command for a description of the file information displayed
by this command.
Console#whichboot
File Name Type Startup Modify Time Size(bytes)
-------------------------------- ------- ------- ------------------- --------- Unit 1:
EX3524_Op_V0.0.0.2.bix OpCode Y 2013-10-18 05:21:23 7499044
startup1.cfg Config Y 2013-10-16 10:46:12 3559
Console#
Automatic Code Upgrade Commands
upgrade opcode auto This command automatically upgrades the current operational code when a new
version is detected on the server indicated by the upgrade opcode path command.
Use the no form of this command to restore the default setting.
Syntax
[no] upgrade opcode auto
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
◆ This command is used to enable or disable automatic upgrade of the
operational code. When the switch starts up and automatic image upgrade is
enabled by this command, the switch will follow these steps when it boots up:
1. It will search for a new version of the image at the location specified by
upgrade opcode path command. The name for the new image stored on
the TFTP server must be EX3524_Op.bix. If the switch detects a code
– 97 –
Page 98
Chapter 4
| System Management Commands
File Management
version newer than the one currently in use, it will download the new
image. If two code images are already stored in the switch, the image not
set to start up the system will be overwritten by the new version.
2. After the image has been downloaded, the switch will send a trap message
to log whether or not the upgrade operation was successful.
3. It sets the new version as the startup image.
4. It then restarts the system to start using the new image.
◆ Any changes made to the default setting can be displayed with the show
running-config or show startup-config commands.
Example
Console(config)#upgrade opcode auto
Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#
If a new image is found at the specified location, the following type of messages
will be displayed during bootup.
.
.
.
Automatic Upgrade is looking for a new image
New image detected: current version 1.0.1.5; new version 1.1.2.0
Image upgrade in progress
The switch will restart after upgrade succeeds
Downloading new image
Flash programming started
Flash programming completed
The switch will now restart
.
.
.
upgrade opcode path This command specifies an TFTP server and directory in which the new opcode is
stored. Use the no form of this command to clear the current setting.
Syntax
upgrade opcode path opcode-dir-url
no upgrade opcode path
Default Setting
None
Command Mode
Global Configuration
opcode-dir-url - The location of the new code.
– 98 –
Page 99
Chapter 4
| System Management Commands
File Management
Command Usage
◆ This command is used in conjunction with the upgrade opcode auto command
to facilitate automatic upgrade of new operational code stored at the location
indicated by this command.
◆ The name for the new image stored on the TFTP server must be
EX3524_Op.bix. However, note that file name is not to be included in this
command.
◆ When specifying a TFTP server, the following syntax must be used, where filedir
indicates the path to the directory containing the new image:
tftp://192.168.0.1[/filedir]/
◆ When specifying an FTP server, the following syntax must be used, where filedir
indicates the path to the directory containing the new image:
ftp://[username[:password@]]192.168.0.1[/filedir]/
If the user name is omitted, “anonymous” will be used for the connection. If the
password is omitted a null string (“”) will be used for the connection.
Example
This shows how to specify a TFTP server where new code is stored.
Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#
This shows how to specify an FTP server where new code is stored.
Console(config)#upgrade opcode path ftp://motorola:billy@192.168.0.1/sm24/
Console(config)#
show upgrade This command shows the opcode upgrade configuration settings.
Command Mode
Privileged Exec
Example
Console#show upgrade
Auto Image Upgrade Global Settings:
Status : Disabled
Path :
File Name : EX3524_Op.bix
Console#
– 99 –
Page 100
Chapter 4
Line
Line
| System Management Commands
You can access the onboard configuration program by attaching a VT100
compatible device to the server’s serial port. These commands are used to set
communication parameters for the serial port or Telnet (i.e., a virtual terminal).
Table 16: Line Commands
Command Function Mode
line Identifies a specific line for configuration and starts the line
accounting exec Applies an accounting method to local console, Telnet or
authorization exec Applies an authorization method to local console, Telnet or
databits
exec-timeout Sets the interval that the command interpreter waits until
login Enables password checking at login LC
parity
password Specifies a password on a line LC
password-thresh Sets the password intrusion threshold, which limits the
silent-time
speed
stopbits
*
*
*
*
*
configuration mode
SSH connections
SSH connections
Sets the number of data bits per character that are
interpreted and generated by hardware
user input is detected
Defines the generation of a parity bit LC
number of failed logon attempts
Sets the amount of time the management console is
inaccessible after the number of unsuccessful logon
attempts exceeds the threshold set by the password-
thresh command
Sets the terminal baud rate LC
Sets the number of the stop bits transmitted per byte LC
GC
LC
LC
LC
LC
LC
LC
timeout login response Sets the interval that the system waits for a login attempt LC
disconnect Terminates a line connection PE
show line Displays a terminal line's parameters NE, PE
* These commands only apply to the serial port.
– 100 –
Loading...